Bug 2498870

Summary:	ec2-instance-connect overrides other AuthorizedKeysCommand's
Product:	[Fedora] Fedora	Reporter:	Kevin Fenzi <kevin>
Component:	ec2-instance-connect	Assignee:	David Duncan <davdunc>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	45	CC:	cloud-sig, davdunc, ngompa13, pbrobinson
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kevin Fenzi 2026-07-09 23:02:12 UTC

Since this package adds to the sshd command line that overrides any AuthorizedKeysCommand's that users may have set in /etc/ssh/sshd_config.d/ snippets.

Perhaps this package could move to setting those in a file late in the sequence to allow folks to set their own if they want. Or detect if one is set and not run or something?

It's very confusing since this doesn't appear in ssh config at all, and only if you happen to notice it on the sshd argument list do you realize whats happening. 

Also, on removing this package, sshd is _stopped_ completely. ;( It should restart sshd without the arguments.

Reproducible: Always

Comment 1 Kevin Fenzi 2026-07-09 23:10:09 UTC

It looks like it also disables sshd on uninstall:

[1/2] Prepare transaction                         100% |  12.0   B/s |   1.0   B |  00m00s>>> Running %preun scriptlet: ec2-instance-connect-config-0:1.1.17-6.fc44.noarch
>>> Finished %preun scriptlet: ec2-instance-connect-config-0:1.1.17-6.fc44.noarch
>>> Scriptlet output:                                                                     >>> Removed '/etc/systemd/system/multi-user.target.wants/sshd.service'.
>>>                                                                                       
[2/2] Removing ec2-instance-connect-config-0:1.1. 100% |   1.0   B/s |   1.0   B |  00m01s
Complete!
● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; preset: enabled)

Comment 2 Aoife Moloney 2026-08-17 15:17:51 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.