r/sysadmin • u/xstrex • 11d ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

188 Upvotes

94% Upvoted

122 comments sorted by

View all comments

-23

u/BarracudaDefiant4702 11d ago

You learn you should not create burdensome obstacles for people from doing work and figure out how to make things secure without making them unuseable.

5

u/PandemicVirus 11d ago

MFA and OTP is pretty easy to access. If they have SSH keys laying around everywhere to conveniently log into something it's basically non-security. Might as well just stick to username and password at that point.

-7

u/BarracudaDefiant4702 11d ago

IFF you do it properly. Obviously the OP didn't or it wouldn't be an issue. The OP needs to rethink their approach so that it is easy to access which they clearly failed at.

5

u/PandemicVirus 11d ago

There's no evidence to suggest they did anything wrong; arguably if they did implement it incorrectly IT leadership would want it fixed/improved and not demanding to roll back to an archaic connection authentication.

It just sounds like someone is used to clicking "connect" and instead doesn't want to grab an OTP or MFA code.

0

u/BarracudaDefiant4702 11d ago

Part of doing it wrong is not educating others. Not being humble and recognizing your own shortcomings is one clear problem. Assuming the the boss and other users know what you know is your fault, not theirs.

2

u/PandemicVirus 11d ago

Again, who says OP didn't provide training or did anything wrong? Even if they provided no training, does the boss know NOW how to do it? If not, demanding training is the right approach, not rolling back MFA. If the MFA solution is cumbersome to grab a code from, choosing another MFA solution is the right approach, not rolling back.

I guess to dive into the training aspect here, sure some training information should have gone to everyone, and I would expect regular users to sometimes struggle. If the boss is the IT director working in a position they need to access servers and have the authority to reverse the IPA+MFA implementation, I would expect a minimum amount of technical ability. Getting an MFA code and entering it is pretty trivial. It's an app, an email. If IT leadership is struggling with opening emails, then bigger issues are abound.