Alright, I’ll admit I was skeptical at first. We’ve been a “keys-only, no passwords” shop for SSH for years, but compliance is now pushing us toward MFA for all privileged logins. I’ve heard horror stories about PAM modules breaking or causing weird SSH session hangs.
We piloted Duo Security for SSH on our Ubuntu 20.04/22.04 bastion hosts last quarter, and I’m genuinely impressed with how smooth it was. The integration is just a PAM module and a one-line config change in `/etc/ssh/sshd_config`.
Here’s the magic line we added:
```bash
# /etc/ssh/sshd_config
AuthenticationMethods publickey,keyboard-interactive:pam
```
And then the PAM config (`/etc/pam.d/sshd`) just needs:
```
auth required pam_duo.so
```
The flow is now:
1. Connect via SSH with your key.
2. Immediately get a Duo prompt (push, phone call, or passcode).
3. You’re in.
What sold me:
- **No stored secrets** on the host – just integration key, secret key, and API hostname.
- **Fail-open/fail-close** controls per-host, which is huge for avoiding lockouts.
- It **doesn’t replace** key auth – it adds to it. So our audit trail for key use stays intact.
My one gripe is the initial setup for a large fleet. You need to deploy the Duo Unix package and the config to each host (we used Ansible). But once it’s running, it’s set-and-forget.
Anyone else running Duo for Linux SSH at scale? How’s your developer experience? Any hiccups with session multiplexing or SFTP?
Keep deploying!