This commit was generated by cvs2svn to compensate for changes in r76238,

which included commits to RCS files with non-trunk default branches.

27 files changed, 2847 insertions, 0 deletions

diff --git a/contrib/libpam/modules/Simple.Rules b/contrib/libpam/modules/Simple.Rules
new file mode 100644
index 0000000..954641c
--- /dev/null
+++ b/contrib/libpam/modules/Simple.Rules
@@ -0,0 +1,92 @@
+# $Id: Simple.Rules,v 1.3 2001/02/22 04:55:41 agmorgan Exp $
+#
+# For simple modules with no significant dependencies, set $(TITLE)
+# and include this file.
+#
+# There are a few ways to customize this set of rules. Namely, define
+#
+#   $(MODULE_SIMPLE_EXTRACLEAN)
+#   $(MODULE_SIMPLE_CLEAN)
+#   $(MODULE_SIMPLE_REMOVE)
+#   $(MODULE_SIMPLE_INSTALL)
+#   $(MODULE_SIMPLE_EXTRALIBS)  - other things to link with the module
+#   $(MODULE_SIMPLE_EXTRAFILES) - other files to build (no .c suffix)
+#
+
+LIBFILES = $(TITLE) $(MODULE_SIMPLE_EXTRAFILES)
+LIBSRC = $(addsuffix .c,$(LIBFILES))
+LIBOBJ = $(addsuffix .o,$(LIBFILES))
+LIBOBJD = $(addprefix dynamic/,$(LIBOBJ))
+LIBOBJS = $(addprefix static/,$(LIBOBJ))
+
+ifdef DYNAMIC
+LIBSHARED = $(TITLE).so
+endif
+
+ifdef STATIC
+LIBSTATIC = lib$(TITLE).o
+endif
+
+####################### don't edit below #######################
+
+all: dirs $(LIBSHARED) $(LIBSTATIC) register
+
+dynamic/%.o : %.c
+	$(CC) $(CFLAGS) $(DYNAMIC) $(TARGET_ARCH) -c $< -o $@
+
+static/%.o : %.c
+	$(CC) $(CFLAGS) $(STATIC) $(TARGET_ARCH) -c $< -o $@
+
+dirs:
+ifdef DYNAMIC
+	$(MKDIR) ./dynamic
+endif
+ifdef STATIC
+	$(MKDIR) ./static
+endif
+
+register:
+ifdef STATIC
+	( cd .. ; ./register_static $(TITLE) $(TITLE)/$(LIBSTATIC) )
+endif
+
+ifdef DYNAMIC
+$(LIBOBJD): $(LIBSRC)
+endif
+
+ifdef DYNAMIC
+$(LIBSHARED):	$(LIBOBJD)
+	$(LD_D) -o $@ $(LIBOBJD) $(MODULE_SIMPLE_EXTRALIBS) $(NEED_LINK_LIB_C)
+
+endif
+
+ifdef STATIC
+$(LIBOBJS): $(LIBSRC)
+endif
+
+ifdef STATIC
+$(LIBSTATIC): $(LIBOBJS)
+	$(LD) -r -o $@ $(LIBOBJS) $(MODULE_SIMPLE_EXTRALIBS)
+endif
+
+install: all
+	$(MKDIR) $(FAKEROOT)$(SECUREDIR)
+ifdef DYNAMIC
+	$(INSTALL) -m $(SHLIBMODE) $(LIBSHARED) $(FAKEROOT)$(SECUREDIR)
+endif
+	$(MODULE_SIMPLE_INSTALL)
+
+remove:
+	rm -f $(FAKEROOT)$(SECUREDIR)/$(TITLE).so
+	$(MODULE_SIMPLE_REMOVE)
+
+clean:
+	rm -f $(LIBOBJD) $(LIBOBJS) core *~
+	$(MODULE_SIMPLE_CLEAN)
+	rm -f *.a *.o *.so *.bak
+	rm -rf dynamic static
+	$(MODULE_SIMPLE_EXTRACLEAN)
+
+.c.o:	
+	$(CC) $(CFLAGS) -c $<
+
diff --git a/contrib/libpam/modules/download-all b/contrib/libpam/modules/download-all
new file mode 100755
index 0000000..9b6cf65
--- /dev/null
+++ b/contrib/libpam/modules/download-all
@@ -0,0 +1,30 @@
+#!/bin/sh
+#
+# $Id: download-all,v 1.1.1.1 2000/06/20 22:11:29 agmorgan Exp $
+#
+cat <<EOT
+For a number of reasons it is not practical for Linux-PAM to be
+distributed with every module out there.  However, this shell script
+is intended as a convenient way for users to download modules from the
+'net in some semiautomated fashion.
+
+Please feel free to send (pam-list@redhat.com) snippets of code that
+will help others to download and unpack your favorite module into the
+Linux-PAM source tree.  Especially welcome are snippets of the
+following form:
+
+ncftp ftp://my.ftpsite.org/pub/fluff/pam_fluff.tar.gz
+rm -fr pam_fluff
+tar zvfx pam_fluff.tar.gz
+
+Cheers
+
+Andrew
+morgan@linux.kernel.org
+EOT
+
+# --- insert your snippets below ---
+
+# --- insert your snippets above ---
+
+exit 0
diff --git a/contrib/libpam/modules/install_conf b/contrib/libpam/modules/install_conf
new file mode 100755
index 0000000..80f6be2
--- /dev/null
+++ b/contrib/libpam/modules/install_conf
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+FAKEROOT=$1
+CONFD=$1$2
+CONFILE=$1$3
+MODULE=$4
+CONF=$5
+
+IGNORE_AGE=./.ignore_age
+QUIET_INSTALL=../../.quiet_install
+
+echo
+
+if [ -f "$QUIET_INSTALL" ]; then
+    if [ ! -f "$CONFILE" ]; then
+        yes="y"
+    else
+        yes="skip"
+    fi
+elif [ -f "$IGNORE_AGE" ]; then
+    echo "you don't want to be bothered with the age of your $CONFILE file"
+    yes="n"
+elif [ ! -f "$CONFILE" ] || [ "$CONF" -nt "$CONFILE" ]; then
+    if [ -f "$CONFILE" ]; then
+	echo "An older $MODULE configuration file already exists ($CONFILE)"
+	echo "Do you wish to copy the $CONF file in this distribution"
+	echo "to $CONFILE ? (y/n) [skip] "
+        read yes
+    else
+	yes="y"
+    fi
+else
+    yes="skip"
+fi
+
+if [ "$yes" = "y" ]; then
+    mkdir -p $CONFD
+    echo "  copying $CONF to $CONFILE"
+    cp $CONF $CONFILE
+else
+    echo "  Skipping $CONF installation"
+    if [ "$yes" = "n" ]; then
+	touch "$IGNORE_AGE"
+    fi
+fi
+
+echo
+
+exit 0
diff --git a/contrib/libpam/modules/pam_issue/Makefile b/contrib/libpam/modules/pam_issue/Makefile
new file mode 100644
index 0000000..1bd2be2
--- /dev/null
+++ b/contrib/libpam/modules/pam_issue/Makefile
@@ -0,0 +1,15 @@
+#
+# $Id: Makefile,v 1.2 2000/11/19 23:54:04 agmorgan Exp $
+#
+# This Makefile controls a build process of $(TITLE) module for
+# Linux-PAM. You should not modify this Makefile (unless you know
+# what you are doing!).
+#
+# Created by Andrew Morgan <morgan@linux.kernel.org> 2000/08/27
+#
+
+include ../../Make.Rules
+
+TITLE=pam_issue
+
+include ../Simple.Rules
diff --git a/contrib/libpam/modules/pam_issue/pam_issue.c b/contrib/libpam/modules/pam_issue/pam_issue.c
new file mode 100644
index 0000000..2cb54be
--- /dev/null
+++ b/contrib/libpam/modules/pam_issue/pam_issue.c
@@ -0,0 +1,266 @@
+/* pam_issue module - a simple /etc/issue parser to set PAM_USER_PROMPT
+ *
+ * Copyright 1999 by Ben Collins <bcollins@debian.org>
+ *
+ * Needs to be called before any other auth modules so we can setup the
+ * user prompt before it's first used. Allows one argument option, which
+ * is the full path to a file to be used for issue (uses /etc/issue as a
+ * default) such as "issue=/etc/issue.telnet".
+ *
+ * We can also parse escapes within the the issue file (enabled by
+ * default, but can be disabled with the "noesc" option). It's the exact
+ * same parsing as util-linux's agetty program performs.
+ *
+ * Released under the GNU LGPL version 2 or later
+ */
+
+#define _GNU_SOURCE
+#define _BSD_SOURCE
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/utsname.h>
+#include <utmp.h>
+#include <malloc.h>
+
+#include <security/_pam_macros.h>
+
+#define PAM_SM_AUTH
+
+#include <security/pam_modules.h>
+
+static int _user_prompt_set = 0;
+
+char *do_prompt (FILE *);
+
+/* --- authentication management functions (only) --- */
+
+PAM_EXTERN
+int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
+                        const char **argv)
+{
+    int retval = PAM_SUCCESS;
+    FILE *fd;
+    int parse_esc = 1;
+    char *prompt_tmp = NULL, *cur_prompt = NULL;
+    struct stat st;
+    char *issue_file = NULL;
+
+   /* If we've already set the prompt, don't set it again */
+    if(_user_prompt_set)
+	return PAM_IGNORE;
+    else
+       /* we set this here so if we fail below, we wont get further
+	  than this next time around (only one real failure) */
+	_user_prompt_set = 1;
+
+    for ( ; argc-- > 0 ; ++argv ) {
+	if (!strncmp(*argv,"issue=",6)) {
+	    issue_file = (char *) strdup(6+*argv);
+	    if (issue_file != NULL) {
+		D(("set issue_file to: %s", issue_file));
+	    } else {
+		D(("failed to strdup issue_file - ignored"));
+		return PAM_IGNORE;
+	    }
+	} else if (!strcmp(*argv,"noesc")) {
+	    parse_esc = 0;
+	    D(("turning off escape parsing by request"));
+	} else
+	    D(("unknown option passed: %s", *argv));
+    }
+
+    if (issue_file == NULL)
+	issue_file = strdup("/etc/issue");
+
+    if ((fd = fopen(issue_file, "r")) != NULL) {
+	int tot_size = 0;
+
+	if (stat(issue_file, &st) < 0)
+	    return PAM_IGNORE;
+
+	retval = pam_get_item(pamh, PAM_USER_PROMPT, (const void **) &cur_prompt);
+	if (retval != PAM_SUCCESS)
+	    return PAM_IGNORE;
+
+       /* first read in the issue file */
+
+	if (parse_esc)
+	    prompt_tmp = do_prompt(fd);
+	else {
+	    int count = 0;
+	    prompt_tmp = malloc(st.st_size + 1);
+	    if (prompt_tmp == NULL) return PAM_IGNORE;
+	    memset (prompt_tmp, '\0', st.st_size + 1);
+	    count = fread(prompt_tmp, sizeof(char *), st.st_size, fd);
+	    prompt_tmp[st.st_size] = '\0';
+	}
+
+	fclose(fd);
+
+	tot_size = strlen(prompt_tmp) + strlen(cur_prompt) + 1;
+
+       /*
+	* alloc some extra space for the original prompt
+	* and postpend it to the buffer
+	*/
+	prompt_tmp = realloc(prompt_tmp, tot_size);
+	strcpy(prompt_tmp+strlen(prompt_tmp), cur_prompt);
+
+	prompt_tmp[tot_size] = '\0';
+
+	retval = pam_set_item(pamh, PAM_USER_PROMPT, (const char *) prompt_tmp);
+
+	free(issue_file);
+	free(prompt_tmp);
+    } else {
+	D(("could not open issue_file: %s", issue_file));
+	return PAM_IGNORE;
+    }
+
+    return retval;
+}
+
+PAM_EXTERN
+int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc,
+                   const char **argv)
+{
+     return PAM_IGNORE;
+}
+
+char *do_prompt(FILE *fd)
+{
+    int c, size = 1024;
+    char *issue = (char *)malloc(size);
+    char buf[1024];
+    struct utsname uts;
+
+    if (issue == NULL || fd == NULL)
+	return NULL;
+
+    issue[0] = '\0'; /* zero this, for strcat to work on first buf */
+    (void) uname(&uts);
+
+    while ((c = getc(fd)) != EOF) {
+	if (c == '\\') {
+	    c = getc(fd);
+	    switch (c) {
+	      case 's':
+		snprintf (buf, 1024, "%s", uts.sysname);
+		break;
+	      case 'n':
+		snprintf (buf, 1024, "%s", uts.nodename);
+		break;
+	      case 'r':
+		snprintf (buf, 1024, "%s", uts.release);
+		break;
+	      case 'v':
+		snprintf (buf, 1024, "%s", uts.version);
+		break;
+	      case 'm':
+		snprintf (buf, 1024, "%s", uts.machine);
+		break;
+	      case 'o':
+		{
+		    char domainname[256];
+
+		    getdomainname(domainname, sizeof(domainname));
+		    domainname[sizeof(domainname)-1] = '\0';
+		    snprintf (buf, 1024, "%s", domainname);
+		}
+		break;
+
+	      case 'd':
+	      case 't':
+		{
+		    const char *weekday[] = {
+			"Sun", "Mon", "Tue", "Wed", "Thu",
+			"Fri", "Sat" };
+		    const char *month[] = {
+			"Jan", "Feb", "Mar", "Apr", "May",
+			"Jun", "Jul", "Aug", "Sep", "Oct",
+			"Nov", "Dec" };
+		    time_t now;
+		    struct tm *tm;
+
+		    (void) time (&now);
+		    tm = localtime(&now);
+
+		    if (c == 'd')
+			snprintf (buf, 1024, "%s %s %d  %d",
+				weekday[tm->tm_wday], month[tm->tm_mon],
+				tm->tm_mday, 
+				tm->tm_year + 1900);
+		    else
+			snprintf (buf, 1024, "%02d:%02d:%02d",
+				tm->tm_hour, tm->tm_min, tm->tm_sec);
+		}
+		break;
+	      case 'l':
+		{
+		    char *ttyn = ttyname(1);
+		    if (!strncmp(ttyn, "/dev/", 5))
+			ttyn += 5;
+		    snprintf (buf, 1024, "%s", ttyn);
+		}
+		break;
+	      case 'u':
+	      case 'U':
+		{
+		    int users = 0;
+		    struct utmp *ut;
+		    setutent();
+		    while ((ut = getutent()))
+			if (ut->ut_type == USER_PROCESS)
+			users++;
+		    endutent();
+		    printf ("%d ", users);
+		    if (c == 'U')
+			snprintf (buf, 1024, "%s", (users == 1) ?
+				" user" : " users");
+		    break;
+		}
+	      default:
+		buf[0] = c; buf[1] = '\0';
+	    }
+	    if ((strlen(issue) + strlen(buf)) < size + 1) {
+		size += strlen(buf) + 1;
+		issue = (char *) realloc (issue, size);
+	    }
+	    strcat(issue, buf);
+	} else {
+	    buf[0] = c; buf[1] = '\0';
+	    if ((strlen(issue) + strlen(buf)) < size + 1) {
+		size += strlen(buf) + 1;
+		issue = (char *) realloc (issue, size);
+	    }
+	    strcat(issue, buf);
+	}
+    }
+    return issue;
+}
+
+#ifdef PAM_STATIC
+
+/* static module data */
+
+struct pam_module _pam_issue_modstruct = {
+     "pam_issue",
+     pam_sm_authenticate,
+     pam_sm_setcred,
+     NULL,
+     NULL,
+     NULL,
+     NULL,
+};
+
+#endif
+
+/* end of module definition */
diff --git a/contrib/libpam/modules/pam_mail/README b/contrib/libpam/modules/pam_mail/README
new file mode 100644
index 0000000..155bd1d
--- /dev/null
+++ b/contrib/libpam/modules/pam_mail/README
@@ -0,0 +1,17 @@
+This is the README for pam_mail
+-------------------------------
+
+This PAM module tells the User that he has new/unread email.
+
+Options for:
+auth:	for authentication it provides pam_authenticate() and
+	pam_setcred() hooks.
+
+	"debug"		write more information to syslog
+	"dir=maildir"	users mailbox is maildir/<login> 
+	"hash=count"	mail directory hash depth
+	"close"		print message also on logout
+	"nopen"		print message not on login
+	"noenv"		don't set the MAIL environment variable
+	"empty"		also print message if user has no mail
+
diff --git a/contrib/libpam/modules/pam_mkhomedir/Makefile b/contrib/libpam/modules/pam_mkhomedir/Makefile
new file mode 100644
index 0000000..f017f4a
--- /dev/null
+++ b/contrib/libpam/modules/pam_mkhomedir/Makefile
@@ -0,0 +1,15 @@
+#
+# $Id: Makefile,v 1.3 2000/11/19 23:54:04 agmorgan Exp $
+#
+# This Makefile controls a build process of $(TITLE) module for
+# Linux-PAM. You should not modify this Makefile (unless you know
+# what you are doing!).
+#
+# Created by Andrew Morgan <morgan@linux.kernel.org> 2000/08/27
+#
+
+include ../../Make.Rules
+
+TITLE=pam_mkhomedir
+
+include ../Simple.Rules
diff --git a/contrib/libpam/modules/pam_mkhomedir/pam_mkhomedir.c b/contrib/libpam/modules/pam_mkhomedir/pam_mkhomedir.c
new file mode 100644
index 0000000..ec05993
--- /dev/null
+++ b/contrib/libpam/modules/pam_mkhomedir/pam_mkhomedir.c
@@ -0,0 +1,370 @@
+/* PAM Make Home Dir module
+
+   This module will create a users home directory if it does not exist
+   when the session begins. This allows users to be present in central
+   database (such as nis, kerb or ldap) without using a distributed
+   file system or pre-creating a large number of directories.
+   
+   Here is a sample /etc/pam.d/login file for Debian GNU/Linux
+   2.1:
+   
+   auth       requisite  pam_securetty.so
+   auth       sufficient pam_ldap.so
+   auth       required   pam_pwdb.so
+   auth       optional   pam_group.so
+   auth       optional   pam_mail.so
+   account    requisite  pam_time.so
+   account    sufficient pam_ldap.so
+   account    required   pam_pwdb.so
+   session    required   pam_mkhomedir.so skel=/etc/skel/ umask=0022
+   session    required   pam_pwdb.so
+   session    optional   pam_lastlog.so
+   password   required   pam_pwdb.so   
+   
+   Released under the GNU LGPL version 2 or later
+   Originally written by Jason Gunthorpe <jgg@debian.org> Feb 1999
+   Structure taken from pam_lastlogin by Andrew Morgan 
+     <morgan@parc.power.net> 1996
+ */
+
+/* I want snprintf dammit */
+#define _GNU_SOURCE 1
+#include <stdarg.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <dirent.h>
+
+/*
+ * here, we make a definition for the externally accessible function
+ * in this file (this definition is required for static a module
+ * but strongly encouraged generally) it is used to instruct the
+ * modules include file to define the function prototypes.
+ */
+
+#define PAM_SM_SESSION
+
+#include <security/pam_modules.h>
+#include <security/_pam_macros.h>
+
+/* argument parsing */
+#define MKHOMEDIR_DEBUG      020	/* keep quiet about things */
+#define MKHOMEDIR_QUIET      040	/* keep quiet about things */
+
+static unsigned int UMask = 0022;
+static char SkelDir[BUFSIZ] = "/etc/skel";
+
+/* some syslogging */
+static void _log_err(int err, const char *format, ...)
+{
+    va_list args;
+
+    va_start(args, format);
+    openlog("PAM-mkhomedir", LOG_CONS|LOG_PID, LOG_AUTH);
+    vsyslog(err, format, args);
+    va_end(args);
+    closelog();
+}
+
+static int _pam_parse(int flags, int argc, const char **argv)
+{
+   int ctrl = 0;
+
+   /* does the appliction require quiet? */
+   if ((flags & PAM_SILENT) == PAM_SILENT)
+      ctrl |= MKHOMEDIR_QUIET;
+
+   /* step through arguments */
+   for (; argc-- > 0; ++argv)
+   {
+      if (!strcmp(*argv, "silent"))
+      {
+	 ctrl |= MKHOMEDIR_QUIET;
+      } 
+      else if (!strncmp(*argv,"umask=",6))
+	 UMask = strtol(*argv+6,0,0);
+      else if (!strncmp(*argv,"skel=",5))
+	 strcpy(SkelDir,*argv+5);
+      else
+      {
+	 _log_err(LOG_ERR, "unknown option; %s", *argv);
+      }
+   }
+
+   D(("ctrl = %o", ctrl));
+   return ctrl;
+}
+
+/* This common function is used to send a message to the applications 
+   conversion function. Our only use is to ask the application to print 
+   an informative message that we are creating a home directory */
+static int converse(pam_handle_t * pamh, int ctrl, int nargs
+		    ,struct pam_message **message
+		    ,struct pam_response **response)
+{
+   int retval;
+   struct pam_conv *conv;
+
+   D(("begin to converse"));
+
+   retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
+   if (retval == PAM_SUCCESS)
+   {
+
+      retval = conv->conv(nargs, (const struct pam_message **) message
+			  ,response, conv->appdata_ptr);
+
+      D(("returned from application's conversation function"));
+
+      if (retval != PAM_SUCCESS && (ctrl & MKHOMEDIR_DEBUG))
+      {
+	 _log_err(LOG_DEBUG, "conversation failure [%s]"
+		  ,pam_strerror(pamh, retval));
+      }
+
+   }
+   else
+   {
+      _log_err(LOG_ERR, "couldn't obtain coversation function [%s]"
+	       ,pam_strerror(pamh, retval));
+   }
+
+   D(("ready to return from module conversation"));
+
+   return retval;		/* propagate error status */
+}
+
+/* Ask the application to display a short text string for us. */
+static int make_remark(pam_handle_t * pamh, int ctrl, const char *remark)
+{
+   int retval;
+
+   if ((ctrl & MKHOMEDIR_QUIET) != MKHOMEDIR_QUIET)
+   {
+      struct pam_message msg[1], *mesg[1];
+      struct pam_response *resp = NULL;
+
+      mesg[0] = &msg[0];
+      msg[0].msg_style = PAM_TEXT_INFO;
+      msg[0].msg = remark;
+
+      retval = converse(pamh, ctrl, 1, mesg, &resp);
+
+      msg[0].msg = NULL;
+      if (resp)
+      {
+	 _pam_drop_reply(resp, 1);
+      }
+   }
+   else
+   {
+      D(("keeping quiet"));
+      retval = PAM_SUCCESS;
+   }
+
+   D(("returning %s", pam_strerror(pamh, retval)));
+   return retval;
+}
+
+/* Do the actual work of creating a home dir */
+static int create_homedir(pam_handle_t * pamh, int ctrl,
+			 const struct passwd *pwd)
+{
+   char *remark;
+   DIR *D;
+   struct dirent *Dir;
+   
+   /* Some scratch space */
+   remark = malloc(BUFSIZ);
+   if (remark == NULL)
+   {
+      D(("no memory for last login remark"));
+      return PAM_BUF_ERR;
+   }
+
+   /* Mention what is happening, if the notification fails that is OK */
+   if (snprintf(remark,BUFSIZ,"Creating home directory '%s'.",
+	    pwd->pw_dir) == -1)
+      return PAM_PERM_DENIED;
+   
+   make_remark(pamh, ctrl, remark);
+
+   /* Crete the home directory */
+   if (mkdir(pwd->pw_dir,0700) != 0)
+   {
+      free(remark);
+      _log_err(LOG_DEBUG, "unable to create home directory %s",pwd->pw_dir);
+      return PAM_PERM_DENIED;
+   }   
+   if (chmod(pwd->pw_dir,0777 & (~UMask)) != 0 ||
+       chown(pwd->pw_dir,pwd->pw_uid,pwd->pw_gid) != 0)
+   {
+      free(remark);
+      _log_err(LOG_DEBUG, "unable to chance perms on home directory %s",pwd->pw_dir);
+      return PAM_PERM_DENIED;
+   }   
+   
+   /* See if we need to copy the skel dir over. */
+   if (SkelDir[0] == 0)
+   {
+      free(remark);
+      return PAM_SUCCESS;
+   }
+
+   /* Scan the directory */
+   D = opendir(SkelDir);
+   if (D == 0)
+   {
+      free(remark);
+      _log_err(LOG_DEBUG, "unable to read directory %s",SkelDir);
+      return PAM_PERM_DENIED;
+   }
+   
+   for (Dir = readdir(D); Dir != 0; Dir = readdir(D))
+   {  
+      int SrcFd;
+      int DestFd;
+      int Res;
+      struct stat St;
+      
+      /* Skip some files.. */
+      if (strcmp(Dir->d_name,".") == 0 ||
+	  strcmp(Dir->d_name,"..") == 0)
+	 continue;
+      
+      /* Check if it is a directory */
+      snprintf(remark,BUFSIZ,"%s/%s",SkelDir,Dir->d_name);
+      if (stat(remark,&St) != 0)
+        continue;
+      if (S_ISDIR(St.st_mode))
+      {
+	snprintf(remark,BUFSIZ,"%s/%s",pwd->pw_dir,Dir->d_name);
+	if (mkdir(remark,(St.st_mode | 0222) & (~UMask)) != 0 ||
+	    chmod(remark,(St.st_mode | 0222) & (~UMask)) != 0 ||
+	    chown(remark,pwd->pw_uid,pwd->pw_gid) != 0)
+	{
+	   free(remark);
+	   _log_err(LOG_DEBUG, "unable to change perms on copy %s",remark);
+	   return PAM_PERM_DENIED;
+	}
+	continue;
+      }
+
+      /* Open the source file */
+      if ((SrcFd = open(remark,O_RDONLY)) < 0 || fstat(SrcFd,&St) != 0)
+      {
+	 free(remark);
+	 _log_err(LOG_DEBUG, "unable to open src file %s",remark);
+	 return PAM_PERM_DENIED;
+      }
+      stat(remark,&St);
+      
+      /* Open the dest file */
+      snprintf(remark,BUFSIZ,"%s/%s",pwd->pw_dir,Dir->d_name);
+      if ((DestFd = open(remark,O_WRONLY | O_TRUNC | O_CREAT,0600)) < 0)
+      {
+	 close(SrcFd);
+	 free(remark);
+	 _log_err(LOG_DEBUG, "unable to open dest file %s",remark);
+	 return PAM_PERM_DENIED;
+      }
+
+      /* Set the proper ownership and permissions for the module. We make
+       	 the file a+w and then mask it with the set mask. This preseves
+       	 execute bits */
+      if (fchmod(DestFd,(St.st_mode | 0222) & (~UMask)) != 0 ||
+	  fchown(DestFd,pwd->pw_uid,pwd->pw_gid) != 0)
+      {
+	 free(remark);
+	 _log_err(LOG_DEBUG, "unable to chang perms on copy %s",remark);
+	 return PAM_PERM_DENIED;
+      }   
+      
+      /* Copy the file */
+      do
+      {
+	 Res = read(SrcFd,remark,BUFSIZ);
+	 if (Res < 0 || write(DestFd,remark,Res) != Res)
+	 {
+	    close(SrcFd);
+	    close(DestFd);
+	    free(remark);
+	    _log_err(LOG_DEBUG, "unable to perform IO");
+	    return PAM_PERM_DENIED;
+	 }
+      }
+      while (Res != 0);
+      close(SrcFd);
+      close(DestFd);
+   }
+   
+   free(remark);
+   return PAM_SUCCESS;
+}
+
+/* --- authentication management functions (only) --- */
+
+PAM_EXTERN
+int pam_sm_open_session(pam_handle_t * pamh, int flags, int argc
+			,const char **argv)
+{
+   int retval, ctrl;
+   const char *user;
+   const struct passwd *pwd;
+   struct stat St;
+      
+   /* Parse the flag values */
+   ctrl = _pam_parse(flags, argc, argv);
+
+   /* Determine the user name so we can get the home directory */
+   retval = pam_get_item(pamh, PAM_USER, (const void **) &user);
+   if (retval != PAM_SUCCESS || user == NULL || *user == '\0')
+   {
+      _log_err(LOG_NOTICE, "user unknown");
+      return PAM_USER_UNKNOWN;
+   }
+
+   /* Get the password entry */
+   pwd = getpwnam(user);
+   if (pwd == NULL)
+   {
+      D(("couldn't identify user %s", user));
+      return PAM_CRED_INSUFFICIENT;
+   }
+
+   /* Stat the home directory, if something exists then we assume it is
+      correct and return a success*/
+   if (stat(pwd->pw_dir,&St) == 0)
+      return PAM_SUCCESS;
+
+   return create_homedir(pamh,ctrl,pwd);
+}
+
+/* Ignore */
+PAM_EXTERN 
+int pam_sm_close_session(pam_handle_t * pamh, int flags, int argc
+			 ,const char **argv)
+{
+   return PAM_SUCCESS;
+}
+
+#ifdef PAM_STATIC
+
+/* static module data */
+struct pam_module _pam_mkhomedir_modstruct =
+{
+   "pam_mkhomedir",
+   NULL,
+   NULL,
+   NULL,
+   pam_sm_open_session,
+   pam_sm_close_session,
+   NULL,
+};
+
+#endif
diff --git a/contrib/libpam/modules/pam_motd/Makefile b/contrib/libpam/modules/pam_motd/Makefile
new file mode 100644
index 0000000..fb83807
--- /dev/null
+++ b/contrib/libpam/modules/pam_motd/Makefile
@@ -0,0 +1,15 @@
+#
+# $Id: Makefile,v 1.2 2000/11/19 23:54:04 agmorgan Exp $
+#
+# This Makefile controls a build process of $(TITLE) module for
+# Linux-PAM. You should not modify this Makefile (unless you know
+# what you are doing!).
+#
+# Created by Andrew Morgan <morgan@linux.kernel.org> 2000/08/27
+#
+
+include ../../Make.Rules
+
+TITLE=pam_motd
+
+include ../Simple.Rules
diff --git a/contrib/libpam/modules/pam_motd/pam_motd.c b/contrib/libpam/modules/pam_motd/pam_motd.c
new file mode 100644
index 0000000..2434b29
--- /dev/null
+++ b/contrib/libpam/modules/pam_motd/pam_motd.c
@@ -0,0 +1,119 @@
+/* pam_motd module */
+
+/*
+ * Modified for pam_motd by Ben Collins <bcollins@debian.org>
+ *
+ * Based off of:
+ * $Id: pam_motd.c,v 1.1.1.1 2000/06/20 22:11:46 agmorgan Exp $
+ * 
+ * Written by Michael K. Johnson <johnsonm@redhat.com> 1996/10/24
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <pwd.h>
+
+#include <security/_pam_macros.h>
+/*
+ * here, we make a definition for the externally accessible function
+ * in this file (this definition is required for static a module
+ * but strongly encouraged generally) it is used to instruct the
+ * modules include file to define the function prototypes.
+ */
+
+#define PAM_SM_SESSION
+#define DEFAULT_MOTD	"/etc/motd"
+
+#include <security/pam_modules.h>
+
+/* --- session management functions (only) --- */
+
+PAM_EXTERN
+int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc,
+                        const char **argv)
+{
+     return PAM_IGNORE;
+}
+
+PAM_EXTERN
+int pam_sm_open_session(pam_handle_t *pamh, int flags, int argc,
+                   const char **argv)
+{
+     int retval = PAM_IGNORE;
+     int fd;
+     char *mtmp=NULL, *motd_path=NULL;
+     struct pam_conv *conversation;
+     struct pam_message message;
+     struct pam_message *pmessage = &message;
+     struct pam_response *resp = NULL;
+     struct stat st;
+
+     if (flags & PAM_SILENT) {
+	return retval;
+     }
+
+    for (; argc-- > 0; ++argv) {
+        if (!strncmp(*argv,"motd=",5)) {
+            motd_path = (char *) strdup(5+*argv);
+            if (motd_path != NULL) {
+                D(("set motd path: %s", motd_path));
+            } else {
+                D(("failed to duplicate motd path - ignored"));
+            }
+	}
+     }
+
+     if (motd_path == NULL)
+	motd_path = DEFAULT_MOTD;
+
+     message.msg_style = PAM_TEXT_INFO;
+
+     if ((fd = open(motd_path, O_RDONLY, 0)) >= 0) {
+       /* fill in message buffer with contents of motd */
+       if ((fstat(fd, &st) < 0) || !st.st_size)
+         return retval;
+       message.msg = mtmp = malloc(st.st_size+1);
+       /* if malloc failed... */
+       if (!message.msg) return retval;
+       read(fd, mtmp, st.st_size);
+       if (mtmp[st.st_size-1] == '\n')
+	  mtmp[st.st_size-1] = '\0';
+       else
+	  mtmp[st.st_size] = '\0';
+       close(fd);
+       /* Use conversation function to give user contents of motd */
+       pam_get_item(pamh, PAM_CONV, (const void **)&conversation);
+       conversation->conv(1, (const struct pam_message **)&pmessage,
+			  &resp, conversation->appdata_ptr);
+       free(mtmp);
+       if (resp)
+	   _pam_drop_reply(resp, 1);
+     }
+
+     return retval;
+}
+
+
+#ifdef PAM_STATIC
+
+/* static module data */
+
+struct pam_module _pam_motd_modstruct = {
+     "pam_motd",
+     NULL,
+     NULL,
+     NULL,
+     pam_sm_open_session,
+     pam_sm_close_session,
+     NULL,
+};
+
+#endif
+
+/* end of module definition */
diff --git a/contrib/libpam/modules/pam_tally/faillog.h b/contrib/libpam/modules/pam_tally/faillog.h
new file mode 100644
index 0000000..0f16261
--- /dev/null
+++ b/contrib/libpam/modules/pam_tally/faillog.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright 1989 - 1994, Julianne Frances Haugh
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of Julianne F. Haugh nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY JULIE HAUGH AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL JULIE HAUGH OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * faillog.h - login failure logging file format
+ *
+ *	$Id: faillog.h,v 1.1.1.1 2000/06/20 22:11:59 agmorgan Exp $
+ *
+ * The login failure file is maintained by login(1) and faillog(8)
+ * Each record in the file represents a separate UID and the file
+ * is indexed in that fashion.
+ */
+
+#ifndef _FAILLOG_H
+#define _FAILLOG_H
+
+struct	faillog {
+	short	fail_cnt;	/* failures since last success */
+	short	fail_max;	/* failures before turning account off */
+	char	fail_line[12];	/* last failure occured here */
+	time_t	fail_time;	/* last failure occured then */
+	/*
+	 * If nonzero, the account will be re-enabled if there are no
+	 * failures for fail_locktime seconds since last failure.
+	 */
+	long	fail_locktime;
+};
+
+#endif
diff --git a/contrib/libpam/modules/pam_tally/pam_tally_app.c b/contrib/libpam/modules/pam_tally/pam_tally_app.c
new file mode 100644
index 0000000..9e6e1fa
--- /dev/null
+++ b/contrib/libpam/modules/pam_tally/pam_tally_app.c
@@ -0,0 +1,7 @@
+/*
+ #  This seemed like such a good idea at the time. :)
+ */
+
+#define MAIN
+#include "pam_tally.c"
+
diff --git a/contrib/libpam/modules/pam_unix/bigcrypt.c b/contrib/libpam/modules/pam_unix/bigcrypt.c
new file mode 100644
index 0000000..b1568d6
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/bigcrypt.c
@@ -0,0 +1,119 @@
+/*
+ * This function implements the "bigcrypt" algorithm specifically for
+ * Linux-PAM.
+ *  
+ * This algorithm is algorithm 0 (default) shipped with the C2 secure
+ * implementation of Digital UNIX.
+ * 
+ * Disclaimer: This work is not based on the source code to Digital
+ * UNIX, nor am I connected to Digital Equipment Corp, in any way
+ * other than as a customer. This code is based on published
+ * interfaces and reasonable guesswork.
+ * 
+ * Description: The cleartext is divided into blocks of SEGMENT_SIZE=8
+ * characters or less. Each block is encrypted using the standard UNIX
+ * libc crypt function. The result of the encryption for one block
+ * provides the salt for the suceeding block.
+ * 
+ * Restrictions: The buffer used to hold the encrypted result is
+ * statically allocated. (see MAX_PASS_LEN below).  This is necessary,
+ * as the returned pointer points to "static data that are overwritten
+ * by each call", (XPG3: XSI System Interface + Headers pg 109), and
+ * this is a drop in replacement for crypt();
+ *
+ * Andy Phillips <atp@mssl.ucl.ac.uk>
+ */
+
+#include <string.h>
+#include <security/_pam_macros.h>
+
+char *crypt(const char *key, const char *salt);
+char *bigcrypt(const char *key, const char *salt);
+
+/*
+ * Max cleartext password length in segments of 8 characters this
+ * function can deal with (16 segments of 8 chars= max 128 character
+ * password).
+ */
+
+#define MAX_PASS_LEN       16
+#define SEGMENT_SIZE       8
+#define SALT_SIZE          2
+#define KEYBUF_SIZE        ((MAX_PASS_LEN*SEGMENT_SIZE)+SALT_SIZE)
+#define ESEGMENT_SIZE      11
+#define CBUF_SIZE          ((MAX_PASS_LEN*ESEGMENT_SIZE)+SALT_SIZE+1)
+
+char *bigcrypt(const char *key, const char *salt)
+{
+	static char dec_c2_cryptbuf[CBUF_SIZE];		/* static storage area */
+
+	unsigned long int keylen, n_seg, j;
+	char *cipher_ptr, *plaintext_ptr, *tmp_ptr, *salt_ptr;
+	char keybuf[KEYBUF_SIZE + 1];
+
+	D(("called with key='%s', salt='%s'.", key, salt));
+
+	/* reset arrays */
+	memset(keybuf, 0, KEYBUF_SIZE + 1);
+	memset(dec_c2_cryptbuf, 0, CBUF_SIZE);
+
+	/* fill KEYBUF_SIZE with key */
+	strncpy(keybuf, key, KEYBUF_SIZE);
+
+	/* deal with case that we are doing a password check for a
+	   conventially encrypted password: the salt will be
+	   SALT_SIZE+ESEGMENT_SIZE long. */
+	if (strlen(salt) == (SALT_SIZE + ESEGMENT_SIZE))
+		keybuf[SEGMENT_SIZE] = '\0';	/* terminate password early(?) */
+
+	keylen = strlen(keybuf);
+
+	if (!keylen) {
+		n_seg = 1;
+	} else {
+		/* work out how many segments */
+		n_seg = 1 + ((keylen - 1) / SEGMENT_SIZE);
+	}
+
+	if (n_seg > MAX_PASS_LEN)
+		n_seg = MAX_PASS_LEN;	/* truncate at max length */
+
+	/* set up some pointers */
+	cipher_ptr = dec_c2_cryptbuf;
+	plaintext_ptr = keybuf;
+
+	/* do the first block with supplied salt */
+	tmp_ptr = crypt(plaintext_ptr, salt);	/* libc crypt() */
+
+	/* and place in the static area */
+	strncpy(cipher_ptr, tmp_ptr, 13);
+	cipher_ptr += ESEGMENT_SIZE + SALT_SIZE;
+	plaintext_ptr += SEGMENT_SIZE;	/* first block of SEGMENT_SIZE */
+
+	/* change the salt (1st 2 chars of previous block) - this was found
+	   by dowsing */
+
+	salt_ptr = cipher_ptr - ESEGMENT_SIZE;
+
+	/* so far this is identical to "return crypt(key, salt);", if
+	   there is more than one block encrypt them... */
+
+	if (n_seg > 1) {
+		for (j = 2; j <= n_seg; j++) {
+
+			tmp_ptr = crypt(plaintext_ptr, salt_ptr);
+
+			/* skip the salt for seg!=0 */
+			strncpy(cipher_ptr, (tmp_ptr + SALT_SIZE), ESEGMENT_SIZE);
+
+			cipher_ptr += ESEGMENT_SIZE;
+			plaintext_ptr += SEGMENT_SIZE;
+			salt_ptr = cipher_ptr - ESEGMENT_SIZE;
+		}
+	}
+	D(("key=|%s|, salt=|%s|\nbuf=|%s|\n", key, salt, dec_c2_cryptbuf));
+
+	/* this is the <NUL> terminated encrypted password */
+
+	return dec_c2_cryptbuf;
+}
diff --git a/contrib/libpam/modules/pam_unix/lckpwdf.-c b/contrib/libpam/modules/pam_unix/lckpwdf.-c
new file mode 100644
index 0000000..b5ff458
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/lckpwdf.-c
@@ -0,0 +1,117 @@
+/*
+ * This is a hack, but until libc and glibc both include this function
+ * by default (libc only includes it if nys is not being used, at the
+ * moment, and glibc doesn't appear to have it at all) we need to have
+ * it here, too.  :-(
+ *
+ * This should not become an official part of PAM.
+ *
+ * BEGIN_HACK
+ */
+
+/*
+ * lckpwdf.c -- prevent simultaneous updates of password files
+ *
+ * Before modifying any of the password files, call lckpwdf().  It may block
+ * for up to 15 seconds trying to get the lock.  Return value is 0 on success
+ * or -1 on failure.  When you are done, call ulckpwdf() to release the lock.
+ * The lock is also released automatically when the process exits.  Only one
+ * process at a time may hold the lock.
+ *
+ * These functions are supposed to be conformant with AT&T SVID Issue 3.
+ *
+ * Written by Marek Michalkiewicz <marekm@i17linuxb.ists.pwr.wroc.pl>,
+ * public domain.
+ */
+
+#include <fcntl.h>
+#include <signal.h>
+
+#define LOCKFILE "/etc/.pwd.lock"
+#define TIMEOUT 15
+
+static int lockfd = -1;
+
+static int set_close_on_exec(int fd)
+{
+	int flags = fcntl(fd, F_GETFD, 0);
+	if (flags == -1)
+		return -1;
+	flags |= FD_CLOEXEC;
+	return fcntl(fd, F_SETFD, flags);
+}
+
+static int do_lock(int fd)
+{
+	struct flock fl;
+
+	memset(&fl, 0, sizeof fl);
+	fl.l_type = F_WRLCK;
+	fl.l_whence = SEEK_SET;
+	return fcntl(fd, F_SETLKW, &fl);
+}
+
+static void alarm_catch(int sig)
+{
+/* does nothing, but fcntl F_SETLKW will fail with EINTR */
+}
+
+static int lckpwdf(void)
+{
+	struct sigaction act, oldact;
+	sigset_t set, oldset;
+
+	if (lockfd != -1)
+		return -1;
+
+	lockfd = open(LOCKFILE, O_CREAT | O_WRONLY, 0600);
+	if (lockfd == -1)
+		return -1;
+	if (set_close_on_exec(lockfd) == -1)
+		goto cleanup_fd;
+
+	memset(&act, 0, sizeof act);
+	act.sa_handler = alarm_catch;
+	act.sa_flags = 0;
+	sigfillset(&act.sa_mask);
+	if (sigaction(SIGALRM, &act, &oldact) == -1)
+		goto cleanup_fd;
+
+	sigemptyset(&set);
+	sigaddset(&set, SIGALRM);
+	if (sigprocmask(SIG_UNBLOCK, &set, &oldset) == -1)
+		goto cleanup_sig;
+
+	alarm(TIMEOUT);
+	if (do_lock(lockfd) == -1)
+		goto cleanup_alarm;
+	alarm(0);
+	sigprocmask(SIG_SETMASK, &oldset, NULL);
+	sigaction(SIGALRM, &oldact, NULL);
+	return 0;
+
+      cleanup_alarm:
+	alarm(0);
+	sigprocmask(SIG_SETMASK, &oldset, NULL);
+      cleanup_sig:
+	sigaction(SIGALRM, &oldact, NULL);
+      cleanup_fd:
+	close(lockfd);
+	lockfd = -1;
+	return -1;
+}
+
+static int ulckpwdf(void)
+{
+	unlink(LOCKFILE);
+	if (lockfd == -1)
+		return -1;
+
+	if (close(lockfd) == -1) {
+		lockfd = -1;
+		return -1;
+	}
+	lockfd = -1;
+	return 0;
+}
+/* END_HACK */
diff --git a/contrib/libpam/modules/pam_unix/md5.c b/contrib/libpam/modules/pam_unix/md5.c
new file mode 100644
index 0000000..7ee9ed0
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/md5.c
@@ -0,0 +1,256 @@
+/*
+ * $Id: md5.c,v 1.1.1.1 2000/06/20 22:12:03 agmorgan Exp $
+ *
+ * This code implements the MD5 message-digest algorithm.
+ * The algorithm is due to Ron Rivest.  This code was
+ * written by Colin Plumb in 1993, no copyright is claimed.
+ * This code is in the public domain; do with it what you wish.
+ *
+ * Equivalent code is available from RSA Data Security, Inc.
+ * This code has been tested against that, and is equivalent,
+ * except that you don't need to include two pages of legalese
+ * with every copy.
+ *
+ * To compute the message digest of a chunk of bytes, declare an
+ * MD5Context structure, pass it to MD5Init, call MD5Update as
+ * needed on buffers full of bytes, and then call MD5Final, which
+ * will fill a supplied 16-byte array with the digest.
+ *
+ */
+
+#include <string.h>
+#include "md5.h"
+
+#ifndef HIGHFIRST
+#define byteReverse(buf, len)	/* Nothing */
+#else
+static void byteReverse(unsigned char *buf, unsigned longs);
+
+#ifndef ASM_MD5
+/*
+ * Note: this code is harmless on little-endian machines.
+ */
+static void byteReverse(unsigned char *buf, unsigned longs)
+{
+	uint32 t;
+	do {
+		t = (uint32) ((unsigned) buf[3] << 8 | buf[2]) << 16 |
+		    ((unsigned) buf[1] << 8 | buf[0]);
+		*(uint32 *) buf = t;
+		buf += 4;
+	} while (--longs);
+}
+#endif
+#endif
+
+/*
+ * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
+ * initialization constants.
+ */
+void MD5Name(MD5Init)(struct MD5Context *ctx)
+{
+	ctx->buf[0] = 0x67452301U;
+	ctx->buf[1] = 0xefcdab89U;
+	ctx->buf[2] = 0x98badcfeU;
+	ctx->buf[3] = 0x10325476U;
+
+	ctx->bits[0] = 0;
+	ctx->bits[1] = 0;
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void MD5Name(MD5Update)(struct MD5Context *ctx, unsigned const char *buf, unsigned len)
+{
+	uint32 t;
+
+	/* Update bitcount */
+
+	t = ctx->bits[0];
+	if ((ctx->bits[0] = t + ((uint32) len << 3)) < t)
+		ctx->bits[1]++;	/* Carry from low to high */
+	ctx->bits[1] += len >> 29;
+
+	t = (t >> 3) & 0x3f;	/* Bytes already in shsInfo->data */
+
+	/* Handle any leading odd-sized chunks */
+
+	if (t) {
+		unsigned char *p = (unsigned char *) ctx->in + t;
+
+		t = 64 - t;
+		if (len < t) {
+			memcpy(p, buf, len);
+			return;
+		}
+		memcpy(p, buf, t);
+		byteReverse(ctx->in, 16);
+		MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
+		buf += t;
+		len -= t;
+	}
+	/* Process data in 64-byte chunks */
+
+	while (len >= 64) {
+		memcpy(ctx->in, buf, 64);
+		byteReverse(ctx->in, 16);
+		MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
+		buf += 64;
+		len -= 64;
+	}
+
+	/* Handle any remaining bytes of data. */
+
+	memcpy(ctx->in, buf, len);
+}
+
+/*
+ * Final wrapup - pad to 64-byte boundary with the bit pattern 
+ * 1 0* (64-bit count of bits processed, MSB-first)
+ */
+void MD5Name(MD5Final)(unsigned char digest[16], struct MD5Context *ctx)
+{
+	unsigned count;
+	unsigned char *p;
+
+	/* Compute number of bytes mod 64 */
+	count = (ctx->bits[0] >> 3) & 0x3F;
+
+	/* Set the first char of padding to 0x80.  This is safe since there is
+	   always at least one byte free */
+	p = ctx->in + count;
+	*p++ = 0x80;
+
+	/* Bytes of padding needed to make 64 bytes */
+	count = 64 - 1 - count;
+
+	/* Pad out to 56 mod 64 */
+	if (count < 8) {
+		/* Two lots of padding:  Pad the first block to 64 bytes */
+		memset(p, 0, count);
+		byteReverse(ctx->in, 16);
+		MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
+
+		/* Now fill the next block with 56 bytes */
+		memset(ctx->in, 0, 56);
+	} else {
+		/* Pad block to 56 bytes */
+		memset(p, 0, count - 8);
+	}
+	byteReverse(ctx->in, 14);
+
+	/* Append length in bits and transform */
+	((uint32 *) ctx->in)[14] = ctx->bits[0];
+	((uint32 *) ctx->in)[15] = ctx->bits[1];
+
+	MD5Name(MD5Transform)(ctx->buf, (uint32 *) ctx->in);
+	byteReverse((unsigned char *) ctx->buf, 4);
+	memcpy(digest, ctx->buf, 16);
+	memset(ctx, 0, sizeof(ctx));	/* In case it's sensitive */
+}
+
+#ifndef ASM_MD5
+
+/* The four core functions - F1 is optimized somewhat */
+
+/* #define F1(x, y, z) (x & y | ~x & z) */
+#define F1(x, y, z) (z ^ (x & (y ^ z)))
+#define F2(x, y, z) F1(z, x, y)
+#define F3(x, y, z) (x ^ y ^ z)
+#define F4(x, y, z) (y ^ (x | ~z))
+
+/* This is the central step in the MD5 algorithm. */
+#define MD5STEP(f, w, x, y, z, data, s) \
+	( w += f(x, y, z) + data,  w = w<<s | w>>(32-s),  w += x )
+
+/*
+ * The core of the MD5 algorithm, this alters an existing MD5 hash to
+ * reflect the addition of 16 longwords of new data.  MD5Update blocks
+ * the data and converts bytes into longwords for this routine.
+ */
+void MD5Name(MD5Transform)(uint32 buf[4], uint32 const in[16])
+{
+	register uint32 a, b, c, d;
+
+	a = buf[0];
+	b = buf[1];
+	c = buf[2];
+	d = buf[3];
+
+	MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478U, 7);
+	MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756U, 12);
+	MD5STEP(F1, c, d, a, b, in[2] + 0x242070dbU, 17);
+	MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceeeU, 22);
+	MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0fafU, 7);
+	MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62aU, 12);
+	MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613U, 17);
+	MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501U, 22);
+	MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8U, 7);
+	MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7afU, 12);
+	MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1U, 17);
+	MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7beU, 22);
+	MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122U, 7);
+	MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193U, 12);
+	MD5STEP(F1, c, d, a, b, in[14] + 0xa679438eU, 17);
+	MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821U, 22);
+
+	MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562U, 5);
+	MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340U, 9);
+	MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51U, 14);
+	MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aaU, 20);
+	MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105dU, 5);
+	MD5STEP(F2, d, a, b, c, in[10] + 0x02441453U, 9);
+	MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681U, 14);
+	MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8U, 20);
+	MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6U, 5);
+	MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6U, 9);
+	MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87U, 14);
+	MD5STEP(F2, b, c, d, a, in[8] + 0x455a14edU, 20);
+	MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905U, 5);
+	MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8U, 9);
+	MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9U, 14);
+	MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8aU, 20);
+
+	MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942U, 4);
+	MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681U, 11);
+	MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122U, 16);
+	MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380cU, 23);
+	MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44U, 4);
+	MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9U, 11);
+	MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60U, 16);
+	MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70U, 23);
+	MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6U, 4);
+	MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127faU, 11);
+	MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085U, 16);
+	MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05U, 23);
+	MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039U, 4);
+	MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5U, 11);
+	MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8U, 16);
+	MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665U, 23);
+
+	MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244U, 6);
+	MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97U, 10);
+	MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7U, 15);
+	MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039U, 21);
+	MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3U, 6);
+	MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92U, 10);
+	MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47dU, 15);
+	MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1U, 21);
+	MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4fU, 6);
+	MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0U, 10);
+	MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314U, 15);
+	MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1U, 21);
+	MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82U, 6);
+	MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235U, 10);
+	MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bbU, 15);
+	MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391U, 21);
+
+	buf[0] += a;
+	buf[1] += b;
+	buf[2] += c;
+	buf[3] += d;
+}
+
+#endif
diff --git a/contrib/libpam/modules/pam_unix/md5.h b/contrib/libpam/modules/pam_unix/md5.h
new file mode 100644
index 0000000..103f168
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/md5.h
@@ -0,0 +1,31 @@
+
+#ifndef MD5_H
+#define MD5_H
+
+typedef unsigned int uint32;
+
+struct MD5Context {
+	uint32 buf[4];
+	uint32 bits[2];
+	unsigned char in[64];
+};
+
+void GoodMD5Init(struct MD5Context *);
+void GoodMD5Update(struct MD5Context *, unsigned const char *, unsigned);
+void GoodMD5Final(unsigned char digest[16], struct MD5Context *);
+void GoodMD5Transform(uint32 buf[4], uint32 const in[16]);
+void BrokenMD5Init(struct MD5Context *);
+void BrokenMD5Update(struct MD5Context *, unsigned const char *, unsigned);
+void BrokenMD5Final(unsigned char digest[16], struct MD5Context *);
+void BrokenMD5Transform(uint32 buf[4], uint32 const in[16]);
+
+char *Goodcrypt_md5(const char *pw, const char *salt);
+char *Brokencrypt_md5(const char *pw, const char *salt);
+
+/*
+ * This is needed to make RSAREF happy on some MS-DOS compilers.
+ */
+
+typedef struct MD5Context MD5_CTX;
+
+#endif				/* MD5_H */
diff --git a/contrib/libpam/modules/pam_unix/md5_crypt.c b/contrib/libpam/modules/pam_unix/md5_crypt.c
new file mode 100644
index 0000000..257e4bb
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/md5_crypt.c
@@ -0,0 +1,149 @@
+/*
+ * $Id: md5_crypt.c,v 1.1.1.1 2000/06/20 22:12:03 agmorgan Exp $
+ *
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ *
+ * Origin: Id: crypt.c,v 1.3 1995/05/30 05:42:22 rgrimes Exp
+ *
+ */
+
+#include <string.h>
+#include "md5.h"
+
+static unsigned char itoa64[] =	/* 0 ... 63 => ascii - 64 */
+"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+static void to64(char *s, unsigned long v, int n)
+{
+	while (--n >= 0) {
+		*s++ = itoa64[v & 0x3f];
+		v >>= 6;
+	}
+}
+
+/*
+ * UNIX password
+ *
+ * Use MD5 for what it is best at...
+ */
+
+char *MD5Name(crypt_md5)(const char *pw, const char *salt)
+{
+	const char *magic = "$1$";
+	/* This string is magic for this algorithm.  Having
+	 * it this way, we can get get better later on */
+	static char passwd[120], *p;
+	static const char *sp, *ep;
+	unsigned char final[16];
+	int sl, pl, i, j;
+	MD5_CTX ctx, ctx1;
+	unsigned long l;
+
+	/* Refine the Salt first */
+	sp = salt;
+
+	/* If it starts with the magic string, then skip that */
+	if (!strncmp(sp, magic, strlen(magic)))
+		sp += strlen(magic);
+
+	/* It stops at the first '$', max 8 chars */
+	for (ep = sp; *ep && *ep != '$' && ep < (sp + 8); ep++)
+		continue;
+
+	/* get the length of the true salt */
+	sl = ep - sp;
+
+	MD5Name(MD5Init)(&ctx);
+
+	/* The password first, since that is what is most unknown */
+	MD5Name(MD5Update)(&ctx,(unsigned const char *)pw,strlen(pw));
+
+	/* Then our magic string */
+	MD5Name(MD5Update)(&ctx,(unsigned const char *)magic,strlen(magic));
+
+	/* Then the raw salt */
+	MD5Name(MD5Update)(&ctx,(unsigned const char *)sp,sl);
+
+	/* Then just as many characters of the MD5(pw,salt,pw) */
+	MD5Name(MD5Init)(&ctx1);
+	MD5Name(MD5Update)(&ctx1,(unsigned const char *)pw,strlen(pw));
+	MD5Name(MD5Update)(&ctx1,(unsigned const char *)sp,sl);
+	MD5Name(MD5Update)(&ctx1,(unsigned const char *)pw,strlen(pw));
+	MD5Name(MD5Final)(final,&ctx1);
+	for (pl = strlen(pw); pl > 0; pl -= 16)
+		MD5Name(MD5Update)(&ctx,(unsigned const char *)final,pl>16 ? 16 : pl);
+
+	/* Don't leave anything around in vm they could use. */
+	memset(final, 0, sizeof final);
+
+	/* Then something really weird... */
+	for (j = 0, i = strlen(pw); i; i >>= 1)
+		if (i & 1)
+			MD5Name(MD5Update)(&ctx, (unsigned const char *)final+j, 1);
+		else
+			MD5Name(MD5Update)(&ctx, (unsigned const char *)pw+j, 1);
+
+	/* Now make the output string */
+	strcpy(passwd, magic);
+	strncat(passwd, sp, sl);
+	strcat(passwd, "$");
+
+	MD5Name(MD5Final)(final,&ctx);
+
+	/*
+	 * and now, just to make sure things don't run too fast
+	 * On a 60 Mhz Pentium this takes 34 msec, so you would
+	 * need 30 seconds to build a 1000 entry dictionary...
+	 */
+	for (i = 0; i < 1000; i++) {
+		MD5Name(MD5Init)(&ctx1);
+		if (i & 1)
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)pw,strlen(pw));
+		else
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)final,16);
+
+		if (i % 3)
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)sp,sl);
+
+		if (i % 7)
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)pw,strlen(pw));
+
+		if (i & 1)
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)final,16);
+		else
+			MD5Name(MD5Update)(&ctx1,(unsigned const char *)pw,strlen(pw));
+		MD5Name(MD5Final)(final,&ctx1);
+	}
+
+	p = passwd + strlen(passwd);
+
+	l = (final[0] << 16) | (final[6] << 8) | final[12];
+	to64(p, l, 4);
+	p += 4;
+	l = (final[1] << 16) | (final[7] << 8) | final[13];
+	to64(p, l, 4);
+	p += 4;
+	l = (final[2] << 16) | (final[8] << 8) | final[14];
+	to64(p, l, 4);
+	p += 4;
+	l = (final[3] << 16) | (final[9] << 8) | final[15];
+	to64(p, l, 4);
+	p += 4;
+	l = (final[4] << 16) | (final[10] << 8) | final[5];
+	to64(p, l, 4);
+	p += 4;
+	l = final[11];
+	to64(p, l, 2);
+	p += 2;
+	*p = '\0';
+
+	/* Don't leave anything around in vm they could use. */
+	memset(final, 0, sizeof final);
+
+	return passwd;
+}
diff --git a/contrib/libpam/modules/pam_unix/support.h b/contrib/libpam/modules/pam_unix/support.h
new file mode 100644
index 0000000..80f0b40
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/support.h
@@ -0,0 +1,144 @@
+/*
+ * $Id: support.h,v 1.3 2000/12/20 05:15:05 vorlon Exp $
+ */
+
+#ifndef _PAM_UNIX_SUPPORT_H
+#define _PAM_UNIX_SUPPORT_H
+
+
+/*
+ * here is the string to inform the user that the new passwords they
+ * typed were not the same.
+ */
+
+#define MISTYPED_PASS "Sorry, passwords do not match"
+
+/* type definition for the control options */
+
+typedef struct {
+	const char *token;
+	unsigned int mask;	/* shall assume 32 bits of flags */
+	unsigned int flag;
+} UNIX_Ctrls;
+
+/*
+ * macro to determine if a given flag is on
+ */
+
+#define on(x,ctrl)  (unix_args[x].flag & ctrl)
+
+/*
+ * macro to determine that a given flag is NOT on
+ */
+
+#define off(x,ctrl) (!on(x,ctrl))
+
+/*
+ * macro to turn on/off a ctrl flag manually
+ */
+
+#define set(x,ctrl)   (ctrl = ((ctrl)&unix_args[x].mask)|unix_args[x].flag)
+#define unset(x,ctrl) (ctrl &= ~(unix_args[x].flag))
+
+/* the generic mask */
+
+#define _ALL_ON_  (~0U)
+
+/* end of macro definitions definitions for the control flags */
+
+/* ****************************************************************** *
+ * ctrl flags proper..
+ */
+
+/*
+ * here are the various options recognized by the unix module. They
+ * are enumerated here and then defined below. Internal arguments are
+ * given NULL tokens.
+ */
+
+#define UNIX__OLD_PASSWD          0	/* internal */
+#define UNIX__VERIFY_PASSWD       1	/* internal */
+#define UNIX__IAMROOT             2	/* internal */
+
+#define UNIX_AUDIT                3	/* print more things than debug..
+					   some information may be sensitive */
+#define UNIX_USE_FIRST_PASS       4
+#define UNIX_TRY_FIRST_PASS       5
+#define UNIX_NOT_SET_PASS         6	/* don't set the AUTHTOK items */
+
+#define UNIX__PRELIM              7	/* internal */
+#define UNIX__UPDATE              8	/* internal */
+#define UNIX__NONULL              9	/* internal */
+#define UNIX__QUIET              10	/* internal */
+#define UNIX_USE_AUTHTOK         11	/* insist on reading PAM_AUTHTOK */
+#define UNIX_SHADOW              12	/* signal shadow on */
+#define UNIX_MD5_PASS            13	/* force the use of MD5 passwords */
+#define UNIX__NULLOK             14	/* Null token ok */
+#define UNIX_DEBUG               15	/* send more info to syslog(3) */
+#define UNIX_NODELAY             16	/* admin does not want a fail-delay */
+#define UNIX_NIS                 17	/* wish to use NIS for pwd */
+#define UNIX_BIGCRYPT            18	/* use DEC-C2 crypt()^x function */
+#define UNIX_LIKE_AUTH           19	/* need to auth for setcred to work */
+#define UNIX_REMEMBER_PASSWD     20	/* Remember N previous passwords */
+/* -------------- */
+#define UNIX_CTRLS_              21	/* number of ctrl arguments defined */
+
+
+static const UNIX_Ctrls unix_args[UNIX_CTRLS_] =
+{
+/* symbol                  token name          ctrl mask             ctrl     *
+ * ----------------------- ------------------- --------------------- -------- */
+
+/* UNIX__OLD_PASSWD */     {NULL,              _ALL_ON_,                  01},
+/* UNIX__VERIFY_PASSWD */  {NULL,              _ALL_ON_,                  02},
+/* UNIX__IAMROOT */        {NULL,              _ALL_ON_,                  04},
+/* UNIX_AUDIT */           {"audit",           _ALL_ON_,                 010},
+/* UNIX_USE_FIRST_PASS */  {"use_first_pass",  _ALL_ON_^(060),           020},
+/* UNIX_TRY_FIRST_PASS */  {"try_first_pass",  _ALL_ON_^(060),           040},
+/* UNIX_NOT_SET_PASS */    {"not_set_pass",    _ALL_ON_,                0100},
+/* UNIX__PRELIM */         {NULL,              _ALL_ON_^(0600),         0200},
+/* UNIX__UPDATE */         {NULL,              _ALL_ON_^(0600),         0400},
+/* UNIX__NONULL */         {NULL,              _ALL_ON_,               01000},
+/* UNIX__QUIET */          {NULL,              _ALL_ON_,               02000},
+/* UNIX_USE_AUTHTOK */     {"use_authtok",     _ALL_ON_,               04000},
+/* UNIX_SHADOW */          {"shadow",          _ALL_ON_,              010000},
+/* UNIX_MD5_PASS */        {"md5",             _ALL_ON_^(0400000),    020000},
+/* UNIX__NULLOK */         {"nullok",          _ALL_ON_^(01000),           0},
+/* UNIX_DEBUG */           {"debug",           _ALL_ON_,              040000},
+/* UNIX_NODELAY */         {"nodelay",         _ALL_ON_,             0100000},
+/* UNIX_NIS */             {"nis",             _ALL_ON_^(010000),    0200000},
+/* UNIX_BIGCRYPT */        {"bigcrypt",        _ALL_ON_^(020000),    0400000},
+/* UNIX_LIKE_AUTH */       {"likeauth",        _ALL_ON_,            01000000},
+/* UNIX_REMEMBER_PASSWD */ {"remember=",       _ALL_ON_,            02000000},
+};
+
+#define UNIX_DEFAULTS  (unix_args[UNIX__NONULL].flag)
+
+
+/* use this to free strings. ESPECIALLY password strings */
+
+#define _pam_delete(xx)		\
+{				\
+	_pam_overwrite(xx);	\
+	_pam_drop(xx);		\
+}
+
+extern char *PAM_getlogin(void);
+extern void _log_err(int err, pam_handle_t *pamh, const char *format,...);
+extern int _make_remark(pam_handle_t * pamh, unsigned int ctrl
+		       ,int type, const char *text);
+extern int _set_ctrl(pam_handle_t * pamh, int flags, int *remember, int argc,
+		     const char **argv);
+extern int _unix_blankpasswd(unsigned int ctrl, const char *name);
+extern int _unix_verify_password(pam_handle_t * pamh, const char *name
+			  ,const char *p, unsigned int ctrl);
+extern int _unix_read_password(pam_handle_t * pamh
+			,unsigned int ctrl
+			,const char *comment
+			,const char *prompt1
+			,const char *prompt2
+			,const char *data_name
+			,const char **pass);
+
+#endif /* _PAM_UNIX_SUPPORT_H */
+
diff --git a/contrib/libpam/modules/pam_unix/unix_chkpwd.c b/contrib/libpam/modules/pam_unix/unix_chkpwd.c
new file mode 100644
index 0000000..e232e75
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/unix_chkpwd.c
@@ -0,0 +1,314 @@
+/*
+ * $Id: unix_chkpwd.c,v 1.3 2001/02/11 06:33:53 agmorgan Exp $
+ *
+ * This program is designed to run setuid(root) or with sufficient
+ * privilege to read all of the unix password databases. It is designed
+ * to provide a mechanism for the current user (defined by this
+ * process' uid) to verify their own password.
+ *
+ * The password is read from the standard input. The exit status of
+ * this program indicates whether the user is authenticated or not.
+ *
+ * Copyright information is located at the end of the file.
+ *
+ */
+
+#include <security/_pam_aconf.h>
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include <shadow.h>
+#include <signal.h>
+
+#define MAXPASS		200	/* the maximum length of a password */
+
+#include <security/_pam_macros.h>
+
+#include "md5.h"
+
+extern char *crypt(const char *key, const char *salt);
+extern char *bigcrypt(const char *key, const char *salt);
+
+#define UNIX_PASSED	0
+#define UNIX_FAILED	1
+
+/* syslogging function for errors and other information */
+
+static void _log_err(int err, const char *format,...)
+{
+	va_list args;
+
+	va_start(args, format);
+	openlog("unix_chkpwd", LOG_CONS | LOG_PID, LOG_AUTH);
+	vsyslog(err, format, args);
+	va_end(args);
+	closelog();
+}
+
+static void su_sighandler(int sig)
+{
+	if (sig > 0) {
+		_log_err(LOG_NOTICE, "caught signal %d.", sig);
+		exit(sig);
+	}
+}
+
+static void setup_signals(void)
+{
+	struct sigaction action;	/* posix signal structure */
+
+	/*
+	 * Setup signal handlers
+	 */
+	(void) memset((void *) &action, 0, sizeof(action));
+	action.sa_handler = su_sighandler;
+	action.sa_flags = SA_RESETHAND;
+	(void) sigaction(SIGILL, &action, NULL);
+	(void) sigaction(SIGTRAP, &action, NULL);
+	(void) sigaction(SIGBUS, &action, NULL);
+	(void) sigaction(SIGSEGV, &action, NULL);
+	action.sa_handler = SIG_IGN;
+	action.sa_flags = 0;
+	(void) sigaction(SIGTERM, &action, NULL);
+	(void) sigaction(SIGHUP, &action, NULL);
+	(void) sigaction(SIGINT, &action, NULL);
+	(void) sigaction(SIGQUIT, &action, NULL);
+}
+
+static int _unix_verify_password(const char *name, const char *p, int opt)
+{
+	struct passwd *pwd = NULL;
+	struct spwd *spwdent = NULL;
+	char *salt = NULL;
+	char *pp = NULL;
+	int retval = UNIX_FAILED;
+
+	/* UNIX passwords area */
+	setpwent();
+	pwd = getpwnam(name);	/* Get password file entry... */
+	endpwent();
+	if (pwd != NULL) {
+		if (strcmp(pwd->pw_passwd, "x") == 0) {
+			/*
+			 * ...and shadow password file entry for this user,
+			 * if shadowing is enabled
+			 */
+			setspent();
+			spwdent = getspnam(name);
+			endspent();
+			if (spwdent != NULL)
+				salt = x_strdup(spwdent->sp_pwdp);
+			else
+				pwd = NULL;
+		} else {
+			if (strcmp(pwd->pw_passwd, "*NP*") == 0) {	/* NIS+ */
+				uid_t save_uid;
+
+				save_uid = geteuid();
+				seteuid(pwd->pw_uid);
+				spwdent = getspnam(name);
+				seteuid(save_uid);
+
+				salt = x_strdup(spwdent->sp_pwdp);
+			} else {
+				salt = x_strdup(pwd->pw_passwd);
+			}
+		}
+	}
+	if (pwd == NULL || salt == NULL) {
+		_log_err(LOG_ALERT, "check pass; user unknown");
+		p = NULL;
+		return retval;
+	}
+
+	if (strlen(salt) == 0)
+		return (opt == 0) ? UNIX_FAILED : UNIX_PASSED;
+
+	/* the moment of truth -- do we agree with the password? */
+	retval = UNIX_FAILED;
+	if (!strncmp(salt, "$1$", 3)) {
+		pp = Goodcrypt_md5(p, salt);
+		if (strcmp(pp, salt) == 0) {
+			retval = UNIX_PASSED;
+		} else {
+			pp = Brokencrypt_md5(p, salt);
+			if (strcmp(pp, salt) == 0)
+				retval = UNIX_PASSED;
+		}
+	} else {
+		pp = bigcrypt(p, salt);
+		if (strcmp(pp, salt) == 0) {
+			retval = UNIX_PASSED;
+		}
+	}
+	p = NULL;		/* no longer needed here */
+
+	/* clean up */
+	{
+		char *tp = pp;
+		if (pp != NULL) {
+			while (tp && *tp)
+				*tp++ = '\0';
+		}
+		pp = tp = NULL;
+	}
+
+	return retval;
+}
+
+static char *getuidname(uid_t uid)
+{
+	struct passwd *pw;
+	static char username[32];
+
+	pw = getpwuid(uid);
+	if (pw == NULL)
+		return NULL;
+
+	memset(username, 0, 32);
+	strncpy(username, pw->pw_name, 32);
+	username[31] = '\0';
+	
+	return username;
+}
+
+int main(int argc, char *argv[])
+{
+	char pass[MAXPASS + 1];
+	char option[8];
+	int npass, opt;
+	int force_failure = 0;
+	int retval = UNIX_FAILED;
+	char *user;
+
+	/*
+	 * Catch or ignore as many signal as possible.
+	 */
+	setup_signals();
+
+	/*
+	 * we establish that this program is running with non-tty stdin.
+	 * this is to discourage casual use. It does *NOT* prevent an
+	 * intruder from repeatadly running this program to determine the
+	 * password of the current user (brute force attack, but one for
+	 * which the attacker must already have gained access to the user's
+	 * account).
+	 */
+
+	if (isatty(STDIN_FILENO)) {
+
+		_log_err(LOG_NOTICE
+		      ,"inappropriate use of Unix helper binary [UID=%d]"
+			 ,getuid());
+		fprintf(stderr
+		 ,"This binary is not designed for running in this way\n"
+		      "-- the system administrator has been informed\n");
+		sleep(10);	/* this should discourage/annoy the user */
+		return UNIX_FAILED;
+	}
+
+	/*
+	 * determine the current user's name is
+	 */
+	user = getuidname(getuid());
+	if (argc == 2) {
+	    /* if the caller specifies the username, verify that user
+	       matches it */
+	    if (strcmp(user, argv[1])) {
+		force_failure = 1;
+	    }
+	}
+
+	/* read the nollok/nonull option */
+
+	npass = read(STDIN_FILENO, option, 8);
+
+	if (npass < 0) {
+		_log_err(LOG_DEBUG, "no option supplied");
+		return UNIX_FAILED;
+	} else {
+		option[7] = '\0';
+		if (strncmp(option, "nullok", 8) == 0)
+			opt = 1;
+		else
+			opt = 0;
+	}
+
+	/* read the password from stdin (a pipe from the pam_unix module) */
+
+	npass = read(STDIN_FILENO, pass, MAXPASS);
+
+	if (npass < 0) {	/* is it a valid password? */
+
+		_log_err(LOG_DEBUG, "no password supplied");
+
+	} else if (npass >= MAXPASS) {
+
+		_log_err(LOG_DEBUG, "password too long");
+
+	} else {
+		if (npass == 0) {
+			/* the password is NULL */
+
+			retval = _unix_verify_password(user, NULL, opt);
+
+		} else {
+			/* does pass agree with the official one? */
+
+			pass[npass] = '\0';	/* NUL terminate */
+			retval = _unix_verify_password(user, pass, opt);
+
+		}
+	}
+
+	memset(pass, '\0', MAXPASS);	/* clear memory of the password */
+
+	/* return pass or fail */
+
+	if ((retval != UNIX_PASSED) || force_failure) {
+	    return UNIX_FAILED;
+	} else {
+	    return UNIX_PASSED;
+	}
+}
+
+/*
+ * Copyright (c) Andrew G. Morgan, 1996. All rights reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ * 
+ * ALTERNATIVELY, this product may be distributed under the terms of
+ * the GNU Public License, in which case the provisions of the GPL are
+ * required INSTEAD OF the above restrictions.  (This clause is
+ * necessary due to a potential bad interaction between the GPL and
+ * the restrictions contained in a BSD-style copyright.)
+ * 
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
diff --git a/contrib/libpam/modules/pam_unix/yppasswd.h b/contrib/libpam/modules/pam_unix/yppasswd.h
new file mode 100644
index 0000000..6b414be
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/yppasswd.h
@@ -0,0 +1,51 @@
+/*
+ * yppasswdd
+ * Copyright 1994, 1995, 1996 Olaf Kirch, <okir@monad.swb.de>
+ *
+ * This program is covered by the GNU General Public License, version 2.
+ * It is provided in the hope that it is useful. However, the author
+ * disclaims ALL WARRANTIES, expressed or implied. See the GPL for details.
+ *
+ * This file was generated automatically by rpcgen from yppasswd.x, and
+ * editied manually.
+ */
+
+#ifndef _YPPASSWD_H_
+#define _YPPASSWD_H_
+
+#define YPPASSWDPROG ((u_long)100009)
+#define YPPASSWDVERS ((u_long)1)
+#define YPPASSWDPROC_UPDATE ((u_long)1)
+
+/*
+ * The password struct passed by the update call. I renamed it to
+ * xpasswd to avoid a type clash with the one defined in <pwd.h>.
+ */
+#ifndef __sgi
+typedef struct xpasswd {
+	char *pw_name;
+	char *pw_passwd;
+	int pw_uid;
+	int pw_gid;
+	char *pw_gecos;
+	char *pw_dir;
+	char *pw_shell;
+} xpasswd;
+
+#else
+#include <pwd.h>
+typedef struct xpasswd xpasswd;
+#endif
+
+/* The updated password information, plus the old password.
+ */
+typedef struct yppasswd {
+	char *oldpass;
+	xpasswd newpw;
+} yppasswd;
+
+/* XDR encoding/decoding routines */
+bool_t xdr_xpasswd(XDR * xdrs, xpasswd * objp);
+bool_t xdr_yppasswd(XDR * xdrs, yppasswd * objp);
+
+#endif	/* _YPPASSWD_H_ */
diff --git a/contrib/libpam/modules/pam_unix/yppasswd_xdr.c b/contrib/libpam/modules/pam_unix/yppasswd_xdr.c
new file mode 100644
index 0000000..b1a60b4
--- /dev/null
+++ b/contrib/libpam/modules/pam_unix/yppasswd_xdr.c
@@ -0,0 +1,38 @@
+/* 
+ * yppasswdd
+ * Copyright 1994, 1995, 1996 Olaf Kirch, <okir@monad.swb.de>
+ *
+ * This program is covered by the GNU General Public License, version 2.
+ * It is provided in the hope that it is useful. However, the author
+ * disclaims ALL WARRANTIES, expressed or implied. See the GPL for details.
+ * 
+ * This file was generated automatically by rpcgen from yppasswd.x, and
+ * editied manually.
+ */
+
+#include <security/_pam_aconf.h>
+
+#include <rpc/rpc.h>
+#include <rpcsvc/yp_prot.h>
+#include <rpcsvc/ypclnt.h>
+#include "yppasswd.h"
+
+bool_t
+xdr_xpasswd(XDR * xdrs, xpasswd * objp)
+{
+	return xdr_string(xdrs, &objp->pw_name, ~0)
+	    && xdr_string(xdrs, &objp->pw_passwd, ~0)
+	    && xdr_int(xdrs, &objp->pw_uid)
+	    && xdr_int(xdrs, &objp->pw_gid)
+	    && xdr_string(xdrs, &objp->pw_gecos, ~0)
+	    && xdr_string(xdrs, &objp->pw_dir, ~0)
+	    && xdr_string(xdrs, &objp->pw_shell, ~0);
+}
+
+
+bool_t
+xdr_yppasswd(XDR * xdrs, yppasswd * objp)
+{
+	return xdr_string(xdrs, &objp->oldpass, ~0)
+	    && xdr_xpasswd(xdrs, &objp->newpw);
+}
diff --git a/contrib/libpam/modules/pam_userdb/Makefile b/contrib/libpam/modules/pam_userdb/Makefile
new file mode 100644
index 0000000..ebdcff9
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/Makefile
@@ -0,0 +1,35 @@
+#
+# This Makefile controls a build process of $(TITLE) module for
+# Linux-PAM. You should not modify this Makefile (unless you know
+# what you are doing!).
+
+# $Id: Makefile,v 1.4 2001/02/18 03:03:31 agmorgan Exp $
+# Created by Cristian Gafton <gafton@redhat.com>
+
+include ../../Make.Rules
+
+TITLE=pam_userdb
+
+ifeq ($(HAVE_NDBM_H),yes)
+ WHICH_DB=ndbm
+ MODULE_SIMPLE_EXTRALIBS = -lndbm
+else
+ifeq ($(HAVE_LIBDB),yes)
+ WHICH_DB=db
+ MODULE_SIMPLE_EXTRALIBS = -ldb
+else
+ WHICH_DB=none
+endif
+endif
+
+ifeq ($(WHICH_DB),none)
+
+include ../dont_makefile
+
+else
+
+MODULE_SIMPLE_EXTRAFILES = conv
+
+include ../Simple.Rules
+
+endif
diff --git a/contrib/libpam/modules/pam_userdb/README b/contrib/libpam/modules/pam_userdb/README
new file mode 100644
index 0000000..af78d47
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/README
@@ -0,0 +1,30 @@
+pam_userdb:
+	Look up users in a .db database and verify their password against
+	what is contained in that database.
+
+RECOGNIZED ARGUMENTS:
+	debug		write a message to syslog indicating success or
+			failure.
+
+	db=[path]	use the [path] database for performing lookup. There
+			is no default; the module will return PAM_IGNORE if
+			no database is provided.
+			
+	icase		make the password verification to be case insensitive
+			(ie when working with registration numbers and such)
+
+	dump		dump all the entries in the database to the log (eek,
+			don't do this by default!)
+
+MODULE SERVICES PROVIDED:
+	auth		_authetication and _setcred (blank)
+
+EXAMPLE USE:
+	auth  sufficient pam_userdb.so icase db=/tmp/dbtest.db
+
+AUTHOR:
+	Cristian Gafton <gafton@redhat.com>
+
+
+
+$Id: README,v 1.1.1.1 2000/06/20 22:12:09 agmorgan Exp $
diff --git a/contrib/libpam/modules/pam_userdb/conv.c b/contrib/libpam/modules/pam_userdb/conv.c
new file mode 100644
index 0000000..0f13d03
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/conv.c
@@ -0,0 +1,125 @@
+/*
+ * Conversation related functions
+ */
+
+/* $Id */
+/* Copyright at the end of the file */
+
+#define _BSD_SOURCE
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <security/pam_modules.h>
+#include <security/_pam_macros.h>
+
+#include "pam_userdb.h"
+
+/*
+ * dummy conversation function sending exactly one prompt
+ * and expecting exactly one response from the other party
+ */
+static int converse(pam_handle_t *pamh,
+		    struct pam_message **message,
+		    struct pam_response **response)
+{
+    int retval;
+    const struct pam_conv *conv;
+
+    retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv ) ;
+    if (retval == PAM_SUCCESS)
+	retval = conv->conv(1, (const struct pam_message **)message,
+			    response, conv->appdata_ptr);
+	
+    return retval; /* propagate error status */
+}
+
+
+static char *_pam_delete(register char *xx)
+{
+    _pam_overwrite(xx);
+    _pam_drop(xx);
+    return NULL;
+}
+
+/*
+ * This is a conversation function to obtain the user's password
+ */
+int conversation(pam_handle_t *pamh)
+{
+    struct pam_message msg[2],*pmsg[2];
+    struct pam_response *resp;
+    int retval;
+    char * token = NULL;
+    
+    pmsg[0] = &msg[0];
+    msg[0].msg_style = PAM_PROMPT_ECHO_OFF;
+    msg[0].msg = "Password: ";
+
+    /* so call the conversation expecting i responses */
+    resp = NULL;
+    retval = converse(pamh, pmsg, &resp);
+
+    if (resp != NULL) {
+	const char * item;
+	/* interpret the response */
+	if (retval == PAM_SUCCESS) {     /* a good conversation */
+	    token = x_strdup(resp[0].resp);
+	    if (token == NULL) {
+		return PAM_AUTHTOK_RECOVER_ERR;
+	    }
+	}
+
+	/* set the auth token */
+	retval = pam_set_item(pamh, PAM_AUTHTOK, token);
+	token = _pam_delete(token);   /* clean it up */
+	if ( (retval != PAM_SUCCESS) ||
+	     (retval = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&item))
+	     != PAM_SUCCESS ) {
+	    return retval;
+	}
+	
+	_pam_drop_reply(resp, 1);
+    } else {
+	retval = (retval == PAM_SUCCESS)
+	    ? PAM_AUTHTOK_RECOVER_ERR:retval ;
+    }
+
+    return retval;
+}
+
+/*
+ * Copyright (c) Cristian Gafton <gafton@redhat.com>, 1999
+ *                                              All rights reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ *
+ * ALTERNATIVELY, this product may be distributed under the terms of
+ * the GNU Public License, in which case the provisions of the GPL are
+ * required INSTEAD OF the above restrictions.  (This clause is
+ * necessary due to a potential bad interaction between the GPL and
+ * the restrictions contained in a BSD-style copyright.)
+ *
+ * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
diff --git a/contrib/libpam/modules/pam_userdb/create.pl b/contrib/libpam/modules/pam_userdb/create.pl
new file mode 100644
index 0000000..0e1687d
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/create.pl
@@ -0,0 +1,23 @@
+#!/usr/bin/perl
+# this program creates a database in ARGV[1] from pairs given on 
+# stdandard input
+#
+# $Id: create.pl,v 1.1.1.1 2000/06/20 22:12:09 agmorgan Exp $
+
+use DB_File;
+
+my $database = $ARGV[0];
+die "Use: check,pl <database>\n" unless ($database);
+print "Using database: $database\n";
+
+my %lusers = ();
+
+tie %lusers, 'DB_File', $database, O_RDWR|O_CREAT, 0644, $DB_HASH ;
+while (<STDIN>) {
+  my ($user, $pass) = split;
+
+  $lusers{$user} = $pass;
+}
+untie %lusers;
+
+
diff --git a/contrib/libpam/modules/pam_userdb/pam_userdb.c b/contrib/libpam/modules/pam_userdb/pam_userdb.c
new file mode 100644
index 0000000..9da9370
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/pam_userdb.c
@@ -0,0 +1,304 @@
+/* pam_userdb module */
+ 
+/*
+ * $Id: pam_userdb.c,v 1.4 2000/12/04 15:02:16 baggins Exp $
+ * Written by Cristian Gafton <gafton@redhat.com> 1996/09/10
+ * See the end of the file for Copyright Information
+ */
+
+#include <security/_pam_aconf.h>
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <syslog.h>
+#include <stdarg.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#include "pam_userdb.h"
+
+#ifdef HAVE_NDBM_H
+# include <ndbm.h>
+#else
+# ifdef HAVE_DB_H
+#  define DB_DBM_HSEARCH    1 /* use the dbm interface */
+#  include <db.h>
+# else
+#  error "failed to find a libdb or equivalent"
+# endif
+#endif
+
+/*
+ * here, we make a definition for the externally accessible function
+ * in this file (this definition is required for static a module
+ * but strongly encouraged generally) it is used to instruct the
+ * modules include file to define the function prototypes.
+ */
+
+#define PAM_SM_AUTH
+#define PAM_SM_ACCOUNT
+
+#include <security/pam_modules.h>
+
+/* some syslogging */
+
+static void _pam_log(int err, const char *format, ...)
+{
+    va_list args;
+
+    va_start(args, format);
+    openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
+    vsyslog(err, format, args);
+    va_end(args);
+    closelog();
+}
+
+char * database	 = NULL;
+static int ctrl	 = 0;
+
+static int _pam_parse(int argc, const char **argv)
+{
+     /* step through arguments */
+     for (ctrl = 0; argc-- > 0; ++argv) {
+
+          /* generic options */
+
+          if (!strcmp(*argv,"debug"))
+               ctrl |= PAM_DEBUG_ARG;
+	  else if (!strcasecmp(*argv, "icase"))
+	      ctrl |= PAM_ICASE_ARG;
+	  else if (!strcasecmp(*argv, "dump"))
+	      ctrl |= PAM_DUMP_ARG;
+          else if (!strncasecmp(*argv,"db=", 3)) {
+	      database = strdup((*argv) + 3);
+	      if (database == NULL)
+		  _pam_log(LOG_ERR, "pam_parse: could not parse argument \"%s\"",
+			   *argv);
+	  } else {
+               _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
+          }
+     }
+
+     return ctrl;
+}
+
+
+/*
+ * Looks up an user name in a database and checks the password
+ *
+ * return values:
+ *	 1  = User not found
+ *	 0  = OK
+ * 	-1  = Password incorrect
+ *	-2  = System error
+ */
+static int user_lookup(const char *user, const char *pass)
+{
+    DBM *dbm;
+    datum key, data;
+
+    /* Open the DB file. */
+    dbm = dbm_open(database, O_RDONLY, 0644);
+    if (dbm == NULL) {
+	_pam_log(LOG_ERR, "user_lookup: could not open database `%s'",
+		 database);
+	return -2;
+    }
+
+    if (ctrl &PAM_DUMP_ARG) {
+	_pam_log(LOG_INFO, "Database dump:");
+	for (key = dbm_firstkey(dbm);  key.dptr != NULL;
+	     key = dbm_nextkey(dbm)) {
+	    data = dbm_fetch(dbm, key);
+	    _pam_log(LOG_INFO, "key[len=%d] = `%s', data[len=%d] = `%s'",
+		     key.dsize, key.dptr, data.dsize, data.dptr);
+	}
+    } 
+    /* do some more init work */
+
+    memset(&key, 0, sizeof(key));
+    memset(&data, 0, sizeof(data));
+    key.dptr = x_strdup(user);
+    key.dsize = strlen(user);
+    user = NULL;
+
+    if (key.dptr) {
+	data = dbm_fetch(dbm, key);
+	memset(key.dptr, 0, key.dsize);
+	free(key.dptr);
+    }
+
+    if (ctrl & PAM_DEBUG_ARG) {
+	_pam_log(LOG_INFO, "password in database is [%p]`%s', len is %d",
+		 data.dptr, (char *) data.dptr, data.dsize);
+    }
+
+    if (data.dptr != NULL) {
+	int compare = 0;
+	/* bingo, got it */
+	if (ctrl & PAM_ICASE_ARG)
+	    compare = strncasecmp(pass, data.dptr, data.dsize);
+	else
+	    compare = strncmp(pass, data.dptr, data.dsize);
+	dbm_close(dbm);
+	if (compare == 0)
+	    return 0; /* match */
+	else
+	    return -1; /* wrong */
+    } else {
+	if (ctrl & PAM_DEBUG_ARG) {    
+	    _pam_log(LOG_INFO, "error returned by dbm_fetch: %s",
+		     strerror(errno));
+	}
+	dbm_close(dbm);
+	/* probably we should check dbm_error() here */
+	return 1; /* not found */
+    }
+
+    /* NOT REACHED */
+    return -2;
+}
+
+/* --- authentication management functions (only) --- */
+
+PAM_EXTERN
+int pam_sm_authenticate(pam_handle_t *pamh, int flags,
+			int argc, const char **argv)
+{
+     const char *username;
+     const char *password;
+     int retval = PAM_AUTH_ERR;
+    
+     /* parse arguments */
+     ctrl = _pam_parse(argc, argv);
+
+     /* Get the username */
+     retval = pam_get_user(pamh, &username, NULL);
+     if ((retval != PAM_SUCCESS) || (!username)) {
+        if (ctrl & PAM_DEBUG_ARG)
+            _pam_log(LOG_DEBUG,"can not get the username");
+        return PAM_SERVICE_ERR;
+     }
+     
+     /* Converse just to be sure we have the password */
+     retval = conversation(pamh);
+     if (retval != PAM_SUCCESS) {
+	 _pam_log(LOG_ERR, "could not obtain password for `%s'",
+		  username);
+	 return -2;
+     }
+     
+     /* Get the password */
+     retval = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&password);
+     if (retval != PAM_SUCCESS) {
+	 _pam_log(LOG_ERR, "Could not retrive user's password");
+	 return -2;
+     }
+     
+     if (ctrl & PAM_DEBUG_ARG)
+	 _pam_log(LOG_INFO, "Verify user `%s' with password `%s'",
+		  username, password);
+     
+     /* Now use the username to look up password in the database file */
+     retval = user_lookup(username, password);
+     switch (retval) {
+	 case -2:
+	     /* some sort of system error. The log was already printed */
+	     return PAM_SERVICE_ERR;    
+	 case -1:
+	     /* incorrect password */
+	     _pam_log(LOG_WARNING,
+		      "user `%s' denied access (incorrect password)",
+		      username);
+	     return PAM_AUTH_ERR;
+	 case 1:
+	     /* the user does not exist in the database */
+	     if (ctrl & PAM_DEBUG_ARG)
+		 _pam_log(LOG_NOTICE, "user `%s' not found in the database",
+			  username);
+	     return PAM_USER_UNKNOWN;
+	 case 0:
+	     /* Otherwise, the authentication looked good */
+	     _pam_log(LOG_NOTICE, "user '%s' granted acces", username);
+	     return PAM_SUCCESS;
+	 default:
+	     /* we don't know anything about this return value */
+	     _pam_log(LOG_ERR,
+		      "internal module error (retval = %d, user = `%s'",
+		      retval, username);
+	     return PAM_SERVICE_ERR;
+     }
+
+     /* should not be reached */
+     return PAM_IGNORE;
+}
+
+PAM_EXTERN
+int pam_sm_setcred(pam_handle_t *pamh, int flags,
+		   int argc, const char **argv)
+{
+    return PAM_SUCCESS;
+}
+
+PAM_EXTERN
+int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
+		   int argc, const char **argv)
+{
+    return PAM_SUCCESS;
+}
+
+
+#ifdef PAM_STATIC
+
+/* static module data */
+
+struct pam_module _pam_userdb_modstruct = {
+     "pam_userdb",
+     pam_sm_authenticate,
+     pam_sm_setcred,
+     NULL,
+     NULL,
+     NULL,
+     NULL,
+};
+
+#endif
+
+/*
+ * Copyright (c) Cristian Gafton <gafton@redhat.com>, 1999
+ *                                              All rights reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ *
+ * ALTERNATIVELY, this product may be distributed under the terms of
+ * the GNU Public License, in which case the provisions of the GPL are
+ * required INSTEAD OF the above restrictions.  (This clause is
+ * necessary due to a potential bad interaction between the GPL and
+ * the restrictions contained in a BSD-style copyright.)
+ *
+ * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
diff --git a/contrib/libpam/modules/pam_userdb/pam_userdb.h b/contrib/libpam/modules/pam_userdb/pam_userdb.h
new file mode 100644
index 0000000..542cdf5
--- /dev/null
+++ b/contrib/libpam/modules/pam_userdb/pam_userdb.h
@@ -0,0 +1,61 @@
+
+#ifndef _PAM_USERSDB_H
+#define _PAM_USERSDB_H
+/* $Id: pam_userdb.h,v 1.1.1.1 2000/06/20 22:12:09 agmorgan Exp $ */
+   
+/* Header files */
+#include <security/pam_appl.h>
+
+/* argument parsing */
+#define PAM_DEBUG_ARG		0x0001
+#define PAM_ICASE_ARG		0x0002
+#define PAM_DUMP_ARG		0x0004
+
+/* Useful macros */
+#define  x_strdup(s)  ( (s) ? strdup(s):NULL )
+
+/* The name of the module we are compiling */
+#ifndef MODULE_NAME
+#define MODULE_NAME	"pam_userdb"
+#endif /* MODULE_NAME */
+
+/* function prototypes */
+int conversation(pam_handle_t *);
+
+#endif /* _PAM_USERSDB_H */
+
+/*
+ * Copyright (c) Cristian Gafton <gafton@redhat.com>, 1999
+ *                                              All rights reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ *
+ * ALTERNATIVELY, this product may be distributed under the terms of
+ * the GNU Public License, in which case the provisions of the GPL are
+ * required INSTEAD OF the above restrictions.  (This clause is
+ * necessary due to a potential bad interaction between the GPL and
+ * the restrictions contained in a BSD-style copyright.)
+ *
+ * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */