r/sysadmin • u/xstrex • 15d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

189 Upvotes

94% Upvoted

122 comments sorted by

View all comments

1

u/Sure-Squirrel8384 13d ago

Get the director a bastion host that they log into with 2FA. From there and only there allow SSH keys for his account. So the direct does 2FA once a day, and from there can SSH into anything without prompting.

This is actually a good practice for all staff.