sshd_config directive for multiple AuthorizedKeysCommand

[Ethan Heilman]

Howdy,

Is there is interest in a patch to OpenSSH to allow more than one
AuthorizedKeysCommand.

sshd_config only allows a single AuthorizedKeysCommand to be configured.
This is a problem when an admin needs to use multiple SSH authentication
systems side-by-side that each rely on AuthorizedKeysCommand, e.g. AWS
Instance Connect uses AuthorizedKeysCommand. If an admin wants to install a
second tool that also uses AuthorizedKeysCommand (such as OPKSSH [0]), the
installation either breaks Instance Connect or requires building a fragile
shim script that is likely to be clobbered by the next AWS update.
Contention over the single AuthorizedKeysCommand has caused problems in the
past[1].

Consider a new sshd_config directive, `AuthorizedKeysCommandPath
/path/to/auth_cmd_configs`. To add a new AuthorizedKeysCommand create a
file with appropriate permissions in the identified directory:
`AuthorizedKeysCommandAdd
<runAsUser> /path/to/the/cmd %u %k %t`.
- This directory structure is useful for install scripts that need an
AuthorizedKeysCommand
as they can just drop a file in the directory without the risk of
accidentally mucking up the sshd_config file. - To maintain backwards
compatibility with the current AuthorizedKeysCommand, we use a new
directive AuthorizedKeysCommandAdd.

- To avoid confusion about which user goes to with which command,
AuthorizedKeysCommandAdd includes the “run as user” in the same directive.


Would the OpenSSH project be open to reviewing a patch if I put one
together? Is there interest?

Thanks,

Ethan Heilman

[0] OPKSSH - https://github.com/openpubkey/opkssh/

[1] AuthorizedKeysCommand fails on Ubuntu 20.04

https://github.com/widdix/aws-ec2-ssh/issues/157#issuecomment-874750889