Duo's PAM module arguably violates the "MFA is only useful, if all parts of it can be enforced server-side!" principle from this blog post. The authentication does happen on a server, but it's a server controlled by Duo, not by you. The PAM module simply makes an API request and authorizes a user iff Duo says they should be authorized.
(Hopefully you'll have configured things so that Duo's approval and a password are both required for login, so this isn't a catastrophic break in security, but it's still a little worrying. And what about when your Internet connection, or Duo's, is having problems? As I write this comment, HTTPS connections to www.duosecurity.com are throwing errors because they've installed a certificate for *.test.duosecurity.com. [1])
I prefer Google's pam_google_authenticator module. Like the Android/iOS app, it doesn't have any external service dependencies; all it assumes is reasonable clock synchrony.
Sterling Windmill from Duo Security here. We experienced a brief issue today resulting from the deployment of an incorrect SSL certificate to our public website. One benefit of the conscious decision to segregate our public website from other services is that this event had no impact on end user authentication. Feel free to reach out to support@duosecurity.com with any questions regarding this or anything else!
(Hopefully you'll have configured things so that Duo's approval and a password are both required for login, so this isn't a catastrophic break in security, but it's still a little worrying. And what about when your Internet connection, or Duo's, is having problems? As I write this comment, HTTPS connections to www.duosecurity.com are throwing errors because they've installed a certificate for *.test.duosecurity.com. [1])
I prefer Google's pam_google_authenticator module. Like the Android/iOS app, it doesn't have any external service dependencies; all it assumes is reasonable clock synchrony.
[1]: https://www.ssllabs.com/ssltest/analyze.html?d=www.duosecuri...