tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-28 08:14:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream: document "-O no-restrict-websafe"; spotted by Ross L

Browse Source 
Richardson

OpenBSD-Commit-ID: fe9eaa50237693a14ebe5b5614bf32a02145fe8b
This commit is contained in:
djm@openbsd.org 2022-10-07 04:06:26 +00:00 committed by Damien Miller
parent 614252b05d
commit 9fd2441113
No known key found for this signature in database
1 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
ssh-agent.1
View File

@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-agent.1,v 1.73 2022/03/31 17:27:27 naddy Exp $ .\" $OpenBSD: ssh-agent.1,v 1.74 2022/10/07 04:06:26 djm Exp $
.\" .\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.Dd $Mdocdate: March 31 2022 $ .Dd $Mdocdate: October 7 2022 $
.Dt SSH-AGENT 1 .Dt SSH-AGENT 1
.Os .Os
.Sh NAME .Sh NAME
@ -46,11 +46,13 @@
.Op Fl \&Dd .Op Fl \&Dd
.Op Fl a Ar bind_address .Op Fl a Ar bind_address
.Op Fl E Ar fingerprint_hash .Op Fl E Ar fingerprint_hash
.Op Fl O Ar option
.Op Fl P Ar allowed_providers .Op Fl P Ar allowed_providers
.Op Fl t Ar life .Op Fl t Ar life
.Nm ssh-agent .Nm ssh-agent
.Op Fl a Ar bind_address .Op Fl a Ar bind_address
.Op Fl E Ar fingerprint_hash .Op Fl E Ar fingerprint_hash
.Op Fl O Ar option
.Op Fl P Ar allowed_providers .Op Fl P Ar allowed_providers
.Op Fl t Ar life .Op Fl t Ar life
.Ar command Op Ar arg ... .Ar command Op Ar arg ...
@ -102,6 +104,27 @@ The default is
Kill the current agent (given by the Kill the current agent (given by the
.Ev SSH_AGENT_PID .Ev SSH_AGENT_PID
environment variable). environment variable).
.It Fl O Ar option
Specify an option when starting
.Xr ssh-agent 1 .
Currently only one option is supported:
.Cm no-restrict-websafe .
This instructs
.Xr ssh-agent 1
to permit signatures using FIDO keys that might be web authentication
requests.
By default,
.Xr ssh-agent 1
refuses signature requests for FIDO keys where the key application string
does not start with
.Dq ssh:
and when the data to be signed does not appear to be a
.Xr ssh 1
user authentication request or a
.Xr ssh-keygen 1
signature.
The default behaviour prevents forwarded access to a FIDO key from also
implicitly forwarding the ability to authenticate to websites.
.It Fl P Ar allowed_providers .It Fl P Ar allowed_providers
Specify a pattern-list of acceptable paths for PKCS#11 provider and FIDO Specify a pattern-list of acceptable paths for PKCS#11 provider and FIDO
authenticator middleware shared libraries that may be used with the authenticator middleware shared libraries that may be used with the