sshd_config only allows one AuthorizedKeysCommand

[EthanHeilman]

sshd_config only allows one AuthorizedKeysCommand This creates problems where admin has two AuthorizedKeysCommands they want to use on the same system for instance opkssh and AWS instance connect.

This isn't an issue with opkssh so much as an issue with SSH, that opkssh needs to care about because it is a tool for SSH. As such this has impacted projects other than opkssh such as:

• AuthorizedKeysCommand fails on Ubuntu 20.04
  • AuthorizedKeysCommand fails on Ubuntu 20.04 widdix/aws-ec2-ssh#157 (comment)
  • userdb: 20-systemd-userdb.conf as default can break existing sshd configurations systemd/systemd#33648 (comment)
• Support chaining to other AuthorizedKeysCommands Support chaining to other AuthorizedKeysCommands coreos/ssh-key-dir#10

[sjpb]

AuthorizedKeysCommand and AuthorizedKeysCommandUser are allowed in Match blocks, so as long as you have some way to distinguish when each command should be used, it is workable, just not with the current installer (and TBH I don't see how the installer could support that sort of arbitrary logic, other than having a --no-sshd-config option). But yes you can't define a list of commands to try (a la keys).

[EthanHeilman]

@sjpb You make a good point.

I looked into allowing two AuthorizedKeysCommand using match a while ago and the main issue and as you said "as long as you have some way to distinguish when each command should be used", but there isn't a good match pattern to do this (or rather I haven't found one). For instance if you knew that one AuthorizedKeysCommand always used a particular user, special-user that opkssh would never use, then you could match on that user.

Match User special-user
    AuthorizedKeysCommand /usr/local/bin/keysComamand.sh special-user %k %t
    AuthorizedKeysCommandUser root

AuthorizedKeysCommand /usr/local/bin/opkssh verify %u %k %t
AuthorizedKeysCommandUser opksshuser

I talked to someone once who told me they used port numbers to specify which AuthorizedKeysCommand to use. It works, but it doesn't work for most people, so it is hard to recommend. A better solution is to create an AuthorizedKeysCommand multiplexer

AuthorizedKeysCommand /usr/local/bin/multiplexer.sh %u %k %t
AuthorizedKeysCommandUser root

Then /usr/local/bin/multiplexer.sh would have its own config, would call multiple commands. This works, but the danger is that it isn't standard part of the OS, so AWS instance-connect will just write the opensshd config and not to the multiplexer.sh configure.

The ideal solution would be to update openssh to support more than one AuthorizedKeysCommand. I have an email I wrote three years to propose this idea to the openssh dev list, but I haven't sent it. I keep hoping there is a better solution than updating opensshd.

My proposed change to OpenSSHd config

As someone whose project [0] depends heavily on AuthorizedKeysCommand, I've often run into the issue that sshd_config only allows one AuthorizedKeysCommand. This creates problems where the admin has two AuthorizedKeysCommands they want to use on the same system.
 
I want to propose a new new sshd_config directive AuthorizedKeysCommandAdd <USER> <COMMAND> to allow more than one AuthorizedKeyCommand to be executed.

-  AuthorizedKeysCommandAdd can be used in parallel with AuthorizedKeysCommand or by itself. We use a new directive name to ensure that the behavior of existing sshd_config remains unchanged. An sshd_config with two AuthorizedKeysCommands will still operate according to the "last one wins" rule.

• Each AuthorizedKeysCommandAdd would be executed sequentially in config order until a matching key is found.
• AuthorizedKeysCommandAdd includes the run as user in the same line as the command to avoid misconfigurations arising from confusions between which run as user belongs to which command. The %-expansions are unchanged.
• This would play nicely with /etc/ssh/*.conf to provide drop-in AuthorizedKeysCommand configs.

An example use would look like: 

AuthorizedKeysCommand /opt/aws/bin/eic_run_authorized_keys %u %f
AuthorizedKeysCommandUser ec2-instance-connect

AuthorizedKeysCommandAdd policyuser /usr/local/bin/check_github %u %k %t
AuthorizedKeysCommandAdd ldap-admin /usr/local/bin/ldap_auth %u %k

AuthorizedKeysCommandAdd dev /usr/local/bin/breakglass.sh %u %k %t

It is possible to solve this issue without changing SSH by configuring sshd_config to use AuthorizedKeysCommand that unions the results from multiple commands. This one command to run them all has several drawbacks:

There is no agreed upon location or format for this command. Preventing upgrades and installs from clobbering this command's AuthorizedKeyCommand directive would require a high degree of coordination and cooperation between software projects. This degree of coordination seems unrealistic (See AWS overwriting AuthorizedKeysCommand [1]). Compare the likelihood of misconfigurations with this approach vs putting managing AuthorizedKeysCommandAdd as a /etc/ssh/sshd_config.d/*.conf drop in.

Another issue is that this command that unions multiple commands would need to have the AuthorizedKeysCommandUser set to root so that the command it is running can run as the correct user. This is less secure than having AuthorizedKeysCommandUser always scoped to the non-root user of that command.

Alternatively match blocks can be used to specify more than one AuthorizedKeysCommand, but this doesn't solve installs clobbering each other's configures. It also only fits use cases where you have some matching condition that fits the AuthorizedKeysCommand you want to run.

If OpenSSH would be open to considering this I'd be more than willing to put together a patch for review.

Any feedback on this proposal would be welcomed, thanks,

[0] OPKSSH - https://github.com/openpubkey/opkssh/
[1] AuthorizedKeysCommand fails on Ubuntu 20.04 widdix/aws-ec2-ssh#157 (comment)