Index: ssh-agent.1
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh-agent.1,v
retrieving revision 1.41
diff -u -r1.41 ssh-agent.1
--- ssh-agent.1	11 Jul 2004 17:48:47 -0000	1.41
+++ ssh-agent.1	26 Dec 2004 23:35:30 -0000
@@ -87,6 +87,11 @@
 Kill the current agent (given by the
 .Ev SSH_AGENT_PID
 environment variable).
+.It Fl r
+Require that the user confirm any requests to lock the agent or to
+remove identities.  This confirmation uses 
+.Ev SSH_ASKPASS
+just like confirmation requests for use of stored keys.
 .It Fl t Ar life
 Set a default value for the maximum lifetime of identities added to the agent.
 The lifetime may be specified in seconds or in a time format specified in
@@ -195,6 +200,7 @@
 .Xr ssh 1 ,
 .Xr ssh-add 1 ,
 .Xr ssh-keygen 1 ,
+.Xr ssh-askpass 1 ,
 .Xr sshd 8
 .Sh AUTHORS
 OpenSSH is a derivative of the original and free
Index: ssh-agent.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh-agent.c,v
retrieving revision 1.122
diff -u -r1.122 ssh-agent.c
--- ssh-agent.c	29 Oct 2004 22:53:56 -0000	1.122
+++ ssh-agent.c	26 Dec 2004 23:35:31 -0000
@@ -107,6 +107,9 @@
 /* Default lifetime (0 == forever) */
 static int lifetime = 0;
 
+/* require confirmation for locking and key removal */
+static int requireconfirmation = 0;
+
 static void
 close_socket(SocketEntry *e)
 {
@@ -325,9 +328,10 @@
 process_remove_identity(SocketEntry *e, int version)
 {
 	u_int blen, bits;
-	int success = 0;
+	int success = 0, confirmed = 0;
 	Key *key = NULL;
 	u_char *blob;
+	char *p;
 
 	switch (version) {
 	case 1:
@@ -356,6 +360,13 @@
 			 * all the entries between the empty slot and the end
 			 * of the array.
 			 */
+		  if (requireconfirmation) {
+			p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
+			
+			confirmed = ask_permission("Allow request to delete key with fingerprint %s?", p);
+			xfree(p);
+		  }
+		  if (!requireconfirmation || confirmed) {
 			Idtab *tab = idtab_lookup(version);
 			if (tab->nentries < 1)
 				fatal("process_remove_identity: "
@@ -365,6 +376,7 @@
 			free_identity(id);
 			tab->nentries--;
 			success = 1;
+		  }
 		}
 		key_free(key);
 	}
@@ -379,6 +391,7 @@
 	Idtab *tab = idtab_lookup(version);
 	Identity *id;
 
+	if (!requireconfirmation || ask_permission("Allow request to delete all version %d identities?", version)) {
 	/* Loop over all identities and clear the keys. */
 	for (id = TAILQ_FIRST(&tab->idlist); id;
 	    id = TAILQ_FIRST(&tab->idlist)) {
@@ -392,6 +405,11 @@
 	/* Send success. */
 	buffer_put_int(&e->output, 1);
 	buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
+	} else {
+		/* Send failure. */
+		buffer_put_int(&e->output, 1);
+		buffer_put_char(&e->output, SSH_AGENT_FAILURE);
+	}
 }
 
 static void
@@ -535,9 +553,11 @@
 		lock_passwd = NULL;
 		success = 1;
 	} else if (!locked && lock) {
+	  if (!requireconfirmation || ask_permission("Allow request to lock SSH agent?")) {
 		locked = 1;
 		lock_passwd = xstrdup(passwd);
 		success = 1;
+	  }
 	}
 	memset(passwd, 0, strlen(passwd));
 	xfree(passwd);
@@ -983,6 +1003,7 @@
 	fprintf(stderr, "  -d          Debug mode.\n");
 	fprintf(stderr, "  -a socket   Bind agent socket to given name.\n");
 	fprintf(stderr, "  -t life     Default identity lifetime (seconds).\n");
+	fprintf(stderr, "  -r          Require confirmation for locking and key removal.\n");
 	exit(1);
 }
 
@@ -1007,7 +1028,7 @@
 
 	SSLeay_add_all_algorithms();
 
-	while ((ch = getopt(ac, av, "cdksa:t:")) != -1) {
+	while ((ch = getopt(ac, av, "cdksra:t:")) != -1) {
 		switch (ch) {
 		case 'c':
 			if (s_flag)
@@ -1016,6 +1037,9 @@
 			break;
 		case 'k':
 			k_flag++;
+			break;
+		case 'r':
+			requireconfirmation = 1;
 			break;
 		case 's':
 			if (c_flag)
