cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3282
Views
2
Helpful
3
Replies

Linux - Get Push Notification Twice on Login

Greg_Griessel
Level 1
Level 1

I have successfully secured my linux Server with Duo - Raspbian (Debian) on a Raspberry Pi - Awesome Stuff

works 100% using “interactive keyboard” = Password on SSH login plus Push as Second Factor , however i get the Duo Push Twice when SSH’ing in …

After the second push is accepted i do get logged in … so Duo is functioning

Any idea How to fix the “Dual Push” issue ??

Thx
Greg

3 Replies 3

Xander_Desai
Level 1
Level 1

Hi Greg!
One common issue that we see that causes this to happen is accidentally calling the pam_duo.so module twice in your pam_stacks.

The docs refer to two stacks
/etc/pam.d/sshd
/etc/pam.d/common-auth or /etc/pam.d/system-auth (I can’t remember which it is on raspbian)

You’ll want to double check that you don’t have pam_duo.so in both of those files, but only in one.

This can be a lot easier to debug with logs and config files so if you still can’t figure this out definitely reach out to Support | Duo Security and we’ll get you taken care of!

Greg_Griessel
Level 1
Level 1

Great thanks - got it working

i had two pam_do.so statements , removed it from common-auth and its working now

Thx
Greg

Firstly, apologies for the thread resurrection - this thread is one of the top results in Google for “duo unix push twice” and it seemed better to add some clarifications here rather than a new thread for anyone dealing with this.

My issue was two fold, and the highlight by @Xander_Desai helped with both but took me a bit of fiddling to get right.

Issue One: Prompt for notification type was appearing twice
Issue Two: Duo was prompting for a local password when I was using Public Key Auth.

The issue stemmed from my misreading of the section in the documentation titled ‘PAM Examples’ - when you choose your distro/release, there are two sections, one for ’ SSH Public Key Authentication and the other for System-wide Authentication. These are two different options, rather than two mandatory setups.

I initially fixed the first issue by reading this thread, removing the reference pam_duo.so from my common-auth file resolved the double-issuing of auth prompts.

To resolve the second issue (local password being prompted for), I realised after some head scratching that I also had to remove the rest of the stuff I had added in the System Wide Authentication section. Seems obvious in hindsight but thought I would add my workings for other folks in the future

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Quick Links