sshd_config directive for multiple AuthorizedKeysCommand

[Ethan Heilman]

Hi Damien,

Good to know, thank you. I've been thinking about putting together a
utility to handle multiple AuthorizedKeyCommands outside of sshd, I'll do
that instead.

Thanks,
Ethan

On Wed, Jul 22, 2026 at 8:09 PM Damien Miller <djm at mindrot.org> wrote:

> On Wed, 22 Jul 2026, Ethan Heilman wrote:
>
> > Howdy,
> >
> > Is there is interest in a patch to OpenSSH to allow more than one
> > AuthorizedKeysCommand.
> >
> > sshd_config only allows a single AuthorizedKeysCommand to be configured.
> > This is a problem when an admin needs to use multiple SSH authentication
> > systems side-by-side that each rely on AuthorizedKeysCommand, e.g. AWS
> > Instance Connect uses AuthorizedKeysCommand. If an admin wants to
> install a
> > second tool that also uses AuthorizedKeysCommand (such as OPKSSH [0]),
> the
> > installation either breaks Instance Connect or requires building a
> fragile
> > shim script that is likely to be clobbered by the next AWS update.
> > Contention over the single AuthorizedKeysCommand has caused problems in
> the
> > past[1].
> >
> > Consider a new sshd_config directive, `AuthorizedKeysCommandPath
> > /path/to/auth_cmd_configs`. To add a new AuthorizedKeysCommand create a
> > file with appropriate permissions in the identified directory:
> > `AuthorizedKeysCommandAdd
> > <runAsUser> /path/to/the/cmd %u %k %t`.
> > - This directory structure is useful for install scripts that need an
> > AuthorizedKeysCommand
> > as they can just drop a file in the directory without the risk of
> > accidentally mucking up the sshd_config file. - To maintain backwards
> > compatibility with the current AuthorizedKeysCommand, we use a new
> > directive AuthorizedKeysCommandAdd.
> >
> > - To avoid confusion about which user goes to with which command,
> > AuthorizedKeysCommandAdd includes the “run as user” in the same
> directive.
> >
> >
> > Would the OpenSSH project be open to reviewing a patch if I put one
> > together? Is there interest?
>
> No interest sorry - I think the best way to run multiple commands is
> to wrap them all in a single shell script and run that from
> Authorized*Command. I'd rather not make sshd_config (even) more complex
> because some downstream packages invoke sshd in stupid ways.
>
> -d