Duo

https://duo.com/docs/
Admin
Duo offers comprehensive identity and access management solutions, including multi-factor...
Tokens:240,474
Snippets:1,701
Trust Score:10
Update:1 year ago
Show doc for...
Tokens:
Raw
### Start Duo Authentication Proxy Service

Source: https://duo.com/docs/authproxy-reference

Starts the Duo Authentication Proxy service using the provided control script.

```bash
/opt/duoauthproxy/bin/authproxyctl start

```

--------------------------------

### Start Duo Authentication Proxy Service (authproxyctl)

Source: https://duo.com/docs/authproxy-reference

This command starts the Duo Authentication Proxy service using the `authproxyctl` utility, available in v5.1.0 and later. The `bin` directory is automatically added to the system path during installation.

```batch
authproxyctl start

```

--------------------------------

### Start Duo Authentication Proxy (Linux CLI)

Source: https://duo.com/docs/authproxy-reference

Starts the Duo Authentication Proxy service on Linux. This command is executed from a root shell or using `su`, with the full path to the `authproxyctl` utility.

```bash
/opt/duoauthproxy/bin/authproxyctl start
```

--------------------------------

### Run Duo Authentication Proxy Installer

Source: https://duo.com/docs/authproxy-reference

Executes the Duo Authentication Proxy installer script to perform an interactive installation or upgrade.

```bash
./install

```

--------------------------------

### Start Duo Authentication Proxy Service (Windows CMD)

Source: https://duo.com/docs/authproxy-reference

This command starts the Duo Authentication Proxy service from an administrator command prompt on Windows. It is used after an upgrade or if the service is not running.

```batch
net start duoauthproxy

```

--------------------------------

### Build Duo Authentication Proxy Installer

Source: https://duo.com/docs/authproxy-reference

Compiles the Duo Authentication Proxy source code using the 'make' command to generate the installation package.

```bash
make

```

--------------------------------

### Start Duo Authentication Proxy Service on Windows

Source: https://duo.com/docs/awsworkspaces

Instructions for starting the Duo Authentication Proxy service on Windows using either the Duo Authentication Proxy Manager utility, the command prompt with `net start`, or the `authproxyctl` executable.

```bash
net start DuoAuthProxy

```

```bash
authproxyctl start

```

--------------------------------

### Enabling SELinux Module During Silent Install

Source: https://duo.com/docs/authproxy-reference

This command demonstrates how to append the `--enable-selinux` flag to the silent installation command to include the Authentication Proxy's SELinux module. Installing this module permits the Authentication Proxy service to be started by systemd when SELinux is in enforcing mode.

```bash
sudo ./duoauthproxy-build/install --install-dir /opt/duoauthproxy --service-user duo_authproxy_svc --log-group duo_authproxy_grp --create-init-script yes --enable-selinux=yes
```

--------------------------------

### Primary Only Mode Log Entry

Source: https://duo.com/docs/authproxy-reference

Example log output indicating that the Duo Authentication Proxy has started in primary only mode.

```log
2019-02-04T17:27:57+0000 [-] Running in PRIMARY ONLY mode. Stopping in 60 minutes
```

--------------------------------

### Example: RADIUS Client Configuration

Source: https://duo.com/docs/bomgar

Provides an example of how to configure a RADIUS client section within the 'authproxy.cfg' file for primary authentication.

```ini
[radius_client]

```

--------------------------------

### Example RADIUS Server Configuration

Source: https://duo.com/docs/authproxy-reference

This snippet shows an example configuration for a RADIUS server using Duo. It includes essential parameters like integration key, secret key, API host, fail mode, RADIUS IP, and RADIUS secret.

```ini
[radius_server_duo_only]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
failmode=safe
radius_ip_1=5.6.7.8
radius_secret_1=thisisalsoaradiussecret


```

--------------------------------

### Install RPM Dependencies with SELinux Support for Duo Authentication Proxy

Source: https://duo.com/docs/authproxy-reference

Installs required build tools, development libraries, and SELinux policy development packages for the Duo Authentication Proxy on RPM-based systems when SELinux module installation is desired.

```bash
$ yum install gcc make libffi-devel zlib-devel diffutils selinux-policy-devel chkconfig

```

--------------------------------

### Start Duo Authentication Proxy Service on Windows (authproxyctl)

Source: https://duo.com/docs/checkpoint

Starts the Duo Authentication Proxy service on Windows using the 'authproxyctl start' command. This command is available in versions 5.1.0 and later. The installer automatically adds the command to the system path.

```powershell
authproxyctl start
```

--------------------------------

### Example: Active Directory/LDAP Client Configuration

Source: https://duo.com/docs/bomgar

Provides an example of how to configure an Active Directory or LDAP client section within the 'authproxy.cfg' file for primary authentication.

```ini
[ad_client]

```

--------------------------------

### RADIUS Server Configuration Example

Source: https://duo.com/docs/authproxy-reference

An example configuration block for a RADIUS server section within the Duo Authentication Proxy. It includes essential parameters like integration key, secret key, API host, failmode, RADIUS IP, RADIUS secret, client type, and prompt format.

```ini
[radius_server_challenge]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
failmode=safe
radius_ip_1=5.6.7.8
radius_secret_1=thisisalsoaradiussecret
client=radius_client
prompt_format=html
```

--------------------------------

### Start Duo Authentication Proxy Service on Linux

Source: https://duo.com/docs/checkpoint

Starts the Duo Authentication Proxy service on Linux by executing the 'authproxyctl start' command with root privileges. The command is typically located in '/opt/duoauthproxy/bin/'.

```bash
# /opt/duoauthproxy/bin/authproxyctl start
```

--------------------------------

### Install Debian Dependencies with SELinux Support for Duo Authentication Proxy

Source: https://duo.com/docs/authproxy-reference

Installs required build tools, development libraries, and SELinux policy development packages for the Duo Authentication Proxy on Debian-derived systems when SELinux module installation is desired.

```bash
$ apt-get install build-essential libssl-dev libffi-dev selinux-policy-devel chkconfig

```

--------------------------------

### Install Debian Dependencies for Duo Authentication Proxy

Source: https://duo.com/docs/authproxy-reference

Installs essential build tools and development libraries required for the Duo Authentication Proxy on Debian-derived Linux distributions.

```bash
$ apt-get install build-essential libssl-dev libffi-dev

```

--------------------------------

### Start Primary Only Mode on Windows

Source: https://duo.com/docs/authproxy-reference

Restarts the Duo Authentication Proxy in primary only mode for one hour on Windows. Requires an administrative command prompt and the window must remain open.

```batch
"C:\Program Files\Duo Security Authentication Proxy\bin\authproxy_primary_only.exe"
```

--------------------------------

### Start Duo Authentication Proxy Service on Windows (Command Line)

Source: https://duo.com/docs/checkpoint

Starts the Duo Authentication Proxy service on Windows using the 'net start' command. Requires administrator privileges. This is an alternative to using the Duo Authentication Proxy Manager utility.

```powershell
net start DuoAuthProxy
```

--------------------------------

### Start the Duo Authentication Proxy Service

Source: https://duo.com/docs/ciscoasa-radius-duo-only

Instructions on how to start, stop, and restart the Duo Authentication Proxy service on Windows and Linux.

```APIDOC
## Start the Proxy

### Windows

If you installed the Duo Authentication Proxy Manager utility (available with 5.6.0 and later), click the Start Service button at the top of the Proxy Manager window to start the service.

To start the service from the command line, open an Administrator command prompt and run:
```bash
net start DuoAuthProxy
```

Alternatively, open the Windows Services console (`services.msc`), locate "Duo Security Authentication Proxy Service" in the list of services, and click the Start Service button.

Authentication Proxy v5.1.0 and later includes the `authproxyctl` executable. From an administrator command prompt run:
```bash
authproxyctl start
```

If the service starts successfully, Authentication Proxy service output is written to the `authproxy.log` file, which can be found in the `log` subdirectory.

If you see an error saying that the "service could not be started", open the Application Event Viewer and look for an Error from the source "DuoAuthProxy". The traceback may include a "ConfigError" that can help you find the source of the issue.

To stop and restart the Authentication Proxy service by either clicking the Restart Service button in the Duo Authentication Proxy Manager or the Windows Services console or issuing these commands from an Administrator command prompt:
```bash
net stop DuoAuthProxy & net start DuoAuthProxy
```

To stop and restart the Authentication Proxy using `authproxyctl`, from an administrator command prompt run:
```bash
authproxyctl restart
```

### Linux

Open a root shell and run:
```bash
# [Linux start command - actual command depends on systemd/init.d]
```
```

--------------------------------

### Configure HTTP Proxy

Source: https://duo.com/docs/authproxy-reference

Example configuration for the `[http_proxy]` section, specifying the API host, port, and allowed client IP addresses for proxy connections.

```ini
[http_proxy]
api_host=api-XXXXXXXX.duosecurity.com
port=8080
client_ip=192.168.23.42,192.168.23.64

```

--------------------------------

### Duo Auth API v1 - First Steps

Source: https://duo.com/docs/authapi-v1

Guides users through the initial setup process for integrating the Duo Auth API, including account signup and obtaining API credentials.

```APIDOC
## First Steps

### Prerequisites
1. Sign up for a Duo account.
2. Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.
3. Locate and add the 'Auth API' application to get your integration key, secret key, and API hostname.
4. Update User access settings in the Admin Panel to grant access to the application for desired users or groups.

### Security Note
Treat your secret key with the same security as a password. Do not share it or email it.
```

--------------------------------

### Install Go Duo Universal Dependency

Source: https://duo.com/docs/duoweb

Installs the Duo Universal Go SDK using Go Modules. This enables integration into existing Go projects.

```bash
go get github.com/duosecurity/duo_universal_golang/duouniversal
```

--------------------------------

### Start Duo Authentication Proxy Service (Windows)

Source: https://duo.com/docs/barracuda-alt

Commands to start the Duo Authentication Proxy service on Windows. This can be done via the command prompt using 'net start' or the dedicated 'authproxyctl' tool.

```batch
net start DuoAuthProxy
```

```batch
authproxyctl start
```

--------------------------------

### Enable Connectivity Tool on Startup (Configuration)

Source: https://duo.com/docs/authproxy-reference

Configures the Duo Authentication Proxy to automatically run the connectivity tool upon startup. This is achieved by adding `test_connectivity_on_startup=true` to the `[main]` section of the `authproxy.cfg` file.

```ini
[main]
test_connectivity_on_startup=true
```

--------------------------------

### Install RPM Dependencies for Duo Authentication Proxy

Source: https://duo.com/docs/authproxy-reference

Installs essential build tools and development libraries required for the Duo Authentication Proxy on RPM-based Linux distributions like Fedora, Red Hat Enterprise, and CentOS.

```bash
$ yum install gcc make libffi-devel zlib-devel diffutils

```

--------------------------------

### Run Connectivity Tool (Windows CLI)

Source: https://duo.com/docs/authproxy-reference

Launches the Duo Authentication Proxy connectivity tool on Windows interactively. This executable is run from an administrative command prompt and helps diagnose connectivity issues.

```cmd
"C:\Program Files\Duo Security Authentication Proxy\bin\authproxy_connectivity_tool.exe"
```

--------------------------------

### Launch Duo Authentication Proxy Manager on Windows

Source: https://duo.com/docs/authproxy-reference

This command launches the Duo Authentication Proxy Manager utility from the command line on a Windows system. This utility helps manage the local Authentication Proxy installation.

```powershell
C:\Program File\Duo Security Authentication Proxy\bin\local_proxy_manager-win32-x64\Duo_Authentication_Proxy_Manager.exe
```

--------------------------------

### Run Connectivity Tool (Linux CLI)

Source: https://duo.com/docs/authproxy-reference

Launches the Duo Authentication Proxy connectivity tool on Linux interactively. This command is executed via SSH using `sudo` and the full path to the utility.

```bash
sudo /opt/duoauthproxy/bin/authproxy_connectivity_tool
```

--------------------------------

### Navigate to Duo Authentication Proxy Build Directory

Source: https://duo.com/docs/authproxy-reference

Changes the current directory to the folder containing the built Duo Authentication Proxy installer files.

```bash
cd duoauthproxy-build

```

--------------------------------

### LDAP Server Auto Configuration Example

Source: https://duo.com/docs/authproxy-reference

This snippet demonstrates a basic configuration for the `[ldap_server_auto]` section of the Duo Authentication Proxy. It includes essential parameters like client identification, integration keys, secret key, API host, and fail mode.

```ini
[ldap_server_auto]
client=ad_client
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
failmode=safe

```

--------------------------------

### Active Directory Client Configuration (TLS)

Source: https://duo.com/docs/authproxy-reference

This example shows a TLS-secured configuration for the `[ad_client]` section. It includes the `transport=starttls` option and specifies a CA certificate file (`ssl_ca_certs_file`) for establishing a secure connection to the Active Directory server. Ensure the certificate file is placed in the 'conf' subdirectory.

```ini
[ad_client]
host=1.2.3.4
host_2=1.2.3.5
service_account_username=duoservice
service_account_password=password1
search_dn=DC=example,DC=com
security_group_dn=CN=DuoVPNUsers,OU=Groups,DC=example,DC=com
transport=starttls
ssl_ca_certs_file=conf\example_com_ca.pem
```

--------------------------------

### Start Duo Authentication Proxy Service on Linux

Source: https://duo.com/docs/awsworkspaces

Command to start the Duo Authentication Proxy service on a Linux system. Requires root privileges and uses the `authproxyctl` script located in the proxy's bin directory.

```bash
# /opt/duoauthproxy/bin/authproxyctl start

```

--------------------------------

### Run Duo Support Tool on Windows

Source: https://duo.com/docs/authproxy-reference

Executes the Duo Authentication Proxy support tool on a Windows server. Requires an administrative command prompt.

```batch
"C:\Program Files\Duo Security Authentication Proxy\bin\authproxy_support.exe"
```

--------------------------------

### Install Python Duo Universal Dependency

Source: https://duo.com/docs/duoweb

Installs the Duo Universal Python client library using pip. This is the first step for Python integrations.

```bash
pip install duo_universal
```

--------------------------------

### Active Directory Search Base Example (Multiple DNs)

Source: https://duo.com/docs/dag-windows

Example demonstrating how to specify multiple distinguished names (DNs) for searching user accounts in Active Directory. Each DN should be on a new line and represents a specific container or organizational unit (OU) within the directory structure.

```text
OU=Employees,OU=US,DC=acme,DC=corp
OU=Users,DC=EMEA,DC=acme,DC=corp
```

--------------------------------

### Install Node.js Duo Universal Dependency

Source: https://duo.com/docs/duoweb

Installs the Duo Universal Node.js client library from NPM. This is for integrating with Node.js applications.

```bash
npm install @duosecurity/duo_universal
```

--------------------------------

### Start Docker Service with systemctl

Source: https://duo.com/docs/dag-linux

Starts the Docker daemon immediately. This command initiates the Docker service, allowing you to begin using Docker commands.

```bash
sudo systemctl start docker
```

--------------------------------

### Active Directory Search Attributes Example

Source: https://duo.com/docs/dag-windows

Example of how to provide multiple Active Directory attributes for matching user login input. The values for these attributes should be separated by commas. This allows users to log in using different identifiers like their email or account name.

```text
sAMAccountName,mail
```

--------------------------------

### LDAP Server Connection Example (Conceptual)

Source: https://duo.com/docs/dag-windows

A conceptual example illustrating how to specify multiple LDAP servers for redundancy or load balancing. The format requires prefixing each server with 'ldap://' and separating them with commas. This is typically used when configuring the 'Server' field for Active Directory or OpenLDAP.

```text
ldap://dc1.example.com,ldap://dc2.example.com
```

--------------------------------

### Install PHP Duo Universal Dependency

Source: https://duo.com/docs/duoweb

Installs the Duo Universal PHP client library using Composer. This is required for PHP integrations.

```bash
composer require duosecurity/duo_universal_php
```

--------------------------------

### Stop and Start Duo Authentication Proxy Service on Windows (Command Line)

Source: https://duo.com/docs/checkpoint

Stops and then immediately starts the Duo Authentication Proxy service on Windows using 'net stop' and 'net start' commands. This is useful for applying configuration changes. Requires administrator privileges.

```powershell
net stop DuoAuthProxy & net start DuoAuthProxy
```

--------------------------------

### Duo Device API Setup and Authentication

Source: https://duo.com/docs/deviceapi

Guides users through the initial steps of setting up a trusted endpoint integration, obtaining API credentials, and securing the secret key.

```APIDOC
## Duo Device API Setup and Authentication

### Overview
This section details the initial steps required to use the Duo Device API, focusing on creating a trusted endpoint integration and understanding the security implications of API credentials.

### Setup Steps
1.  **Log in to Duo Admin Panel**: Navigate to **Devices** → **Trusted Endpoints**.
2.  **Create Integration**: Create a **Trusted Endpoints Generic with Duo Desktop** integration. Refer to the [Generic Duo Desktop Trust documentation](link_to_docs) for detailed instructions.
3.  **Obtain API Credentials**: The API credentials (ikey, skey, host) are provided within the context of the created Trusted Endpoints integration.
4.  **Configure Network Access (Optional)**: In **Networks for API Access**, specify allowed IP addresses or ranges for this Device API application. If not specified, access is allowed from any network.

### Security Best Practices
-   **Treat Secret Key Like a Password**: The security of your Duo device trust integration depends on the secrecy of your API secret key (skey). Secure it diligently, do not share it, and never email it.
-   **Monitor Blocked Requests**: If you restrict network access and observe blocked Device API requests from unexpected IP addresses, it may indicate a compromise of your secret key.

### API Clients
Duo Security provides demonstration clients for various programming languages on GitHub:
-   Python (`duo_client_python`)
-   Java (`duo_client_java`)
-   C# (`duo_api_csharp`)
-   Go (`duo_api_golang`)
-   Node (`duo_api_nodejs`)
-   Ruby (`duo_api_ruby`)
-   Perl (`duo_api_perl`)
-   PHP (`duo_api_php`)
```

--------------------------------

### Duo Authentication Proxy Up-to-Date Log Output

Source: https://duo.com/docs/authproxy-reference

This log output confirms that the installed version of the Duo Authentication Proxy is current and no updates are detected. It indicates that the user is running the latest available version.

```log
Checking updates for Duo Authentication Proxy...
[info]  No updates detected. Your Duo Authentication Proxy is up to date.
```

--------------------------------

### Run Duo Support Tool on Linux

Source: https://duo.com/docs/authproxy-reference

Executes the Duo Authentication Proxy support tool on a Linux server. Requires SSH access and sudo privileges.

```bash
sudo /opt/duoauthproxy/bin/authproxy_support
```

--------------------------------

### Directory Server Connection Details

Source: https://duo.com/docs/authproxy-reference

Specify the host, port, and user attribute for connecting to the directory server.

```APIDOC
## Directory Server Connection Details

### Description
Configuration for connecting to the Active Directory or LDAP server, including host, port, and username attribute.

### Endpoint
N/A (Configuration Settings)

### Parameters
#### Request Body
- **port** (integer) - Optional - The port on which to contact the domain controller. Defaults to 636 for LDAPS and 389 for others. Use Global Catalog port (e.g., 3268) for multi-domain forests.
- **username_attribute** (string) - Optional - The LDAP attribute containing the username. Defaults to "sAMAccountName".

### Request Example
```json
{
  "port": 389,
  "username_attribute": "userPrincipalName"
}
```

### Response
#### Success Response (200)
N/A (Configuration Settings)

#### Response Example
N/A (Configuration Settings)
```

--------------------------------

### Disabling SELinux Module During Silent Install

Source: https://duo.com/docs/authproxy-reference

This command shows how to append the `--enable-selinux=no` flag to the silent installation command to exclude the Authentication Proxy's SELinux module. If the SELinux module is not installed, systemd cannot start the Authentication Proxy service if SELinux is in enforcing mode.

```bash
sudo ./duoauthproxy-build/install --install-dir /opt/duoauthproxy --service-user duo_authproxy_svc --log-group duo_authproxy_grp --create-init-script yes --enable-selinux=no
```

--------------------------------

### Sample Duo Authentication Proxy Configuration (Windows)

Source: https://duo.com/docs/adsync

Example `authproxy.cfg` file demonstrating the use of protected parameters for encrypted secrets and service account passwords. This configuration is for Plain authentication.

```ini
[cloud]
ikey=DIXXXXXXXXXXXXXXXXXX
skey_protected=AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAEK80Kg76BUKI63ApctGZ/wQAAAAeAAAAdwBpAG4AMwAyAGMAcgB5AHAAdABvAC4AcAB5AAAAA2YAAMAAAAAQAAAAMlqARKe+pLNcFwVWWzLfrwAAAAAEgAAAoAAAABAAAAAe+ADzHx0OmowXFu+95w4ACAAAAC+9Hae0HWbNFAAAAA/94/UTD1iB2vnlGcVvDaqKtdcu
api_host=api-XXXXXXXX.duosecurity.com
service_account_username=duosync
service_account_password_protected=QAAANCMnd8BFdERjHoAwE/Cl+sBAAAA5hII/4JlnEeB5xMBzB5D/wQAAAAeAAAAdwBpAG4AMwAyAGMAcgB5AHAAdABvAC4AcAB5AAAAA2YAAMAAAAAQAAAA5AHAAdABvAC4AcAB5AAAAA2YAAMAAAAAQAAAASApm6tif+wDKj+Rt0UtQ9QAAAAAEgAlnEeB5xMBzB5D/wQAAAAeAAAAdwBpAG4AMwAyAGMAcgB5AHAAdABvQ8M7voQmwOOxqv91QmJs9QAAAAAEgAAAoAAAABAAAACxWVslLxrlFOunUUeq+kg1CAAAAPFj+oygch2RFAAAAD9HgbRonCsy/GNx4M9FxSq/KJCq
```

--------------------------------

### Kandji SSO Login URL Example

Source: https://duo.com/docs/sso-kandji

Provides an example of the URL format for accessing Kandji via SSO. Users navigate to this URL and click a specific button to initiate the Duo Single Sign-On authentication process.

```text
You can log on to Kandji by navigating to your Kandji SSO page _e.g., https://youraccount-nfr.kandji.io/signin_. Click **Log in** , and then **Continue with (Your Account)** to be redirected to Duo Single Sign-On to begin authentication.
```

--------------------------------

### Navigate to Duo Authentication Proxy Source Directory

Source: https://duo.com/docs/authproxy-reference

Changes the current directory to the extracted source code folder of the Duo Authentication Proxy.

```bash
cd duoauthproxy-6.5.2-src

```

--------------------------------

### Primary Only Mode Bypassed Authentication Log Entry

Source: https://duo.com/docs/authproxy-reference

Example log output showing that secondary authentication was bypassed during primary only mode.

```log
Primary Only Mode - Secondary authentication bypassed
```

--------------------------------

### First Steps for Accounts API

Source: https://duo.com/docs/accountsapi

Instructions for obtaining access and setting up the Accounts API, including required roles and obtaining integration keys.

```APIDOC
## First Steps

### Role Required
**Owner**

Note that only administrators with the **Owner** role in the parent account may contact Duo Support to request access to the Accounts API application, or can create or modify an Accounts API application in the Duo Admin Panel.

### Setup Instructions
1. Sign up for a Duo account.
2. Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.
3. Locate the entry for Accounts API in the catalog. Click the `+ Add` button to create the application, and get your integration key, secret key, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications with Duo and additional application options.

**Treat your secret key like a password**
The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!

4. Optionally specify which IP addresses or ranges are allowed to use this Accounts API application in **Networks for API Access**. If you do not specify any IP addresses or ranges, this Accounts API application may be accessed from any network.

The Accounts API performs the IP check after verifying the authentication signature in a request. If you restrict the allowed networks for API access and see logged events for blocked Accounts API requests from unrecognized IP addresses, this may indicate compromise of your Accounts API application's secret key.
```

--------------------------------

### Authentication Configuration

Source: https://duo.com/docs/authproxy-reference

Configure the authentication method and related parameters for connecting to the Active Directory server.

```APIDOC
## Authentication Configuration

### Description
Defines the authentication protocol and credentials used to connect to the Active Directory server.

### Endpoint
N/A (Configuration Settings)

### Parameters
#### Request Body
- **auth_type** (string) - Optional - The authentication protocol. Options: "ntlm2", "plain", "sspi". Defaults to "ntlm2".
- **bind_dn** (string) - Optional - The LDAP distinguished name for binding. Required if `auth_type` is "plain".
- **ntlm_domain** (string) - Optional - The domain to provide for NTLM authentication. Not typically needed.
- **ntlm_workstation** (string) - Optional - A workstation name to specify for NTLM authentication. Not typically needed.

### Request Example
```json
{
  "auth_type": "sspi",
  "bind_dn": "CN=Service Account,OU=Users,DC=example,DC=com"
}
```

### Response
#### Success Response (200)
N/A (Configuration Settings)

#### Response Example
N/A (Configuration Settings)
```

--------------------------------

### Comment Syntax in Configuration

Source: https://duo.com/docs/authproxy-reference

Demonstrates how to add comments to the `authproxy.cfg` file. Lines starting with REM, #, or ; are treated as comments. Be cautious with secrets containing these characters.

```ini
# This uses acme-dc01 for AD authentication
[ad_client]
host=1.2.3.4
service_account_username=duoservice
service_account_password=password1
search_dn=cn=Users,dc=example,dc=com

# This is the Cisco VPN in the Michigan office
[radius_server_auto]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
radius_ip_1=5.6.7.8
radius_secret_1=thisisaradiussecret
```

--------------------------------

### Start Primary Only Mode with Custom Duration on Linux

Source: https://duo.com/docs/authproxy-reference

Restarts the Duo Authentication Proxy in primary only mode for a specified duration (in minutes) on Linux. The maximum duration is 240 minutes.

```bash
sudo /opt/duoauthproxy/bin/authproxy_primary_only -t 30
```

--------------------------------

### Troubleshooting Authentication Proxy Service Startup

Source: https://duo.com/docs/authproxy-faq

This section details common reasons why the Duo Authentication Proxy service might fail to start, particularly after editing the `authproxy.cfg` file with Notepad, and provides recommended solutions.

```APIDOC
## Troubleshooting Authentication Proxy Service Startup

### Description

This section provides guidance on resolving issues when the Duo Authentication Proxy service fails to start, often due to incorrect configuration file line endings or improper editing tools.

### Problem

The Authentication Proxy service may fail to start if the `authproxy.cfg` file was edited with Windows Notepad, which can mishandle UNIX line endings. Notepad may not correctly display line breaks, leading to a malformed configuration.

### Recommended Solution

1.  **Use a recommended text editor:** Instead of Notepad, use a third-party text editor that correctly handles UNIX line endings. Recommended editors include:
    *   Duo Authentication Proxy Manager (for Windows 5.6.0 and later)
    *   WordPad
    *   Notepad++
    *   Other editors that can display or handle UNIX encoding.
2.  **Verify and save:** Open your `authproxy.cfg` file in the chosen editor, verify the configuration is correct, and save the file.
3.  **Attempt to start the service:** Try starting the Duo Security Authentication Proxy service again.

### Further Troubleshooting

If the service still fails to start after using a recommended editor:

*   **Check the Application Log:** Examine the Application log in the Windows Event Viewer for error messages originating from "DuoAuthProxy". The traceback in the log typically points to the specific line in `authproxy.cfg` causing the startup failure.

### Configuration File Encoding

Ensure that the `authproxy.cfg` file uses UNIX line endings (LF) and not Windows line endings (CRLF). Some text editors might default to CRLF, which can cause parsing errors.
```

--------------------------------

### Start Primary Only Mode on Linux

Source: https://duo.com/docs/authproxy-reference

Restarts the Duo Authentication Proxy in primary only mode for one hour on Linux. Requires SSH access and the shell connection must remain open.

```bash
sudo /opt/duoauthproxy/bin/authproxy_primary_only
```

--------------------------------

### Duo Authentication Proxy Update Available Log Output

Source: https://duo.com/docs/authproxy-reference

This log output indicates that a new version of the Duo Authentication Proxy is available. It specifies the currently installed version, the latest released version, and the number of updates (major, security fixes, minor changes) that are available. It also provides links to release notes and the latest version download.

```log
Checking updates for Duo Authentication Proxy...
[info] A new version of Duo Authentication Proxy is available now.
[info] You are using version n.n.n, but version n.n.n has been released.
[warn] You are missing n update(s), including n major update(s), n security fix(es), and some minor changes
[info] Please visit https://duo.com/docs/authproxy-notes to check release notes of the Duo Authentication Proxy
[info] Please visit https://dl.duosecurity.com/duoauthproxy-latest.exe to download the latest version of the Duo Authentication Proxy
```

--------------------------------

### Extract Duo Authentication Proxy Source Code

Source: https://duo.com/docs/authproxy-reference

Extracts the source archive for the Duo Authentication Proxy, typically a .tgz file, preparing it for building.

```bash
tar xzf duoauthproxy-latest-src.tgz

```

--------------------------------

### Verify FIPS Mode Status in Logs

Source: https://duo.com/docs/authproxy-reference

This example demonstrates a typical log entry indicating that FIPS mode is enabled in the Duo Authentication Proxy. Examining the `authproxy.log` after startup confirms the successful activation of FIPS mode.

```log
FIPS mode 1 is enabled with OpenSSL 1.0.2o-fips

```

--------------------------------

### Configure FIPS-Compliant LDAP Server Auto

Source: https://duo.com/docs/authproxy-reference

This configuration example shows the settings for a FIPS-compliant `ldap_server_auto`. It specifies the associated `ad_client`, Duo API keys, API host, and SSL configuration for the LDAP server, including certificate and key paths and the SSL port.

```ini
[ldap_server_auto]
client=ad_client
ikey=DIXXXXXXXXXXXXXXXXXX
    skey=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
api_host=api-XXXXXXXX.duosecurity.com
ssl_key_path=ldap_server.key
ssl_cert_path=ldap_server.pem
ssl_port=636

```

--------------------------------

### Build and Install Duo OpenVPN Plugin

Source: https://duo.com/docs/openvpn

Instructions for downloading, extracting, building, and installing the Duo OpenVPN plugin. This process ensures the duo_openvpn.so plugin and duo_openvpn.py helper script are available on the OpenVPN server. Requires a Unix-like environment with make and sudo privileges.

```bash
tar zxf 2.4.tar.gz
cd duo_openvpn-2.4
make && sudo make install
```

--------------------------------

### Sample authproxy.cfg for Plain Authentication

Source: https://duo.com/docs/adsync

This code snippet demonstrates a sample `authproxy.cfg` file configuration for Plain authentication with Duo Security. It includes essential parameters like integration key (ikey), secret key (skey), API host, and service account credentials for Active Directory synchronization. Ensure you replace placeholder values with your actual integration details.

```ini
[cloud]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=2v3O7uCJmdhFK6hsKS82HGyNUR5L1XGCRx44DjCQ
api_host=api-XXXXXXXX.duosecurity.com
service_account_username=duosync
service_account_password=Pass12345
```

--------------------------------

### Enable and Start Docker Service (Bash)

Source: https://duo.com/docs/dng

Enables the Docker service to start automatically on boot and starts it immediately. This command uses systemctl for service management.

```bash
sudo systemctl enable --now docker.service
```

--------------------------------

### RADIUS Auto Configuration - Encrypted Passwords (Windows)

Source: https://duo.com/docs/authproxy-reference

On Windows systems, sensitive parameters like the secret key and RADIUS shared secrets can be encrypted for enhanced security. This example assumes the use of `skey_protected` and `radius_secret_protected_1` which would be generated using the Authentication Proxy's password encryption utility.

```ini
[radius_server_auto]
ikey = your_integration_key
skey_protected = "encrypted_secret_key"
api_host = api-XXXXXXXX.duosecurity.com
radius_ip_1 = 1.2.3.4
radius_secret_protected_1 = "encrypted_radius_secret"
client = ad_client
```

--------------------------------

### Example URL-Encoded GET Request

Source: https://duo.com/docs/authapi-v1

Demonstrates how parameters should be URL-encoded and appended to the API endpoint for GET requests. This ensures proper transmission of data to the Duo API.

```HTTP
https://api-XXXXXXXX.duosecurity.com/admin/v1/users?realname=First%20Last&username=root
```

--------------------------------

### DuoConnect Installer Directory Creation and Permissions (macOS)

Source: https://duo.com/docs/duoconnect-notes

This snippet describes how the DuoConnect installer manages directories on macOS. It specifically details the creation of `/usr/local/bin` with `rwxr-xr-x` permissions if it doesn't exist. This ensures proper installation and execution context.

```bash
# Now creates /usr/local/bin with rwxr-xr-x permissions if it does not already exist at time of install.
```

--------------------------------

### Deploy Duo Network Gateway with Docker Compose

Source: https://duo.com/docs/dng

Starts the Duo Network Gateway containers, including DNS, Redis, portal, and admin services, using Docker Compose. This command requires the previously downloaded YML configuration file. Replace the example filename with your actual downloaded file name.

```bash
docker-compose -p network-gateway -f network-gateway-3.3.0-app-relay.yml up -d
```

--------------------------------

### Build Duo Authentication Proxy from Source

Source: https://duo.com/docs/adsync

Extract the downloaded source archive and build the Duo Authentication Proxy using `tar` and `make`. Navigate into the extracted directory before running `make`.

```shell
tar xzf duoauthproxy-6.5.2-src.tgz
cd duoauthproxy-_version_-src
make
```

--------------------------------

### Install IIS and Required Components on Windows Server

Source: https://duo.com/docs/dag-windows

This command installs the Web Server role, Management Tools, CGI, .NET Framework Core, ASP.NET 4.5, and Scripting Tools, which are necessary for Duo Access Gateway. It uses PowerShell's Server Manager module. Ensure you run PowerShell as an administrator.

```powershell
import-module servermanager
add-windowsfeature Web-Server, Web-Mgmt-Tools, Web-CGI, NET-Framework-Core, Web-Asp-Net45, Web-Scripting-Tools
```

--------------------------------

### Example URL for ManageEngine Patch Manager Plus

Source: https://duo.com/docs/sso-patch-manager-plus

This example illustrates the format of the URL for accessing ManageEngine Patch Manager Plus, highlighting the domain and port number required for SSO configuration.

```text
https://ec1-23-456-789-012.compute-1.amazonaws.com:8888
```

--------------------------------

### Duo Authorization Request - HTTP GET Example

Source: https://duo.com/docs/sso-oidc-generic

This snippet shows the base HTTP GET endpoint for initiating a Duo authorization request. It serves as a reference for understanding the structure of the request URL.

```http
GET /authorize

```

--------------------------------

### Example AD Configuration (authproxy.cfg)

Source: https://duo.com/docs/adsync

This snippet illustrates a sample configuration for the Duo Authentication Proxy's `authproxy.cfg` file, demonstrating how to specify AD domain controller details, authentication credentials, and transport security settings. Ensure sensitive information like passwords is handled securely.

```ini
[ad]
# Hostname or IP address of your AD domain controller.
dc_list = dc1.example.com, dc2.example.com
# Base DN for directory searches.
base_dn = DC=example,DC=com

# Authentication type: 'integrated', 'ntlmv2', or 'plain'.
# If using 'ntlmv2' or 'plain', you must also provide:
# ntlm_username = AD_USERNAME
# ntlm_password = AD_PASSWORD
authentication_type = plain

# Transport type: 'clear', 'ldaps', or 'starttls'.
transport_type = ldaps

# Optional: For LDAPS/STARTTLS, specify CA certificates.
# ssl_ca_certs = /path/to/your/ca_certs.pem

# Optional: For LDAPS, if SSL verify hostname is enabled.
# ssl_verify_hostname = true

```

--------------------------------

### Sample authproxy.cfg for Multiple Directory Syncs (Integrated Authentication)

Source: https://duo.com/docs/adsync

This example demonstrates how to configure multiple directory synchronizations using Integrated (SSPI) authentication within the 'authproxy.cfg' file. It shows how different integration keys can be used for separate syncs while maintaining the same API host for a single Duo customer account.

```ini
[cloud]
ikey=DIABCDEFGHIJKLMNOPQR

```

--------------------------------

### Start Docker Service on SUSE Enterprise Linux

Source: https://duo.com/docs/dag-linux

Starts the Docker daemon using the service command. This command requires superuser privileges and is necessary to run Docker containers. It can also be managed using systemctl start docker.service.

```bash
sudo service docker start
```

--------------------------------

### Duo Support Tool - File Collection Script

Source: https://duo.com/docs/authproxy-reference

This text describes the functionality of the Duo Support Tool script, designed to gather essential troubleshooting information for Duo Authentication Proxy issues. It outlines the steps the script takes to collect logs, anonymize configuration files, and package them into a zip archive for submission to Duo Support.

```text
The support tool performs the following actions:
  1. Runs the connectivity tool, outputting test results to the `connectivity_tool.log` file in the `log` directory.
  2. Copies the current `authproxy.cfg` to a new `clean_authproxy.cfg` file and replaces all passwords, RADIUS secrets, and Duo SKEYs with asterisks.
  3. Creates a zip file that contains the `clean_authproxy.cfg` file and all log files in the `log` directory, including `connectivity_tool.log`, `authproxy.log` (and any previously rotated `authproxy.log.n` files), and `authevents.log`.
  4. Saves the zip file in the Duo Authentication Proxy base installation directory as `duoauthproxy-support-datestring-timestring.zip`. So on Windows, for example, the support file would be `C:\Program Files\Duo Security Authentication Proxy\duoauthproxy-support-20190219-140924.zip`.
```

--------------------------------

### Generate Session Key with PowerShell

Source: https://duo.com/docs/owa

Generates a random, cryptographically secure byte array and converts it to a Base64 string, suitable for use as a session key during Duo installation on multiple Exchange Client Access Servers. This ensures a strong, unique key for each installation.

```powershell
$bytes = new-object "System.Byte[]" 30
(new-object System.Security.Cryptography.RNGCryptoServiceProvider).GetBytes($bytes)
[Convert]::ToBase64String($bytes)
```

--------------------------------

### Tableau Server SAML Configuration Example

Source: https://duo.com/docs/sso-tableau-server

This snippet demonstrates the configuration steps within Tableau Server to enable SAML authentication. It highlights the fields requiring URLs, certificate files, key files, and IdP metadata. It also specifies the attribute mapping for username, display name, and email.

```text
## Enable Tableau Server for SSO
  1. Log into your Tableau Server account as an administrator.
  2. At the top of the page, click the **CONFIGURATION** tab.
  3. In the left menu sidebar, click **User Identity & Access**. The "User Identity & Access" page opens.
  4. Click the **Authentication Method** tab.
  5. Under "Authentication Method", click the drop-down menu and select **SAML**.
  6. Under "SAML", click the **Enable SAML authentication for the server** checkbox.
  7. In your web address bar, copy your domain URL and paste it into the **Tableau Server return URL** and **SAML entity ID** fields, under "Step 1". Do not include the port number.
Example: If your web address is **https://ec1-23-45-67-89.compute-1.amazonaws.com:4444/#/configuration** , then your domain URL is **https://ec1-23-45-67-89.compute-1.amazonaws.com**.
  8. Return to the Duo Admin Panel. Under "Service Provider", paste your domain URL into the **Entity ID** field.
  9. In the Duo Admin Panel, under "Downloads", click **Download XML**.
  10. Scroll to the bottom of the page and click **Save**.
  11. Return to Tableau Server. Under "Step 1", click **Select File** next to "SAML certificate file" and open the certificate file you saved earlier.
  12. Click **Select File** next to "SAML key file" and open the key file you saved earlier.
  13. Under "Step 4", click **Select File** next to "SAML IdP metadata file" and open the XML file you downloaded from Duo earlier.
  14. Under "Step 5", type **username** into the **Username** field.
  15. Type **displayName** into the **Display name** field.
  16. Type **email** into the **Email** field.
  17. Under "Step 6", click the **Use SAML to sign in from Tableau Desktop** checkbox.
  18. Click the **Use SAML to sign in from Tableau Mobile** checkbox.
  19. Make sure the **Use SAML sign-out for Tableau Server** checkbox is not checked.
  20. Scroll to the bottom of the page and click **Save Pending Changes**.
  21. In the upper right corner of the page, click **Pending Changes** and then click **Apply Changes and Restart**.
  22. The "Confirm Restart" pop-up window opens. Click **Confirm**.
```

--------------------------------

### RADIUS Auto Configuration

Source: https://duo.com/docs/authproxy-reference

Configuration options for the `[radius_server_auto]` section.

```APIDOC
## RADIUS Auto Configuration

### Description
Configuration options for the `[radius_server_auto]` section to enable automatic device and factor selection for RADIUS logins.

### Method
Configuration

### Endpoint
N/A (Configuration file setting)

### Parameters
#### Required
- **ikey** (string) - Your Duo integration key, obtained from the Duo Admin Panel.
- **skey** (string) - Your Duo secret key, obtained from the Duo Admin Panel. Use `skey_protected` on Windows for encryption.
- **api_host** (string) - Your Duo API hostname (e.g., `api-XXXXXXXX.duosecurity.com`).
- **radius_ip_1** (string) - IP address or IP address range for RADIUS clients (e.g., `1.2.3.4`, `1.2.3.0/24`, `3.3.3.3 - 3.3.3.6`, or IPv6 addresses/ranges).
- **radius_secret_1** (string) - The shared secret for `radius_ip_1`. Use `radius_secret_protected_1` on Windows for encryption.
- **client** (string) - The primary authentication mechanism. Options: `ad_client`, `radius_client`, `duo_only_client`.

#### Optional
- **radius_ip_2** (string) - Address(es) of an additional RADIUS client.
- **radius_secret_2** (string) - The shared secret for `radius_ip_2`. Use `radius_secret_protected_2` on Windows for encryption.
- **factors** (string) - A comma-separated list of factors ordered by preference (e.g., `auto,push,phone,passcode`). `auto` is the default.

### Request Example
```ini
[radius_server_auto]
ikey = <YOUR_IKEY>
skey = <YOUR_SKEY>
api_host = api-XXXXXXXX.duosecurity.com
radius_ip_1 = 10.0.0.0/24
radius_secret_1 = <YOUR_RADIUS_SECRET>
client = radius_client
factors = push,phone
```

### Response
N/A (Configuration applies to server behavior)

### Error Handling
- If `ikey`, `skey`, `api_host`, `radius_ip_1`, `radius_secret_1`, or `client` are missing or invalid, RADIUS authentication may fail.
- Incorrectly configured `radius_ip` and `radius_secret` pairs will prevent clients from connecting.
```

--------------------------------

### Duo RADIUS Challenge Prompt Example

Source: https://duo.com/docs/ciscoasa-radius-challenge

This example shows the text-based prompt users will see when Duo RADIUS authentication is required in AnyConnect. It lists available two-factor authentication options.

```text
Duo two-factor login for jdoe

  Enter a passcode or select one of the following options:
  
  1. Duo Push to XXX-XXX-1234
  2. Phone call to XXX-XXX-1234
  3. SMS passcodes to XXX-XXX-1234
  
  Passcode or option (1-3)
  

```
Tokens:
Raw