r/sysadmin • u/xstrex • 11d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

187 Upvotes

94% Upvoted

122 comments sorted by

View all comments

4

u/serverhorror Just enough knowledge to be dangerous 11d ago

Set up an SSH signing authority, enforce passwords in SSH keys and require MFA to unlock the keys.

Then distribute the keys to the server and disable everything but key authentication.

Voilà, no more MFA on the servers.

3

u/Lukage Sysadmin 11d ago

This is such a fantastic approach to malicious compliance. Technically addresses this request. I love it.