3 ms·
In my case, I'm using a different, easy password, for test servers that contain no important production data or are in a especially privileged network position.
by filleokus 6y ago
In my case, I'm using a different, easy password, for test servers that contain no important production data or are in a especially privileged network position. If they were connected to AD, I would be forced to present my "real" password.
On production servers on the other hand, the amount of people with root is probably much smaller, and there might be bigger wins by being able to centrally enforce password policies or whatever the sysadmins want to do.
- lmilcin 6y agoThat was exactly the point. I had separate password on each box (which I did not have to use normally because I use it only to setup ssh key).
- tw04 6y agoSo create a second AD account for the test environment like most shops do?
- ghjkldsf 6y agoBut then you don't get the joy of throwing the baby out with the bath water. 90% of the time someone insists AD is too insecure for them, it's because they're unwilling to maintain hygiene (logging into an untrusted machines with overscoped credentials 8 times a day), or unwilling to use the provided security features (what do you mean use kerberized services? ldap binds work just find and give me an anti-ad security straw man!)