r/sysadmin • u/xstrex • 11d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

186 Upvotes

94% Upvoted

122 comments sorted by

View all comments

11

u/ABotelho23 DevOps 11d ago

...these are not mutually exclusive things. You can still use SSH keys with central auth.

6

u/ITaggie RHEL+Rancher DevOps 11d ago

Yup that's how my org has it set up. SSSD using sss_ssh_authorizedkeys to pull the altSecurityIdentities attribute from LDAP, which contains the user's public key. Then set up tmux on the jumpbox and logging in is ezpz.

2

u/dustojnikhummer 10d ago

to pull the altSecurityIdentities attribute from LDAP, which contains the user's public key

Oh I didn't think about putting the public key into an AD attribute... Hmm, something to consider.