- Update to OpenSSH 2.9.9

- convert portname into lowercase
- PREFIX support for default sshd_config
- security-patch for cookie files obsolete

15 files changed, 111 insertions, 274 deletions

diff --git a/security/openssh/Makefile b/security/openssh/Makefile
index 0e333046cfd6..acc7e115be27 100644
--- a/security/openssh/Makefile
+++ b/security/openssh/Makefile
@@ -5,9 +5,8 @@
 # $FreeBSD$
 #
 
-PORTNAME=	OpenSSH
-PORTVERSION=	2.9
-PORTREVISION=	3
+PORTNAME=	openssh
+PORTVERSION=	2.9.9
 CATEGORIES=	security
 MASTER_SITES=	ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/ \
 		ftp://ftp.usa.openbsd.org/pub/OpenBSD/OpenSSH/ \
@@ -67,6 +66,8 @@ MAKE_ENV+=	SKEY=yes
 WRKSRC=		${WRKDIR}/ssh
 
 post-extract:
+	@${PERL5} -pi -e "s=/etc/ssh=${PREFIX}/etc/ssh=" ${WRKSRC}/sshd_config
+	@${PERL5} -pi -e "s=/usr/libex=${PREFIX}/libex=" ${WRKSRC}/sshd_config
 	@${CP} ${FILESDIR}/strlcat.c ${FILESDIR}/strlcpy.c ${WRKSRC}/lib/
 	@${CP} ${FILESDIR}/sshd.sh ${WRKSRC}/
 .if ${OSVERSION} < 400014
@@ -85,12 +86,16 @@ post-patch:
 post-configure:
 .for i in ${FIXME}
 	@${PERL5} -pi -e "s=KERBEROS[:]L=KERBEROS=" ${WRKSRC}/${i}
+	@${PERL5} -pi -e "s=KERBEROS5[:]L=KERBEROS5=" ${WRKSRC}/${i}
 	@${PERL5} -pi -e "s=AFS[:]L=AFS=" ${WRKSRC}/${i}
 	@${PERL5} -pi -e "s=TCP_WRAPPERS[:]L=TCP_WRAPPERS=" ${WRKSRC}/${i}
 	@${PERL5} -pi -e "s=SKEY[:]L=SKEY=" ${WRKSRC}/${i}
 .endfor
 .endif
 
+pre-install:
+	${MKDIR} ${PREFIX}/libdata/ssh
+
 post-install:
 .if !defined(BATCH)
 .if !exists(${PREFIX}/etc/ssh_host_key)
diff --git a/security/openssh/distinfo b/security/openssh/distinfo
index 3025d4d125f2..9c29f03dd22f 100644
--- a/security/openssh/distinfo
+++ b/security/openssh/distinfo
@@ -1 +1 @@
-MD5 (openssh-2.9.tgz) = 80b842f8bae8786b2a8b81ba8a09772a
+MD5 (openssh-2.9.9.tgz) = 73723991c8af44e75af74ae7a79b91ae
diff --git a/security/openssh/files/patch-aa b/security/openssh/files/patch-aa
index d6e6c1fa3506..f3ef9a1aac9d 100644
--- a/security/openssh/files/patch-aa
+++ b/security/openssh/files/patch-aa
@@ -1,13 +1,13 @@
---- Makefile.orig	Sun Feb  4 12:11:53 2001
-+++ Makefile	Sat May 26 16:03:54 2001
+--- Makefile.orig	Thu Jun 28 23:55:27 2001
++++ Makefile	Wed Oct  3 12:17:35 2001
 @@ -1,14 +1,15 @@
- #	$OpenBSD: Makefile,v 1.8 2001/02/04 11:11:53 djm Exp $
+ #	$OpenBSD: Makefile,v 1.9 2001/06/28 21:55:27 markus Exp $
  
  .include <bsd.own.mk>
 +.include "Makefile.inc"
  
  SUBDIR=	lib ssh sshd ssh-add ssh-keygen ssh-agent scp sftp-server \
- 	ssh-keyscan sftp
+ 	ssh-keyscan sftp scard
  
  distribution:
 -	install -C -o root -g wheel -m 0644 ${.CURDIR}/ssh_config \
diff --git a/security/openssh/files/patch-ab b/security/openssh/files/patch-ab
index d5f8ab95fa69..d4874c8b85c7 100644
--- a/security/openssh/files/patch-ab
+++ b/security/openssh/files/patch-ab
@@ -1,6 +1,6 @@
---- Makefile.inc.orig	Fri Feb 11 23:56:29 2000
-+++ Makefile.inc	Fri Feb 11 23:57:56 2000
-@@ -2,10 +2,14 @@
+--- Makefile.inc.orig	Sun Jul 29 16:00:07 2001
++++ Makefile.inc	Wed Oct  3 13:49:31 2001
+@@ -17,10 +17,16 @@
  
  .include <bsd.obj.mk>
  
@@ -10,12 +10,14 @@
 -.else
 +AFS?=		no
 +KERBEROS?=	no
++KERBEROS5?=	no
 +PAM?=		no
 +SKEY?=		no
 +TCP_WRAPPERS?=	yes
-+.if !defined(MAKEFILE_INC_FIRST_PASS)
-+MAKEFILE_INC_FIRST_PASS=	0
++
 +CFLAGS+=	-I${OPENSSLINC} ${INET6FLAGS}
++
++.if !defined(IGNORE_LIBSSH)
  LDADD+=         -L${.CURDIR}/../lib -lssh
  DPADD+=         ${.CURDIR}/../lib/libssh.a
  .endif
diff --git a/security/openssh/files/patch-ad b/security/openssh/files/patch-ad
index 1987f6c152cc..7dcdab138466 100644
--- a/security/openssh/files/patch-ad
+++ b/security/openssh/files/patch-ad
@@ -1,23 +1,26 @@
---- lib/Makefile.orig	Tue Apr  3 21:53:30 2001
-+++ lib/Makefile	Sat May 26 14:39:03 2001
-@@ -8,7 +8,12 @@
- 	hostfile.c log.c match.c mpaux.c nchan.c packet.c readpass.c \
+--- lib/Makefile.orig	Mon Sep 24 22:34:07 2001
++++ lib/Makefile	Wed Oct  3 13:45:40 2001
+@@ -9,10 +9,14 @@
  	rsa.c tildexpand.c ttymodes.c uidswap.c xmalloc.c atomicio.c \
  	key.c dispatch.c kex.c mac.c uuencode.c misc.c \
--	cli.c rijndael.c ssh-dss.c ssh-rsa.c dh.c kexdh.c kexgex.c
-+	cli.c rijndael.c ssh-dss.c ssh-rsa.c dh.c kexdh.c kexgex.c \
-+	strlcpy.c strlcat.c
-+
+ 	rijndael.c ssh-dss.c ssh-rsa.c dh.c kexdh.c kexgex.c \
+-	scard.c
++	scard.c strlcpy.c strlcat.c
+ 
+ SRCS+=	readpassphrase.c
+ 
 +.if defined(COMPAT_GETADDRINFO)
 +SRCS+=	getaddrinfo.c getnameinfo.c name6.c rcmd.c bindresvport.c
 +.endif
- 
++
  NOPROFILE= yes
  NOPIC=	yes
-@@ -17,6 +22,7 @@
+ 
+@@ -20,6 +24,8 @@
  	@echo -n
  
  .include <bsd.own.mk>
++IGNORE_LIBSSH=yes
 +.include "../Makefile.inc"
  
  .if (${KERBEROS:L} == "yes")
diff --git a/security/openssh/files/patch-ag b/security/openssh/files/patch-ag
index 7f0fa7e85871..6971b0cfacf1 100644
--- a/security/openssh/files/patch-ag
+++ b/security/openssh/files/patch-ag
@@ -1,5 +1,5 @@
---- ssh/Makefile.orig	Sat Apr 14 18:33:20 2001
-+++ ssh/Makefile	Sat May 26 14:54:24 2001
+--- ssh/Makefile.orig	Tue Sep 11 00:44:47 2001
++++ ssh/Makefile	Wed Oct  3 13:54:47 2001
 @@ -7,8 +7,8 @@
  
  BINMODE?=4555
@@ -11,12 +11,17 @@
  LINKS=	${BINDIR}/ssh ${BINDIR}/slogin
  MLINKS=	ssh.1 slogin.1
  
-@@ -16,10 +16,11 @@
+@@ -16,6 +16,7 @@
  	sshconnect.c sshconnect1.c sshconnect2.c
  
  .include <bsd.own.mk> # for AFS
 +.include "../Makefile.inc"
  
+ .if (${KERBEROS5:L} == "yes")
+ CFLAGS+= -DKRB5 -I${DESTDIR}/usr/include/kerberosV
+@@ -24,8 +25,8 @@
+ .endif # KERBEROS5
+ 
  .if (${KERBEROS:L} == "yes")
 -CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
 -LDADD+=	 -lkrb
@@ -25,12 +30,11 @@
  DPADD+=	 ${LIBKRB}
  .if (${AFS:L} == "yes")
  CFLAGS+= -DAFS
-@@ -29,6 +30,7 @@
- .endif # KERBEROS
+@@ -36,5 +37,5 @@
  
  .include <bsd.prog.mk>
-+.include "../Makefile.inc"
  
 -LDADD+=	-lcrypto -lz
-+LDADD+=	${CRYPTOLIBS} -lz
- DPADD+=	${LIBCRYPTO} ${LIBZ}
+-DPADD+=	${LIBCRYPTO} ${LIBZ}
++LDADD+= ${CRYPTOLIBS} -lcrypt -lutil -lz
++DPADD+= ${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
diff --git a/security/openssh/files/patch-ao b/security/openssh/files/patch-ao
index d81a41d4bc82..f4b4eea96218 100644
--- a/security/openssh/files/patch-ao
+++ b/security/openssh/files/patch-ao
@@ -1,35 +1,24 @@
---- sshd_config.orig	Sat May 26 14:48:18 2001
-+++ sshd_config	Sat May 26 15:15:11 2001
-@@ -7,13 +7,13 @@
- #Protocol 2,1
- #ListenAddress 0.0.0.0
- #ListenAddress ::
--HostKey /etc/ssh_host_key
--HostKey /etc/ssh_host_rsa_key
--HostKey /etc/ssh_host_dsa_key
-+HostKey /usr/local/etc/ssh_host_key
-+HostKey /usr/local/etc/ssh_host_rsa_key
-+HostKey /usr/local/etc/ssh_host_dsa_key
- ServerKeyBits 768
+--- sshd_config.orig	Thu Sep 20 22:57:51 2001
++++ sshd_config	Wed Oct  3 12:37:28 2001
+@@ -25,8 +25,8 @@
+ 
+ # Authentication:
+ 
 -LoginGraceTime 600
-+LoginGraceTime 120
- KeyRegenerationInterval 3600
 -PermitRootLogin yes
++LoginGraceTime 120
 +PermitRootLogin no
- #
- # Don't read ~/.rhosts and ~/.shosts files
- IgnoreRhosts yes
-@@ -57,10 +57,10 @@
- #KerberosTgtPassing yes
+ StrictModes yes
  
- #CheckMail yes
--#UseLogin no
-+UseLogin no
+ RSAAuthentication yes
+@@ -66,8 +66,9 @@
+ #PrintLastLog no
+ KeepAlive yes
+ #UseLogin no
++UseLogin yes
  
 -#MaxStartups 10:30:60
 +MaxStartups 10:30:60
  #Banner /etc/issue.net
  #ReverseMappingCheck yes
  
--Subsystem	sftp	/usr/libexec/sftp-server
-+Subsystem	sftp	/usr/local/libexec/sftp-server
diff --git a/security/openssh/files/patch-at b/security/openssh/files/patch-at
index 66049dac99c2..e4a81598a8f8 100644
--- a/security/openssh/files/patch-at
+++ b/security/openssh/files/patch-at
@@ -1,12 +1,13 @@
---- sshconnect.c-	Tue Feb 15 22:00:22 2000
-+++ sshconnect.c	Tue Feb 15 22:00:27 2000
-@@ -1080,9 +1080,11 @@
- 	case AF_INET:
- 		local = (ntohl(((struct sockaddr_in *)hostaddr)->sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
+--- sshconnect.c.orig	Wed Jul 25 16:35:18 2001
++++ sshconnect.c	Wed Oct  3 12:42:20 2001
+@@ -567,10 +567,12 @@
+ 		local = (ntohl(((struct sockaddr_in *)hostaddr)->
+ 		   sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
  		break;
 +#ifdef INET6
  	case AF_INET6:
- 		local = IN6_IS_ADDR_LOOPBACK(&(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
+ 		local = IN6_IS_ADDR_LOOPBACK(
+ 		    &(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
  		break;
 +#endif
  	default:
diff --git a/security/openssh/files/patch-au b/security/openssh/files/patch-au
index 35bb978e08c1..596e74cb551f 100644
--- a/security/openssh/files/patch-au
+++ b/security/openssh/files/patch-au
@@ -1,6 +1,6 @@
---- session.c.orig	Tue Apr 17 21:34:25 2001
-+++ session.c	Mon Jun 25 07:51:19 2001
-@@ -58,6 +58,12 @@
+--- session.c.orig	Sun Sep 16 16:46:54 2001
++++ session.c	Wed Oct  3 12:50:00 2001
+@@ -57,6 +57,12 @@
  #include "canohost.h"
  #include "session.h"
  
@@ -13,7 +13,7 @@
  /* types */
  
  #define TTYSZ 64
-@@ -461,6 +467,13 @@
+@@ -392,6 +398,13 @@
  		log_init(__progname, options.log_level, options.log_facility, log_stderr);
  
  		/*
@@ -27,10 +27,11 @@
  		 * Create a new session and process group since the 4.4BSD
  		 * setlogin() affects the entire process group.
  		 */
-@@ -566,6 +579,13 @@
+@@ -497,6 +510,14 @@
+ 
  		/* Child.  Reinitialize the log because the pid has changed. */
  		log_init(__progname, options.log_level, options.log_facility, log_stderr);
- 
++
 +		/*
 +		 * Using login and executing a specific "command" are mutually
 +		 * exclusive, so turn off use_login if there's a command.
@@ -41,7 +42,7 @@
  		/* Close the master side of the pseudo tty. */
  		close(ptyfd);
  
-@@ -639,6 +659,11 @@
+@@ -591,6 +612,11 @@
  	time_t last_login_time;
  	struct passwd * pw = s->pw;
  	pid_t pid = getpid();
@@ -53,7 +54,7 @@
  
  	/*
  	 * Get IP address of client. If the connection is not a socket, let
-@@ -679,6 +704,21 @@
+@@ -631,6 +657,21 @@
  			printf("Last login: %s from %s\r\n", time_string, hostname);
  	}
  
@@ -75,7 +76,7 @@
  	do_motd();
  }
  
-@@ -914,6 +954,10 @@
+@@ -857,6 +898,10 @@
  	env[0] = NULL;
  
  	if (!options.use_login) {
@@ -86,7 +87,7 @@
  		/* Set basic environment. */
  		child_set_env(&env, &envsize, "USER", pw->pw_name);
  		child_set_env(&env, &envsize, "LOGNAME", pw->pw_name);
-@@ -921,6 +965,12 @@
+@@ -864,6 +909,12 @@
  #ifdef HAVE_LOGIN_CAP
  		(void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH);
  		child_set_env(&env, &envsize, "PATH", getenv("PATH"));
@@ -99,7 +100,7 @@
  #else
  		child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
  #endif
-@@ -932,8 +982,13 @@
+@@ -875,8 +926,13 @@
  		/* Normal systems set SHELL by default. */
  		child_set_env(&env, &envsize, "SHELL", shell);
  	}
@@ -113,7 +114,7 @@
  
  	/* Set custom environment options from RSA authentication. */
  	while (custom_environment) {
-@@ -1027,7 +1082,7 @@
+@@ -968,7 +1024,7 @@
  	 * initgroups, because at least on Solaris 2.3 it leaves file
  	 * descriptors open.
  	 */
@@ -122,7 +123,7 @@
  		close(i);
  
  	/* Change current directory to the user\'s home directory. */
-@@ -1051,6 +1106,28 @@
+@@ -1004,6 +1060,28 @@
  	 * in this order).
  	 */
  	if (!options.use_login) {
@@ -150,4 +151,4 @@
 +#endif /* __FreeBSD__ */
  		/* ignore _PATH_SSH_USER_RC for subsystems */
  		if (!s->is_subsystem && (stat(_PATH_SSH_USER_RC, &st) >= 0)) {
- 			if (debug_flag)
+ 			snprintf(cmd, sizeof cmd, "%s -c '%s %s'",
diff --git a/security/openssh/files/patch-cookie b/security/openssh/files/patch-cookie
deleted file mode 100644
index 92cc4ab7570d..000000000000
--- a/security/openssh/files/patch-cookie
+++ /dev/null
@@ -1,193 +0,0 @@
---- channels.c.orig	Tue Apr 17 14:55:03 2001
-+++ channels.c	Sat Jun  9 06:43:41 2001
-@@ -1612,7 +1612,7 @@
- 		switch (channels[i].type) {
- 		case SSH_CHANNEL_AUTH_SOCKET:
- 			close(channels[i].sock);
--			unlink(channels[i].path);
-+			/* auth_sock_cleanup_proc deletes the socket */
- 			channel_free(i);
- 			break;
- 		case SSH_CHANNEL_PORT_LISTENER:
-@@ -2524,10 +2524,17 @@
- /* removes the agent forwarding socket */
- 
- void
--cleanup_socket(void)
-+auth_sock_cleanup_proc(void *_pw)
- {
--	unlink(channel_forwarded_auth_socket_name);
--	rmdir(channel_forwarded_auth_socket_dir);
-+	struct passwd *pw = _pw;
-+
-+	if (channel_forwarded_auth_socket_name) {
-+		temporarily_use_uid(pw);
-+		unlink(channel_forwarded_auth_socket_name);
-+		rmdir(channel_forwarded_auth_socket_dir);
-+		channel_forwarded_auth_socket_name = NULL;
-+		restore_uid();
-+	}
- }
- 
- /*
-@@ -2566,11 +2573,9 @@
- 	snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
- 		 channel_forwarded_auth_socket_dir, (int) getpid());
- 
--	if (atexit(cleanup_socket) < 0) {
--		int saved = errno;
--		cleanup_socket();
--		packet_disconnect("socket: %.100s", strerror(saved));
--	}
-+	/* delete agent socket on fatal() */
-+	fatal_add_cleanup(auth_sock_cleanup_proc, pw);
-+
- 	/* Create the socket. */
- 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
- 	if (sock < 0)
---- channels.h.orig	Sat Apr 14 00:46:53 2001
-+++ channels.h	Sat Jun  9 06:43:41 2001
-@@ -303,6 +303,7 @@
- void    auth_input_open_request(int type, int plen, void *ctxt);
- 
- /* XXX */
-+void	auth_sock_cleanup_proc(void *pw);
- int	channel_connect_to(const char *host, u_short host_port);
- int	channel_connect_by_listen_adress(u_short listen_port);
- int	x11_connect_display(void);
---- session.c.orig	Sat Jun  9 06:43:40 2001
-+++ session.c	Sat Jun  9 06:43:41 2001
-@@ -101,6 +101,7 @@
- void	do_child(Session *s, const char *command);
- void	do_motd(void);
- int	check_quietlogin(Session *s, const char *command);
-+void	xauthfile_cleanup_proc(void *pw);
- 
- void	do_authenticated1(Authctxt *authctxt);
- void	do_authenticated2(Authctxt *authctxt);
-@@ -160,18 +161,26 @@
- 		do_authenticated2(authctxt);
- 	else
- 		do_authenticated1(authctxt);
-+
-+	/* remote user's local Xauthority file and agent socket */
-+	if (xauthfile)
-+		xauthfile_cleanup_proc(authctxt->pw);
-+	if (auth_get_socket_name())
-+		auth_sock_cleanup_proc(authctxt->pw);
- }
- 
- /*
-  * Remove local Xauthority file.
-  */
- void
--xauthfile_cleanup_proc(void *ignore)
-+xauthfile_cleanup_proc(void *_pw)
- {
--	debug("xauthfile_cleanup_proc called");
-+	struct passwd *pw = _pw;
-+	char *p;
- 
-+	debug("xauthfile_cleanup_proc called");
- 	if (xauthfile != NULL) {
--		char *p;
-+		temporarily_use_uid(pw);
- 		unlink(xauthfile);
- 		p = strrchr(xauthfile, '/');
- 		if (p != NULL) {
-@@ -180,6 +189,7 @@
- 		}
- 		xfree(xauthfile);
- 		xauthfile = NULL;
-+		restore_uid();
- 	}
- }
- 
-@@ -218,6 +228,7 @@
- 	int success, type, fd, n_bytes, plen, screen_flag, have_pty = 0;
- 	int compression_level = 0, enable_compression_after_reply = 0;
- 	u_int proto_len, data_len, dlen;
-+	struct stat st;
- 
- 	s = session_new();
- 	s->pw = authctxt->pw;
-@@ -300,7 +311,8 @@
- 				packet_send_debug("X11 forwarding disabled in server configuration file.");
- 				break;
- 			}
--			if (!options.xauth_location) {
-+			if (!options.xauth_location ||
-+			    (stat(options.xauth_location, &st) == -1)) {
- 				packet_send_debug("No xauth program; cannot forward with spoofing.");
- 				break;
- 			}
-@@ -354,7 +366,7 @@
- 			if (fd >= 0)
- 				close(fd);
- 			restore_uid();
--			fatal_add_cleanup(xauthfile_cleanup_proc, NULL);
-+			fatal_add_cleanup(xauthfile_cleanup_proc, s->pw);
- 			success = 1;
- 			break;
- 
-@@ -408,9 +420,6 @@
- 
- 			if (command != NULL)
- 				xfree(command);
--			/* Cleanup user's local Xauthority file. */
--			if (xauthfile)
--				xauthfile_cleanup_proc(NULL);
- 			return;
- 
- 		default:
-@@ -1113,10 +1122,11 @@
- #endif /* __FreeBSD__ */
- 		/* ignore _PATH_SSH_USER_RC for subsystems */
- 		if (!s->is_subsystem && (stat(_PATH_SSH_USER_RC, &st) >= 0)) {
-+			snprintf(cmd, sizeof cmd, "%s -c '%s %s'",
-+			    shell, _PATH_BSHELL, _PATH_SSH_USER_RC);
- 			if (debug_flag)
--				fprintf(stderr, "Running %s %s\n", _PATH_BSHELL,
--				    _PATH_SSH_USER_RC);
--			f = popen(_PATH_BSHELL " " _PATH_SSH_USER_RC, "w");
-+				fprintf(stderr, "Running %s\n", cmd);
-+			f = popen(cmd, "w");
- 			if (f) {
- 				if (do_xauth)
- 					fprintf(f, "%s %s\n", s->auth_proto,
-@@ -1433,6 +1443,7 @@
- session_x11_req(Session *s)
- {
- 	int fd;
-+	struct stat st;
- 	if (no_x11_forwarding_flag) {
- 		debug("X11 forwarding disabled in user configuration file.");
- 		return 0;
-@@ -1441,6 +1452,11 @@
- 		debug("X11 forwarding disabled in server configuration file.");
- 		return 0;
- 	}
-+	if (!options.xauth_location ||
-+	    (stat(options.xauth_location, &st) == -1)) {
-+		packet_send_debug("No xauth program; cannot forward with spoofing.");
-+		return 0;
-+	}
- 	if (xauthfile != NULL) {
- 		debug("X11 fwd already started.");
- 		return 0;
-@@ -1481,7 +1497,7 @@
- 	if (fd >= 0)
- 		close(fd);
- 	restore_uid();
--	fatal_add_cleanup(xauthfile_cleanup_proc, s);
-+	fatal_add_cleanup(xauthfile_cleanup_proc, s->pw);
- 	return 1;
- }
- 
-@@ -1775,6 +1791,4 @@
- {
- 
- 	server_loop2();
--	if (xauthfile)
--		xauthfile_cleanup_proc(NULL);
- }
diff --git a/security/openssh/files/patch-rijndael.c b/security/openssh/files/patch-rijndael.c
new file mode 100644
index 000000000000..b4534f82c8d6
--- /dev/null
+++ b/security/openssh/files/patch-rijndael.c
@@ -0,0 +1,10 @@
+--- rijndael.c.orig	Thu Sep 13 11:48:39 2001
++++ rijndael.c	Wed Oct  3 13:40:27 2001
+@@ -27,6 +27,7 @@
+  */
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/types.h>
+ 
+ #include "rijndael.h"
+ 
diff --git a/security/openssh/files/patch-scard-Makefile b/security/openssh/files/patch-scard-Makefile
new file mode 100644
index 000000000000..2aa5f24190ee
--- /dev/null
+++ b/security/openssh/files/patch-scard-Makefile
@@ -0,0 +1,11 @@
+--- scard/Makefile.orig	Fri Jun 29 09:02:09 2001
++++ scard/Makefile	Wed Oct  3 14:14:55 2001
+@@ -3,7 +3,7 @@
+ .PATH:		${.CURDIR}/..
+ 
+ CARDLET=	Ssh.bin
+-DATADIR=	/usr/libdata/ssh
++DATADIR=	/libdata/ssh
+ 
+ all: ${CARDLET}
+ 
diff --git a/security/openssh/files/patch-sftp-Makefile b/security/openssh/files/patch-sftp-Makefile
index 6f79ce06426b..9f2a47b0df01 100644
--- a/security/openssh/files/patch-sftp-Makefile
+++ b/security/openssh/files/patch-sftp-Makefile
@@ -1,5 +1,5 @@
---- sftp/Makefile.orig	Mon Apr 16 11:31:52 2001
-+++ sftp/Makefile	Thu Jul 12 18:59:02 2001
+--- sftp/Makefile.orig	Fri May  4 01:09:57 2001
++++ sftp/Makefile	Wed Oct  3 13:10:32 2001
 @@ -7,13 +7,13 @@
  
  BINMODE?=555
@@ -9,7 +9,7 @@
 +BINDIR=	/bin
 +MAN1=	sftp.1
  
- SRCS=	sftp.c sftp-client.c sftp-int.c sftp-common.c sftp-glob.c scp-common.c
+ SRCS=	sftp.c sftp-client.c sftp-int.c sftp-common.c sftp-glob.c misc.c
  
  .include <bsd.prog.mk>
  
diff --git a/security/openssh/files/patch-ssh-keyscan-Makefile b/security/openssh/files/patch-ssh-keyscan-Makefile
index f5c47809edb0..d31653ac8736 100644
--- a/security/openssh/files/patch-ssh-keyscan-Makefile
+++ b/security/openssh/files/patch-ssh-keyscan-Makefile
@@ -1,6 +1,6 @@
 --- ssh-keyscan/Makefile.orig	Sun Mar  4 08:59:39 2001
 +++ ssh-keyscan/Makefile	Thu Jul 12 18:57:39 2001
-@@ -7,12 +7,12 @@
+@@ -7,12 +7,13 @@
  
  BINMODE?=555
  
@@ -12,7 +12,8 @@
  SRCS=	ssh-keyscan.c
  
  .include <bsd.prog.mk>
++.include "Makefile.inc"
  
 -LDADD+=	-lcrypto
-+LDADD+=	${CRYPTOLIBS}
++LDADD+=	${CRYPTOLIBS} -lutil -lz
  DPADD+=	${LIBCRYPTO}
diff --git a/security/openssh/pkg-plist b/security/openssh/pkg-plist
index 30451a93d84d..7047905d9693 100644
--- a/security/openssh/pkg-plist
+++ b/security/openssh/pkg-plist
@@ -11,6 +11,9 @@ etc/ssh_config
 etc/sshd_config
 sbin/sshd
 libexec/sftp-server
+libdata/ssh/Ssh.bin
+@dirrm libdata/ssh
+@dirrm libdata
 @exec if [ ! -f %D/etc/ssh_host_key ]; then echo ">> Generating a secret RSA host key."; %D/bin/ssh-keygen -N "" -f %D/etc/ssh_host_key; fi
 @exec if [ ! -f %D/etc/ssh_host_dsa_key ]; then echo ">> Generating a secret DSA host key."; %D/bin/ssh-keygen -d -N "" -f %D/etc/ssh_host_dsa_key; fi
 @exec if [ ! -x %D/etc/rc.d/sshd.sh ]; then echo "#!/bin/sh" > %D/etc/rc.d/sshd.sh && exec echo "[ -x %D/sbin/sshd ] && %D/sbin/sshd && echo -n ' sshd'" >> %D/etc/rc.d/sshd.sh && exec chmod 0555 %D/etc/rc.d/sshd.sh; fi