DUO authentication

Every login to SeaWulf, NVwulf, and ClinWulf needs two things: your NetID password and a Duo approval on your phone or another enrolled device. This page covers setting up Duo, what the prompt looks like, and how to get fewer prompts when you log in often or move files.

On this page: Set up Duo · At login · Skip the menu · Fewer prompts · Troubleshooting · Who to contact

Set up Duo before your first login

Duo is Stony Brook's two-step login, run by DoIT. If you already use it for email or other university systems, you're set, since the clusters use the same enrollment.

1. Enroll a device by following DoIT's Duo two-step login instructions. A smartphone with the free Duo Mobile app is easiest.
2. Allow Duo Mobile to send notifications, so pushes show up right away.
3. Add a second device, such as a tablet or another phone, in the Duo device settings. If you lose or replace your phone, you can still log in.

What happens at login

In Open OnDemand (your browser), a Duo screen appears after your password. Approve the push, or choose another method on that screen.

Over SSH, after your password you'll see a short menu, similar to this:

Duo two-factor login for <netid>

Enter a passcode or select one of the following options:

 1. Duo Push to XXX-XXX-1234
 2. Phone call to XXX-XXX-1234
 3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3):

Type 1 and approve the push on your phone. You can also type a 6-digit passcode from the Duo Mobile app, which works even when your phone has no signal.

Skip the menu with DUO_PASSCODE

If you always use the same method, set the DUO_PASSCODE variable and the menu is skipped. It also helps file-transfer tools such as scp and sftp, which can't show the menu.

Value	What it does
push	Sends a Duo push to your device
phone	Calls your phone
sms	Texts you a batch of passcodes. That login fails; log in again with one of the codes.
a passcode, e.g. 123456	Uses a code from Duo Mobile, a text, or a hardware token
push2, phone2…	Adds a number to pick a specific device if you have more than one

macOS and Linux

1. Add these lines to ~/.ssh/config on your computer (create the file if needed):

   Host *.seawulf.stonybrook.edu
       SendEnv DUO_PASSCODE

2. Set the variable, then log in or copy files as usual:

   export DUO_PASSCODE=push
   ssh <netid>@milan.seawulf.stonybrook.edu

3. To make it permanent, add the export line to ~/.zshrc (macOS) or ~/.bashrc (Linux) on your computer.

Windows (MobaXterm)

1. Open your session's settings in MobaXterm.
2. Add the environment variable DUO_PASSCODE with the value push.
3. Set the SSH-browser type to None. MobaXterm's file browser opens a second connection, which otherwise asks for Duo again.

Fewer prompts when you work a lot

• Use the Stony Brook VPN. You approve Duo once when the VPN connects, and cluster logins through the VPN don't ask again. This is the best fix for scripts and file-transfer tools that open many connections.
• Reuse one connection (macOS and Linux). SSH can send later logins and copies through a connection that's already open, so you approve Duo once per session. Add this to ~/.ssh/config:

  Host *.seawulf.stonybrook.edu
      ControlMaster auto
      ControlPath ~/.ssh/cm-%r@%h:%p
      ControlPersist 1h

  While your first SSH window is open (and for an hour after), new ssh, scp, and rsync commands to the same address reuse it.
• Set up an SSH key so you don't type your password each time. See Passwordless SSH.
• Move big data with Globus, which doesn't need a Duo prompt for every file. See Globus file transfer.

Troubleshooting

Who to contact

Problem	Contact
Enrolling devices, new phones, Duo lockouts	DoIT: service.stonybrook.edu or 631-632-9800
Logging in to a cluster, blocked connections, file transfers	HPC support: iacs.supportsystem.com

Next: Connecting to the cluster covers the addresses for each cluster and more login troubleshooting.