Hello I have a working installation of Duo on Rocky Linux 9.x. SSH is able to push a login request, GUI is able to push a login request but Virtual Terminals and local console logins are not. This is the output from /var/log/secure:
Jul 11 15:05:34 localhost login[16610]: starting Duo Unix: PAM Duo
Jul 11 15:05:41 localhost login[16610]: Failsecure Duo login for 'user1': Couldn't connect to api-xxxxxxx.duosecurity.com: Failed to connect
Jul 11 15:05:43 localhost login[16610]: FAILED LOGIN 1 FROM tty3 FOR user1, Authentication failure
Using SSH to login to the same machine:
Jul 11 15:20:15 localhost sshd[18666]: starting Duo Unix: PAM Duo
Jul 11 15:20:32 localhost sshd[18666]: Successful Duo login for 'user1' from 10.0.1.119
Jul 11 15:20:32 localhost sshd[18664]: Accepted keyboard-interactive/pam for user1 from 10.0.1.119 port 39716 ssh2
Jul 11 15:20:32 localhost sshd[18664]: pam_unix(sshd:session): session opened for user user1(uid=1000) by user1(uid=0)
And successfully via GUI.
I have tried edits in BOTH /etc/pam.d/system-auth and /etc/pam.d/login together and separately and all scenarios end with the same error.
system-auth:
# Generated by authselect on Thu Jun 20 14:10:00 2024
# Do not modify this file manually.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
#auth required /lib64/security/pam_duo.so
auth requisite pam_unix.so nullok try_first_pass
auth required /lib64/security/pam_duo.so
auth sufficient pam_fprintd.so
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
auth [default=1 ignore=ignore success=ok] pam_localuser.so
#auth requisite pam_unix.so nullok
#auth sufficient /lib64/security/pam_duo.so
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_usertype.so issystem
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so local_users_only
password sufficient pam_unix.so sha512 shadow nullok use_authtok
password [success=1 default=ignore] pam_localuser.so
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session requisite pam_unix.so
#session sufficient /lib64/security/pam_duo.so
session optional pam_sss.so
Login:
[root@localhost pam.d]# cat login
#%PAM-1.0
#auth substack system-auth
auth include postlogin
auth required pam_env.so
auth requisite pam_unix.so nullok try_first_pass
auth sufficient /lib64/security/pam_duo.so
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so
Duo version installed:
[root@localhost pam.d]# rpmquery duo_unix
duo_unix-2.0.3-0.el9.x86_64
This has me stumped, any help would be appreciated, thanks in advance.
