New to Claude Skills? Learn how to install them →

Get Claude Skills
mukul975 on GitHub

Configuring Multi-Factor Authentication with Duo

Free

Secure your applications with Cisco Duo MFA deployment.

by mukul97527.6k stars on mukul975/anthropic-cybersecurity-skills
1 views
Updated Aug 8, 2026
Get this skill

Free · Opens the source repo

What Configuring Multi-Factor Authentication with Duo does

This skill facilitates the deployment of Cisco Duo multi-factor authentication (MFA) across various enterprise applications, including VPNs, RDP, and SSH access points. It provides a comprehensive guide to integrating Duo’s capabilities into your security architecture, ensuring compliance with standards such as NIST 800-63B AAL2/AAL3. The skill encompasses critical aspects such as adaptive authentication policies, device trust assessments, and phishing-resistant deployment methods, making it a valuable resource for organizations looking to enhance their security posture.

Users will find detailed workflows for setting up the Duo Authentication Proxy, which acts as a bridge for RADIUS/LDAP integration, and instructions for configuring MFA for different access points. The skill also emphasizes the importance of adaptive access policies, allowing organizations to tailor authentication requirements based on user roles, device health, and network context. This level of customization helps reduce friction during the authentication process while maintaining robust security measures.

Designed for security professionals and system administrators, this skill is particularly useful for those tasked with deploying or hardening MFA solutions in environments that require secure remote access. It serves as a practical guide for establishing security controls that align with compliance requirements, as well as for conducting security assessments that necessitate the implementation of MFA.

With a focus on best practices and common pitfalls, the skill also prepares users to monitor and respond to potential security incidents related to MFA usage, ensuring that organizations can proactively defend against threats such as MFA fatigue attacks and unauthorized access attempts.

When to use it

Use this skill when deploying Duo MFA in your environment, particularly for remote access, VPN, or privileged logins.

When not to use it

This skill may not be suitable for environments that do not require multi-factor authentication or for users unfamiliar with identity access management concepts.

What you can build with it

Deploying MFA for Remote Access

Use this skill to configure Duo MFA for secure remote access to VPNs and SSH, ensuring only authorized users can connect.

Establishing Security Controls

Implement adaptive authentication policies to enhance security controls in compliance with industry standards.

Conducting Security Assessments

Utilize this skill during security assessments to evaluate the effectiveness of MFA implementations and identify areas for improvement.

How to install Configuring Multi-Factor Authentication with Duo

View source

1. Install with the skills CLI

npx skills add mukul975/anthropic-cybersecurity-skills/configuring-multi-factor-authentication-with-duo --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by mukul975

Configuring Multi-Factor Authentication with Duo

Overview

Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust assessment, and phishing-resistant MFA deployment aligned with NIST 800-63B AAL2/AAL3 requirements.

When to Use

  • When deploying or configuring configuring multi factor authentication with duo capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with identity access management concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Objectives

  • Configure Duo MFA for VPN, RDP, SSH, and web applications
  • Implement adaptive access policies based on user, device, and network context
  • Deploy phishing-resistant authentication (Duo Verified Push, WebAuthn)
  • Configure device health policies (trusted endpoints, OS version enforcement)
  • Set up Duo Admin Panel monitoring and reporting
  • Implement MFA bypass and emergency access procedures

Key Concepts

Duo Authentication Methods (by security strength)

  1. Security Keys (WebAuthn/FIDO2): Phishing-resistant, AAL3 capable
  2. Duo Verified Push: Requires code entry, resistant to MFA fatigue attacks
  3. Duo Push: Push notification to Duo Mobile app
  4. TOTP (Duo Mobile Passcode): Time-based one-time password
  5. Hardware Tokens: OTP from physical token
  6. SMS/Phone Call: Least secure, use only as fallback

Duo Integration Architecture

  • Duo Authentication Proxy: On-premises proxy for RADIUS/LDAP integration
  • Duo Web SDK: Embed Duo MFA in web applications
  • Duo OIDC/SAML: SSO integration for cloud applications
  • Duo for RDP: Windows Logon MFA
  • Duo Unix: PAM-based MFA for SSH

Adaptive Access Policies

  • Trusted Networks: Reduce MFA friction for corporate networks
  • Remembered Devices: Skip MFA for trusted devices (configurable duration)
  • Device Health: Block or require MFA based on OS patch level, encryption, firewall
  • Risk-Based Authentication: Step-up MFA for anomalous login patterns

Workflow

Step 1: Duo Authentication Proxy Setup

  1. Deploy Duo Authentication Proxy on Windows/Linux server
  2. Configure primary authentication (AD/LDAP or RADIUS)
  3. Configure Duo API credentials (Integration Key, Secret Key, API Hostname)
  4. Set failmode (safe=deny if Duo unreachable, secure=allow)
  5. Test proxy connectivity to Duo cloud and AD

Step 2: VPN MFA Integration

  1. Configure VPN concentrator for RADIUS authentication
  2. Point RADIUS to Duo Authentication Proxy
  3. Configure Duo proxy with [radius_server_auto] section
  4. Test VPN login with Duo Push
  5. Deploy to all VPN users with enrollment period

Step 3: RDP/Windows Logon MFA

  1. Install Duo Authentication for Windows Logon on target servers
  2. Configure Duo application in Admin Panel
  3. Set offline access options (allow N offline logins)
  4. Configure bypass for service accounts
  5. Test RDP login with Duo MFA

Step 4: Adaptive Policy Configuration

  1. Create user groups (Standard, Privileged, Contractors)
  2. Configure per-group authentication policies:
    • Standard: Duo Push allowed, remembered device 7 days
    • Privileged: Verified Push required, no remembered device
    • Contractors: WebAuthn required, no remembered device
  3. Configure device health policies:
    • Require encrypted disk
    • Block outdated OS versions
    • Require firewall enabled
  4. Set trusted network exceptions for corporate IPs

Step 5: Phishing-Resistant MFA Deployment

  1. Enable Verified Push (requires entering 3-digit code from login screen)
  2. Register WebAuthn/FIDO2 security keys for privileged users
  3. Disable SMS and phone call for high-risk groups
  4. Configure Duo Risk-Based Factor Selection
  5. Monitor for MFA fatigue attack patterns

Step 6: Monitoring and Response

  1. Configure Duo Admin Panel alerts
  2. Set up authentication log forwarding to SIEM
  3. Monitor for: MFA denial patterns, bypass usage, new device enrollments
  4. Create incident response playbook for MFA compromise
  5. Regular review of bypass and exception policies

Security Controls

ControlNIST 800-53Description
MFAIA-2(1)Multi-factor authentication for network access
MFA for PrivilegedIA-2(2)MFA for privileged account access
Replay ResistanceIA-2(8)Replay-resistant authentication
Device IdentificationIA-3Device identity and trust
Authenticator ManagementIA-5MFA enrollment and lifecycle

Common Pitfalls

  • Not deploying phishing-resistant MFA (Verified Push/FIDO2) for privileged accounts
  • Setting failmode to "safe" (allow access when Duo is down) in production
  • Not disabling SMS/phone call for users with app-capable devices
  • Forgetting to configure offline access for laptops
  • Not monitoring for MFA fatigue/prompt bombing attacks

Verification

  • VPN login requires Duo MFA
  • RDP to servers requires Duo MFA
  • SSH access requires Duo MFA
  • Verified Push enabled for privileged users
  • Device health policy blocks non-compliant devices
  • Authentication logs forwarded to SIEM
  • Bypass/emergency access procedures tested
  • MFA fatigue detection alerts configured

Frequently asked questions about Configuring Multi-Factor Authentication with Duo

Similar skills

Resemble Detect

Detect and analyze AI-generated media for authenticity.

Licenca para Auditar

Comprehensive security audits and threat modeling for projects.

Authenticated Vulnerability Scan

Run deep vulnerability scans with valid credentials.

Agentless Vulnerability Scanning

Assess systems for vulnerabilities without agents.

Implementing Rapid7 InsightVM for Scanning

Streamline vulnerability management with InsightVM setup.

Next-Generation Firewall Deployment

Streamline Palo Alto firewall configuration and management.