saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/configuring-multi-factor-authentication-with-duo/references/workflows.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

1.6 KiB
Raw Blame History

MFA with Duo Workflows

Workflow 1: Duo Authentication Proxy Deployment

  1. Install Duo Authentication Proxy on dedicated server
  2. Configure authproxy.cfg with AD/LDAP primary auth
  3. Add Duo API credentials (ikey, skey, api_host)
  4. Set failmode=safe for initial testing, change to secure for production
  5. Start Duo proxy service, verify connectivity
  6. Configure VPN/application to use proxy as RADIUS server
  7. Test with pilot group before full deployment

Workflow 2: User Enrollment

  1. Admin creates Duo user (manual or AD sync)
  2. User receives enrollment email/link
  3. User installs Duo Mobile app
  4. User scans QR code to link device
  5. User completes test authentication
  6. Admin verifies enrollment status in Admin Panel

Workflow 3: MFA Fatigue Attack Response

  1. Detect multiple rapid push notifications to single user
  2. Alert security team via SIEM integration
  3. Temporarily lock user's Duo account
  4. Contact user to verify if they initiated authentication
  5. If unauthorized: reset credentials, investigate source
  6. If authorized: educate user, enable Verified Push
  7. Update policy to require Verified Push for affected group

Workflow 4: Duo Failover and Emergency Access

  1. Duo cloud service becomes unreachable
  2. Authentication Proxy checks failmode setting
  3. If failmode=secure: deny all access (most secure)
  4. If failmode=safe: allow primary auth only (business continuity)
  5. Admin monitors Duo status page for resolution
  6. After restoration: review all authentications during outage
  7. Investigate any suspicious access during failover period