Exclude a user from Duo SSH

[james-kavenaugh]

I have Duo setup with sssd public keys for SSH. I would like to exclude a service account from Duo authentication. This user would be authenticated by public key only from a specific host. How can I exclude this user?

I specified the groups I want to have Duo auth in pam_duo.conf. The user I want to exclude gets Permission denied (publickey). So I must be missing something. I checked auth.log and sssd logs but couldn't find why the user was denied.

[james-kavenaugh]

First it helps if I use the correct port, ssh was on 2202. Second, my ad_access_filter wasn't correct in sssd.conf for the user. I added the user to users to be checked by duo but made an exception for the user in /etc/pam.d/sshd to skip duo auth for that user.

auth [success=1 default=ignore] pam_succeed_if.so user = ansible

auth [success=1 default=ignore] /lib64/security/pam_duo.so