freebsd security - Aug 2005 - recompile sshd with OPIE?

Hi,

I'm having trouble getting an answer to the following problem on -questions
- I hope someone here has done something similar and can help.

I'd like to compile support for FreeBSD OPIE into sshd. Presently I have
to use PAM to achieve one-time password support. On a 4.x system I have
in /etc/ssh/sshd_config

ChallengeResponseAuthentication yes

and in /etc/pam.conf

sshd    auth    sufficient      pam_opie.so     no_fake_prompts

To avoid the extra PAM process on 5.x, I'd prefer to just enable OPIE in
the sshd binary, but I'm not sure if this is possible with a commandline
option to make. I would like to rebuild it in the usual way:

# cd /usr/src/secure/usr.sbin/sshd
# make obj && make depend && make all install

but somehow define OPIE or, I think, include the configure option
--with-skey=PATH, or both.

Can this be achieved within the regular system build process, or must I
roll my own?

thanks,
joel

-- Joel Hatton --
Security Analyst                    | Hotline: +61 7 3365 4417
AusCERT - Australia's national CERT | Fax:     +61 7 3365 7031
The University of Queensland        | WWW:     www.auscert.org.au
Qld 4072 Australia                  | Email:   auscert@auscert.org.au

freebsd-security@auscert.org.au writes:
> Can this be achieved within the regular system build process, or must I
> roll my own?
You need to change src/crypto/openssh/config.h so it says

/* #undef PAM */
#define SKEY 1
#define OPIE 1

instead of

#define PAM 1
/* #undef SKEY */
/* #undef OPIE */

then rebuild world.

DES
-- 
Dag-Erling Sm?rgrav - des@des.no

Dag-Erling Sm?rgrav wrote:
> freebsd-security@auscert.org.au writes:
>>Can this be achieved within the regular system build process, or must I
>>roll my own?
> 
> You need to change src/crypto/openssh/config.h so it says
> 
> /* #undef PAM */
> #define SKEY 1
> #define OPIE 1
> 
> instead of
> 
> #define PAM 1
> /* #undef SKEY */
> /* #undef OPIE */
> 
> then rebuild world.
Aha!  I bet ports/security/fwtk would be much happier if SKEY was around.
Were these enabled some time ago and since disabled...?

-- 
-Chuck