[Bug 4051] New: ssh-agent: confirmation for forwarded key use only (-O confirm-forwarded)

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4051

            Bug ID: 4051
           Summary: ssh-agent: confirmation for forwarded key use only (-O
                    confirm-forwarded)
           Product: Portable OpenSSH
           Version: -current
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh-agent
          Assignee: unassigned-bugs at mindrot.org
          Reporter: yannik at sembritzki.org

Created attachment 4020
  --> https://bugzilla.mindrot.org/attachment.cgi?id=4020&action=edit
patch series v1 (5 patches)

Agent forwarding gives the remote host use of every key in the agent.
ssh-add -c limits that, but also prompts for every local use, which
doesn't work for scripted or parallel connections.

The attached series (also posted to openssh-unix-dev) adds:

1/5 escape the requester-supplied user name in the confirmation prompt
    of destination-constrained keys (a forwarded request can currently
    inject extra lines into the askpass dialog)
2/5 name the matching constraint hosts instead of "listed host"
3/5 ssh-agent -O confirm-forwarded: require confirmation only for
    signatures over forwarded connections (session-bind is_forwarding),
    with a prompt saying what the request is for
4/5 session-hostname at openssh.com extension so the prompt can name the
    host the agent was forwarded to
5/5 regress test

Mailing list thread:
https://marc.info/?t=179250667400003&r=1&w=2

Related: bug 3106, bug 1499.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.