2FA with Duo

[acascianelli]

I've spent days trying to figure this out and am close to throwing in the towel and moving on to other things.

I am trying to get xrdp to work with 2FA using Duo. The only thing I have to work from is the instructions that are written for setting up Google Authenticator 2FA with xrdp. After several attempts I have failed thus far adapting those instructions to work with Duo.

I am running a RHEL 9 workstation and xrdp version 0.9.21 out of EPEL.

It seems that sesman is having a problem dealing with the 2FA piece. Sesman debug log shows the following:

[20230125-14:26:45] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 45222
[20230125-14:26:47] [ERROR] pam_authenticate failed: Error in service module
[20230125-14:26:47] [INFO ] AUTHFAIL: user=acascianelli ip=::ffff:xxx.xxx.xxx.xxx time=1674674807
[20230125-14:26:47] [ERROR] sesman_data_in: scp_process_msg failed
[20230125-14:26:47] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20230125-14:26:47] [DEBUG] Closed socket 12 (AF_INET6 ::1 port 3350)

[matt335672]

The Google Authentication instructions should work for any TOTP device. I've set it up OK with Authy.

pam_google_authenticator.so has a debug option (see here). Might be worth setting that.

Also:-

• look in the system log with sudo journalctl -S -2m (all system messages in the last 2 minutes).
• Check for SELinux violations with sudo ausearch -m avc -ts recent.

[acascianelli]

SELinux search returned nothing, but the system log found some curious failures.

Invalid pam_duo option: 'forward_pass'

[acascianelli]

So I managed to get it to work by forcing Duo to perform a push to the 2FA phone app, I'd really like to be able to enter the OTP code as a secondary password at the xRDP login screen.

[matt335672]

It looks like from your description you're using a pam_duo module. I don't know anything about Duo, but if it's using standard TOTP, you should be able to use pam_google_authenticator.so instead. In that case, the installation instructions should be the same.

[Maddiuz]

Will this work for Microsoft Authenticator as well?

[matt335672]

I believe Microsoft Authenticator uses TOTP, so you should be able to use pam_google_authenticator.so.

[Maddiuz]

Thank you! :)