Duo Security Enterprise Guide: Architecture, Deployment, and Hardening

Overview

Duo Security, part of Cisco, is an identity security platform focused on multi-factor authentication (MFA), device trust, and adaptive access policies. Enterprises use Duo to reduce account takeover risk, enforce strong authentication for SaaS, VPN, RDP, SSH, and privileged workflows, and improve Zero Trust maturity without replacing their primary identity provider.

Duo commonly integrates with Microsoft Entra ID, Active Directory, Okta, VPN concentrators, remote access gateways, and on-premises applications. Its core value is centralized policy enforcement with broad application coverage and relatively fast deployment.

Architecture

A typical Duo deployment includes:

• Duo Cloud Service: hosts authentication workflows, policy engine, device insight, and admin portal.
• Authentication Proxy: on-premises service that bridges legacy apps, LDAP, RADIUS, or AD to Duo cloud.
• Duo Universal Prompt: modern browser-based MFA experience for web apps and SSO integrations.
• Duo Mobile / hardware tokens: second-factor methods including push, TOTP, passkeys, and FIDO2 security keys.
• Directory sync: syncs users and groups from AD or Entra ID.

Deployment models

• Cloud-first: Duo SSO with cloud apps and modern IdPs.
• Hybrid: Duo cloud with on-prem Authentication Proxy for VPN, RDP, LDAP, and legacy apps.
• Federated: Duo layered behind or alongside Entra ID or Okta for step-up authentication and device checks.

Data flow

1. User initiates login to VPN, SaaS app, or administrative endpoint.
2. Primary authentication occurs locally, via LDAP/AD, RADIUS, or upstream IdP.
3. Duo evaluates policy using user, group, device posture, network, and application context.
4. User completes MFA with push, passkey, WebAuthn, or token.
5. Result is returned to the application, VPN, or proxy for allow/deny.

Implementation Guide

1. Install Duo Authentication Proxy on Linux

sudo useradd --system --home /opt/duoauthproxy --shell /sbin/nologin duoauthproxy
curl -O https://dl.duosecurity.com/duoauthproxy-latest-src.tgz
tar xzf duoauthproxy-latest-src.tgz
cd duoauthproxy-*
sudo ./install --install-dir /opt/duoauthproxy
sudo /opt/duoauthproxy/bin/authproxyctl start
sudo /opt/duoauthproxy/bin/authproxyctl status

2. Configure LDAP primary auth with Duo MFA

Edit /opt/duoauthproxy/conf/authproxy.cfg:

[main]
debug=true
log_dir=/opt/duoauthproxy/log

[ad_client]
host=dc1.corp.example.com
service_account_username=CORP\\svc_duo_ldap
service_account_password=Str0ngServicePass!
search_dn=DC=corp,DC=example,DC=com

[ldap_server_auto]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
api_host=api-12345678.duosecurity.com
client=ad_client
port=389
interface=0.0.0.0
failmode=safe
ssl_key_path=/opt/duoauthproxy/conf/server.key
ssl_cert_path=/opt/duoauthproxy/conf/server.crt

Restart the service:

sudo /opt/duoauthproxy/bin/authproxyctl restart
sudo tail -f /opt/duoauthproxy/log/authproxy.log

3. Enroll users and sync groups

• In Duo Admin Panel, create a Directory Sync source for AD or Entra ID.
• Scope sync to security groups such as VPN-Users and Privileged-Admins.
• Require enrollment for synced users and enable Universal Prompt where supported.

4. Integrate VPN via RADIUS

Point the VPN gateway to the Duo Authentication Proxy as its RADIUS server. Use a shared secret and restrict source IPs on the proxy host firewall.

Code Examples

Example 1: Firewall rules for Duo proxy host

sudo ufw allow from 10.20.30.0/24 to any port 1812 proto udp
sudo ufw allow from 10.20.30.0/24 to any port 1813 proto udp
sudo ufw allow out 443/tcp
sudo ufw deny 22/tcp from any
sudo ufw enable

Example 2: Docker Compose for log shipping sidecar

version: "3.8"
services:
  fluent-bit:
    image: cr.fluentbit.io/fluent/fluent-bit:2.2
    volumes:
      - /opt/duoauthproxy/log:/var/log/duo:ro
      - ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf:ro
    restart: unless-stopped

Example 3: Validate Duo Admin API connectivity

import requests, time, hmac, hashlib, base64
ikey = "DIXXXXXXXXXXXXXXXXXX"
skey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
host = "api-12345678.duosecurity.com"
date = time.strftime("%a, %d %b %Y %H:%M:%S -0000", time.gmtime())
resp = requests.get(f"https://{host}/admin/v1/info/ping", headers={"Date": date}, auth=(ikey, skey), timeout=10)
print(resp.status_code, resp.text)

Security Hardening

• Use failmode=secure for privileged access paths; reserve safe only for business-critical systems with compensating controls.
• Protect the proxy host with full-disk encryption, EDR, minimal packages, and outbound-only internet access where possible.
• Store service account credentials in a vault and rotate them regularly.
• Enforce phishing-resistant MFA such as FIDO2/WebAuthn or passkeys for administrators.
• Restrict Duo Admin Panel access with SSO, role-based admin roles, and separate break-glass accounts.
• Forward Duo logs to SIEM and alert on MFA bypass, enrollment spikes, and repeated push denials.

Comparison

Troubleshooting

Error 1: LDAP bind failure

Log sample:

2024-11-14T09:22:31.441Z [duoauthproxy.lib.log#info] LDAP Connection error: invalidCredentials
2024-11-14T09:22:31.442Z [duoauthproxy.modules.drad_client#warning] Active Directory authentication failed for user jsmith

Fix: verify service account password, bind format CORP\\svc_duo_ldap, and LDAPS or LDAP port reachability.

Error 2: Duo cloud connectivity failure

Log sample:

2024-11-14T09:25:02.113Z [http_client] HTTPSConnectionPool(host='api-12345678.duosecurity.com', port=443): Max retries exceeded with url: /auth/v2/ping (Caused by ConnectTimeoutError)

Fix: allow outbound TCP 443, validate proxy settings, and confirm DNS resolution from the Authentication Proxy host.

Error 3: RADIUS shared secret mismatch

Log sample:

2024-11-14T09:31:55.008Z [radius_server_auto] Invalid RADIUS packet from 10.20.30.15: bad authenticator

Fix: re-enter the exact shared secret on both the VPN gateway and Duo proxy; check for hidden whitespace.

Best Practices

Do

• Use group-based policies such as stricter controls for Privileged-Admins.
• Prefer Universal Prompt and phishing-resistant authenticators.
• Deploy at least two Authentication Proxy nodes behind load balancing for critical RADIUS or LDAP flows.
• Test fail-open versus fail-closed behavior per application.

Don't

• Do not use a Domain Admin account for directory bind.
• Do not expose the Authentication Proxy directly to the internet.
• Do not rely only on push approvals for high-risk admin access; require FIDO2 or verified device posture.
• Do not skip log export; MFA events are high-value detection telemetry.