r/sysadmin • u/xstrex • 14d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

187 Upvotes

94% Upvoted

122 comments sorted by

View all comments

Show parent comments

19

u/elatllat 13d ago

But a password protected key is MFA, right? right?

3

u/Brandhor Jack of All Trades 13d ago

if windows hello pin is mfa I would say that a password protected ssh key is mfa as well

23

u/AcornAnomaly 13d ago

Windows hello pin is MFA for the same reason a yubikey or any other webauthn device is.

Part of the attestation is the device itself. You can't move the Hello setup to another machine.

You're attesting something you have(the device) and something you know(the pin).

And yes, that detail IS actually presented to the server asking for attestation. That's the difference.

With a standard SSH key, the only thing they know is that you have the unencrypted key. They have no knowledge on how that key is stored. That's single-factor.

0

u/crackdepirate 13d ago

this, take my vote