diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2022-08-11 01:56:51 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2022-08-11 12:00:49 +1000 |
| commit | ec1ddb72a146fd66d18df9cd423517453a5d8044 (patch) | |
| tree | e719fdf106901824ed54e315a7ec0777140b49b4 /sshd.8 | |
| parent | 4df246ec75751da7eb925e1880498300d8bda187 (diff) | |
| download | openssh-git-ec1ddb72a146fd66d18df9cd423517453a5d8044.tar.gz | |
upstream: allow certificate validity intervals, sshsig verification
times and authorized_keys expiry-time options to accept dates in the UTC time
zone in addition to the default of interpreting them in the system time zone.
YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if
suffixed with a 'Z' character.
Also allow certificate validity intervals to be specified in raw
seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This
is intended for use by regress tests and other tools that call
ssh-keygen as part of a CA workflow.
bz3468 ok dtucker
OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13
Diffstat (limited to 'sshd.8')
| -rw-r--r-- | sshd.8 | 9 |
1 files changed, 5 insertions, 4 deletions
@@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.319 2022/05/02 05:40:37 jmc Exp $ -.Dd $Mdocdate: May 2 2022 $ +.\" $OpenBSD: sshd.8,v 1.320 2022/08/11 01:56:51 djm Exp $ +.Dd $Mdocdate: August 11 2022 $ .Dt SSHD 8 .Os .Sh NAME @@ -533,8 +533,9 @@ controlled via the option. .It Cm expiry-time="timespec" Specifies a time after which the key will not be accepted. -The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time -in the system time-zone. +The time may be specified as a YYYYMMDD[Z] date or a YYYYMMDDHHMM[SS][Z] time. +Dates and times will be interpreted in the system time zone unless suffixed +by a Z character, in which case they will be interpreted in the UTC time zone. .It Cm from="pattern-list" Specifies that in addition to public key authentication, either the canonical name of the remote host or its IP address must be present in the |