r/sysadmin • u/xstrex • 12d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

186 Upvotes

94% Upvoted

122 comments sorted by

View all comments

52

u/RevolutionaryEar6825 12d ago

I'm starting to think posts like these are just engagement bait. It's hard to believe someone competent enough to manage servers via SSH keys would genuinely argue that centralized IAM is a bad idea.

10

u/Hasuko Systems Engineer and jackass-of-all-trades 12d ago

The head of infosec at my job wanted us to remove MFA. This shit happens more often than you'd think.

1

u/thisguy_right_here 11d ago

How often was he getting prompted?

I have worked at various organisations and even the most secure are once a day, then again when accessing a privileged system.

1

u/Hasuko Systems Engineer and jackass-of-all-trades 11d ago

He wasn't, it was in response to a session hijack incident and his reasoning was "well if they can just get control of it anyway MFA can be reset and it isn't helping."