Some edge cases not caught by audit_ssh_authorizedkeys

[s3lph]

Some edge cases are not caught by the audit_ssh_authorizedkeys module. Namely those where SSH keys are loaded using token-expanded filenames other than %u, e.g. by matching for the remote hostname (%h).

audit_ssh_authorizedkeys should notice this and produce a warning, but this is not entirely trivial, as we'd need to parse the config file ourselves (sshd configtest only produces merged and expanded config as output, so we can't reliably check for placeholders there) in order to find any includes of other config files (at least the includes don't use token expansion).

[s3lph]

Another case we should detect and emit a warning is the use of the AuthorizedKeysCommand option (e.g. when obtaining SSH keys via SSSD/LDAP).

[s3lph]

AuthorizedKeysCommand is covered by #29