Can I use a block cipher in CTR mode to generate keys from a master key? Suppose I have an AEAD mode based on a block cipher that requires two or more keys.

In some cases, there is a complex proof that one key suffices.  But finding such a proof is hard.

An alternative is to use the block cipher in CTR mode to generate a pseudorandom stream from a master key, which is then split as needed into the needed keys.  It seems to me that this is always secure (assuming that the block cipher is itself secure, which you almost always are assuming anyway).  It is also simple to implement in both hardware and software, allows you to use a longer nonce, and helps with birthday attacks if the extra nonce (used for CTR mode to generate the subkeys) is itself a "nfewtimes" (I don't think the distinguisher against CTR mode is of any use to an attacker until most of the full codebook is exhausted).

Is this recommended?  Assuming you can't just use EAX or CCM, that is.
As Maarten Bodewes points out, you should use a known key derivation function instead of this method (i.e. don't roll your own crypto). Having said that we can still try to understand what happens if you do use this method.

I assume that the method you're describing is something as follows. You take a block cipher $E:\mathsf{K}\times \mathsf{X} \to \mathsf{X}$, and a master key $K\in\mathsf{K}$ and then generate subkeys using 
$$K_0 = E_K(0), K_1 = E_K(1), K_2 = E_K(2), \ldots\,,$$
where $0$, $1$, $2$, $\ldots$ are distinct strings in $\mathsf{X}$.

If you only use the subkeys $K_0,K_1,K_2,\ldots$ as keys in the mode, there should not be an issue, since you're basically using the block cipher as a key derivation function. In order to do this, all you need to assume about the block cipher is that it is a secure pseudorandom permutation when keyed with $K$, $K_0$, $K_1$, $\ldots$. This, of course, also assumes that it is meaningful to use the output of $E_K$ as its key, which you can do for AES128, but not immediately with AES256 (you would have to use two block cipher outputs as a key).

However, the downside to the above approach is that you have to switch keys a few times, which might not be so bad depending upon the application, but is undesirable in general. The optimizations performed by modes such as GCM, EAX, and OCB make it so that you do not need to switch block cipher keys. Their trick is to use $E_K$ and the value $L = E_K(0)$ (or something similar) alongside each other in the mode, without ever using $E_L$. In particular, to ensure security this means that the mode needs to avoid outputting $E_K(0)$ as part of a ciphertext or tag, since then you've released $L$ to the adversary.

Just to be clear, neither method will help you against birthday attacks on the mode. As long as the master key stays the same, you will still find attacks with birthday bound complexity. Also, I don't immediately see the benefit in using a longer nonce, since the number of messages you can process using a key is often well below the number of nonces you can generate using half of a block length. For example, your nonce does not need to exceed 64 bits when using AES128 in GCM, since the birthday bound limits you anyway.