On Fri, Jun 30, 2023 at 03:53:59PM +0000, Richard Wale via IBM TechXchange Community wrote:
> Please advise,
Regarding DUO's AIX integration, the last time I used it I had the
same experience. You have to download and locally compile it.
Unfortunately it's not a real authentication module. They insist you
set the ForceCommand in your /etc/ssh/ssh_config to the DUO program
for the users who use Duo.
This makes it neither global for all users, nor truly integrated with
AIX. Only SSH logins will use Duo, not local logins or su.
It also breaks all utility of ssh remote commands (ie: ssh host ls
-l), as ForceCommand will only allow the execution of the DUO
tool. Essentially every login becomes "ssh host /usr/sbin/login_duo".
I'd recommend using Yubikeys with SSH instead.
> ------------------------------
> Richard Wale
> ------------------------------
------------------------------------------------------------------
Russell Adams
Russell.Adams@AdamsSystems.nlPrincipal Consultant Adams Systems Consultancy
https://adamssystems.nl/
Original Message:
Sent: 6/30/2023 3:18:00 AM
From: Richard Wale
Subject: RE: Duo Unix for AIX
Hello Sanket,
As it's not yet appeared in the Toolbox since your last update, please can you advise if you are still reviewing/considering making DUO available in the AIX Toolbox? It would be very beneficial for AIX Admins to have it within the Toolbox - as Erich said originally, we have to compile it by hand and unless we additional package the compiled files into a BFF, it's easy to lose track of what version is installed where, and as such it easily gets missed being updated as a result.
Please advise,
Regards Rich Wale.
------------------------------
Richard Wale
------------------------------
Original Message:
Sent: Mon June 13, 2022 07:33 AM
From: SANKET RATHI
Subject: Duo Unix for AIX
Thank you Erich and Jan. We will review and evaluate if this can be provided from AIX toolbox.
------------------------------
SANKET RATHI
Original Message:
Sent: Wed June 08, 2022 08:25 AM
From: Jan Harris
Subject: Duo Unix for AIX
Adding the AIX specific link for team to review..
https://w3.ibm.com/w3publisher/ibm2fa/server-admins/unix#AIX
Which delivers duo_unix-1.12.1.tar.gz (or duo_unix-latest.tar.gz)
Obtained from: https://duo.com/docs/duounix (GNU License)
------------------------------
Jan Harris
AIX Development Support (Liaison to the AIX Toolbox for Open Source)
IBM (Contract)
Austin TX
Original Message:
Sent: Tue June 07, 2022 10:58 PM
From: Erich Wolz
Subject: Duo Unix for AIX
AIX is one of the operating systems/platforms supported by the Duo 2FAaaS solution (see https://w3.ibm.com/w3publisher/ibm2fa/server-admins). But, inexplicably, each server admin is expected to download/compile the duo_unix-latest.tar.gz tarball in their own environment!
It seems to me that it would make more sense for an already-built duo package to be maintained/made available via a central repository. Is there any reason the AIX Toolbox can't be that repository?
------------------------------
Erich Wolz
------------------------------