diff options
| author |   djm <djm@openbsd.org> | 2016-11-30 03:07:37 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2016-11-30 03:07:37 +0000 |
| commit | 9476ce1dd37d3c3218d5640b74c34c65e5f4efe5 (patch) | |
| tree | d1ec7ea6f425e871e8ba9334f5d2f98b15e2f8c1 /usr.bin/ssh/ssh-agent.1 | |
| parent | test new behaviour of cert force-command restriction vs. authorized_key/ (diff) | |
| download | wireguard-openbsd-9476ce1dd37d3c3218d5640b74c34c65e5f4efe5.tar.xz wireguard-openbsd-9476ce1dd37d3c3218d5640b74c34c65e5f4efe5.zip | |
add a whitelist of paths from which ssh-agent will load (via
ssh-pkcs11-helper) a PKCS#11 module; ok markus@
Diffstat (limited to 'usr.bin/ssh/ssh-agent.1')
| -rw-r--r-- | usr.bin/ssh/ssh-agent.1 | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/usr.bin/ssh/ssh-agent.1 b/usr.bin/ssh/ssh-agent.1 index c4b50bbdfe7..372adbe7c7f 100644 --- a/usr.bin/ssh/ssh-agent.1 +++ b/usr.bin/ssh/ssh-agent.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-agent.1,v 1.62 2015/11/15 23:54:15 jmc Exp $ +.\" $OpenBSD: ssh-agent.1,v 1.63 2016/11/30 03:07:37 djm Exp $ .\" .\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: November 15 2015 $ +.Dd $Mdocdate: November 30 2016 $ .Dt SSH-AGENT 1 .Os .Sh NAME @@ -47,6 +47,7 @@ .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash .Op Fl t Ar life +.Op Fl P Ar pkcs11_whitelist .Op Ar command Op Ar arg ... .Nm ssh-agent .Op Fl c | s @@ -121,6 +122,18 @@ The default is Kill the current agent (given by the .Ev SSH_AGENT_PID environment variable). +.It Fl P +Specify a pattern-list of acceptable paths for PKCS#11 shared libraries +that may be added using the +.Fl s +option to +.Xr ssh-add 1 . +The default is to allow loading PKCS#11 libraries from +.Dq /usr/lib/*,/usr/local/lib/* . +PKCS#11 libraries that do not match the whitelist will be refused. +See PATTERNS in +.Xr ssh_config 5 +for a description of pattern-list syntax. .It Fl s Generate Bourne shell commands on .Dv stdout . |