Q: How protect a server with Duo?

Answer

The most straightforward way to do this would be to switch the system from using MIT web certificates directly to using MIT Touchstone, and leveraging the Duo integration we've done there. Setting up a system to use Touchstone is well-documented and straightforward for common web server platforms (Apache, IIS); it's doable if you're using nginx but is more complex. Instructions are available here:

https://wikis.mit.edu/confluence/display/TOUCHSTONE/Provisioning+Steps

If using Touchstone isn't an option, it is possible to integrate Duo directly with your application, with documentation from the vendor available here:

https://www.duosecurity.com/docs/duoweb

Making use of Touchstone is the preferable solution.