Bug 1405158

Description of problem:

Apparently, every version of sshd since the dawn of time and across all operating systems **except RHEL 5 and RHEL 6**  support multiple files in the AuthorizedKeysFile line of /etc/ssh/sshd_config, and support the default behavior of using .ssh/authorized_keys and .ssh/authorized_keys2 by default.

I have a customer with thousands of RHEL 5 and RHEL 6 systems that needs both RHEL 5 and RHEL 6 to behave in this standard manner. It's basic Linux functionality and it's broken in RHEL 5 and RHEL 6.  sshd apparently does work as expected in RHEL 4 and earlier and works properly in RHEL 7 (see below).

Version-Release number of selected component (if applicable):
openssh-server-5.3p1-118.1.el6_8.x86_64

Apparently 5.3p1-104 at least supports the default behavior.  But earlier and more recent minor versions are broken.

How reproducible:
at will

Steps to Reproduce:
1. Edit /etc/sshd/sshd_config, as follows:
[root@rhel6test ssh]# diff sshd_config sshd_config-original
49c49
< AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
---
> #AuthorizedKeysFile	.ssh/authorized_keys

2. Restart the sshd service
3.

Actual results:
[root@rhel6test ssh]# service sshd restart
Stopping sshd:                                             [  OK  ]
Starting sshd: /etc/ssh/sshd_config line 49: garbage at end of line; ".ssh/authorized_keys_greg".
                                                           [FAILED]
[root@rhel6test ssh]# 


Expected results:

sshd should behave the same way that sshd in all other Linux and Unix implementations behave.  It should start cleanly with the updated AuthorizedKeysFile line, and should support passwordless logins for users who have an appropriately formatted .ssh/authorized_keys2 file, even if /etc/ssh/sshd_config has the AuthorizedKeysFile line commented out.

Additional info:

RHEL 6 behaves badly.

[root@rhel6test ssh]# pwd
/etc/ssh
[root@rhel6test ssh]# 
[root@rhel6test ssh]# cp sshd_config sshd_config-original
[root@rhel6test ssh]# nano sshd_config
[root@rhel6test ssh]# service sshd restart
Stopping sshd:                                             [  OK  ]
Starting sshd: /etc/ssh/sshd_config line 49: garbage at end of line; ".ssh/authorized_keys_greg".
                                                           [FAILED]
[root@rhel6test ssh]# 
[root@rhel6test ssh]# 
[root@rhel6test ssh]# diff sshd_config sshd_config-original
49c49
< AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
---
> #AuthorizedKeysFile	.ssh/authorized_keys
[root@rhel6test ssh]# 
[root@rhel6test ssh]# 
[root@rhel6test ssh]# rpm -qa | grep ssh
openssh-5.3p1-118.1.el6_8.x86_64
libssh2-1.4.2-1.el6_6.1.x86_64
openssh-server-5.3p1-118.1.el6_8.x86_64
openssh-clients-5.3p1-118.1.el6_8.x86_64
[root@rhel6test ssh]# 

RHEL 7 behaves as expected.

Note the comments in the RHEL 7 variant of /etc/ssh/sshd_config:

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2


[root@rhel7test ~]# cd /etc/ssh
[root@rhel7test ssh]# cp sshd_config sshd_config-original
[root@rhel7test ssh]# nano sshd_config
[root@rhel7test ssh]# 
[root@rhel7test ssh]# systemctl restart sshd.service
[root@rhel7test ssh]# systemctl status sshd.service
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2016-12-15 11:17:29 CST; 12s ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 5959 (sshd)
   CGroup: /system.slice/sshd.service
           └─5959 /usr/sbin/sshd -D

Dec 15 11:17:29 rhel7test sshd[5959]: Server listening on 0.0.0.0 port 22.
Dec 15 11:17:29 rhel7test sshd[5959]: Server listening on :: port 22.
[root@rhel7test ssh]# 
[root@rhel7test ssh]# 
[root@rhel7test ssh]# diff sshd_config sshd_config-original
59c59
< AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
---
> AuthorizedKeysFile	.ssh/authorized_keys
[root@rhel7test ssh]# 
[root@rhel7test ssh]# rpm -qa| grep ssh
openssh-clients-6.6.1p1-25.el7_2.x86_64
libssh2-1.4.3-10.el7_2.1.x86_64
openssh-6.6.1p1-25.el7_2.x86_64
openssh-server-6.6.1p1-25.el7_2.x86_64
[root@rhel7test ssh]#