Default `auth_key_file` is insecure about pam_rssh HOT 2 OPEN

@smortex The point is, it turns “user is allowed $thing if they authenticate with a trusted pubkey” into “user is allowed $thing unconditionally.” The PAM module is bypassed, and if the administrator's intent was the later, they wouldn't have used pam_ssh_agent_auth (or pam_rssh or any other PAM module)

from pam_rssh.

That quite depends on your threat model, but make sense if your ssh daemon rely on AuthorizedKeysFile to change the default which allow users to self-service their own authorized keys management.

Following the sshd configuration would make sense: AuthorizedKeysFile may point to another location, AuthorizedKeysCommand may be used to retrieve keys of a user and so on.

Regarding the example in the liked PR, I feel like the provided example is misleading as the user account used to "elevate" privileges is allowed to run any command as root… so it just make it possible without knowing the user password (while a correct sudo config would not have allowed the user to run any command as root in any case).

from pam_rssh.