Updating sshd configuration to accept/handle a fresh openssh install'…

…s default

bin/configure_sshd.sh

@@ -12,6 +12,16 @@ modified=false
 # Configure sshd to use EC2 Instance Connect's AuthorizedKeysCommand
 AUTH_KEYS_CMD="AuthorizedKeysCommand /usr/bin/timeout 5s /opt/aws/bin/curl_authorized_keys %u %f"
 AUTH_KEYS_USR="AuthorizedKeysCommandUser ec2-instance-connect"
+# If the default, commented out none/nobody is present drop it
+if ! grep -q "^.*AuthorizedKeysCommandRunAs[[:blank:]]\+.*$" /etc/ssh/sshd_config ; then
+    if grep -q "^\#AuthorizedKeysCommand[[:blank:]]none$" /etc/ssh/sshd_config ; then
+        if grep -q "^\#AuthorizedKeysCommandUser[[:blank:]]nobody$" /etc/ssh/sshd_config ; then
+            sed -ir "/^\#AuthorizedKeysCommand[[:blank:]]none$/d" /etc/ssh/sshd_config
+            sed -i "/^\#AuthorizedKeysCommandUser[[:blank:]]nobody$/d" /etc/ssh/sshd_config
+            # We don't need to mark for restart - all we did was remove commented-out config
+        fi
+    fi
+fi
 if ! grep -q "^.*AuthorizedKeysCommand[[:blank:]]\+.*$" /etc/ssh/sshd_config ; then
     if ! grep -q "^.*AuthorizedKeysCommandUser[[:blank:]]\+.*$" /etc/ssh/sshd_config ; then
         if ! grep -q "^.*AuthorizedKeysCommandRunAs[[:blank:]]\+.*$" /etc/ssh/sshd_config ; then
@@ -24,7 +34,7 @@ fi
 
 if [ $modified = true ] ; then
     # Restart sshd
-    # HACK: There is absolutely no good way to tell what init system is running.
+    # HACK: There is no good way to tell what init system is running.
     # "Best" solution is to just try them all
     sudo systemctl restart ssh || true
     sudo service sshd restart || true

bin/reset_sshd.sh

@@ -10,14 +10,15 @@ AUTH_KEYS_USER="#AuthorizedKeysCommandUser nobody"
 if grep -q "^AuthorizedKeysCommandUser[[:blank:]]ec2-instance-connect$" /etc/ssh/sshd_config ; then
     if grep -q "^AuthorizedKeysCommand[[:blank:]]/usr/bin/timeout[[:blank:]]5s[[:blank:]]/opt/aws/bin/curl_authorized_keys[[:blank:]]%u[[:blank:]]%f$" /etc/ssh/sshd_config ; then
         sed -ir "/^AuthorizedKeysCommand[[:blank:]]\/usr\/bin\/timeout[[:blank:]]5s[[:blank:]]\/opt\/aws\/bin\/curl_authorized_keys.*$/d" /etc/ssh/sshd_config
-        sed -i "/^.*AuthorizedKeysCommandUser.*$/d" /etc/ssh/sshd_config
+        sed -i "/^.*AuthorizedKeysCommandUser[[:blank:]]ec2-instance-connect$/d" /etc/ssh/sshd_config
+        printf "\n%s\n%s\n" "#AuthorizedKeysCommand none" "#AuthorizedKeysCommandUser nobody" >> /etc/ssh/sshd_config
         modified=true
     fi
 fi
 
 if [ $modified = true ] ; then
     # Restart sshd
-    # HACK: There is absolutely no good way to tell what init system is running.
+    # HACK: There is no good way to tell what init system is running.
     # "Best" solution is to just try them all
     sudo systemctl restart ssh || true
     sudo service sshd restart || true