Should We Use LDAPS or Local Accounts for Admin Access on Non-Windows Devices?
Asked by
TechGuru42
I'm currently tidying up our Active Directory (AD) and aiming to enhance our security measures. This brought up a question about the best approach for logging in as administrators on non-Windows devices like firewalls and other appliances. I know that using AD users can make management simpler, but considering our smaller IT team, I'm wondering if it's better to have separate admin logins for these devices. Is there a significant security difference between using LDAPS and local accounts? Or is it more about management convenience?
Answers
For devices like firewalls, routers, and switches, I wouldn't suggest using LDAP directly. Instead, a RADIUS server is typically more appropriate for those.
Reply to this answer
For optimal device authentication, using certificates allows for mutual authentication and should definitely include MFA. If you want the best security, here's my ranking: SAML > RADSEC > LDAP over TLS > LDAPS > RADIUS > plain LDAP. SAML is the most secure option out there!
Reply to this answer
I recommend using LDAPS whenever possible, but also have a 'break-glass' local account just in case you need emergency access without relying on the LDAP server.
Reply to this answer
Using centralized management like LDAP has its benefits, making management easier. As for security, it's a bit of a gray area; there are various factors that can impact the security level of either approach.
Reply to this answer
Avoiding local admin accounts on devices can lead to a really risky situation—you could end up locking yourself out. It might be a pain to manage, but keeping local accounts is safer. You could even have fun with naming your admin accounts something quirky!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions