#MFA SSH Duo

5 messages · Page 1 of 1 (latest)

jade tartan
#

Has anyone set up MFA for SSH using Cisco Duo? I've been playing around with it in a test environment and it works fine if Ontap can contact Duo, but when Duo is down (all things fail eventually) it seems like a good way to get locked out of SSH until Duo comes back up. I have ontap communicating with Duo and have verified that users have to enroll to gain ssh access. That works woohoo. I then set up a user in Duo and set it to bypass so that the user doesn't have to do mfa. That all works great when Duo exists. But if I set up a little firewall rule to block Duo, things fall apart. Since every user is by default required to use Duo if it is enabled, and if Ontap can't talk to Duo then all your users are locked out.

I then found Duo Group which looked like an option to get around this issue. So I set up a duo_exclude group on the cluster, added a user to the excluded users list. I then tested. When Ontap can talk to Duo, that user still has the Duo check which doesn't seem like that is how it should work. When Duo is blocked via firewall that user still has the Duo check, again not how I interpret how that should work. It seems like the Duo Group Exclude either doesn't work, or I'm using it wrong (probable here as the documentation seems a little lacking).

I know it seems stupid to have a user bypass Duo, but I also assume that Duo will go down right when I need to do something critical. It could even be part of an attack. If I was inside someone's network with credentials to do bad things, I'd be tempted to try to block Duo after giving myself access to their stuff to limit their access to stop me.

Anyway, any help or advice would be much appreciated.

round valve
#

But changing that to "safe" sounds like making the whole MFA configuration quite unsafe...

#

Regarding Duo groups: Did you check the documentation? https://docs.netapp.com/us-en/ontap/authentication/configure-cisco-duo-mfa-task.html#create-a-duo-group

You not only need to create a Duo group in ONTAP but it must also "match an Active Directory, LDAP, or local group".

Additionally note the info at the end - maybe that's the way to go.

"Exclude local Duo users:
You can exclude specific local users from using Duo authentication by using the Cisco Duo Admin Panel."
https://duo.com/docs/administration-users#changing-user-status

Cisco Duo
Duo Administration - Manage Users | Cisco Duo

Learn more about creating, managing, and deleting users from the Duo Admin Panel.

jade tartan
#

Thanks OG1 for your response. I tried setting the fail-mode to safe, but even then when I block Duo, Ontap times out when trying to communicate with Duo and then just closes the SSH connection.

I have created a user in Duo to test with, and then I set that user to bypass. So when Duo is available and that test user tries to SSH in, Ontap talks to Duo, Duo says bypass, and the login completes without the Duo prompt. When I have Duo blocked to simulate an outage, that user can't log in because that bypass relies on communicating with Duo.

I have an ontap Duo Group that looks somethings like this.
Vserver: <cluster_name>
Group Name: cluster_duo_exclude
List of Excluded Users: <local_test_admin>
Comment: -

Even with that exclude in place that local test admin account still gets prompted for Duo.

I'm gonna create a Netapp Support case to see if they can figure out what is going on, or enlighten me on what I have misconfigured. I'll try to remember to come back here and summarize whatever the result is of the case to leave some bread crumbs for those that run into the same issue.