diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2023-07-19 15:56:33 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2023-07-19 16:18:27 +0200 |
| commit | 1f2731f5d7a8f8a8385c6031667ed29072c0d92a (patch) | |
| tree | 1b3b36cf35f0590f8dd40b306823879bdd2ac9fd /ssh-agent.1 | |
| parent | upstream: terminate process if requested to load a PKCS#11 provider (diff) | |
| download | openssh-1f2731f5d7a8f8a8385c6031667ed29072c0d92a.tar.xz openssh-1f2731f5d7a8f8a8385c6031667ed29072c0d92a.zip | |
upstream: Disallow remote addition of FIDO/PKCS11 provider
libraries to ssh-agent by default.
The old behaviour of allowing remote clients from loading providers
can be restored using `ssh-agent -O allow-remote-pkcs11`.
Detection of local/remote clients requires a ssh(1) that supports
the `session-bind@openssh.com` extension. Forwarding access to a
ssh-agent socket using non-OpenSSH tools may circumvent this control.
ok markus@
OpenBSD-Commit-ID: 4c2bdf79b214ae7e60cc8c39a45501344fa7bd7c
Diffstat (limited to 'ssh-agent.1')
| -rw-r--r-- | ssh-agent.1 | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/ssh-agent.1 b/ssh-agent.1 index b0bf65da8..beb81865a 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-agent.1,v 1.75 2022/10/07 06:00:58 jmc Exp $ +.\" $OpenBSD: ssh-agent.1,v 1.76 2023/07/19 13:56:33 djm Exp $ .\" .\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: October 7 2022 $ +.Dd $Mdocdate: July 19 2023 $ .Dt SSH-AGENT 1 .Os .Sh NAME @@ -107,9 +107,27 @@ environment variable). .It Fl O Ar option Specify an option when starting .Nm . -Currently only one option is supported: +Currently two options are supported: +.Cm allow-remote-pkcs11 +and .Cm no-restrict-websafe . -This instructs +.Pp +The +.Cm allow-remote-pkcs11 +option allows clients of a forwarded +.Nm +to load PKCS#11 or FIDO provider libraries. +By default only local clients may perform this operation. +Note that signalling that a +.Nm +client remote is performed by +.Xr ssh 1 , +and use of other tools to forward access to the agent socket may circumvent +this restriction. +.Pp +The +.Cm no-restrict-websafe , +instructs .Nm to permit signatures using FIDO keys that might be web authentication requests. |