Use a suffix rule. I would have just commented out the skey entry instead,
since it is rarely used and we already do that for kerberos. We could now
use MKKERBEROS to enable it by default, since we have the machinery...

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.11.18;
Install racoon pam file.

Add cron.

Add a new pam description file for the xserver. This is used when the
Xserver is started manually using xinit.

add display_manager and ppp

Major cleanup of PAM service configuration files.

Backout last change. I'm not sure what the correct fix is but the last
change wasn't it.

Fix this so that "make install" will actually work.

don't bother linking ftp -> ftpd

NetBSD Is Not FreeBSD:
* use CONFIGFILES instead of FILES
* use CONFIGLINKS instead of LINKS

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Fix spelling/typo.

update todo items.

passwd(1) does not require -p to use PAM.

update for current reality.

Mention the problem with ftpusers and that we have a ppp config now.

Update status.

Update racoon status

update for rexecd

Update for ppp and passwd.

rsh is done.

ftpd is done.

Update.

Add a status file so that we can coordinate who works on what.

Add cron.

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.6.2;
pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.5.40; 1.5.50; 1.5.58;
add want_agent to the commented line of pam_ssh

Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.3.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

Disable pam_ssh by default, and refer people to pam_ssh(8) for information
on its security risks.

Major cleanup of PAM service configuration files.

branches: 1.1.4;
Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.8.2;
pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.7.58; 1.7.68; 1.7.76;
Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.6.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

Major cleanup of PAM service configuration files.

whitespace

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

branches: 1.1.4;
Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

Set the pam_nologin call to keep our current behavior: login is refused
after password is given.

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Add a config file for ppp; same like ftp for now.

branches: 1.1.4; 1.1.6;
PR/29634: me: missing pam racoon file.

disable pam_ftpusers module because our /etc/ftpusers has different syntax
than what it expects.

Major cleanup of PAM service configuration files.

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

allow rsh if the user's password is null. from christos.

branches: 1.4.2;
PR/29594: Geoff C. Wing: Allow root in rsh like we used to.

Major cleanup of PAM service configuration files.

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.10.2;
pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.9.58; 1.9.68; 1.9.76;
Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.8.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

remove stray l.

Remove ,optional accidentally committed. We are not going to do this after
all.

branches: 1.5.2;
comment out pam_ssh and mention it has potential security issues.

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

branches: 1.1.4;
Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.9.2;
pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.8.6;
Add a commented out entry for pam_u2f.so

branches: 1.7.58; 1.7.66; 1.7.68;
Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.6.20;
PR/29891: Arto Selonen: su(1) does not seem to honor SU_ROOTAUTH any more
Move the rootauth group line before the wheel check, so that rootauth users
are not required to be in wheel [still commented out]

use the ksu module not the krb one. Do kerberos authentication first.

Major cleanup of PAM service configuration files.

Add a commented out option that shows how to get back the rootauth
functionality

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

branches: 1.1.4;
Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

branches: 1.9.2;
pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.8.58; 1.8.68; 1.8.76;
Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.7.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

Add a no nested option that avoids updating the {u,w}tmp databases on a
nested login.

Major cleanup of PAM service configuration files.

Remove pam_ssh for system config, it's not always used.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

branches: 1.1.4;
Wipe out pam_skey.so usage when MKSKEY=no

This fixes the ability to log into the system when it has been built
with MKSKEY=no.

I've built a release with the default MKSKEY value (yes) and without,
and confirmed that the former keeps the pam_skey entries in place and
the latter does not.

correct line for "password"

branches: 1.5.2;
Make a note about when telnetd uses the "telnetd" PAM service, and
when the "login" PAM service is used instead.

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

Major cleanup of PAM service configuration files.

add ssh and krb5 now that they compile

- Add NetBSD RCSID's
- comment out opie since we don't have it.

branches: 1.1.1;
Initial revision

pam_self is "required" not just sufficient to authorize the Xserver.

branches: 1.2.2;
by popular demand, and now that we have verified that password authentication
works, allow a user to start the Xserver without a password.

Add a new pam description file for the xserver. This is used when the
Xserver is started manually using xinit.