Description of problem: The behavior of AuthorizedKeysCommandRunAs sshd_config option has been changed in openssh 6.1p1 package to resemble that of AuthorizedKeysCommandUser of upstream OpenSSH 6.2. Now, when the option is unset, AuthorizedKeysCommand is not run at all and an error message is printed. This does not correspond to what is documented in sshd_config man page, and breaks applications that depend on the documented behavior (such as IPA). Please revert to the old behavior in openssh 6.1p1 package. Version-Release number of selected component (if applicable): openssh-server-6.1p1-6 and later How reproducible: Always. Steps to Reproduce: 1. root@host# /usr/sbin/sshd -D -d -p 2222 -o AuthorizedKeysCommand=/bin/echo 2. user@host$ ssh -p 2222 localhost Actual results: sshd does not run the specified command, the following line can be seen in sshd log: No user for AuthorizedKeysCommand specified, skipping Expected results: sshd runs the specified command under the account of the user being authenticated. Additional info:
You're right, this is an unwanted change for the Fedora 18. I've pushed fixed openssh-6.1p1-akc.patch, which uses the user being authenticated as documented. However, this won't work in the Fedora 19 (openssh-6.2p1) and later. Users, who would want this behavior, should use AuthorizedKeysCommandUser %u
Thanks. As for Fedora 19 and openssh-6.2p1, this is already taken care of: https://fedorahosted.org/freeipa/ticket/3571
openssh-6.1p1-8.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/FEDORA-2013-5918/openssh-6.1p1-8.fc18
Package openssh-6.1p1-8.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing openssh-6.1p1-8.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-5918/openssh-6.1p1-8.fc18 then log in and leave karma (feedback).
openssh-6.1p1-8.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.