Duo LInux two-factor and Windows AD domain users

[skylin3r92]

We’ve implemented Duo two-factor authentication (pam_duo) on our Linux machines.

We’re looking into adding our Linux machines into our Windows active directory. After adding one of our Linux machines to our AD, I’ve noticed that the local user 2FA no longer is required when signing in but is required for admin privilege (sudo).

Is there a way still apply two-factor authentication for local and domain accounts?

For our domain users, we are authenticating with another third-party vendor.

[Gurgling6866]

you’ll need to run the selinux/semodule portion from the pam_duo instruction.
Mount to the installation folder then run

sudo make -C pam_duo semodule
sudo make -C pam_duo semodule-install
sudo setsebool -P pam_duo_permit_local_login on

verify the semodule is installed successfully by running

semodule -l | grep duo