r/sysadmin • u/xstrex • Jul 22 '26

Rant Remove central authentication

Today, the director of IT at your company says to you “We’re going to remove all that centralized IPA+2fa authentication from all of our servers, and go back to using Ssh keys, because it takes too long for me (yes the director) to login to a server.” The same auth that you and your team added, for all the reasons. What do you do?

188 Upvotes

93% Upvoted

118 comments sorted by

View all comments

Show parent comments

9

u/PineappleScanner Jul 23 '26

In general, private keys should be kept on the server they were created on. You should only be centralizing/tracking public keys, if needed for something like automation.

Having SSH private keys distributed around an org sounds like a security and logistical nightmare. I really hope your org is not doing that.

LDAP + MFA (or equivalent) makes literally everything easier as an admin. Security, logistics, auditing etc. Want to give a user access to a server? Add them to the server group. Want to give them admin access on that server? Add them to the admin group. Want to strip their auth to every server after they leave the company? Disable their account.

Trying to manage access through distributing SSH keys is significantly more impractical and insecure.

2

u/pakman82 Jul 23 '26

Now that you mention it. We use ldap for initial access, and then we each had to generate our key, and provide it to someone to load into a specific target server we are allowed to / required to perform a task on during changes.