...
Once you are enrolled in Duo you are ready to use it on the HPC systems. Usage is fairly straight forward and is very similar to what you may be accustomed to with Web sites, such as the UIowa Employees Self Service site. All of the authentication methods are supported however, given that the HPC systems are shell systems, the duo-push method is very convenient for automation.
For normal ssh connections the following illustrates what you will see.
| Panel |
|---|
ssh neon.hpc.uiowa.edu Enter a passcode or select one of the following options: 1. Duo Push to XXX-XXX-8727 Passcode or option (1-4): |
In the above, I have two devices registered, a phone and a tablet. The phone is set to be the primary device. The above requires interaction which in most cases is probably not a huge burden. However, there are times when you do not want to have to interact with the console and you can specify a push to happen automatically to your primary device. To accomplish this you will need to use a generated key (preferably with a passphrase and ssh agent) and set the DUO_PASSCODE environment variable.
| No Format |
|---|
env DUO_PASSCODE=push ssh -o SendEnv=DUO_PASSCODE neon.hpc.uiowa.edu
Reading $DUO_PASSCODE...
Pushed a login request to your device...
Success. Logging you in... |
In the above there is no interaction with the console but you still have to acknowledge the request on the device. It is also possible to send a pre-generated key. This key can either be generated from the app on the device or from the list sent via SMS.
| No Format |
|---|
env DUO_PASSCODE=482946 ssh -o SendEnv=DUO_PASSCODE neon.hpc.uiowa.edu
Reading $DUO_PASSCODE...
Success. Logging you in... |
While the above still requires interaction to generate the code it may be more convenient to send a code first rather than acknowledge after the ssh command.