4 ms·
If LDAP is down in an LDAP environment, you cannot authenticate anyway. Our systems people get local accounts on machines for disasters like LDAP-down. Everyon
by _jal 6y ago
If LDAP is down in an LDAP environment, you cannot authenticate anyway.
Our systems people get local accounts on machines for disasters like LDAP-down. Everyone else is LDAP-only, including ssh keys.
This is nowhere close to "where we started". Now we have a handful of privileged accounts and centralized auth management across thousands of other accounts.
Centralized logging and centralized auth are pretty much mandatory above some size. Without them, you literally do not know who is doing what.
- antoinealb 6y agoA way to work around this is to normally work with short term certificate (24h) and allow your systems people to generate longer term certificates (one month) that are stored encrypted on their laptop or usb key. That way you get both emergency access in case LDAP is broken, as well as a way to make sure old personal access gets revoked after one month.
- _jal 6y agoYep. I'm a big fan of Hashicorp Vault; that's the next step. There are of course also DR considerations for that, as always, it is turtles all the way down.