I submitted a Pull Request to update MacPorts' OpenSSH to 10.1p1 here:https://github.com/macports/macports-ports/pull/28592GitHub Continuous Integration checks passed OK!Alas, the agent.patch that iamGavinJ had created, doesn't apply cleanly, in large part because ssh-agent.c has been reworked significantly with this release.Subsequently, I closed this previous Pull Request: https://github.com/macports/macports-ports/pull/28592 not because I didn't want to restore that functionality to launchd, but because it will require more effort than I can give such things at this time.But, check out these improvements to ssh-agent from the OpenSSH 10.1 release notes:"ssh-agent(1)](https://man.openbsd.org/ssh-agent.1), sshd(8): move agent listener sockets from /tmp tounder ~/.ssh/agent for both ssh-agent(1) and forwarded socketsin sshd(8).This ensures processes that have restricted filesystem accessthat includes /tmp do not ambiently have the ability to use keysin an agent.Moving the default directory has the consequence that the OS willno longer clean up stale agent sockets, so ssh-agent now gainsthis ability.To support $HOME on NFS, the socket path includes a truncatedhash of the hostname. ssh-agent will, by default, only clean upsockets from the same hostname.ssh-agent(1) gains some new flags: -U suppresses the automaticcleanup of stale sockets when it starts. -u forces a cleanupwithout keeping a running agent, -uu forces a cleanup that ignoresthe hostname. -T makes ssh-agent put the socket back in /tmp."Anyway, I updated this as well:https://trac.macports.org/ticket/72482I should probably actually close this ticket now that I think of it (fingers crossed that adding that to the PR is sufficient, since I forgot to add that note to the commit message as is typically preferred: https://trac.macports.org/ticket/73084).#OpenSSH #MacPorts #SecureShell #macOS #encryption #security #infosec
undefined Oblomov shared this topic
