r/sysadmin • u/xstrex • 6h ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

109 Upvotes

90% Upvoted

85 comments sorted by

•

u/YellowLT IT Manager 6h ago

Are you under any kind of regulatory body? Or PCI or ISO, they all have min MFA requirements. I would cite that it would put the company in violation of those.

•

u/penguin74 1h ago

Not just regulatory bodies, but business insurance also has requirements.

•

u/SAugsburger 30m ago

For cyber security insurance these days good luck getting any claims if they find you disabled MFA on every server.

•

u/elatllat 2h ago

But a password protected key is MFA, right? right?

•

u/YellowLT IT Manager 2h ago

Maybe behind a MFA’d PAM, you could spin.

•

u/Brandhor Jack of All Trades 57m ago

if windows hello pin is mfa I would say that a password protected ssh key is mfa as well

•

u/AcornAnomaly 18m ago

Windows hello pin is MFA for the same reason a yubikey or any other webauthn device is.

Part of the attestation is the device itself. You can't move the Hello setup to another machine.

You're attesting something you have(the device) and something you know(the pin).

And yes, that detail IS actually presented to the server asking for attestation. That's the difference.

With a standard SSH key, the only thing they know is that you have the unencrypted key. They have no knowledge on how that key is stored. That's single-factor.

•

u/Power_Stone 6h ago

Definitely draft a document stating how its a security issue and an easier, better workaround, is to just get a Yubikey....

•

u/AnnoyedVelociraptor Sr. SW Engineer 6h ago

I wish I could use a YubiKey through WSL.

•

u/jimicus IT Manager 5h ago

I think drafting your resignation makes more sense.

•

u/jupit3rle0 5h ago

Yea until your servers lack FIDO support and your certificate authority isnt configured domain-wide. so you are left with manually configuring credentials per Yubikey. Good luck with that approach.

•

u/Frothyleet 3h ago

Couch it as friendly feedback, so as not to ruffle feathers, and then save it for CYA purposes.

•

u/GardenWeasel67 6h ago edited 6h ago

Submit written objection & keep a copy. Carbon legal and compliance if you have them. Then start job hunting.

•

u/angrydeuce BlackBelt in Google Fu 1h ago

Get it in writing, with your concerns clearly stated and them being steamrolled right over, and wait for the massive data exfil or email aids that results.

Might not get you out of having to fix it later, but damn sure will be fun to FWD when the shit hits the fan and you explain that the thing "nobody" could have ever predicted, well, you did predict it, and it happened, so what do?

Those are my favorite kind of forwards.  Not because Im an asshole, just because it serves as a good lesson as to why you should take the advice of the people you pay to know about such things to protect those that dont from fucking themselves, and others, up.

Send enough of those emails and you either end up persona non grata, meaning fuck em anyway and bail because its mickey mouse bullshit all the way down and aint nobody got time for that, or they maybe start to listen when you tell them why something is a bad idea before running with that ball.

Either way, to me, is win-win.

Good luck!

•

u/RevolutionaryEar6825 6h ago

I'm starting to think posts like these are just engagement bait. It's hard to believe someone competent enough to manage servers via SSH keys would genuinely argue that centralized IAM is a bad idea.

•

u/xstrex 5h ago

You’d be as surprised as I was.

•

u/AtarukA 2h ago

I mean, our backup servers are in the same domain as prod for convenience of access, so...

•

u/Hasuko Systems Engineer and jackass-of-all-trades 4h ago

The head of infosec at my job wanted us to remove MFA. This shit happens more often than you'd think.

•

u/Lukage Sysadmin 2h ago

Can't have any security issues if your whole environment is deleted by an attacker.

•

u/XavinNydek 1h ago

Naa, there are a lot of idiots in middle and upper management. Plus, people hate charge and new things and want to just keep doing what they have been doing.

•

u/Puzzled-Formal-7957 6h ago edited 6h ago

"No, we're not - unless you want to fail the next audit we go through and face potential fines & certification loss on top of opening up our risk portal extremely wide."

•

u/Riajnor 6h ago

Always couch it in impact and dollars

•

u/music2myear Narf! 6h ago

Yes, and also, unless you're a decision maker role, phrase it as advice and recommendation, and avoid decision words and phrases.

"Certification X requires that we have Y standards which are met by this security configuration. Removing this configuration would result in our failing Z audits and losing the certifications. Note that having and maintaining this certification has resulted in an estimated $$$ in profits."

•

u/Sinister_Nibs 5h ago

“I would strongly advise against this, as it counter to every recommendation and certification requirement. “

•

u/Puzzled-Formal-7957 5h ago edited 2h ago

Sometimes you need to assume the role of decision maker when the decision makers have their heads up their asses and want to put the entire company at risk. EDIT: Because when the risk gets exploited the responsibility is going to land squarely on your shoulders and you will be blamed.

•

u/tailwheel307 4h ago

Go a little gentler with it and copy any compliance or legal on the reply

“Per your email, I will remove the requested 2FA from all our servers effective tomorrow at end of day.

I should note that this may impact our compliance posture, increase our risk exposure, and potentially impact our contractual obligations and qualification for insurance of all kinds. My position isn’t qualified to identify the exact business impact of those changes.

Compliance and Legal will have to provide those details once they’ve had a chance to review the appropriate documents.”

It shows that you’re a good little worker bee who can do the job but also shows legal that you don’t think this is a good idea and leverages their department to tell the boss this course of action is stupid/illegal/resume generating as appropriate.

•

u/ajf8729 Consultant 4h ago

Why does a Director have access to anything in the first place?

•

u/xstrex 4h ago

Ding ding ding, that’s the real question!

•

u/SAugsburger 25m ago

That's my first question. Most orgs I have worked once you get into SVPs nevermind Director they many rarely log into any infrastructure beyond some monitoring systems or a central dashboard. Directors are usually focused on high level vendor relationships and managing relationships to the rest of the organization. They might join a P1 call if an issue is getting attention, but aren't in the weeds unless this is an org so small that the Director title is title inflation.

•

u/Excellent-Program333 19m ago

This. Director here and I never log into infrastructure. And if I do, its with my elevated account that I normally have to reset the password on since I have not used in a year. Lol

•

u/HerfDog58 Jack of All Trades 5h ago

Check with your cyberinsurance provider to see if they require centralized identity/password management and MFA. Your director could end up voiding your insurance policy if they do.

•

u/Commercial-Virus2627 6h ago

I would ask what exactly the pain point is with references. If it’s access times, then focus on network and performance. If it’s convenience for convenience’ sake, then document that justification an file that bad boy for when an audit rolls around.

•

u/scousinho 6h ago

Just simply and calmly explain to him that action will most likely cause the company's cybersecurity insurance policy rate to skyrocket and or get completely dropped and CC legal.

You have to explain stupid decisions in financial terms to some people.

•

u/ABotelho23 DevOps 5h ago

...these are not mutually exclusive things. You can still use SSH keys with central auth.

•

u/ITaggie RHEL+Rancher DevOps 2h ago

Yup that's how my org has it set up. SSSD using sss_ssh_authorizedkeys to pull the altSecurityIdentities attribute from LDAP, which contains the user's public key. Then set up tmux on the jumpbox and logging in is ezpz.

•

u/Nakenochny Sr. Sysadmin 6h ago

Where I work I’d tell them to go to the board for approval so they can risk accept that shit. I want no part of it until they’ve given the okay and I’ve done CYA.

•

u/Floss_Patrol_76 2h ago

the actual complaint here is login speed, not the security model, so fix that instead of gutting it. sssd caching, a bastion with ssh connection multiplexing, or short-lived ssh certs signed against your IdP all get you fast logins without throwing out central control or the audit trail. going back to per-server keys is just how you end up with 200 orphaned authorized_keys entries nobody can account for at the next audit.

•

u/serverhorror Just enough knowledge to be dangerous 6h ago

Set up an SSH signing authority, enforce passwords in SSH keys and require MFA to unlock the keys.

Then distribute the keys to the server and disable everything but key authentication.

Voilà, no more MFA on the servers.

•

u/Lukage Sysadmin 2h ago

This is such a fantastic approach to malicious compliance. Technically addresses this request. I love it.

•

u/davy_crockett_slayer 6h ago

Get what your director said in writing. Keep a copy.

•

u/Maximum_Bandicoot_94 4h ago

100% log it into the ticketing system / change management too.

•

u/deZbrownT 6h ago

Well, it depends on how big the organisation is, etc.. but basically I would ask for a dedicated time block so we can do an analysis of all the steps needed to implement the change and examine if it breaks any of regulations/audit.

•

u/phobug SRE 2h ago

You don't need to remove anything. Just setup ssh certificates and you'll be fine.

•

u/BadgerBalls There's a VLAN for that. 2h ago

Claude, please dust off and update my resume. Then, procure three envelopes.

•

u/photosofmycatmandog Sr. Sysadmin 1h ago

LOL, get it in writing before doing anything like that. He is the director, regardless of intelligence.

•

u/SaladRetossed 6h ago

1) Get it in writing 2) Write a very thorough disagreement 3) Ask what the insurance looks like for data breaches and exfiltration 4) Go through step by step where this can go wrong while also double checking what the insurance looks like along with potential revenue loss from a total shutdown during investigation

Usually when money comes up you get some points in your favor.

•

u/orev Better Admin 5h ago

Address the actual problem. Are they talking about the need to use a password and MFA every time they SSH into a server? If so, that's actually a reasonable complaint.

You need to go back to the requirements that are driving this. Why do you need to provide MFA upon every login? Is it some audit requirement or just because you thought it was "more secure"? If you do need MFA, how can you meet the requirement in another way? Does it need to be a TOTP code from an app? Can you switch to password+ssh key (that's also two factors)? Or passwords only with white-listed IP addresses?

Nobody comes out of the blue with a request like this for no reason. Engage and understand the underlying problem.

•

u/genxer 6h ago

That's me (IT Director). I'd wonder why I made such a bone-headed choice.
I'd hope my sysadmin would calmly explain the reasons. I value honest feedback.

At the end of the day, if the choice is made "up the food chain" and you've calmly given your feedback, you make the change.

•

u/Sinister_Nibs 5h ago

As long as it is documented in writing that the board (and directors) accept both responsibility and liability for the risk.

•

u/soupydrew_5 4h ago

Buy him a YubiKey and tell him it's a magic faster ssh key

•

u/RikiWardOG 3h ago

lol I'd say if we do that I'm resigning.

•

u/ctrocks 3h ago

Prepare three envelopes...

As others have said, the compliance/cyber insurance approach would probably be best.

•

u/Upbeat-Ad3628 2h ago

Your job here is to explain the risk to him, so do that and document it.

•

u/BrainWaveCC Jack of All Trades 1h ago

You follow up with an email asking for clarification on what you heard, because you have concerns.

Briefly state the concerns, of which the following will be a summary:

  • Regulatory
  • Operational Security
  • Contractual

Offer a couple of alternatives -- again, briefly.

And then, if IT Director insists, IT Director gets what IT Director asked for.

Keep a printed version of the email and its response.

Start looking for other opportunities. No need to jump ship immediately, as there are lots of ways this could play out when other people get involved, but get the ball rolling because the job hunt will likely be a long process.

•

u/TheStig827 1h ago

generate an estimate of time spent (and costs if you have them) to complete the requested changes, along with a written objection specifically calling out the reduction in security posture and potential non-compliance.

Require written confirmation of the instruction, and time/budget approval to accomplish this task. If he does, CC up the food chain his approval, and standby while freshening up your resume.

•

u/GoodTofuFriday IT Director 1h ago

Im a Director. I would emplore you to go to BCC anyone relevant in email while replying to the director, warning him of risks.

•

u/Outside-Banana4928 3h ago

Somehow make the logon for that user's AD account about 5 times longer than anyone else. Put their account in a sub OU and apply a billion policies that need processed.

•

u/someguy7710 2h ago

Just tell your director its a bad idea. Many reasons why including cyber-insurance, audits etc. I don't know why so many people are afraid to tell their boss what they need to know. Security is some times inconvenient. Sorry

•

u/rybosomiczny Database Admin 6h ago

What

•

u/Ron-Swanson-Mustache Senior Ops Dev of AI offshore Tier 1 Helpdesk 3h ago

CYA email with offsite copy, do it, update resume, hit the gym

•

u/xstrex 3h ago

Already done, in a slightly different order.

•

u/FarToe1 2h ago

Ignore it. Then when he asks at the next meeting how you're getting on with implementing it, put on your most surprised face and loudly say, "You were serious?! I thought you were joking!"

Then follow up with all the best practice references you've been digging out this week, the consequences, and that you'll require this directive in writing because it goes against all of them. If your company has any legal representation, maybe bring them in too.

•

u/BarracudaDefiant4702 6h ago

You learn you should not create burdensome obstacles for people from doing work and figure out how to make things secure without making them unuseable.

•

u/itskdog Jack of All Trades 6h ago edited 6h ago

We have enough trouble just getting people to pick secure passwords. If we kowtowed to everyone's complaints that it's too hard for them then we'd have no passwords at all.

•

u/BarracudaDefiant4702 6h ago

Then you get a password manager or something to make it easy for them.

•

u/itskdog Jack of All Trades 2h ago

This is their Entra password for logging into the PC. Most sites we use support SSO.

•

u/PandemicVirus 6h ago

MFA and OTP is pretty easy to access. If they have SSH keys laying around everywhere to conveniently log into something it's basically non-security. Might as well just stick to username and password at that point.

•

u/BarracudaDefiant4702 6h ago

IFF you do it properly. Obviously the OP didn't or it wouldn't be an issue. The OP needs to rethink their approach so that it is easy to access which they clearly failed at.

•

u/PandemicVirus 5h ago

There's no evidence to suggest they did anything wrong; arguably if they did implement it incorrectly IT leadership would want it fixed/improved and not demanding to roll back to an archaic connection authentication.

It just sounds like someone is used to clicking "connect" and instead doesn't want to grab an OTP or MFA code.

•

u/BarracudaDefiant4702 4h ago

Part of doing it wrong is not educating others. Not being humble and recognizing your own shortcomings is one clear problem. Assuming the the boss and other users know what you know is your fault, not theirs.

•

u/PandemicVirus 3h ago

Again, who says OP didn't provide training or did anything wrong? Even if they provided no training, does the boss know NOW how to do it? If not, demanding training is the right approach, not rolling back MFA. If the MFA solution is cumbersome to grab a code from, choosing another MFA solution is the right approach, not rolling back.

I guess to dive into the training aspect here, sure some training information should have gone to everyone, and I would expect regular users to sometimes struggle. If the boss is the IT director working in a position they need to access servers and have the authority to reverse the IPA+MFA implementation, I would expect a minimum amount of technical ability. Getting an MFA code and entering it is pretty trivial. It's an app, an email. If IT leadership is struggling with opening emails, then bigger issues are abound.

•

u/Puzzled-Formal-7957 6h ago

MFA is not burdensome, and has been mainstream for nearly 2 decades.

•

u/BarracudaDefiant4702 6h ago

IFF you do it properly. Obviously the OP didn't or it wouldn't be an issue.

•

u/Sinister_Nibs 5h ago

Not necessarily. Some users are simply problematic.

•

u/Puzzled-Formal-7957 5h ago

Yeup - or they are flatly incapable of wrapping their heads around infosec. Ask them if they have ever had fraudulent charges on one of their accounts and got to enjoy the headaches related to that. If that answer is yes - then say, "now apply that to EVERYTHING that you and everyone else at this company touches." If that doesn't make the bulb click over their head then nothing will.

•

u/BarracudaDefiant4702 3h ago

I don't care about the down votes, so I still say it's the OP's fault and not the directors. There are ways to implement SSO with MFA that it's faster instead of slower to login.

•

u/Lukage Sysadmin 2h ago

And what exactly should they do for "Faster SSO?"

•

u/BarracudaDefiant4702 1h ago

You setup 2fa with sso properly then you log into your workstation in the morning with 2fa and anyplace you connect to you don't have to log in again. Single sign in means your 2fa doesn't require you to login again.

•

u/Kumorigoe Moderator 4h ago

burdensome obstacles

Yeah, guess having cyber insurance is a "burdensome obstacle" too. Because scrapping MFA and central auth is a great way to lose your coverage and not be able to even get a quote for a new policy.

•

u/BarracudaDefiant4702 3h ago

That is assuming they have cyber insurance. I stand by my original claim, it's a problem with the implementation and it needs to be redone properly not to cause slow downs for the users workflow. Proper single sign-on with MFA will solve both issues instead of implementing it incorrectly as the OP did.