From owner-freebsd-security@FreeBSD.ORG  Tue Aug 16 01:03:24 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A034E16A41F
	for <freebsd-security@freebsd.org>;
	Tue, 16 Aug 2005 01:03:24 +0000 (GMT)
	(envelope-from freebsd-security@auscert.org.au)
Received: from titania.auscert.org.au (gw.auscert.org.au [203.5.112.28])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1487943D48
	for <freebsd-security@freebsd.org>;
	Tue, 16 Aug 2005 01:03:23 +0000 (GMT)
	(envelope-from freebsd-security@auscert.org.au)
Received: from app.auscert.org.au (app [10.0.1.192])
	by titania.auscert.org.au (8.12.10/8.12.10) with ESMTP id
	j7G13Eco030625 for <freebsd-security@freebsd.org>;
	Tue, 16 Aug 2005 11:03:14 +1000 (EST)
Received: from app.auscert.org.au (localhost.auscert.org.au [127.0.0.1])
	by app.auscert.org.au (8.13.1/8.13.1) with ESMTP id j7G13MUj057073
	for <freebsd-security@freebsd.org>;
	Tue, 16 Aug 2005 11:03:22 +1000 (EST)
	(envelope-from freebsd-security@auscert.org.au)
Message-Id: <200508160103.j7G13MUj057073@app.auscert.org.au>
To: freebsd-security@freebsd.org
from: freebsd-security@auscert.org.au
In-Reply-To: Message from des@des.no (=?iso-8859-1?q?Dag-Erling_Sm=F8rgrav?=) 
	of "Mon, 15 Aug 2005 14:14:12 +0200." <86wtmnqtwr.fsf@xps.des.no> 
Date: Tue, 16 Aug 2005 11:03:22 +1000
Subject: Re: recompile sshd with OPIE? 
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Aug 2005 01:03:24 -0000

> freebsd-security@auscert.org.au writes:
> > Can this be achieved within the regular system build process, or must I
> > roll my own?
> 
> You need to change src/crypto/openssh/config.h so it says
> 
> /* #undef PAM */
> #define SKEY 1
> #define OPIE 1
> 
> instead of
> 
> #define PAM 1
> /* #undef SKEY */
> /* #undef OPIE */
> 
> then rebuild world.

Thanks - that is extremely helpful. Given that this involves modification
of CVS files I'll create a localised patch for myself. I believe that I
should be able to follow the independent build process for openssh rather
than building world; at least, I'll try that first.

joel

-- Joel Hatton --
Security Analyst                    | Hotline: +61 7 3365 4417
AusCERT - Australia's national CERT | Fax:     +61 7 3365 7031
The University of Queensland        | WWW:     www.auscert.org.au
Qld 4072 Australia                  | Email:   auscert@auscert.org.au