It seems that login_duo and pam_duo don’t respect our resolv.conf settings - at least not until they try some other methods which time-out. Our firewalls are not open for external DNS resolvers. /usr/sbin/login_duo seems to attempt to reach external ...