RFC: PROTOCOL.authrec, a structured authentication record from sshd

[Ethan Heilman]

This is really cool. I use AuthorizedKeysCommand in my project OPKSSH [0].

Currently I cannot combine SSH authn methods with the authn methods
performed by my AuthorizedKeysCommand. This is because my cmd can't see
what other methods passed or failed for sshd. The ability to configure sshd
with authentication requirements and then check that they passed in OPKSSH
be valuable and allow OPKSSH to take advantage of these additional authn
methods.

I'm supportive of this functionality.

[0]: opkssh (OpenPubkey SSH) https://github.com/openpubkey/opkssh


On Tue, Jul 21, 2026 at 1:32 AM Damien Miller <djm at mindrot.org> wrote:

> On Tue, 14 Jul 2026, Avinash Duduskar wrote:
>
> > Hi,
> >
> > By the end of userauth, sshd holds a set of structured facts:
> > session identity, transport parameters, the authentication method
> > sequence, the keys and certificates that authenticated.
> > ExposeAuthInfo=yes (shipped in 7.6) exports a line-based text file
> > carrying a fraction of them. Consumers that need the rest (audit
> > pipelines, session policy hooks, identity-provider liveness checks)
> > reconstruct it from log scraping or by parsing key blobs out of the
> > text file.
>
> [...]
>
> FWIW I think this is a worthwhile idea that could make existing
> things like AuthorizedKeys/PrincipalsCommand more useful in
> settings that require multiple authentication.
>
> I would like to hear what other people think though.
>
> -d
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>