PubkeyOptions and OpenSSH 10.6

[Herbert J. Skuhra]

On Wed, 7 Oct 2026, at 11:50, Lars Noodén via openssh-unix-dev wrote:
> Thanks for OpenSSH 10.6.  I see that a PubkeyOptions directive is listed 
> for sshd(8) under the New Features section of the release notes¹. 
> However, it seems to be missing from the 10.6 found in OpenBSD snapshots 
> and the sources which I have been checking.
>
> Perhaps I have interpreted the release notes incorrectly or made some 
> other error.  Should there be something about PubkeyOptions in either 
> the tarball, OpenBSD's source, or the Git repository?  Or is it a 
> pre-announcement for a feature coming up in 10.7 instead?
>
> $ ftp https://ftp.fr.openbsd.org/pub/OpenBSD/OpenSSH/openssh-10.6.tar.gz
> $ tar zxf openssh-10.6.tar.gz
> $ cd ssh
> $ grep -i PubkeyOptions * | wc -l
>         0
>
> $ cd /usr/src/usr.bin/ssh
> $ cvs -q up -Pd -A
> $ grep -i PubkeyOptions * | wc -l
>         0
>
> $ git clone git://anongit.mindrot.org/openssh.git
> Cloning into 'openssh'...
> remote: Enumerating objects: 73622, done.
> remote: Counting objects: 100% (73622/73622), done.
> remote: Compressing objects: 100% (19701/19701), done.
> remote: Total 73622 (delta 58037), reused 68693 (delta 53846), 
> pack-reused 0 (from 0)
> Receiving objects: 100% (73622/73622), 18.93 MiB | 87.00 KiB/s, done.
> Resolving deltas: 100% (58037/58037), done.
> $ cd openssh
> $ grep -iR PubkeyOptions * | wc -l
>         0
> $ grep -iR Pubkey * | wc -l
>       642
> $ git log -1 | head -n 3
> commit d549f99da344c178c5f632a62a6aa60544d7236e
> Author: robert at openbsd.org <robert at openbsd.org>
> Date:   Wed Oct 7 09:00:11 2026 +0000
>
>
> The server in the most recent OpenBSD snapshot doesn't seem to 
> acknowledge PubkeyOptions yet:
>
> # /usr/sbin/sshd -o 'PubkeyOptions max-pk-ok:1'
> command-line: line 0: Bad configuration option: PubkeyOptions
>
> # man sshd_config | grep -i pubkeyoptions | wc -l
>         0
>
> # /usr/sbin/sshd -V
> OpenSSH_10.6, LibreSSL 4.4.0
>
> # grep -A1 '^OpenBSD' /var/run/dmesg.boot | tail -n 2
> OpenBSD 8.0 (GENERIC.MP) #84: Tue Oct  6 23:13:49 MDT 2026
>      deraadt at amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP

PubkeyAuthOptions ?