---
name: "pam_duo"
section: "8"
platform: "linux"
package: "libpam-duo"
version: "1.11.3-1.2+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_duo"
---

# pam\_duo(8)

PAM module for Duo authentication

## NAME

**pam\_duo** – PAM module for Duo authentication

## SYNOPSIS

pam\_duo.so \[**conf=**⟨*FILENAME*⟩\]

## DESCRIPTION

**pam\_duo** provides secondary authentication (typically after successful password-based authentication) through the Duo authentication service.

## OPTIONS

PAM module configuration options supported:

- conf

  Specify an alternate configuration file to load. Default is  */etc/duo/pam\_duo.conf*

- debug

  Debug mode; send log messages to stderr instead of syslog.

## CONFIGURATION

The INI-format configuration file must have a “duo” section with the following options:

- **host**

  Duo API host (required).

- **ikey**

  Duo integration key (required).

- **skey**

  Duo secret key (required).

- **groups**

  If specified, Duo authentication is required only for users whose primary group or supplementary group list matches one of the space-separated  *pattern-lists* (see PATTERNS below).

- **failmode**

  On service or configuration errors that prevent Duo authentication, fail “safe” (allow access) or “secure” (deny access). Default is “safe”.

- **pushinfo**

  Send command to be approved via Duo Push authentication. Default is “no”.

- **http\_proxy**

  Use the specified HTTP proxy, same format as the HTTP\_PROXY environment variable.

- **autopush**

  Automatically send a login request to the first factor (usually push), instead of prompting the user. Default is "no".

- **prompts**

  Set the maxiumum number of prompts pam\_duo will show before denying access. Default is 3.

- **fallback\_local\_ip**

  If unable to detect the authorizing user's IP address, fallback on the server's IP. Default is "no".

- **send\_gecos**

  Instead of using the unix username, send Duo the contents of the GECOS field from /etc/passwd.  Default is "no".

An example configuration file:

```
[duo]
host = api-deadbeef.duosecurity.com
ikey = SI9F...53RI
skey = 4MjR...Q2NmRiM2Q1Y
pushinfo = yes
autopush = yes
```

Other authentication restrictions may be implemented using  [pam\_listfile(8)](/pam_listfile/8.md), [pam\_access(8)](/pam_access/8.md), etc.

## PATTERNS

A *pattern* consists of zero or more non-whitespace characters, ‘\*’ (a wildcard that matches zero or more characters), or ‘?’ (a wildcard that matches exactly one character).

A  *pattern-list* is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark (‘!’). For example, to specify Duo authentication for all users (except those that are also admins), and for guests:

```
groups = users,!wheel,!*admin guests
```

## FILES

- */etc/duo/pam\_duo.conf*

  Default configuration file path

## AUTHORS

**pam\_duo** was written by  Duo Security ⟨support@duosecurity.com⟩

## NOTES

When used with OpenSSH's  [sshd(8)](/sshd/8.md), only PAM-based authentication can be protected with this module; pubkey authentication bypasses PAM entirely. OpenSSH's PAM integration also does not honor an interactive  [pam\_conv(3)](/pam_conv/3.md) conversation, prohibiting real-time Duo status messages (such as during voice callback).