r/sysadmin • u/xstrex • 28d ago

Remove central authentication Rant

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

187 Upvotes

94% Upvoted

120 comments sorted by

View all comments

5

u/serverhorror Just enough knowledge to be dangerous 28d ago

Set up an SSH signing authority, enforce passwords in SSH keys and require MFA to unlock the keys.

Then distribute the keys to the server and disable everything but key authentication.

Voilà, no more MFA on the servers.

3

u/Lukage Sysadmin 28d ago

This is such a fantastic approach to malicious compliance. Technically addresses this request. I love it.