CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/30 01:18:18
Modified files:
usr.bin/ssh : ssh-agent.1 ssh-agent.c
Log message:
disallow remote removal of PKCS#11 providers from ssh-agent by
default, as this permits an attacker with access to a forwarded agent
a silly path-validity oracle. It's better just to be symmetric with
the restrictions on adding providers.
Note: a user of a forwarded agent can still remove a provider's _keys_
as it is important that access to keys can be easily revoked, this just
block removing entire providers by name.
Anthropic ANT-2026-DYLIZ0VY
