diff options
author | Ed Maste <emaste@FreeBSD.org> | 2022-10-19 14:27:11 +0000 |
---|---|---|
committer | Ed Maste <emaste@FreeBSD.org> | 2022-10-19 14:27:11 +0000 |
commit | 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3 (patch) | |
tree | 19efd716d56fca37802e8c6c6ebec2e873b3786a /crypto/openssh/ssh-pkcs11-helper.8 | |
parent | af3297898720af2f2ed18d18d45ea6bf50d55ef1 (diff) | |
parent | 56fae06595918644df9cfd2f285777195c8d29b8 (diff) | |
download | src-38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3.tar.gz src-38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3.zip |
ssh: update to OpenSSH 9.1p1
Release notes are available at https://www.openssh.com/txt/release-9.1
9.1 contains fixes for three minor memory safety problems; these have
lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base
system.
Some highlights copied from the release notes:
Potentially-incompatible changes
--------------------------------
* ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config
are now first-match-wins to match other directives. Previously
if an environment variable was multiply specified the last set
value would have been used. bz3438
* ssh-keygen(8): ssh-keygen -A (generate all default host key types)
will no longer generate DSA keys, as these are insecure and have
not been used by default for some years.
New features
------------
* ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum
RSA key length. Keys below this length will be ignored for user
authentication and for host authentication in sshd(8).
* sftp-server(8): add a "users-groups-by-id@openssh.com" extension
request that allows the client to obtain user/group names that
correspond to a set of uids/gids.
* sftp(1): use "users-groups-by-id@openssh.com" sftp-server
extension (when available) to fill in user/group names for
directory listings.
* sftp-server(8): support the "home-directory" extension request
defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps
a bit with the existing "expand-path@openssh.com", but some other
clients support it.
* ssh-keygen(1), sshd(8): allow certificate validity intervals,
sshsig verification times and authorized_keys expiry-time options
to accept dates in the UTC time zone in addition to the default
of interpreting them in the system time zone. YYYYMMDD and
YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed
with a 'Z' character.
Also allow certificate validity intervals to be specified in raw
seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This
is intended for use by regress tests and other tools that call
ssh-keygen as part of a CA workflow. bz3468
* sftp(1): allow arguments to the sftp -D option, e.g. sftp -D
"/usr/libexec/sftp-server -el debug3"
* ssh-keygen(1): allow the existing -U (use agent) flag to work
with "-Y sign" operations, where it will be interpreted to require
that the private keys is hosted in an agent; bz3429
MFC after: 2 weeks
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'crypto/openssh/ssh-pkcs11-helper.8')
-rw-r--r-- | crypto/openssh/ssh-pkcs11-helper.8 | 23 |
1 files changed, 14 insertions, 9 deletions
diff --git a/crypto/openssh/ssh-pkcs11-helper.8 b/crypto/openssh/ssh-pkcs11-helper.8 index 6a592b1f36e3..5edc98507e0c 100644 --- a/crypto/openssh/ssh-pkcs11-helper.8 +++ b/crypto/openssh/ssh-pkcs11-helper.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-pkcs11-helper.8,v 1.6 2019/11/30 07:07:59 jmc Exp $ +.\" $OpenBSD: ssh-pkcs11-helper.8,v 1.7 2022/04/29 03:24:30 djm Exp $ .\" .\" Copyright (c) 2010 Markus Friedl. All rights reserved. .\" @@ -14,7 +14,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: November 30 2019 $ +.Dd $Mdocdate: April 29 2022 $ .Dt SSH-PKCS11-HELPER 8 .Os .Sh NAME @@ -26,12 +26,14 @@ .Sh DESCRIPTION .Nm is used by -.Xr ssh-agent 1 +.Xr ssh 1 , +.Xr ssh-agent 1 , +and +.Xr ssh-keygen 1 to access keys provided by a PKCS#11 token. .Pp .Nm -is not intended to be invoked by the user, but from -.Xr ssh-agent 1 . +is not intended to be invoked directly by the user. .Pp A single option is supported: .Bl -tag -width Ds @@ -47,17 +49,20 @@ options increase the verbosity. The maximum is 3. .Pp Note that -.Xr ssh-agent 1 +.Xr ssh 1 , +.Xr ssh-agent 1 , +and +.Xr ssh-keygen 1 will automatically pass the .Fl v flag to .Nm -when it has itself been placed in debug mode. +when they have themselves been placed in debug mode. .El .Sh SEE ALSO .Xr ssh 1 , -.Xr ssh-add 1 , -.Xr ssh-agent 1 +.Xr ssh-agent 1 , +.Xr ssh-keygen 1 .Sh HISTORY .Nm first appeared in |