What it does. Deploys Cisco Duo multi-factor authentication across enterprise applications, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-multi-factor-authentication-with-duo, or copy the skill folder into ~/.claude/skills/configuring-multi-factor-authentication-with-duo/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/SKILL.md
SKILL.md (verbatim)
name: configuring-multi-factor-authentication-with-duo
description: Deploys Cisco Duo multi-factor authentication across enterprise applications,
VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive
authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2
deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA
for remote access, VPN, or privileged logins with Duo.
domain: cybersecurity
subdomain: identity-access-management
tags:
- iam
- identity
- access-control
- authentication
- mfa
- duo
- multi-factor
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-02
- PR.AA-05
- PR.AA-06
mitre_attack:
- T1621
- T1110.004
- T1110.003
- T1078
- T1556.006
Configuring Multi-Factor Authentication with Duo
Overview
Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust assessment, and phishing-resistant MFA deployment aligned with NIST 800-63B AAL2/AAL3 requirements.
When to Use
- When deploying or configuring configuring multi factor authentication with duo capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with identity access management concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Configure Duo MFA for VPN, RDP, SSH, and web applications
- Implement adaptive access policies based on user, device, and network context
- Deploy phishing-resistant authentication (Duo Verified Push, WebAuthn)
- Configure device health policies (trusted endpoints, OS version enforcement)
- Set up Duo Admin Panel monitoring and reporting
- Implement MFA bypass and emergency access procedures
Key Concepts
Duo Authentication Methods (by security strength)
- Security Keys (WebAuthn/FIDO2): Phishing-resistant, AAL3 capable
- Duo Verified Push: Requires code entry, resistant to MFA fatigue attacks
- Duo Push: Push notification to Duo Mobile app
- TOTP (Duo Mobile Passcode): Time-based one-time password
- Hardware Tokens: OTP from physical token
- SMS/Phone Call: Least secure, use only as fallback
Duo Integration Architecture
- Duo Authentication Proxy: On-premises proxy for RADIUS/LDAP integration
- Duo Web SDK: Embed Duo MFA in web applications
- Duo OIDC/SAML: SSO integration for cloud applications
- Duo for RDP: Windows Logon MFA
- Duo Unix: PAM-based MFA for SSH
Adaptive Access Policies
- Trusted Networks: Reduce MFA friction for corporate networks
- Remembered Devices: Skip MFA for trusted devices (configurable duration)
- Device Health: Block or require MFA based on OS patch level, encryption, firewall
- Risk-Based Authentication: Step-up MFA for anomalous login patterns
Workflow
Step 1: Duo Authentication Proxy Setup
- Deploy Duo Authentication Proxy on Windows/Linux server
- Configure primary authentication (AD/LDAP or RADIUS)
- Configure Duo API credentials (Integration Key, Secret Key, API Hostname)
- Set failmode (safe=deny if Duo unreachable, secure=allow)
- Test proxy connectivity to Duo cloud and AD
Step 2: VPN MFA Integration
- Configure VPN concentrator for RADIUS authentication
- Point RADIUS to Duo Authentication Proxy
- Configure Duo proxy with [radius_server_auto] section
- Test VPN login with Duo Push
- Deploy to all VPN users with enrollment period
Step 3: RDP/Windows Logon MFA
- Install Duo Authentication for Windows Logon on target servers
- Configure Duo application in Admin Panel
- Set offline access options (allow N offline logins)
- Configure bypass for service accounts
- Test RDP login with Duo MFA
Step 4: Adaptive Policy Configuration
- Create user groups (Standard, Privileged, Contractors)
- Configure per-group authentication policies:
- Standard: Duo Push allowed, remembered device 7 days
- Privileged: Verified Push required, no remembered device
- Contractors: WebAuthn required, no remembered device
- Configure device health policies:
- Require encrypted disk
- Block outdated OS versions
- Require firewall enabled
- Set trusted network exceptions for corporate IPs
Step 5: Phishing-Resistant MFA Deployment
- Enable Verified Push (requires entering 3-digit code from login screen)
- Register WebAuthn/FIDO2 security keys for privileged users
- Disable SMS and phone call for high-risk groups
- Configure Duo Risk-Based Factor Selection
- Monitor for MFA fatigue attack patterns
Step 6: Monitoring and Response
- Configure Duo Admin Panel alerts
- Set up authentication log forwarding to SIEM
- Monitor for: MFA denial patterns, bypass usage, new device enrollments
- Create incident response playbook for MFA compromise
- Regular review of bypass and exception policies
Security Controls
| Control |
NIST 800-53 |
Description |
| MFA |
IA-2(1) |
Multi-factor authentication for network access |
| MFA for Privileged |
IA-2(2) |
MFA for privileged account access |
| Replay Resistance |
IA-2(8) |
Replay-resistant authentication |
| Device Identification |
IA-3 |
Device identity and trust |
| Authenticator Management |
IA-5 |
MFA enrollment and lifecycle |
Common Pitfalls
- Not deploying phishing-resistant MFA (Verified Push/FIDO2) for privileged accounts
- Setting failmode to "safe" (allow access when Duo is down) in production
- Not disabling SMS/phone call for users with app-capable devices
- Forgetting to configure offline access for laptops
- Not monitoring for MFA fatigue/prompt bombing attacks
Verification
Other files in this skill
assets/template.md (verbatim)
Duo MFA Deployment Checklist
Duo Admin Panel Configuration
Authentication Policy Matrix
| Group |
Push |
Verified Push |
WebAuthn |
TOTP |
SMS |
Phone |
Remember |
| Standard |
Yes |
No |
Optional |
Yes |
No |
No |
7 days |
| Privileged |
No |
Yes |
Yes |
Backup |
No |
No |
None |
| Contractors |
Yes |
No |
No |
Yes |
No |
No |
None |
Integration Points
| System |
Integration Method |
Status |
| VPN (Cisco ASA) |
RADIUS via Auth Proxy |
[ ] |
| VPN (Palo Alto) |
RADIUS via Auth Proxy |
[ ] |
| Windows RDP |
Duo for Windows Logon |
[ ] |
| Linux SSH |
Duo Unix (PAM) |
[ ] |
| Web Apps (SAML) |
Duo SSO |
[ ] |
| Office 365 |
Duo + Azure AD |
[ ] |
Device Health Policy
Emergency Procedures
references/api-reference.md (verbatim)
Duo MFA Configuration — API Reference
Libraries
| Library |
Install |
Purpose |
| duo_client |
pip install duo_client |
Official Duo SDK for Python |
| requests |
pip install requests |
HTTP client for Admin API |
Duo Admin API Endpoints
| Method |
Endpoint |
Description |
| GET |
/admin/v1/users |
List all users with enrollment status |
| GET |
/admin/v1/users/{user_id} |
Get user details and devices |
| GET |
/admin/v1/info/summary |
Account summary (user count, integrations) |
| GET |
/admin/v2/logs/authentication |
Authentication logs (v2 with paging) |
| POST |
/admin/v1/users/enroll |
Enroll new user for MFA |
| POST |
/admin/v1/users/{id}/bypass_codes |
Generate bypass codes |
Authentication (HMAC Signing)
import duo_client
admin_api = duo_client.Admin(
ikey="DIXXXXXXXXXXXXXXXXXX",
skey="YourSecretKey",
host="api-XXXXXXXX.duosecurity.com"
)
users = admin_api.get_users()
User Status Values
| Status |
Description |
| active |
User enrolled and can authenticate |
| bypass |
MFA bypassed — security risk |
| disabled |
User account disabled |
| locked_out |
Temporarily locked due to failed attempts |
External References
references/standards.md (verbatim)
Standards and References - MFA with Duo
NIST Standards
- NIST SP 800-63B: Digital Identity Guidelines - Authentication and Lifecycle Management
- AAL1: Single-factor authentication
- AAL2: Multi-factor authentication (Duo Push, TOTP)
- AAL3: Hardware-based phishing-resistant (FIDO2, PIV)
- NIST SP 800-53 Rev 5: IA-2, IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-3, IA-5
Duo Documentation
CISA Guidance
- CISA MFA Guidance: Phishing-resistant MFA requirement for federal agencies
- EO 14028: Executive Order on Improving the Nation's Cybersecurity - MFA mandate
Compliance
- PCI DSS 4.0: Requirement 8.3.1 - MFA for all access to CDE
- HIPAA: 45 CFR 164.312(d) - Person or entity authentication
- SOX: MFA for privileged financial system access
- CMMC: Level 2 - IA.L2-3.5.3 Multi-factor authentication
references/workflows.md (verbatim)
MFA with Duo Workflows
Workflow 1: Duo Authentication Proxy Deployment
- Install Duo Authentication Proxy on dedicated server
- Configure authproxy.cfg with AD/LDAP primary auth
- Add Duo API credentials (ikey, skey, api_host)
- Set failmode=safe for initial testing, change to secure for production
- Start Duo proxy service, verify connectivity
- Configure VPN/application to use proxy as RADIUS server
- Test with pilot group before full deployment
Workflow 2: User Enrollment
- Admin creates Duo user (manual or AD sync)
- User receives enrollment email/link
- User installs Duo Mobile app
- User scans QR code to link device
- User completes test authentication
- Admin verifies enrollment status in Admin Panel
Workflow 3: MFA Fatigue Attack Response
- Detect multiple rapid push notifications to single user
- Alert security team via SIEM integration
- Temporarily lock user's Duo account
- Contact user to verify if they initiated authentication
- If unauthorized: reset credentials, investigate source
- If authorized: educate user, enable Verified Push
- Update policy to require Verified Push for affected group
Workflow 4: Duo Failover and Emergency Access
- Duo cloud service becomes unreachable
- Authentication Proxy checks failmode setting
- If failmode=secure: deny all access (most secure)
- If failmode=safe: allow primary auth only (business continuity)
- Admin monitors Duo status page for resolution
- After restoration: review all authentications during outage
- Investigate any suspicious access during failover period
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.