DUO 2FA integration with FreeRadius

[David Aldwinckle]

I use Duo 2FA with FreeRadius for CLI access to some network devices. I’m not aware of a away to do it without using the DUO proxies.

It gets tricky when specific devices are expecting VSA’s in the access accept message and you also want 2FA. I’m currently hijacking a standard radius attribute to store device info so it gets passed through the Duo proxy.

Its a hack and I don’t like it, but it works.

Dave Aldwinckle
Network Support Specialist
Information Systems and Technology
Phone: (519)-888-4567 ext. 41145
E-Mail: daldwinc at uwaterloo.ca

> On Apr 12, 2018, at 2:39 PM, Charles Butera via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:
> 
> Hello,
> 
> Has anyone been able to integrate DUO 2FA with Freeradius?
> 
> I currently have a radius proxy provided by DUO in order to get this
> working but I would rather have this done solely by Freeradius if possible.
> https://duo.com/docs/authproxy_reference#installation
> 
> Thank you,
> Charles Butera
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html