I was wondering why hare did not seem to be working anymore.
I tracked it down to a missing line in /etc/pam.d/sshd.
The file is there in this snapshot:
[12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN autosnap_2026-08-04_00:00:18_daily/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd --- autosnap_2026-08-04_00:00:18_daily/etc/pam.d/sshd 2023-12-03 16:38:51.359135000 +0000 +++ /jails/serpico/etc/pam.d/sshd 2026-06-12 09:42:15.000000000 +0000 @@ -21,4 +21,3 @@ # password #password sufficient pam_krb5.so no_warn try_first_pass password required pam_unix.so no_warn try_first_pass -session optional pam_exec.so /usr/local/sbin/hare 10.55.0.10 [12:25 r730-01 dvl /jails/serpico/.zfs/snapshot] %
It is gone the next day:
[12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN autosnap_2026-08-05_00:00:20_daily/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd [12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] %
It is also there in this snapshot:
[12:28 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN mkjail-2026-08-04-14:17:37/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd --- mkjail-2026-08-04-14:17:37/etc/pam.d/sshd 2026-07-29 05:09:12.000000000 +0000 +++ /jails/serpico/etc/pam.d/sshd 2026-06-12 09:42:15.000000000 +0000 @@ -21,4 +21,3 @@ # password #password sufficient pam_krb5.so no_warn try_first_pass password required pam_unix.so no_warn try_first_pass -session optional pam_exec.so /usr/local/sbin/hare 10.55.0.10 [12:29 r730-01 dvl /jails/serpico/.zfs/snapshot] %
I suspect the upgrade to FreeBSD 15.1 dropped that line.
Adding the line back into that file restores the previous behavior.
Now I wonder what else has been removed and how to avoid this in future upgrade.
