recompile sshd with OPIE?

[freebsd-security at auscert.org.au]

Hi,

I'm having trouble getting an answer to the following problem on -questions
- I hope someone here has done something similar and can help.

I'd like to compile support for FreeBSD OPIE into sshd. Presently I have
to use PAM to achieve one-time password support. On a 4.x system I have
in /etc/ssh/sshd_config

ChallengeResponseAuthentication yes

and in /etc/pam.conf

sshd    auth    sufficient      pam_opie.so     no_fake_prompts

To avoid the extra PAM process on 5.x, I'd prefer to just enable OPIE in
the sshd binary, but I'm not sure if this is possible with a commandline
option to make. I would like to rebuild it in the usual way:

# cd /usr/src/secure/usr.sbin/sshd
# make obj && make depend && make all install

but somehow define OPIE or, I think, include the configure option
--with-skey=PATH, or both.

Can this be achieved within the regular system build process, or must I
roll my own?

thanks,
joel

-- Joel Hatton --
Security Analyst                    | Hotline: +61 7 3365 4417
AusCERT - Australia's national CERT | Fax:     +61 7 3365 7031
The University of Queensland        | WWW:     www.auscert.org.au
Qld 4072 Australia                  | Email:   auscert at auscert.org.au