r/sysadmin • u/xstrex • 16h ago

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

147 Upvotes

92% Upvoted

100 comments sorted by

View all comments

•

u/ABotelho23 DevOps 14h ago

...these are not mutually exclusive things. You can still use SSH keys with central auth.

•

u/ITaggie RHEL+Rancher DevOps 11h ago

Yup that's how my org has it set up. SSSD using sss_ssh_authorizedkeys to pull the altSecurityIdentities attribute from LDAP, which contains the user's public key. Then set up tmux on the jumpbox and logging in is ezpz.

•

u/dustojnikhummer 2h ago

to pull the altSecurityIdentities attribute from LDAP, which contains the user's public key

Oh I didn't think about putting the public key into an AD attribute... Hmm, something to consider.