setting_up_and_using_duo.md 6.2 KB
Newer Older
Adam Caprez's avatar
Adam Caprez committed
1
2
3
+++
title = "Setting Up and Using Duo"
description = "Duo Setup Instructions"
4
weight = "8"
Adam Caprez's avatar
Adam Caprez committed
5
6
7
8
9
10
11
12
13
14
+++

##### Use of Duo two-factor authentication (https://www.duosecurity.com) is required for access to HCC resources.

Users will connect via SSH and enter their username/passwords as usual. One additional
authentication step through Duo is then needed before the login is completed. This 
second authentication can be in several different forms (cell phone, YubiKey hardware token), 
and is user-selectable at each login. A brief description of each is provided
[below](#duo-authentication-methods). See the
[Duo Authentication Methods](https://www.duosecurity.com/authentication-methods)
15
16
17
page for more details.

Initial Setup
Adam Caprez's avatar
Adam Caprez committed
18
-------------
19
20
21
22

Most HCC account holders use the Duo Mobile application on their
smartphone or purchase a YubiKey USB device.

Adam Caprez's avatar
Adam Caprez committed
23
24
25
26
27
28
29
### Smartphone

1.  Install the free **Duo Mobile** application from the
    [Google Play Store](https://play.google.com/store/apps/details?id=com.duosecurity.duomobile), [Apple App Store](https://itunes.apple.com/us/app/duo-mobile/id422663827), or [Microsoft Store](https://www.microsoft.com/en-us/store/apps/duo-mobile/9nblggh08m1g)
2.  Visit one of the following locations.  **Bring your smartphone and a valid photo ID** such as your university ID card or drivers license.
    1.  Visit either HCC location [118 Schorr Center, UNL](http://www1.unl.edu/tour/SHOR) | 
        [152 Peter Kiewit Institute, UNO](http://pki.nebraska.edu/new/pages/about-pki/maps-directions-and-parking) in-person anytime from 9am-5pm to enroll.
30
    2.  Visit Information Technology Services [115 Otto Olsen, UNK](http://www.unk.edu/campus-map/?q=m15)
31
32
33
34
35
        in-person and ask for HCC identity verification.

Faculty/staff members with a verified NU telephone number can enroll by
phone. If you would like an HCC staff member to call your NU telephone
number to enroll, please email
Adam Caprez's avatar
Adam Caprez committed
36
{{< icon name="envelope" >}}[hcc-support@unl.edu] (mailto:hcc-support@unl.edu) 
37
38
with a time you will be available.

Adam Caprez's avatar
Adam Caprez committed
39
### YubiKeys
40

npavlovikj's avatar
i    
npavlovikj committed
41
YubiKey devices are currently a one-time cost of around $25 from HCC, or can be
42
43
44
purchased from Yubico and added in-person at either HCC location.
Purchasing a YubiKey from HCC must be done via a University cost object
transfer (HCC cannot accept cash or credit cards). Please bring the cost
npavlovikj's avatar
i    
npavlovikj committed
45
46
object number with you if possible. YubiKeys are also available from the
Husker Tech store in the UNL City Union. Note that
47
48
49
50
YubiKeys are configured for HCC's Duo, and not for general YubiCloud or
U2F use.

Example login using Duo Push
Adam Caprez's avatar
Adam Caprez committed
51
----------------------------
52
53
54
55
56
57
58
59

This demonstrates an example login to Crane using the Duo Push method.
Using another method (SMS, phone call, etc.) proceeds in the same way.
 (Click on any image for a larger version.)

First, a user connects via SSH using their normal HCC username/password,
exactly as before.

Adam Caprez's avatar
Adam Caprez committed
60
{{< figure src="/images/5832713.png" width="600" >}}
61

Adam Caprez's avatar
Adam Caprez committed
62
{{% notice warning%}}**Account lockout**
63

Adam Caprez's avatar
Adam Caprez committed
64
After 10 failed authentication attempts, the user's account is
65
disabled. If this is the case, then the user needs to send an email to
Adam Caprez's avatar
Adam Caprez committed
66
[hcc-support@unl.edu] (mailto:hcc-support@unl.edu)
67
68
including his/her username and the reason why multiple failed
authentication attempts occurred.  
Adam Caprez's avatar
Adam Caprez committed
69
{{% /notice %}}
70
71
72
73
74
75
76
77

After entering the password, instead of completing the login, the user
will be presented with the Duo prompt. This gives the choice to use any
authentication method that the particular account is setup to use. In
this example, the choices are Duo Push notification, SMS message, or
phone call. Choosing option 1 for Duo Push, a request to verify the
login will be sent to the user's smartphone.

78
{{< figure src="/images/5832716.png" height="350" >}}
79
80
81

Simply tap `Approve` to verify the login.

82
{{< figure src="/images/5832717.png" height="350" >}}
83

Adam Caprez's avatar
Adam Caprez committed
84
{{% notice warning%}}**If you receive a verification request you didn't initiate, deny the 
85
request and contact HCC immediately via email at
Adam Caprez's avatar
Adam Caprez committed
86
87
[hcc-support@unl.edu] (mailto:hcc-support@unl.edu)**
{{% /notice %}}
88
89
90
91

In the terminal, the login will now complete and the user will logged in
as usual.

Adam Caprez's avatar
Adam Caprez committed
92
{{< figure src="/images/5832714.png" height="350" >}}
93
94


Adam Caprez's avatar
Adam Caprez committed
95
96
Duo Authentication Methods
--------------------------
97

Adam Caprez's avatar
Adam Caprez committed
98
99
### Duo Push 
##### [[Watch the Duo Push Demo]](https://www.duosecurity.com/duo-push)
100

Adam Caprez's avatar
Adam Caprez committed
101
{{< figure src="/images/5832709.png" height="350" caption="Photo credit: https://duosecurity.com" >}}
102
103
104
105
106
107
108
109

For smartphone or tablet users (iPhone, Android, Blackberry, Windows
Phone), the Duo Mobile app is available for free. A push notification
will be sent to the device, and users can simply confirm the login with
one tap.

### Duo Mobile Passcodes

Adam Caprez's avatar
Adam Caprez committed
110
{{< figure src="/images/5832711.png" height="350" caption="Photo credit: https://duosecurity.com" >}}
111
112
113
114
115
116
117
118

The Duo Mobile app can also be used to generate numeric passcodes, even
when internet and cell service is unavailable.  Press the key icon to
generate a passcode.  The passcode is then entered manually at the login
prompt to complete authentication.

### SMS Passcodes

Adam Caprez's avatar
Adam Caprez committed
119
120

{{< figure src="/images/5832712.png" height="350" >}}
121
122
123
124
125
126

For non-smartphone users, Duo can send passcodes via normal text
messages which are entered manually to complete login. Please note since
this is an SMS message it may not be free, depending on the details of
the particular cell phone plan.

Adam Caprez's avatar
Adam Caprez committed
127
### Phone Callback
128
129
130
131
132
133

For users with cell phones who prefer not to use any of the above
methods and for those with landline phones, Duo will call the phone and
provide a passcode via automatic voice message. The passcode is then
entered manually to complete the login.

Adam Caprez's avatar
Adam Caprez committed
134
135
### YubiKey
##### [[Yubico]](http://www.yubico.com/)
136

Adam Caprez's avatar
Adam Caprez committed
137
{{< figure src="/images/5832710.jpg" height="200" caption="Photo credit: Yubico" >}}
138
139
140
141

YubiKeys are USB hardware tokens that generate passcodes when pressed.
They appear as a USB keyboard to the computer they are connected to, and
so require no driver software with almost all modern operating systems.
npavlovikj's avatar
i    
npavlovikj committed
142
YubiKeys are available from the Husker Tech store at UNL. Users may also purchase them directly from
Adam Caprez's avatar
Adam Caprez committed
143
144
145
[Yubico](https://store.yubico.com) if desired; this does require stopping 
by either HCC location in person to have the YubiKey added to the user's account. 
For your convenience, HCC often carries some YubiKeys as well; these may only be purchased via a
146
Cost Object transfer.