Bug 953534 - AuthorizedKeysCommandRunAs doesn't work as documented
AuthorizedKeysCommandRunAs doesn't work as documented
Product: Fedora
Classification: Fedora
Component: openssh (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Petr Lautrbach
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2013-04-18 07:52 EDT by Jan Cholasta
Modified: 2013-04-25 20:57 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-04-25 20:57:24 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan Cholasta 2013-04-18 07:52:10 EDT
Description of problem:

The behavior of AuthorizedKeysCommandRunAs sshd_config option has been changed in openssh 6.1p1 package to resemble that of AuthorizedKeysCommandUser of upstream OpenSSH 6.2. Now, when the option is unset, AuthorizedKeysCommand is not run at all and an error message is printed. This does not correspond to what is documented in sshd_config man page, and breaks applications that depend on the documented behavior (such as IPA).

Please revert to the old behavior in openssh 6.1p1 package.

Version-Release number of selected component (if applicable):

openssh-server-6.1p1-6 and later

How reproducible:


Steps to Reproduce:
1. root@host# /usr/sbin/sshd -D -d -p 2222 -o AuthorizedKeysCommand=/bin/echo
2. user@host$ ssh -p 2222 localhost

Actual results:

sshd does not run the specified command, the following line can be seen in sshd log:

No user for AuthorizedKeysCommand specified, skipping

Expected results:

sshd runs the specified command under the account of the user being authenticated.

Additional info:
Comment 1 Petr Lautrbach 2013-04-22 09:15:10 EDT
You're right, this is an unwanted change for the Fedora 18. I've pushed fixed openssh-6.1p1-akc.patch, which uses the user being authenticated as documented.

However, this won't work in the Fedora 19 (openssh-6.2p1) and later. Users, who would want this behavior, should use 
AuthorizedKeysCommandUser %u
Comment 2 Jan Cholasta 2013-04-22 09:21:16 EDT

As for Fedora 19 and openssh-6.2p1, this is already taken care of: https://fedorahosted.org/freeipa/ticket/3571
Comment 3 Fedora Update System 2013-04-23 06:39:23 EDT
openssh-6.1p1-8.fc18 has been submitted as an update for Fedora 18.
Comment 4 Fedora Update System 2013-04-23 21:25:08 EDT
Package openssh-6.1p1-8.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing openssh-6.1p1-8.fc18'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2013-04-25 20:57:26 EDT
openssh-6.1p1-8.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.