---
title: Two-Factor Authentication for MediaWiki with Duo Security
description: Two-factor authentication can be the difference between a major compromise and just a fleeting annoyance for a company.
image: https://email.networksgroup.com/hubfs/Blogs/two%20factor.png
---
- info@networksgroup.com
- [Contact Us](https://www.networksgroup.com/contact/)
-
-
-
- [mailto:info@networksgroup.com](mailto:info@networksgroup.com)
[  ](https://www.networksgroup.com/)
- [Home](https://www.networksgroup.com/)
- Detect & Respond
- [Managed Detection & Response](https://www.networksgroup.com/managed-detection-response/)
- [Endpoint Managed Detection & Response](https://www.networksgroup.com/managed-detection-response/endpoint-mdr/)
- Ethical Hacking
- [Full Scope Penetration Test](https://www.networksgroup.com/full-scope-penetration-test/)
- [Web Application Security Test](https://www.networksgroup.com/web-application-security-test/)
- Security Services
- [Managed Security Infrastructure](https://www.networksgroup.com/managed-security-services/)
- [Compliance Services](https://www.networksgroup.com/pci/)
- [Vulnerability Management](https://www.networksgroup.com/vulnerability-management/)
- [Security Architecture Review](https://www.networksgroup.com/security-architecture-review/)
- Resources
- [Blog](http://blog.networksgroup.com/)
- [Library](https://www.networksgroup.com/library/)
- Company
- [About](https://www.networksgroup.com/about/)
- [Contact Us](https://www.networksgroup.com/contact/)
- [Careers](https://www.networksgroup.com/careers/)
- [Partners](https://www.networksgroup.com/partners/)
[](https://www.networksgroup.com/)
- [Home](https://www.networksgroup.com/)
- Detect & Respond
- [Managed Detection & Response](https://www.networksgroup.com/managed-detection-response/)
- [Endpoint Managed Detection & Response](https://www.networksgroup.com/managed-detection-response/endpoint-mdr/)
- Ethical Hacking
- [Full Scope Penetration Test](https://www.networksgroup.com/full-scope-penetration-test/)
- [Web Application Security Test](https://www.networksgroup.com/web-application-security-test/)
- Security Services
- [Managed Security Infrastructure](https://www.networksgroup.com/managed-security-services/)
- [Compliance Services](https://www.networksgroup.com/pci/)
- [Vulnerability Management](https://www.networksgroup.com/vulnerability-management/)
- [Security Architecture Review](https://www.networksgroup.com/security-architecture-review/)
- Resources
- [Blog](http://blog.networksgroup.com/)
- [Library](https://www.networksgroup.com/library/)
- Company
- [About](https://www.networksgroup.com/about/)
- [Contact Us](https://www.networksgroup.com/contact/)
- [Careers](https://www.networksgroup.com/careers/)
- [Partners](https://www.networksgroup.com/partners/)
# NetWorks Group Blog
# Two-Factor Authentication for MediaWiki with Duo Security
Posted by [NetWorks Group](https://email.networksgroup.com/author/networks-group) on Apr 9, 2013 10:54:00 AM
Find me on:
[Facebook](https://www.facebook.com/networksgroupinc/) [LinkedIn](https://www.linkedin.com/company/networks-group) [Twitter](https://twitter.com/networksgroup)
- [Tweet](https://twitter.com/share)
Two-factor authentication can be the difference between a major compromise and just a fleeting annoyance for a company. While there have always been a few multifactor authentication options on the market, they rarely have gone to the lengths that [Duo Security](https://www.duosecurity.com/) has to provide multi-language, multi-device, and multi-application support for two-factor implementation with one service. I won't go into the details of all that they offer, but it's important to us and our clients to have a solution that can cover many avenues of technology seamlessly.
One such need that is often overlooked when evaluating infrastructure integrity are the all-too-vulnerable corporate web applications (e.g. blogs, content management systems, and wikis). While many companies spend large amounts of their time deploying quality firewall infrastructure, the public-facing web applications behind that firewall rarely get the treatment they deserve for security forethought.
While it's easy to say that a wiki may not be a real 'target' for attackers, it's important to remember that with general password reuse, it's convenient for an attacker to leverage stolen credentials against you, and could bounce from that mundane wiki into other parts of your infrastructure. The strategy of defense-in-depth should protect assets from being compromised if only a single point of a security mechanism has been beaten. If a user happens to get phished, that shouldn't allow an attacker to become an administrator on your corporate wiki or otherwise.
Recently, I deployed an internal wiki for the company using [MediaWiki](http://www.mediawiki.org/wiki/MediaWiki) and wanted to ensure that we were following best practices by implementing two-factor authentication, even though the exposure was limited by design. Luckily, Duo Security recently published their [two-factor authentication module for MediaWiki](https://github.com/duosecurity/duo_mediawiki). Having had a chance to deploy it, I felt like this may be a topic that would be of interest for the many companies deploying wikis without that added protection. Here are a few quick implementation notes:
1. Download the latest copy of the MediaWiki plugin from the Duo Security [GitHub](https://github.com/duosecurity/duo_mediawiki/zipball/master)
2. Copy the zip into the MediaWiki 'extensions' folder on your server and uncompress the file
3. Ensure that the plugin folder is called 'DuoAuth'
4. Edit your 'LocalSettings.php' file to include the following plugin directives:
1. require\_once( "$IP/extensions/DuoAuth/DuoAuth.php" );
2. $wgRedirectOnLogin = 'Special:DuoAuth';
3. $wgDuoIKey = '\[The app's integration key\]';
4. $wgDuoSKey = '\[The app's secret key\]';
5. $wgDuoHost = '\[api-host\].duosecurity.com';
5. Finally, if you are using MediaWiki in 'Private Wiki' mode, add this final directive to your 'LocalSettings.php' file:
1. $wgWhitelistRead = array("Special:DuoAuth");
These changes should make the MediaWiki installation require Duo Security following your initial login. Beyond MediaWiki, Duo Security also offers [WordPress](https://github.com/duosecurity/duo_wordpress), [Drupal](https://github.com/duosecurity/duo_drupal), and [Expression Engine](https://github.com/davidwilemski/duo_expressionengine) (forked from original Duo Security module) plugins on the blog/CMS front. If those don't fit your needs, check out the rest of the [Duo Security GitHub](https://github.com/duosecurity/) account for a collection of programming language development kits and build your own!
While two-factor authentication isn't a panacea to all security issues, it certainly mitigates the impact of a single set of user credentials getting stolen. It's important to understand that just because credentials to a web application seem unimportant, does not mean that the impact from such a compromise won't have cascading effects into the whole of your infrastructure integrity.
Topics: [Threat Management](https://email.networksgroup.com/topic/threat-management)
### Subscribe to our blog!
### Stay Informed!
### Recent Posts
### Posts by Topic
- [Information Security (50)](https://email.networksgroup.com/topic/information-security)
- [Threat Management (34)](https://email.networksgroup.com/topic/threat-management)
- [Ethical Hacking (31)](https://email.networksgroup.com/topic/ethical-hacking)
- [Managed Detection & Response (25)](https://email.networksgroup.com/topic/managed-detection-response)
- [Penetration Testing (21)](https://email.networksgroup.com/topic/penetration-testing)
- [Vulnerability Management (12)](https://email.networksgroup.com/topic/vulnerability-management)
- [Compliance (11)](https://email.networksgroup.com/topic/compliance)
- [Security Monitoring (11)](https://email.networksgroup.com/topic/security-monitoring)
- [Healthcare (9)](https://email.networksgroup.com/topic/healthcare)
- [Threat Advisory (8)](https://email.networksgroup.com/topic/threat-advisory)
- [Threat Hunting (7)](https://email.networksgroup.com/topic/threat-hunting)
- [Security Architecture Review (6)](https://email.networksgroup.com/topic/security-architecture-review)
- [HIPAA (5)](https://email.networksgroup.com/topic/hipaa)
- [Device Management (4)](https://email.networksgroup.com/topic/device-management)
- [Incident Response (4)](https://email.networksgroup.com/topic/incident-response)
- [Events (1)](https://email.networksgroup.com/topic/events)
- [PCI (1)](https://email.networksgroup.com/topic/pci)
see all
###### About Us
NetWorks Group is a Managed Detection & Response (MDR) and Ethical Hacking Service provider. We help organizations detect and respond to advanced cyber security threats through a powerful combination of our proprietary threat detection platform, expertise and security tools. Our unique approach to security not only helps you stay ahead of cyber criminals but also helps you reduce cost and increase efficiency.
###### More Links
- [Home](https://www.networksgroup.com/)
- [Blog](http://blog.networksgroup.com/)
- [About](https://www.networksgroup.com/about/)
###### Contact Us
(888) 798-1012
info@networksgroup.com
www.networksgroup.com
-
-
-
© 2017 - NetWorks Group