Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFH (r254407, r254960, r255371): misc cleanup
MFH (r255386): make libssh private
MFH (r255369, r255376, r255393, r262530): import OpenPAM Nummularia

Pull in OpenPAM Micrampelis from head. Also merge a few minor module
changes, most importantly support for ECDSA keys in pam_ssh.

MFH r226625, 226632: document what openpam_static.c is for

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Adjust for OpenPAM Hydrangea.

Change the GCC specific __FUNCTION__ to C99's __func__.

OK'ed by: des

Update for OpenPAM Figwort.

Approved by: re (kensmith)

Add openpam_free_envlist(3).

NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE

For variables that are only checked with defined(), don't provide
any fake value.

Join the 21st century: Cryptography is no longer an optional component
of releases. The -DNOCRYPT build option still exists for anyone who
really wants to build non-cryptographic binaries, but the "crypto"
release distribution is now part of "base", and anyone installing from a
release will get cryptographic binaries.

Approved by: re (scottl), markm
Discussed on: freebsd-current, in late April 2004

Downgrade WARNS level for GCC 3.4.2.

Deal better with the crypto version of the PAM library that goes
on the release media -- only put what is different in the crypto
version compared to the base version. This reduces PAM entries
in /usr/lib in the "crypto" distribution to:

libpam.a
libpam.so@
libpam.so.2
pam_krb5.so@
pam_krb5.so.2
pam_ksu.so@
pam_ksu.so.2
pam_ssh.so@
pam_ssh.so.2

The libpam.so* is still redundant (it is identical to the "base"
version), but we can't set DISTRIBUTION differently for libpam.a
and libpam.so.

(The removal of libpam.so* from the crypto distribution could be
addressed by the release/scripts/crypto-make.sh script, but then
we'd also need to remove redundant PAM headers, and I'm not sure
this is worth a hassle.)

bsd.dep.mk,v 1.43 allows us to replace a hack with a solution.

Add openpam_readline(3).

Don't build pam_std_option().

Remove pam_std_option() and related functions. Add #defines for common
options.

OpenPAM is WANRS6-clean.

Use C99-style varadic macros instead of the non-standard gcc syntax.

Mark libpam as c99- and WARNS5-clean.

style.Makefile(5) police
(I've tried to keep to the spirit of the original formatting)

Reviewed by: des

Initiate deorbit burn for the i386-only a.out related support. Moves are
under way to move the remnants of the a.out toolchain to ports. As the
comment in src/Makefile said, this stuff is deprecated and one should not
expect this to remain beyond 4.0-REL. It has already lasted WAY beyond
that.

Notable exceptions:
gcc - I have not touched the a.out generation stuff there.
ldd/ldconfig - still have some code to interface with a.out rtld.
old as/ld/etc - I have not removed these yet, pending their move to ports.
some includes - necessary for ldd/ldconfig for now.

Tested on: i386 (extensively), alpha

Install more man pages - I thought I'd committed this ages ago...

Add openpam_nullconv.3.

Added new bsd.incs.mk which handles installing of header files
via INCS. Implemented INCSLINKS (equivalent to SYMLINKS) to
handle symlinking include files. Allow for multiple groups of
include files to be installed, with the powerful INCSGROUPS knob.
Documentation to follow.

Added standard `includes' and `incsinstall' targets, use them
in Makefile.inc1. Headers from the following makefiles were
not installed before (during `includes' in Makefile.inc1):

kerberos5/lib/libtelnet/Makefile
lib/libbz2/Makefile
lib/libdevinfo/Makefile
lib/libform/Makefile
lib/libisc/Makefile
lib/libmenu/Makefile
lib/libmilter/Makefile
lib/libpanel/Makefile

Replaced all `beforeinstall' targets for installing includes
with the INCS stuff.

Renamed INCDIR to INCSDIR, for consistency with FILES and SCRIPTS,
and for compatibility with NetBSD. Similarly for INCOWN, INCGRP,
and INCMODE.

Consistently use INCLUDEDIR instead of /usr/include.

gnu/lib/libstdc++/Makefile and gnu/lib/libsupc++/Makefile changes
were only lightly tested due to the missing contrib/libstdc++-v3.
I fully tested the pre-WIP_GCC31 version of this patch with the
contrib/libstdc++.295 stuff.

These changes have been tested on i386 with the -DNO_WERROR "make
world" and "make release".

Add openpam_nullconv.c to SRCS.

Revert previous change. bsd.dep.mk,v 1.31 had a bug that was fixed
in revision 1.32 and made this change OBE.

Reflect change in share/mk/bsd.dep.mk,v 1.31.

New files in OpenPAM Cineraria.

Sponsored by: DARPA, NAI Labs

Cosmetic nit.

Cast a ptrdiff_t to int before using it as a printf field width.

Change || into && (braino in previous commit). Also append \n to the
error message.

Major cleanup:

- add __unused where appropriate
- PAM_RETURN -> return since OpenPAM already logs the return value.
- make PAM_LOG use openpam_log()
- make PAM_VERBOSE_ERROR use openpam_get_option() and check flags
for PAM_SILENT
- remove dummy functions since OpenPAM handles missing service
functions
- fix various warnings

Sponsored by: DARPA, NAI Labs

Reimplement the hack to put pam_static.o into .depend with some magic.

Don't override standard _EXTRADEPEND actions, add to them.
Fix CLEANFILES.
Collapse openpam_static_modules.o generation.

Add new files and man pages from OpenPAM Cinchona.

Sponsored by: DARPA, NAI Labs

NAI DBA update.

Fix build for OpenPAM. The directories needed tweeking.

This file is not needed any more

Add forgotten NOPROFILE that broke world.

Switch to OpenPAM. Bump library version. Modules are now versioned, so
applications linked with Linux-PAM will still work.
Remove pam_get_pass(); OpenPAM has pam_get_authtok().
Remove pam_prompt(); OpenPAM has pam_{,v}{error,info,prompt}().
Remove pam_set_item(3) man page as OpenPAM has its own.

Sponsored by: DARPA, NAI Labs

Explicitly declare (gcc internal) functions.

Submitted by: ru

Connect the pam_lastlog(8) and pam_login_access(8) modules to the build.

Sponsored by: DARPA, NAI Labs

Add pam_ssh support to the static PAM library, libpam.a:

- Spam /usr/lib some more by making libssh a standard library.
- Tweak ${LIBPAM} and ${MINUSLPAM}.
- Garbage collect unused libssh_pic.a.
- Add fake -lz dependency to secure/ makefiles needed for
dynamic linkage with -lssh.

Reviewed by: des, markm
Approved by: markm

Link pam_opieaccess, pam_self and pam_ssh into the static library.

Sponsored by: DARPA, NAI Labs

Fixed a missing "const".

Now that _pam_init_handlers() works as intended, it seems clear that we
do not actually want to define PAM_READ_BOTH_CONFS, so back out previous
commit.

Sponsored by: DARPA, NAI Labs

We need pam_client.h from libpamc. This unbreaks world

Pointed out by: jhay
Pointy hat to: des

Define PAM_READ_BOTH_CONFS. We can now have both /etc/pam.d and
/etc/pam.conf.

Sponsored by: DARPA, NAI Labs

Install the correct version of pam_misc.h.

Sponsored by: DARPA, NAI Labs

Mdoc police.

Submitted by: ru

Add a pam_set_item(3) man page with an MLINK to pam_get_item(3).

PR: docs/32294
Sponsored by: DARPA, NAI Labs
MFC after: 3 days

Add __FBSDID()s to libpam

Add extra logging detail. This needs a more general solution.

Add 'try_mapped_pass' standard option.

Asked for by: lukeh@PADL.COM

Rework this to prevent a nasty problem involving different modules'
option interacting with each other.

Declare the new user-error reporting macro.

This is a macro to allow use of the __FILE__ and __FUNCTION__
macros.

Add a routine for providing feedback via the conversation mechanism
(usually to stderr) for user-reportable errors.

Fix a horrible bug introduced by myself where the options collection
keeps on growing as the module stack is parsed.

Almost completely rewrite the PAM module options processing
routines, and provide a more extended API for doing this.

Provide an API for debug logging.

Audit and clean up the code.

Fix libpam's linker set stuff to use the new API (unbreak world), and get
rid of gensetdefs from here as well.

Big module cleanup.

Move common stuff into Makefile.inc, and tidy up all the Makefiles
as a result.

Build new modules.

Put a commented-out dependancy on libpam for the (shared) modules.
I can't bring this in just yet, as the dependancy (modules->libpam)
is reversed for the static case (libpam->modules).

Tidy up the options list (and make it more extendable), and add some
extra "standard" options.

Add the "auth_as_self" option to the pam_unix module (there is no
reason not to add it to others later). This causes the pam_unix
module to check the user's _own_ password, not the password of the
account that the user is authenticating into. This will allow eg:
WHEELSU type behaviour from su(1).

Bring in a few useful PAM modules.

pam_krb5 is a Kerberos 5 (Heimdal) authentication module.

pam_nologin checks for /etc/nologin and does the "usual stuff"
if it is found, otherwise it silently succeeds.

pam_rootok silently succeeds if the user is root, otherwise
it fails.

pam_wheel silently succeeds if the user is a member of group
"wheel" (or another nominated group), and fails
otherwise.

There is an issue with kerberosIV and kerberos5 - if both are
being built, then static linking fails with duplicate symbols.
This will take a bit of work to sort out in the kerberii.

Finish disconnecting pam_ssh from the build.

Update for (Linux-)PAM 0.75

MAN[1-9] -> MAN.

Connect pam_opie to the build.

Buildworld fixes for NO_OPENSSH and NO_OPENSSL

Approved by: jkh

Don't try to build k5 PAM; it ain't ready yet.

Same fix as in ../modules, dont use the crypto stuff if its not there.

Use libcrypto instead of libdes.

Also - OpenSSH blesses us with a module for PAM.

Don't include Kerberos if NOCRYPT is defined, because it isn't build
if NOCRYPT is defined. Likewise, don't include DES if NOSECURE is
defined.

Common Error libraries are needed here.

Revive the pam_deny and pam_permit modules from Linux-PAM. They are
simple enough to be trusted.

Add account management functionality to the pam_unix module.

These changes should make it possible to use PAM in some ports.

Submitted by: Max Khon <fjoe@iclub.nsu.ru>

Fix breakage for the static a.out case. The a.out linker doesn't
consider a linker set definition to be sufficient reason to pull an
object module from an archive library. This caused undefined
symbols when linking with libpam.a using a.out. I solved it by
linking in the object that references the linker set in the "ld -r"
step.

Make it possible to use PAM in statically-linked applications.

Fix an NFS-related installation problem.

Submitted by: asami

Install PAM modules into ${SHLIBDIR}, not ${LIBDIR}.

Noticed by: bde

This commit was generated by cvs2svn to compensate for changes in r41227,
which included commits to RCS files with non-trunk default branches.

Build structure for contribified Linux-PAM, plus some home-grown
modules for FreeBSD's standard authentication methods. Although
the Linux-PAM modules are present in the contrib tree, we don't
use any of them.

The main library "libpam" is composed of sources taken from three
places. First are the standard Linux-PAM libpam sources from the
contrib tree. Second are the Linux-PAM "libpam_misc" sources, also
from the contrib tree. In Linux these form a separate library.
But as Mike Smith pointed out to me, that seems pointless, so I
have combined them into the libpam library. Third are some additional
sources from the "src/lib/libpam" tree with some common functions
that make it easier to write modules. Those I wrote myself.

This work has been donated to FreeBSD by Juniper Networks, Inc.