Configuring multifactor authentication with Duo Security

The system integrates with Duo Security to provide multifactor authentication for system users.

With Duo Security, security administrators can configure the system as an application that requires two factors for users and user groups to access the system with either the management GUI or CLI.

You can manage every aspect of your Duo two-factor authentication system from the Duo Admin Panel including creating and managing applications, enrolling and activating users, issuing and managing SMS passcodes and bypass codes, managing mobile devices, fine-tuning the user experience of your Duo installation.

Multifactor authentication can be used to protect both local users, including superuser, and remote users.

For information on how to configure directory synchronization for remote users with Duo Security, see Duo Directory Synchronization.

Duo Security configures the management GUI and the command-line interface as separate API clients that require separate credentials. For CLI access, Duo Security communicates with the system through standard REST API requests. For GUI-based logins, the system communicates with Duo Security through the OpenID Connect (OIDC) protocol.

Prerequisites

Ensure that the following prerequisite tasks are completed on the system before you configure multifactor authentication on Duo Security:
  1. Configure a DNS server. To create a DNS server, select Settings > Network > DNS. In the command-line interface, use the mkdnsserver command to define a DNS server.
  2. Configure an HTTP proxy server or configure your firewall to access Duo Security. To create an HTTP proxy server, Settings > Network > Internal Proxy Server. For more information, see HTTP proxy server. If your system does not directly connect to the Internet, you can create a firewall exception to allow your system access to Duo Security.
    Important: If the proxy server is not configured correctly, the system cannot communicate with Duo Security and the login to the system fails.
  3. For the management GUI and the command-line interface, ensure that the inactivity logout is equal to or greater than the time it takes for a user to receive a one-time passcode (OTP) from the authentication service. The default value for the inactivity timeout is 30 minutes for the management GUI and 15 minutes for the CLI. To set the inactivity timeout for both interfaces in the management GUI, select Settings > Security > Inactivity Logout. To set the GUI inactivity timeout on the command-line interface, use the chsecurity -guitimeout command. For the CLI timeout, use the chsecurity -clitimeout command.
  4. Ensure that the SSH grace time for the command-line interface is equal to or greater than the time it takes for a user to receive a one-time passcode (OTP) from the authentication service. The default value for the SSH grace time period is 60 seconds. To set SSH grace time on the system in the command-line interface, use the chsecurity -sshgracetime command.
The following prerequisite steps on Duo Security must be completed before you can configure multifactor authentication on the system:
  1. Create a subscription for Duo Security. For more information, see Editions & Pricing page on Duo Security website. During subscription creation, you specify a tenant that is used to create a URL to access the Duo Security dashboard.
  2. To create a Duo Security application, enter the following:
    admin-XXXXXXXX.duosecurity.com
    where XXXXXXXX is unique to your subscription that you specified when you created your subscription.
  3. On Applications page, click Protect an Application and select Web SDK. The credentials on this page are the OpenID Client ID and Secret required for GUI access.
  4. On Applications page, click Protect an Application and select UNIX Application. The credentials on this page are the API Client Integration Key and Secret Key required for CLI access.
Note: Duo Security does not support the use of IP addresses when accessing your system by using a web browser. Once multifactor authentication is configured, make sure that a hostname is used when accessing your system by using a web browser.

Using the management GUI

To configure multifactor authentication on Duo Security, complete these steps:
  1. Select Settings > Security > Multifactor Authentication.
  2. On Multifactor Authentication page, select Duo Security authentication provider.
    Note: For IBM Security Verify authentication provider, see Configuring multifactor authentication with IBM Security Verify.
  3. Enter the hostname and port of the authentication server. For Duo Security, enter the following:
    api-XXXXXXXX.duosecurity.com
    Where XXXXXXXX is unique to your subscription that you specified when you created your subscription.
  4. For the OpenID Credentials, complete the following steps in the Duo Security interface to add the Client ID and Client Secret:
    1. Select Dashboard > Applications > Protect an Application.
    2. Search Web SDK, click Protect.
    3. Copy Client ID and Client Secret.
  5. For the API Client Credentials, complete the following steps in the Duo Security interface to add the Integration Key and Secret Key:
    1. Select Dashboard > Applications > Protect an Application.
    2. Search UNIX Application, click Protect.
    3. Copy Integration Key and Secret Key.
  6. Click Save.
  7. On the confirmation page, click Confirm to enable multifactor authentication for the system.

Multifactor authentication is enabled for the system. You can configure user groups to use multifactor authentication. Click Navigate to launch the User Groups page.

Using the CLI

You can enable multifactor authentication on the system by using the following command:
  • To enable multifactor authentication with Duo Security, enter the following command:
    chauthmultifactorduo -enable -hostname api-XXXXXXXX.duosecurity.com -openidclientid openid_client_id -openidclientsecret openid_client_secret -integrationkey integration_key -secretkey secret_key
    where parameter -enable enables multifactor authentication service and -hostname is the hostname of the Duo Security tenant. The -openidclientid and the -openidclientsecret are the Open ID Client and Open ID Secret for the system, required to enable multifactor authentication for login to the storage system GUI. The -integrationkey and the -secretkey are the integration key and secret key for the system, required to enable multifactor authentication for login to the Storage Virtualize CLI.