Sorry, I know this is an older post, but I am also trying to setup offline auth on Ubuntu.  I am trying to setup the config you mention but I can't seem to get the pam_duo module to hand-off auth if it fails.  It seems to only adhere to the settings ...