RFC: PROTOCOL.authrec, a structured authentication record from sshd

[Damien Miller]

On Tue, 14 Jul 2026, Avinash Duduskar wrote:

> Hi,
> 
> By the end of userauth, sshd holds a set of structured facts:
> session identity, transport parameters, the authentication method
> sequence, the keys and certificates that authenticated.
> ExposeAuthInfo=yes (shipped in 7.6) exports a line-based text file
> carrying a fraction of them. Consumers that need the rest (audit
> pipelines, session policy hooks, identity-provider liveness checks)
> reconstruct it from log scraping or by parsing key blobs out of the
> text file.

[...]

FWIW I think this is a worthwhile idea that could make existing
things like AuthorizedKeys/PrincipalsCommand more useful in
settings that require multiple authentication.

I would like to hear what other people think though.

-d