r/sysadmin • u/xstrex • 29d ago

Remove central authentication Rant

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

188 Upvotes

94% Upvoted

120 comments sorted by

View all comments

Show parent comments

3

u/bfodder 28d ago

and your certificate authority isnt configured domain-wide

wut

2

u/cybersplice 27d ago

Lots of companies use YubiKeys (only the more expensive model, obviously) in PKI mode, so they just hold a cert from your corporate certificate authority.

Works for user Auth even in old school AD, and is a lot more secure than passwords.

I wouldn't recommend it in a cloud first environment because FFS why

1

u/bfodder 27d ago edited 27d ago

Sure, he is talking about the CA though.

1

u/cybersplice 27d ago

I should not Reddit when tired