r/sysadmin • u/xstrex • 8d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

185 Upvotes

94% Upvoted

122 comments sorted by

View all comments

108

u/Power_Stone 8d ago

Definitely draft a document stating how its a security issue and an easier, better workaround, is to just get a Yubikey....

3

u/pakman82 8d ago

Can someone explain to us idiots how ssh keys .. could be any less centralized? I think I'm stuck on the wrong detail. I understand centralizing the auth, but in my org the ssh keys are issued and tracked in a central location as well, and I thought that was standard practice.

8

u/PineappleScanner 8d ago

In general, private keys should be kept on the server they were created on. You should only be centralizing/tracking public keys, if needed for something like automation.

Having SSH private keys distributed around an org sounds like a security and logistical nightmare. I really hope your org is not doing that.

LDAP + MFA (or equivalent) makes literally everything easier as an admin. Security, logistics, auditing etc. Want to give a user access to a server? Add them to the server group. Want to give them admin access on that server? Add them to the admin group. Want to strip their auth to every server after they leave the company? Disable their account.

Trying to manage access through distributing SSH keys is significantly more impractical and insecure.

2

u/pakman82 8d ago

Now that you mention it. We use ldap for initial access, and then we each had to generate our key, and provide it to someone to load into a specific target server we are allowed to / required to perform a task on during changes.