sshd_config directive for multiple AuthorizedKeysCommand

[Damien Miller]

On Wed, 22 Jul 2026, Ethan Heilman wrote:

> Howdy,
> 
> Is there is interest in a patch to OpenSSH to allow more than one
> AuthorizedKeysCommand.
> 
> sshd_config only allows a single AuthorizedKeysCommand to be configured.
> This is a problem when an admin needs to use multiple SSH authentication
> systems side-by-side that each rely on AuthorizedKeysCommand, e.g. AWS
> Instance Connect uses AuthorizedKeysCommand. If an admin wants to install a
> second tool that also uses AuthorizedKeysCommand (such as OPKSSH [0]), the
> installation either breaks Instance Connect or requires building a fragile
> shim script that is likely to be clobbered by the next AWS update.
> Contention over the single AuthorizedKeysCommand has caused problems in the
> past[1].
> 
> Consider a new sshd_config directive, `AuthorizedKeysCommandPath
> /path/to/auth_cmd_configs`. To add a new AuthorizedKeysCommand create a
> file with appropriate permissions in the identified directory:
> `AuthorizedKeysCommandAdd
> <runAsUser> /path/to/the/cmd %u %k %t`.
> - This directory structure is useful for install scripts that need an
> AuthorizedKeysCommand
> as they can just drop a file in the directory without the risk of
> accidentally mucking up the sshd_config file. - To maintain backwards
> compatibility with the current AuthorizedKeysCommand, we use a new
> directive AuthorizedKeysCommandAdd.
> 
> - To avoid confusion about which user goes to with which command,
> AuthorizedKeysCommandAdd includes the “run as user” in the same directive.
> 
> 
> Would the OpenSSH project be open to reviewing a patch if I put one
> together? Is there interest?

No interest sorry - I think the best way to run multiple commands is
to wrap them all in a single shell script and run that from
Authorized*Command. I'd rather not make sshd_config (even) more complex
because some downstream packages invoke sshd in stupid ways.

-d