[openssh-commits] [openssh] 53/87: upstream: add warning not to use `Match exec` in

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 99b84cbe6621700674a931a6c4ada031a09fa6a4
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 06:03:54 2026 +0000

    upstream: add warning not to use `Match exec` in
    
    /etc/ssh/ssh_config to control EnableSSHKeysign, as the user effectively
    controls how `Match exec` commands are run.
    
    Anthropic ANT-2026-1W8VNWB5
    
    (Anthropic proposed a fix, but IMO this is likely such a rarity that an
    admonition is sufficient).
    
    OpenBSD-Commit-ID: b80ca24d3ba1ff6c7333098d4acf1426798f38cd
---
 ssh_config.5 | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/ssh_config.5 b/ssh_config.5
index bd1ec9721..f16c57f84 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.433 2026/10/09 08:25:28 dtucker Exp $
-.Dd $Mdocdate: October 9 2026 $
+.\" $OpenBSD: ssh_config.5,v 1.434 2026/10/30 06:03:54 djm Exp $
+.Dd $Mdocdate: October 30 2026 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -203,6 +203,16 @@ Arguments to
 accept the tokens described in the
 .Sx TOKENS
 section.
+Commands are executed using
+.Ev SHELL
+from the user's environment.
+Because of this,
+.Cm exec
+should not be used in the global
+.Pa /etc/ssh/ssh_config
+to control security-sensitive configuration
+such as
+.Cm EnableSSHKeysign .
 .Pp
 The
 .Cm localnetwork

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.