Red Hat Bugzilla – Bug 953534
AuthorizedKeysCommandRunAs doesn't work as documented
Last modified: 2013-04-25 20:57:26 EDT
Description of problem:
The behavior of AuthorizedKeysCommandRunAs sshd_config option has been changed in openssh 6.1p1 package to resemble that of AuthorizedKeysCommandUser of upstream OpenSSH 6.2. Now, when the option is unset, AuthorizedKeysCommand is not run at all and an error message is printed. This does not correspond to what is documented in sshd_config man page, and breaks applications that depend on the documented behavior (such as IPA).
Please revert to the old behavior in openssh 6.1p1 package.
Version-Release number of selected component (if applicable):
openssh-server-6.1p1-6 and later
Steps to Reproduce:
1. root@host# /usr/sbin/sshd -D -d -p 2222 -o AuthorizedKeysCommand=/bin/echo
2. user@host$ ssh -p 2222 localhost
sshd does not run the specified command, the following line can be seen in sshd log:
No user for AuthorizedKeysCommand specified, skipping
sshd runs the specified command under the account of the user being authenticated.
You're right, this is an unwanted change for the Fedora 18. I've pushed fixed openssh-6.1p1-akc.patch, which uses the user being authenticated as documented.
However, this won't work in the Fedora 19 (openssh-6.2p1) and later. Users, who would want this behavior, should use
As for Fedora 19 and openssh-6.2p1, this is already taken care of: https://fedorahosted.org/freeipa/ticket/3571
openssh-6.1p1-8.fc18 has been submitted as an update for Fedora 18.
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing openssh-6.1p1-8.fc18'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
openssh-6.1p1-8.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.