I was wondering why hare did not seem to be working anymore.
FYI, this bug report was created before I did this work: pkgbase upgrade to 15.1 restores default /etc/pam.d/* configuration
I tracked it down to a missing line in /etc/pam.d/sshd.
The file is there in this snapshot:
[12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN autosnap_2026-08-04_00:00:18_daily/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd --- autosnap_2026-08-04_00:00:18_daily/etc/pam.d/sshd 2023-12-03 16:38:51.359135000 +0000 +++ /jails/serpico/etc/pam.d/sshd 2026-06-12 09:42:15.000000000 +0000 @@ -21,4 +21,3 @@ # password #password sufficient pam_krb5.so no_warn try_first_pass password required pam_unix.so no_warn try_first_pass -session optional pam_exec.so /usr/local/sbin/hare 10.55.0.10 [12:25 r730-01 dvl /jails/serpico/.zfs/snapshot] %
It is gone the next day:
[12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN autosnap_2026-08-05_00:00:20_daily/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd [12:24 r730-01 dvl /jails/serpico/.zfs/snapshot] %
It is also there in this snapshot:
[12:28 r730-01 dvl /jails/serpico/.zfs/snapshot] % diff -ruN mkjail-2026-08-04-14:17:37/etc/pam.d/sshd /jails/serpico/etc/pam.d/sshd --- mkjail-2026-08-04-14:17:37/etc/pam.d/sshd 2026-07-29 05:09:12.000000000 +0000 +++ /jails/serpico/etc/pam.d/sshd 2026-06-12 09:42:15.000000000 +0000 @@ -21,4 +21,3 @@ # password #password sufficient pam_krb5.so no_warn try_first_pass password required pam_unix.so no_warn try_first_pass -session optional pam_exec.so /usr/local/sbin/hare 10.55.0.10 [12:29 r730-01 dvl /jails/serpico/.zfs/snapshot] %
I suspect the upgrade to FreeBSD 15.1 dropped that line.
Adding the line back into that file restores the previous behavior.
Now I wonder what else has been removed and how to avoid this in future upgrade.
kevans asked for this after mentioning: It does try a three-way merge, but if that fails then it’s supposed to install the ‘new’ version as foo.pkgnew and let you reconcile the differences
[22:05 r730-01 dvl ~] % ls -l /jails/*/etc/pam.d/sshd.pkg{new,save}
zsh: no matches found: /jails/*/etc/pam.d/sshd.pkgnew
None found on any of the hosts.
I also checked for /jails/*/etc/pam.d/sshd* – only the sshd file was found.
