From owner-freebsd-security@FreeBSD.ORG Mon Aug 15 03:55:22 2005 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9E70116A41F for ; Mon, 15 Aug 2005 03:55:22 +0000 (GMT) (envelope-from freebsd-security@auscert.org.au) Received: from titania.auscert.org.au (gw.auscert.org.au [203.5.112.28]) by mx1.FreeBSD.org (Postfix) with ESMTP id 170DC43D48 for ; Mon, 15 Aug 2005 03:55:21 +0000 (GMT) (envelope-from freebsd-security@auscert.org.au) Received: from app.auscert.org.au (app [10.0.1.192]) by titania.auscert.org.au (8.12.10/8.12.10) with ESMTP id j7F3tCco021568 for ; Mon, 15 Aug 2005 13:55:12 +1000 (EST) Received: from app.auscert.org.au (localhost.auscert.org.au [127.0.0.1]) by app.auscert.org.au (8.13.1/8.13.1) with ESMTP id j7F3tISY066942 for ; Mon, 15 Aug 2005 13:55:18 +1000 (EST) (envelope-from freebsd-security@auscert.org.au) Message-Id: <200508150355.j7F3tISY066942@app.auscert.org.au> To: freebsd-security@freebsd.org from: freebsd-security@auscert.org.au Date: Mon, 15 Aug 2005 13:55:18 +1000 Subject: recompile sshd with OPIE? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2005 03:55:22 -0000 Hi, I'm having trouble getting an answer to the following problem on -questions - I hope someone here has done something similar and can help. I'd like to compile support for FreeBSD OPIE into sshd. Presently I have to use PAM to achieve one-time password support. On a 4.x system I have in /etc/ssh/sshd_config ChallengeResponseAuthentication yes and in /etc/pam.conf sshd auth sufficient pam_opie.so no_fake_prompts To avoid the extra PAM process on 5.x, I'd prefer to just enable OPIE in the sshd binary, but I'm not sure if this is possible with a commandline option to make. I would like to rebuild it in the usual way: # cd /usr/src/secure/usr.sbin/sshd # make obj && make depend && make all install but somehow define OPIE or, I think, include the configure option --with-skey=PATH, or both. Can this be achieved within the regular system build process, or must I roll my own? thanks, joel -- Joel Hatton -- Security Analyst | Hotline: +61 7 3365 4417 AusCERT - Australia's national CERT | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert@auscert.org.au