Bug 2498870 - ec2-instance-connect overrides other AuthorizedKeysCommand's
Summary: ec2-instance-connect overrides other AuthorizedKeysCommand's
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: ec2-instance-connect
Version: 45
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: David Duncan
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-09 23:02 UTC by Kevin Fenzi
Modified: 2026-08-17 15:17 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Kevin Fenzi 2026-07-09 23:02:12 UTC
Since this package adds to the sshd command line that overrides any AuthorizedKeysCommand's that users may have set in /etc/ssh/sshd_config.d/ snippets.

Perhaps this package could move to setting those in a file late in the sequence to allow folks to set their own if they want. Or detect if one is set and not run or something?

It's very confusing since this doesn't appear in ssh config at all, and only if you happen to notice it on the sshd argument list do you realize whats happening. 

Also, on removing this package, sshd is _stopped_ completely. ;( It should restart sshd without the arguments.

Reproducible: Always

Comment 1 Kevin Fenzi 2026-07-09 23:10:09 UTC
It looks like it also disables sshd on uninstall:

[1/2] Prepare transaction                         100% |  12.0   B/s |   1.0   B |  00m00s>>> Running %preun scriptlet: ec2-instance-connect-config-0:1.1.17-6.fc44.noarch
>>> Finished %preun scriptlet: ec2-instance-connect-config-0:1.1.17-6.fc44.noarch
>>> Scriptlet output:                                                                     >>> Removed '/etc/systemd/system/multi-user.target.wants/sshd.service'.
>>>                                                                                       
[2/2] Removing ec2-instance-connect-config-0:1.1. 100% |   1.0   B/s |   1.0   B |  00m01s
Complete!
● sshd.service - OpenSSH server daemon
     Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; preset: enabled)

Comment 2 Aoife Moloney 2026-08-17 15:17:51 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.


Note You need to log in before you can comment on or make changes to this bug.