Duo 2fa

[kswys87]

I have setup duo and it goes through the setup and sends me the push but then it just goes to a page with "Internal Server Error" , this has happened on both of my servers, I can't seem to find anything on this issue. Both servers are Ubuntu 22.04 and both are on the latest version of MeshCentral (1.1.40) Both work with the standard authenticator app. The only error in the log is below,

Mar 4 18:07:44 mesh node[581685]: ERR: ReferenceError: direct is not defined
Mar 4 18:07:44 mesh node[581685]: at /opt/meshcentral/node_modules/meshcentral/webserver.js:7095:75
Mar 4 18:07:44 mesh node[581685]: at obj.authenticate (/opt/meshcentral/node_modules/meshcentral/webserver.js:429:108)
Mar 4 18:07:44 mesh node[581685]: at /opt/meshcentral/node_modules/meshcentral/webserver.js:7012:33
Mar 4 18:07:44 mesh node[581685]: at Layer.handle [as handle_request] (/opt/meshcentral/node_modules/express/lib/router/layer.js:95:5)
Mar 4 18:07:44 mesh node[581685]: at next (/opt/meshcentral/node_modules/express/lib/router/route.js:149:13)
Mar 4 18:07:44 mesh node[581685]: at Route.dispatch (/opt/meshcentral/node_modules/express/lib/router/route.js:119:3)
Mar 4 18:07:44 mesh node[581685]: at Layer.handle [as handle_request] (/opt/meshcentral/node_modules/express/lib/router/layer.js:95:5)
Mar 4 18:07:44 mesh node[581685]: at /opt/meshcentral/node_modules/express/lib/router/index.js:284:15
Mar 4 18:07:44 mesh node[581685]: at Function.process_params (/opt/meshcentral/node_modules/express/lib/router/index.js:346:12)
Mar 4 18:07:44 mesh node[581685]: at next (/opt/meshcentral/node_modules/express/lib/router/index.js:280:10)

Thoughts anyone??

[si458]

Can you share your config.json

[si458]

also this issue was already reported in the duo feature request issue but havent been able to replicate the issue yet?
#2432 (comment)
the issue is because the login fails when it gets returned from duo
do you click accept with duo? do u click decline? how did you setup the duo? what does your config.json look like?

[si458]

@kswys87 the fix is here for you - c6da201
you should actually never hit this step to begin with,
you only hit this step IF when you returned from duo and it cant reauthenticate your user,
this ONLY happens if your session or cookie has changed from when you first logged in
so this COULD happen with like loadbalancing or reverseproxys which dont use sticky cookie sessions

[kswys87]

That fixed it, the servers are behind proxies… Thanks! Kevin Swysgood Voice Products Inc. P 800.466.1152 | F 316.263.1823 ***@***.******@***.***> From: Simon Smith ***@***.***> Sent: Wednesday, March 5, 2025 4:41 AM To: Ylianst/MeshCentral ***@***.***> Cc: Kevin Swysgood ***@***.***>; Mention ***@***.***> Subject: Re: [Ylianst/MeshCentral] Duo 2fa (Discussion #6850) @kswys87<https://github.com/kswys87> the fix is here for you - c6da201<c6da201> you should actually never hit this step to begin with, you only hit this step IF when you returned from duo and it cant reauthenticate your user, and this ONLY happens if your session or cookie has changed from when you first login so this can happen with like loadbalancing or reverseproxys which dont use sticky cookie sessions — Reply to this email directly, view it on GitHub<#6850 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BQD7WP3C7LHMOPKXQMDWNGL2S3ICPAVCNFSM6AAAAABYKY7QW2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMZZHE3DQOA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[si458]

glad it fixed! but random one
what now happens when u applied the fix?
did it return from duo back to the login screen where the user had to login again?
or did it redirect you to the web ui?
as you should never be hitting this stage and it should redirect you back to the login page?

[kswys87]

Actually I spoke to soon, it didn't fix it, it now no longer gives an error but it never sends a push either, if I attempt to enable duo again the duo window pops up for a second and then I'm just taken to the home screen of mesh.

[kswys87]

Duo setup per the instructions on this site and it did walk me through adding account which shows in the duo admin portal. config.json for server I'm testing

"settings": {
"cert": "example.com",
"MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
"_WANonly": true,
"_LANonly": true,
"_sessionKey": "a;sldkjf;asolkdjg;askoldjgasl;kdjfg",
"port": 444,
"aliasPort": 443,
"_redirPort": 80,
"WebRTC": true,
"plugins": true,
"TlsOffload": "1.1.1.1",
"trustedProxy": "1.1.1.1",
"_redirAliasPort": 80
},
"domains": {
"": {
"_title": "MeshCentral",
"_title2": "Server",
"minify": true,
"userallowedip": "1.1.1.1",
"newAccounts": false,
"_userNameIsEmail": true,
"showModernUIToggle": true,
"certurl": "https://1.1.1.1",
"force2factor": true,
"duo2factor": {
"integrationkey": "abcdefg",
"secretkey": "abcdefg",
"apihostname": "abcdefg.duo.com"
}
}
},
"_letsencrypt": {
"comment": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
"email": "[email protected]",
"names": "myserver.mydomain.com",
"skipChallengeVerification": true,
"production": false

[si458]

you dont have a sessionkey set!
this is required to help remember sessions across server rebootes and proxies etc
so you should set sessionKey: "secretvaluethatyoutellnobody" and restart meshcentral then try again
always remove the _ to tell meshcentral to use that value

[kswys87]

sessionkey set, no change, no push is sent, it just logs me in.

[si458]

That's weird?
So ur not redirected to duo now when u login?

[kswys87]

Nope it just goes to my devices page like normal. Also my production server already had a session key set.

[kswys87]

1.1.41 does not fix duo, I tried again on test server with npm install of 1.1.41(no old clients so issue didn't matter), no push is sent it just logs in the user.