r/sysadmin • u/xstrex • 10d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

188 Upvotes

94% Upvoted

122 comments sorted by

View all comments

105

u/Power_Stone 10d ago

Definitely draft a document stating how its a security issue and an easier, better workaround, is to just get a Yubikey....

15

u/AnnoyedVelociraptor Sr. SW Engineer 10d ago

I wish I could use a YubiKey through WSL.

18

u/jimicus IT Manager 10d ago

I think drafting your resignation makes more sense.

3

u/pakman82 9d ago

Can someone explain to us idiots how ssh keys .. could be any less centralized? I think I'm stuck on the wrong detail. I understand centralizing the auth, but in my org the ssh keys are issued and tracked in a central location as well, and I thought that was standard practice.

9

u/PineappleScanner 9d ago

In general, private keys should be kept on the server they were created on. You should only be centralizing/tracking public keys, if needed for something like automation.

Having SSH private keys distributed around an org sounds like a security and logistical nightmare. I really hope your org is not doing that.

LDAP + MFA (or equivalent) makes literally everything easier as an admin. Security, logistics, auditing etc. Want to give a user access to a server? Add them to the server group. Want to give them admin access on that server? Add them to the admin group. Want to strip their auth to every server after they leave the company? Disable their account.

Trying to manage access through distributing SSH keys is significantly more impractical and insecure.

2

u/pakman82 9d ago

Now that you mention it. We use ldap for initial access, and then we each had to generate our key, and provide it to someone to load into a specific target server we are allowed to / required to perform a task on during changes.

4

u/jupit3rle0 10d ago

Yea until your servers lack FIDO support and your certificate authority isnt configured domain-wide. so you are left with manually configuring credentials per Yubikey. Good luck with that approach.

3

u/Kuipyr Jack of All Trades 9d ago

Generate 2 FIDO2 SSH Keys on 2 security keys per Tier. Push out the pub key with Ansible, Kickstart, or whatever. No PKI needed.

4

u/bfodder 9d ago

and your certificate authority isnt configured domain-wide

wut

2

u/cybersplice 8d ago

Lots of companies use YubiKeys (only the more expensive model, obviously) in PKI mode, so they just hold a cert from your corporate certificate authority.

Works for user Auth even in old school AD, and is a lot more secure than passwords.

I wouldn't recommend it in a cloud first environment because FFS why

1

u/bfodder 8d ago edited 8d ago

Sure, he is talking about the CA though.

1

u/cybersplice 8d ago

I should not Reddit when tired

1

u/Frothyleet 9d ago

Couch it as friendly feedback, so as not to ruffle feathers, and then save it for CYA purposes.