Anyone know of any good Domain Registars that allow you to have multiple accounts for people and MFA?

Forums › IT Pro and developers › Anyone know of any good Domain Registars that allow you to have multiple accounts for people and MFA?

ChevronX

280 posts

Ultimate Geek

#279769 6-Nov-2020 20:45

Hey guys

Does anyone know of any good Domain Registars that allow you to have multiple accounts for people (and RO access for some of the accounts) and MFA?

The register I am with currently, only allows one account, but due to new security requirements, sharing policies, need to grant access to third parties to review.

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

marpada

476 posts

Ultimate Geek

#2599273 6-Nov-2020 21:05

AWS, however the list of supported extension is limited https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.html

BlakJak

1275 posts

Uber Geek

Trusted

#2599647 7-Nov-2020 21:11

What security requirements are those?

I work in a highly sensitive space and i've never had a situation where i've had to give others access (though I agree these sound like smart features).

I think the honest truth is that most people wouldn't log into the registrar's interface more than a couple of times per year so there's not been a lot of focus on this sort of bizzo.

No signature to see here, move along...

ChevronX

280 posts

Ultimate Geek

#2599721 8-Nov-2020 08:28

Its more to allow third party auditors and the team want some auditing on who is logging inetc

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

nic.wise

333 posts

Ultimate Geek

Trusted

#2599741 8-Nov-2020 09:30

BlakJak: What security requirements are those? I work in a highly sensitive space and i've never had a situation where i've had to give others access (though I agree these sound like smart features). I think the honest truth is that most people wouldn't log into the registrar's interface more than a couple of times per year so there's not been a lot of focus on this sort of bizzo.

How about because 2FA and one user per account is basic security hygiene? I've worked in a few places which _needed_ a group of people to be able to manage the DNS for various domains, and would prefer to be able to audit who does what.

If you are the only person in a (large) org who can get into the DNS, I have a bus you should really (not) meet.

I was looking for the same recently and totally struck out. Even the US based ones are all single user + 2FA at best. AWS is a close, they do everything I want here, but they don't do .nz (they do .co.nz but not .nz which I need).

Nic Wise - fastchicken.co.nz

ChevronX

280 posts

Ultimate Geek

#2599797 8-Nov-2020 09:45

Yeah, Cloudflare registar doesn't support NZ domains either.

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

BlakJak

1275 posts

Uber Geek

Trusted

#2600103 8-Nov-2020 20:27

nic.wise:

BlakJak: What security requirements are those? I work in a highly sensitive space and i've never had a situation where i've had to give others access (though I agree these sound like smart features). I think the honest truth is that most people wouldn't log into the registrar's interface more than a couple of times per year so there's not been a lot of focus on this sort of bizzo.

How about because 2FA and one user per account is basic security hygiene? I've worked in a few places which _needed_ a group of people to be able to manage the DNS for various domains, and would prefer to be able to audit who does what.

If you are the only person in a (large) org who can get into the DNS, I have a bus you should really (not) meet.

I was looking for the same recently and totally struck out. Even the US based ones are all single user + 2FA at best. AWS is a close, they do everything I want here, but they don't do .nz (they do .co.nz but not .nz which I need).

There are plenty of IT systems which will have only shared credential access because, well, they do. Local admin accounts on any given machine for one. Routers with local root/enable type credentials.
The way most enterprises solve this is through the use of an enterprise password safe (to which access can be controlled at a user level) which can also provide an audit trail... and then you will need to accept the need to roll those shared creds when someone who knows them, leaves.
So the concept of Compensating Controls needs to be applied, because there are plenty of services used in an enterprise environment that are not going to be set up for multi-user access.

A registrar with good SSO integration and RBAC allowing multiple users to have access, would be neat, but it's not something that can't be worked around for audit and management purposes.

In the couple of circumstances I still have like this, things like DNS have at least two individuals who know/have access to shared credentials (no SPOF) which is not ideal for activity audit purposes but the risks aren't enough to justify substantial changes.

And I probably don't want my auditor looking directly at anything sensitive. They can shoulder-surf me when needed, or use the evidence I provide them.

Back to my point, any security or audit requirement can apply compensating controls and your approving authority can choose to accept (or not) the residual position this presents.

No signature to see here, move along...