I have worked in places where it is a common practice to be able to move between all servers, with SSH, as administrator without passwords. There are usually a couple of servers, which by their nature are considered more secure (not exposed on the web, etc) from where you can login to others without password. The opposite has also happened - you need passwords/other access control mechanisms for everything.
I have very strong objections against the first formula from a security perspective. Although this group of servers can be considered more secure, this is obviously debatable. But I have several coleagues that advocate this, and I have to admit it's very handy. In any case if an attacker can get root privileges in one machine it basically "owns" the full system.
Am I being too strict regarding security?