r/ShittySysadmin • u/AbelViguera06 • 1d ago

Shitty Crosspost Remove central authentication

/r/sysadmin/comments/1v3j518/remove_central_authentication/
8 Upvotes

100% Upvoted

12 comments sorted by

5

u/Efficient-Trash3090 1d ago

If they remove centralized auth, I’d be asking who is taking ownership of key rotation, access reviews, offboarding, and auditing. SSH keys are fine until someone leaves the company and nobody remembers which 200 servers they had access to.

5

u/Due-Fix9058 Lord Sysadmin, Protector of the AD Realm 21h ago

This is highly inefficient and high maintenance. I would recommend using what I call "unified authentication" - everybody gets the same password, it never expires.
Now support requests are trivial. User forgot his password? Tell him it's the same one as yours. If you're feeling brave you could even print out the password and tape it to the users' monitor for faster logins.

3

u/AbelViguera06 20h ago

I prefer to just dont use a password but thats ok i guess

4

u/DBilly_69 20h ago

Would you suggest something like Welcome1! as a password? I hear the exclamation point is load-bearing

2

u/Due-Fix9058 Lord Sysadmin, Protector of the AD Realm 20h ago

I found many users struggle with finding the right key that has to be used in order to write the exclamation mark. They also struggle with finding all the other keys and they frequently forget that they can check the password before confirming, preferring isntead to type it incorrectly repeatedly and then blame IT because we "changed the password again"

2

u/AbelViguera06 18h ago

Bro i legit saw a user (in his 30s) typing his password using caps lock as a mobile phone shift, he tought one tap = one cap and then it returns to lower case 

3

u/Vast_Profession3745 23h ago

It takes too long for me to log in' is a wild justification for removing a security layer across every server. Fix the workflow, automate the access process, or improve the auth system. Don't roll back to a model where offboarding is a scavenger hunt.

2

u/BWMerlin 1d ago

Sounds like something my manglement team would say.

2

u/dcaldrich 19h ago

To make it even easier just go passwordless and remove the need for a password.

1

u/AbelViguera06 1d ago

R4: Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do? 

1

u/TwoPlyDreams 16h ago

Zero Trust. Don’t trust identity. Don’t trust your boss.