Linux - Get Push Notification Twice on Login

[Greg_Griessel]

I have successfully secured my linux Server with Duo - Raspbian (Debian) on a Raspberry Pi - Awesome Stuff

works 100% using “interactive keyboard” = Password on SSH login plus Push as Second Factor , however i get the Duo Push Twice when SSH’ing in …

After the second push is accepted i do get logged in … so Duo is functioning

Any idea How to fix the “Dual Push” issue ??

Thx
Greg

[Xander_Desai]

Hi Greg!
One common issue that we see that causes this to happen is accidentally calling the pam_duo.so module twice in your pam_stacks.

The docs refer to two stacks
/etc/pam.d/sshd
/etc/pam.d/common-auth or /etc/pam.d/system-auth (I can’t remember which it is on raspbian)

You’ll want to double check that you don’t have pam_duo.so in both of those files, but only in one.

This can be a lot easier to debug with logs and config files so if you still can’t figure this out definitely reach out to Support | Duo Security and we’ll get you taken care of!

[Greg_Griessel]

Xander_Desai:

/etc/pam.d/sshd
/etc/pam.d/common-aut

Great thanks - got it working

i had two pam_do.so statements , removed it from common-auth and its working now

Thx
Greg

[suitedupgeek]

Firstly, apologies for the thread resurrection - this thread is one of the top results in Google for “duo unix push twice” and it seemed better to add some clarifications here rather than a new thread for anyone dealing with this.

My issue was two fold, and the highlight by @Xander_Desai helped with both but took me a bit of fiddling to get right.

Issue One: Prompt for notification type was appearing twice
Issue Two: Duo was prompting for a local password when I was using Public Key Auth.

The issue stemmed from my misreading of the section in the documentation titled ‘PAM Examples’ - when you choose your distro/release, there are two sections, one for ’ SSH Public Key Authentication and the other for System-wide Authentication. These are two different options, rather than two mandatory setups.

I initially fixed the first issue by reading this thread, removing the reference pam_duo.so from my common-auth file resolved the double-issuing of auth prompts.

To resolve the second issue (local password being prompted for), I realised after some head scratching that I also had to remove the rest of the stuff I had added in the System Wide Authentication section. Seems obvious in hindsight but thought I would add my workings for other folks in the future