Description
Root Cause
When pam_duo detects service == "sshd", it unconditionally sets DUO_FLAG_SYNC (pam_duo.c:181 (https://github.com/duosecurity/duo_unix/blob/master/pam_duo/pam_duo.c#L181)), which sends async=0 to the Duo /auth API. This causes the API call to block server-side for the entire push duration and return a single response containing only the final status_msg (e.g., "Success. Logging you in..." or "Login timed out.").
The Verified Push code is an intermediate status that only appears during async polling of /auth_status. Since DUO_FLAG_SYNC prevents the async polling path from ever executing, the VP code is never received by pam_duo and never emitted to the user.
This is why VP works correctly via su and sudo (which don't set DUO_FLAG_SYNC) but fails over SSH.
Background
DUO_FLAG_SYNC was introduced as a workaround for OpenSSH bug 2876 (https://bugzilla.mindrot.org/show_bug.cgi?id=2876), where sshpam_query() accumulated PAM_TEXT_INFO messages and only delivered them when a PAM_PROMPT_ECHO_* followed or the module returned. Since async mode emits incremental status via PAM_TEXT_INFO, those messages were swallowed by unfixed versions of OpenSSH.
This OpenSSH bug has since been fixed:
- Upstream: commit b9a6dd4d (openssh/openssh-portable@b9a6dd4), merged 2026-02-16
- Ubuntu 24.04: backported in February 2024 (package 1:9.6p1-3ubuntu13)
- Not yet backported: Fedora 39-42, RHEL/Rocky 8-9
Verification
On an Ubuntu 24.04 VM with the OpenSSH fix present, commenting out the DUO_FLAG_SYNC line and rebuilding pam_duo.so causes the VP code to appear correctly during SSH login:
(gobo@localhost) Passcode or option (1-1): 1
Please enter verification code ###### into Duo Mobile...
Success. Logging you in...
Relationship to #347
Issue #347 attributed this to OpenSSH bug 2876. The OpenSSH bug is real and related — it's why the DUO_FLAG_SYNC workaround exists — but it is not the proximate cause. The proximate cause is that DUO_FLAG_SYNC prevents pam_duo from ever receiving the VP code from the Duo API in the first place.
Expected Behavior
When using pam_duo to protect ssh, and Verified Push is used, the user should be shown the VP code.
Actual Behavior
No Verified Push code is shown.
Steps to Reproduce
- Configure pam_duo with sshd and enable verified push on Ubuntu 24 or 26
- Trigger a verified push
- The VP code is never displayed
Workarounds
Potentially use login_duo instead?
Description
Root Cause
When pam_duo detects service == "sshd", it unconditionally sets DUO_FLAG_SYNC (pam_duo.c:181 (https://github.com/duosecurity/duo_unix/blob/master/pam_duo/pam_duo.c#L181)), which sends async=0 to the Duo /auth API. This causes the API call to block server-side for the entire push duration and return a single response containing only the final status_msg (e.g., "Success. Logging you in..." or "Login timed out.").
The Verified Push code is an intermediate status that only appears during async polling of /auth_status. Since DUO_FLAG_SYNC prevents the async polling path from ever executing, the VP code is never received by pam_duo and never emitted to the user.
This is why VP works correctly via su and sudo (which don't set DUO_FLAG_SYNC) but fails over SSH.
Background
DUO_FLAG_SYNC was introduced as a workaround for OpenSSH bug 2876 (https://bugzilla.mindrot.org/show_bug.cgi?id=2876), where sshpam_query() accumulated PAM_TEXT_INFO messages and only delivered them when a PAM_PROMPT_ECHO_* followed or the module returned. Since async mode emits incremental status via PAM_TEXT_INFO, those messages were swallowed by unfixed versions of OpenSSH.
This OpenSSH bug has since been fixed:
Verification
On an Ubuntu 24.04 VM with the OpenSSH fix present, commenting out the DUO_FLAG_SYNC line and rebuilding pam_duo.so causes the VP code to appear correctly during SSH login:
(gobo@localhost) Passcode or option (1-1): 1
Please enter verification code ###### into Duo Mobile...
Success. Logging you in...
Relationship to #347
Issue #347 attributed this to OpenSSH bug 2876. The OpenSSH bug is real and related — it's why the DUO_FLAG_SYNC workaround exists — but it is not the proximate cause. The proximate cause is that DUO_FLAG_SYNC prevents pam_duo from ever receiving the VP code from the Duo API in the first place.
Expected Behavior
When using pam_duo to protect ssh, and Verified Push is used, the user should be shown the VP code.
Actual Behavior
No Verified Push code is shown.
Steps to Reproduce
Workarounds
Potentially use login_duo instead?