add LIBKRB5_LDADD/LIBKRB5_DPADD and their static counterparts
to bsd.prog.mk. use them instead of hard coding various lists
of libraries for krb5.

this fixes static builds.

add sqlite3

branches: 1.44.8; 1.44.10; 1.44.12; 1.44.16; 1.44.18;
Keep the built-in support for passwd -k, but don't make the kpasswd link or
install the kpasswd man page since these are provided by heimdal. I ifdef'ed
them so that the code to install them is still with the Makefile.

don't build kpasswd; heimdal does it for us.

branches: 1.42.4; 1.42.6; 1.42.10; 1.42.12; 1.42.14;
We no longer need -I/usr/include/krb5.

Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on the
FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to
various string and memory copy and set functions (as well as a few system
calls and other miscellany) where known at function entry. RedHat has
evidently built all "core system packages" with this option for some time.

This option should be used at the top of Makefiles (or Makefile.inc where
this is used for subdirectories) but after any setting of LIB.

This is only useful for userland code, and cannot be used in libc or in
any code which includes the libc internals, because it overrides certain
libc functions with macros. Some effort has been made to make USE_FORT=yes
work correctly for a full-system build by having the bsd.sys.mk logic
disable the feature where it should not be used (libc, libssp iteself,
the kernel) but no attempt has been made to build the entire system with
USE_FORT and doing so will doubtless expose numerous bugs and misfeatures.

Adjust the system build so that all programs and libraries that are setuid,
directly handle network data (including serial comm data), perform
authentication, or appear likely to have (or have a history of having)
data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default,
with the exception of libc, which cannot use USE_FORT and thus uses
only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no
per-directory or in a system build will disable if desired.

Introduce PAM_STATIC_LDADD and PAM_STATIC_DPADD. When compiling
with MKPIC=no, possibly because the target does not support shared
libraries, these include libraries required to resolve all symbols
which end up referenced from PAM-using applications. The libraries
presently required are -lcrypt, -lrpcsvc and -lutil.

Add use of these variables which are currently set up to use PAM,
so that they compile when MKPIC=no.

Also, in the telnetd case, reorder the order of the libraries, so
that libtelnet.a comes before -ltermcap and -lutil, again to fix
link error when MKPIC=no.

Discussed with thorpej and christos.

Remove COPTS+=-g.

Magor rework of passwd(1) for the PAM case. Add "-d <database>" option,
similar to Solaris's "-r <repository" or Mac OS X's "-i <infosystem>",
to select the password database (files, nis, krb5). Otherwise, we default
to using whatever PAM decides.

Add a PAM passwd module.
XXX: This avoids the issue of supporting separate -l -y -k, but is the behavior
correct? Should passwd -p disable all other passwd methods? Should it become
the default if compiled in?

use pw_gensalt() and don't dig into libcrypt.

Add support for SHA1 hashed passwords.
The algorithm used is essentially PBKDF1 from RFC 2898 but using
hmac_sha1 rather than SHA1 directly (suggested by smb@research.att.com).

* The format of the encrypted password is:
* $<tag>$<iterations>$<salt>$<digest>
*
* where:
* <tag> is "sha1"
* <iterations> is an unsigned int identifying how many rounds
* have been applied to <digest>. The number
* should vary slightly for each password to make
* it harder to generate a dictionary of
* pre-computed hashes. See crypt_sha1_iterations.
* <salt> up to 64 bytes of random data, 8 bytes is
* currently considered more than enough.
* <digest> the hashed password.

hmac.c implementes HMAC as defined in RFC 2104 and includes a unit
test for both hmac_sha1 and hmac_sha1 using a selection of the Known
Answer Tests from RFC 2202.

It is worth noting that to be FIPS compliant the hmac key (password)
should be 10-20 chars.

remove unnecessary rules

Don't build a separate kpasswd program, passwd can handle Kerberos
password changing. Fixes last part of bin/14988.

add DPADD.

Split the notion of building Hesiod, Kerberos, S/key, and YP
infrastructure and using that infrastructure in programs.

* MKHESIOD, MKKERBEROS, MKSKEY, and MKYP control building
of the infratsructure (libraries, support programs, etc.)

* USE_HESIOD, USE_KERBEROS, USE_SKEY, and USE_YP control
building of support for using the corresponding API
in various libraries/programs that can use it.

As discussed on tech-toolchain.

Remove INSTALLFLAGS=-fschg, as per change to usr.bin/ssh/ssh/Makefile.

remove -lvers, it's not used

update build infrastructure for heimdal 0.3a

Add pwd_gensalt() - generates password salt/setting for crypt(), based upon
target user and information obtained from passwd.conf. From OpenBSD.

Add a MKKERBEROS check to enable/disable kerberos support during the build.

branches: 1.25.2;
Merge a bunch of things from crypto-us and crypto-intl into basesrc,
adding support for Heimdal/KTH Kerberos where easy to do so. Eliminate
bsd.crypto.mk.

There is still a bunch more work to do, but crypto is now more-or-less
fully merged into the base NetBSD distribution.

branches: 1.24.2;
Wrap login.conf database access in ifdef LOGIN_CAP.

Fix yppasswd part of passwd. This has never worked since the
password map was split and master.passwd.byname was introduced.

XXX This is a temporary fix until luke finds some time to add
the necessary support glue to libc for TRT.

optionally include CRYPTOPATH Makefile.frag files.

Use bsd.crypto.mk.

Remove the crypto-related bits until such time as we have a fully-
integrated source tree. Export-controlled versions of these are now
built during the domestic build process.

use CPPFLAGS instead of CFLAGS

branches: 1.18.2;
find "namespace.h" ...

Back out the .PATH.c changes. The .depend problem (and others)
will be fixed using the new .NOPATH make feature instead.

Use .PATH.c: ...

remove vestigal Berkeley kpasswdd support

Sync with 4.4BSD-Lite2 (whew!)

Slight semantics change: ALWAYS use YP if the system is bound to a
YP server. This is required if the passwd database is to stay in sync
if this program is run on the YP server. Note, local passwd database
operations can still be performed by passing the -l flag.

Also, some minor cleanup and RCS id police.

Updated to use new password file functions in libutil.
From Greg Hudson <ghudson@MIT.EDU>.

Fix minor -Ibooboo

Make passwd work with a link to yppasswd. (From Jason Thorpe)

Patch from Giles Lean to make compilation flags more consistent.

Fix krb4 build. From Michael Graff <explorer@vorpal.com>

branches: 1.7.2;
Add conditional kerberosIV and kerberos5 support

always use libcrypt

Add RCS identifiers.

Add YP support.

changed to use new libcrypt scheme.

added support for using real crypt

branches: 1.1.1;
Initial revision