I’m sure I’m missing something obvious. Here’s the config I’m using:
[duo]
ikey =
skey =
host =
pushinfo = yes
autopush = yes
sshd_config:
UsePAM yes
ChallengeResponseAuthentication yes
UseDNS no
PAM config:
auth requisite pam_unix.so nullok_secure
...