PubkeyOptions and OpenSSH 10.6

[Lars Noodén]

Thanks for OpenSSH 10.6.  I see that a PubkeyOptions directive is listed 
for sshd(8) under the New Features section of the release notes¹. 
However, it seems to be missing from the 10.6 found in OpenBSD snapshots 
and the sources which I have been checking.

Perhaps I have interpreted the release notes incorrectly or made some 
other error.  Should there be something about PubkeyOptions in either 
the tarball, OpenBSD's source, or the Git repository?  Or is it a 
pre-announcement for a feature coming up in 10.7 instead?

$ ftp https://ftp.fr.openbsd.org/pub/OpenBSD/OpenSSH/openssh-10.6.tar.gz
$ tar zxf openssh-10.6.tar.gz
$ cd ssh
$ grep -i PubkeyOptions * | wc -l
        0

$ cd /usr/src/usr.bin/ssh
$ cvs -q up -Pd -A
$ grep -i PubkeyOptions * | wc -l
        0

$ git clone git://anongit.mindrot.org/openssh.git
Cloning into 'openssh'...
remote: Enumerating objects: 73622, done.
remote: Counting objects: 100% (73622/73622), done.
remote: Compressing objects: 100% (19701/19701), done.
remote: Total 73622 (delta 58037), reused 68693 (delta 53846), 
pack-reused 0 (from 0)
Receiving objects: 100% (73622/73622), 18.93 MiB | 87.00 KiB/s, done.
Resolving deltas: 100% (58037/58037), done.
$ cd openssh
$ grep -iR PubkeyOptions * | wc -l
        0
$ grep -iR Pubkey * | wc -l
      642
$ git log -1 | head -n 3
commit d549f99da344c178c5f632a62a6aa60544d7236e
Author: robert at openbsd.org <robert at openbsd.org>
Date:   Wed Oct 7 09:00:11 2026 +0000


The server in the most recent OpenBSD snapshot doesn't seem to 
acknowledge PubkeyOptions yet:

# /usr/sbin/sshd -o 'PubkeyOptions max-pk-ok:1'
command-line: line 0: Bad configuration option: PubkeyOptions

# man sshd_config | grep -i pubkeyoptions | wc -l
        0

# /usr/sbin/sshd -V
OpenSSH_10.6, LibreSSL 4.4.0

# grep -A1 '^OpenBSD' /var/run/dmesg.boot | tail -n 2
OpenBSD 8.0 (GENERIC.MP) #84: Tue Oct  6 23:13:49 MDT 2026
     deraadt at amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP


/Lars

¹ https://www.openssh.org/txt/release-10.6