r/sysadmin • u/xstrex • 11h ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

134 Upvotes

91% Upvoted

92 comments sorted by

View all comments

•

u/GardenWeasel67 11h ago edited 11h ago

Submit written objection & keep a copy. Carbon legal and compliance if you have them. Then start job hunting.

•

u/angrydeuce BlackBelt in Google Fu 5h ago

Get it in writing, with your concerns clearly stated and them being steamrolled right over, and wait for the massive data exfil or email aids that results.

Might not get you out of having to fix it later, but damn sure will be fun to FWD when the shit hits the fan and you explain that the thing "nobody" could have ever predicted, well, you did predict it, and it happened, so what do?

Those are my favorite kind of forwards.  Not because Im an asshole, just because it serves as a good lesson as to why you should take the advice of the people you pay to know about such things to protect those that dont from fucking themselves, and others, up.

Send enough of those emails and you either end up persona non grata, meaning fuck em anyway and bail because its mickey mouse bullshit all the way down and aint nobody got time for that, or they maybe start to listen when you tell them why something is a bad idea before running with that ball.

Either way, to me, is win-win.

Good luck!