pam-sshagent: only allow managed SSH keys

[wmertens]

[Breaking change]

Fixes #31611. If people have self-managed SSH keys in ~/.ssh, they will no longer be able to use those to get sudo access.

Update: This needs to be made configurable first, see the comment below. Basically, enable it if openssh non-managed keys are enabled, and allow overriding?

[sometimes-i-send-pull-requests]

As I mentioned in #31611, I currently depend on the behavior as-is, so I would like this to be configurable. I also don't think the configuration being as it is now was an unintentional introduction, since it must have taken some work for @edolstra to come up with 3644f91 in the first place, which was necessary for this to work at all. I would be much happier with this patch if:

• It were an controlled by an option
• Whether or not OpenSSH obeys non-managed keys were also an option
• This option controlling pam_ssh_agent_auth defaulted to the value of the OpenSSH option

It's probably best if these both default to the more secure option, but it would be good to be consistent. What do you think?

[wmertens]

@matthewbauer ???

[matthewbauer]

Sorry, I thought I was deleting branches on my own fork.

[zimbatm]

Let's get this merged. Any objections?

[zimbatm]

Reading #31611 (comment) I think this should be made configurable actually.

[fpletz]

I would say we go with #62317 to make it configurable properly. Thanks!