diff --git a/ObsoleteFiles.inc b/ObsoleteFiles.inc
index efd466721ce..4e7d80d19cf 100644
--- a/ObsoleteFiles.inc
+++ b/ObsoleteFiles.inc
@@ -174,6 +174,70 @@ OLD_FILES+=usr/lib/clang/6.0.0/lib/freebsd/libclang_rt.ubsan_standalone_cxx-x86_
 OLD_DIRS+=usr/lib/clang/6.0.0/lib/freebsd
 OLD_DIRS+=usr/lib/clang/6.0.0/lib
 OLD_DIRS+=usr/lib/clang/6.0.0
+# 20180625: krb5 private lib32
+OLD_LIBS+=usr/lib32/libgssapi.a
+OLD_LIBS+=usr/lib32/libgssapi.so
+OLD_LIBS+=usr/lib32/libgssapi.so.10
+OLD_LIBS+=usr/lib32/libasn1.a
+OLD_LIBS+=usr/lib32/libasn1.so
+OLD_LIBS+=usr/lib32/libasn1.so.11
+OLD_LIBS+=usr/lib32/libasn1_p.a
+OLD_LIBS+=usr/lib32/libgssapi_krb5.a
+OLD_LIBS+=usr/lib32/libgssapi_krb5.so
+OLD_LIBS+=usr/lib32/libgssapi_krb5.so.10
+OLD_LIBS+=usr/lib32/libgssapi_krb5_p.a
+OLD_LIBS+=usr/lib32/libgssapi_ntlm.a
+OLD_LIBS+=usr/lib32/libgssapi_ntlm.so
+OLD_LIBS+=usr/lib32/libgssapi_ntlm.so.10
+OLD_LIBS+=usr/lib32/libgssapi_ntlm_p.a
+OLD_LIBS+=usr/lib32/libgssapi_spnego.a
+OLD_LIBS+=usr/lib32/libgssapi_spnego.so
+OLD_LIBS+=usr/lib32/libgssapi_spnego.so.10
+OLD_LIBS+=usr/lib32/libgssapi_spnego_p.a
+OLD_LIBS+=usr/lib32/libhdb.a
+OLD_LIBS+=usr/lib32/libhdb.so
+OLD_LIBS+=usr/lib32/libhdb.so.11
+OLD_LIBS+=usr/lib32/libhdb_p.a
+OLD_LIBS+=usr/lib32/libheimbase.a
+OLD_LIBS+=usr/lib32/libheimbase.so
+OLD_LIBS+=usr/lib32/libheimbase.so.11
+OLD_LIBS+=usr/lib32/libheimbase_p.a
+OLD_LIBS+=usr/lib32/libheimntlm.a
+OLD_LIBS+=usr/lib32/libheimntlm.so
+OLD_LIBS+=usr/lib32/libheimntlm.so.11
+OLD_LIBS+=usr/lib32/libheimntlm_p.a
+OLD_LIBS+=usr/lib32/libhx509.a
+OLD_LIBS+=usr/lib32/libhx509.so
+OLD_LIBS+=usr/lib32/libhx509.so.11
+OLD_LIBS+=usr/lib32/libhx509_p.a
+OLD_LIBS+=usr/lib32/libkadm5clnt.a
+OLD_LIBS+=usr/lib32/libkadm5clnt.so
+OLD_LIBS+=usr/lib32/libkadm5clnt.so.11
+OLD_LIBS+=usr/lib32/libkadm5clnt_p.a
+OLD_LIBS+=usr/lib32/libkadm5srv.a
+OLD_LIBS+=usr/lib32/libkadm5srv.so
+OLD_LIBS+=usr/lib32/libkadm5srv.so.11
+OLD_LIBS+=usr/lib32/libkadm5srv_p.a
+OLD_LIBS+=usr/lib32/libkafs5.a
+OLD_LIBS+=usr/lib32/libkafs5.so
+OLD_LIBS+=usr/lib32/libkafs5.so.11
+OLD_LIBS+=usr/lib32/libkafs5_p.a
+OLD_LIBS+=usr/lib32/libkdc.a
+OLD_LIBS+=usr/lib32/libkdc.so
+OLD_LIBS+=usr/lib32/libkdc.so.11
+OLD_LIBS+=usr/lib32/libkdc_p.a
+OLD_LIBS+=usr/lib32/libkrb5.a
+OLD_LIBS+=usr/lib32/libkrb5.so
+OLD_LIBS+=usr/lib32/libkrb5.so.11
+OLD_LIBS+=usr/lib32/libkrb5_p.a
+OLD_LIBS+=usr/lib32/libroken.a
+OLD_LIBS+=usr/lib32/libroken.so
+OLD_LIBS+=usr/lib32/libroken.so.11
+OLD_LIBS+=usr/lib32/libroken_p.a
+OLD_LIBS+=usr/lib32/libwind.a
+OLD_LIBS+=usr/lib32/libwind.so
+OLD_LIBS+=usr/lib32/libwind.so.11
+OLD_LIBS+=usr/lib32/libwind_p.a
 # 20180615: asf(8) removed
 OLD_FILES+=usr/sbin/asf
 OLD_FILES+=usr/share/man/man8/asf.8.gz
@@ -193,6 +257,8 @@ OLD_FILES+=usr/share/nls/es_ES.ISO8859-1/grep.cat
 OLD_FILES+=usr/share/nls/ru_RU.KOI8-R/grep.cat
 OLD_FILES+=usr/share/nls/uk_UA.UTF-8/grep.cat
 OLD_FILES+=usr/share/nls/ja_JP.UTF-8/grep.cat
+# 20180603: No need for krb5-config, it confuses ports.
+OLD_FILES+=usr/bin/krb5-config
 # 20180517: retire vxge
 OLD_FILES+=usr/share/man/man4/if_vxge.4.gz
 OLD_FILES+=usr/share/man/man4/vxge.4.gz
@@ -221,6 +287,10 @@ OLD_FILES+=usr/sbin/lmcconfig
 OLD_FILES+=usr/share/man/man4/lmc.4.gz
 OLD_FILES+=usr/share/man/man4/if_lmc.4.gz
 OLD_FILES+=usr/share/man/man8/lmcconfig.8.gz
+# 20180430: libgssapi should also be private
+OLD_LIBS+=usr/lib/libgssapi.a
+OLD_LIBS+=usr/lib/libgssapi.so
+OLD_LIBS+=usr/lib/libgssapi.so.10
 # 20180417: remove fuswintr and suswintr
 OLD_FILES+=usr/share/man/man9/fuswintr.9.gz
 OLD_FILES+=usr/share/man/man9/suswintr.9.gz
@@ -747,6 +817,122 @@ OLD_DIRS+=usr/share/openssl/man/cat1
 OLD_DIRS+=usr/share/openssl/man/cat3
 OLD_DIRS+=usr/share/openssl/man/en.ISO8859-1/cat1
 OLD_DIRS+=usr/share/openssl/man/en.ISO8859-1/cat3
+# 20170831: hemdal becomes private
+OLD_FILES+=usr/include/asn1-common.h
+OLD_FILES+=usr/include/asn1_err.h
+OLD_FILES+=usr/include/base64.h
+OLD_FILES+=usr/include/cms_asn1.h
+OLD_FILES+=usr/include/crmf_asn1.h
+OLD_FILES+=usr/include/der-private.h
+OLD_FILES+=usr/include/der-protos.h
+OLD_FILES+=usr/include/der.h
+OLD_FILES+=usr/include/digest_asn1.h
+OLD_FILES+=usr/include/getarg.h
+OLD_FILES+=usr/include/hdb-protos.h
+OLD_FILES+=usr/include/hdb.h
+OLD_FILES+=usr/include/hdb_asn1.h
+OLD_FILES+=usr/include/hdb_err.h
+OLD_FILES+=usr/include/heim_asn1.h
+OLD_FILES+=usr/include/heim_err.h
+OLD_FILES+=usr/include/heim_threads.h
+OLD_FILES+=usr/include/heimbase.h
+OLD_FILES+=usr/include/heimntlm-protos.h
+OLD_FILES+=usr/include/heimntlm.h
+OLD_FILES+=usr/include/hex.h
+OLD_FILES+=usr/include/hx509-private.h
+OLD_FILES+=usr/include/hx509-protos.h
+OLD_FILES+=usr/include/hx509.h
+OLD_FILES+=usr/include/hx509_err.h
+OLD_FILES+=usr/include/k524_err.h
+OLD_FILES+=usr/include/kafs.h
+OLD_FILES+=usr/include/kdc-protos.h
+OLD_FILES+=usr/include/kdc.h
+OLD_FILES+=usr/include/krb5-private.h
+OLD_FILES+=usr/include/krb5-protos.h
+OLD_FILES+=usr/include/krb5-types.h
+OLD_FILES+=usr/include/krb5.h
+OLD_FILES+=usr/include/krb5_asn1.h
+OLD_FILES+=usr/include/krb5_ccapi.h
+OLD_FILES+=usr/include/krb5_err.h
+OLD_FILES+=usr/include/kx509_asn1.h
+OLD_FILES+=usr/include/ntlm_err.h
+OLD_FILES+=usr/include/ocsp_asn1.h
+OLD_FILES+=usr/include/parse_bytes.h
+OLD_FILES+=usr/include/parse_time.h
+OLD_FILES+=usr/include/parse_units.h
+OLD_FILES+=usr/include/pkcs10_asn1.h
+OLD_FILES+=usr/include/pkcs12_asn1.h
+OLD_FILES+=usr/include/pkcs8_asn1.h
+OLD_FILES+=usr/include/pkcs9_asn1.h
+OLD_FILES+=usr/include/pkinit_asn1.h
+OLD_FILES+=usr/include/resolve.h
+OLD_FILES+=usr/include/rfc2459_asn1.h
+OLD_FILES+=usr/include/roken-common.h
+OLD_FILES+=usr/include/roken.h
+OLD_FILES+=usr/include/rtbl.h
+OLD_FILES+=usr/include/wind.h
+OLD_FILES+=usr/include/wind_err.h
+OLD_FILES+=usr/include/xdbm.h
+OLD_LIBS+=usr/lib/libasn1.a
+OLD_LIBS+=usr/lib/libasn1.so
+OLD_LIBS+=usr/lib/libasn1.so.11
+OLD_LIBS+=usr/lib/libasn1_p.a
+OLD_LIBS+=usr/lib/libgssapi_krb5.a
+OLD_LIBS+=usr/lib/libgssapi_krb5.so
+OLD_LIBS+=usr/lib/libgssapi_krb5.so.10
+OLD_LIBS+=usr/lib/libgssapi_krb5_p.a
+OLD_LIBS+=usr/lib/libgssapi_ntlm.a
+OLD_LIBS+=usr/lib/libgssapi_ntlm.so
+OLD_LIBS+=usr/lib/libgssapi_ntlm.so.10
+OLD_LIBS+=usr/lib/libgssapi_ntlm_p.a
+OLD_LIBS+=usr/lib/libgssapi_spnego.a
+OLD_LIBS+=usr/lib/libgssapi_spnego.so
+OLD_LIBS+=usr/lib/libgssapi_spnego.so.10
+OLD_LIBS+=usr/lib/libgssapi_spnego_p.a
+OLD_LIBS+=usr/lib/libhdb.a
+OLD_LIBS+=usr/lib/libhdb.so
+OLD_LIBS+=usr/lib/libhdb.so.11
+OLD_LIBS+=usr/lib/libhdb_p.a
+OLD_LIBS+=usr/lib/libheimbase.a
+OLD_LIBS+=usr/lib/libheimbase.so
+OLD_LIBS+=usr/lib/libheimbase.so.11
+OLD_LIBS+=usr/lib/libheimbase_p.a
+OLD_LIBS+=usr/lib/libheimntlm.a
+OLD_LIBS+=usr/lib/libheimntlm.so
+OLD_LIBS+=usr/lib/libheimntlm.so.11
+OLD_LIBS+=usr/lib/libheimntlm_p.a
+OLD_LIBS+=usr/lib/libhx509.a
+OLD_LIBS+=usr/lib/libhx509.so
+OLD_LIBS+=usr/lib/libhx509.so.11
+OLD_LIBS+=usr/lib/libhx509_p.a
+OLD_LIBS+=usr/lib/libkadm5clnt.a
+OLD_LIBS+=usr/lib/libkadm5clnt.so
+OLD_LIBS+=usr/lib/libkadm5clnt.so.11
+OLD_LIBS+=usr/lib/libkadm5clnt_p.a
+OLD_LIBS+=usr/lib/libkadm5srv.a
+OLD_LIBS+=usr/lib/libkadm5srv.so
+OLD_LIBS+=usr/lib/libkadm5srv.so.11
+OLD_LIBS+=usr/lib/libkadm5srv_p.a
+OLD_LIBS+=usr/lib/libkafs5.a
+OLD_LIBS+=usr/lib/libkafs5.so
+OLD_LIBS+=usr/lib/libkafs5.so.11
+OLD_LIBS+=usr/lib/libkafs5_p.a
+OLD_LIBS+=usr/lib/libkdc.a
+OLD_LIBS+=usr/lib/libkdc.so
+OLD_LIBS+=usr/lib/libkdc.so.11
+OLD_LIBS+=usr/lib/libkdc_p.a
+OLD_LIBS+=usr/lib/libkrb5.a
+OLD_LIBS+=usr/lib/libkrb5.so
+OLD_LIBS+=usr/lib/libkrb5.so.11
+OLD_LIBS+=usr/lib/libkrb5_p.a
+OLD_LIBS+=usr/lib/libroken.a
+OLD_LIBS+=usr/lib/libroken.so
+OLD_LIBS+=usr/lib/libroken.so.11
+OLD_LIBS+=usr/lib/libroken_p.a
+OLD_LIBS+=usr/lib/libwind.a
+OLD_LIBS+=usr/lib/libwind.so
+OLD_LIBS+=usr/lib/libwind.so.11
+OLD_LIBS+=usr/lib/libwind_p.a
 # 20170802: ksyms(4) ioctl interface was removed
 OLD_FILES+=usr/include/sys/ksyms.h
 # 20170722: new clang import which bumps version from 4.0.0 to 5.0.0.
diff --git a/etc/mtree/BSD.usr.dist b/etc/mtree/BSD.usr.dist
index 3212e81ed84..e321d70cc2e 100644
--- a/etc/mtree/BSD.usr.dist
+++ b/etc/mtree/BSD.usr.dist
@@ -9,14 +9,34 @@
     ..
     include
         private
+            asn1
+            ..
             bsdstat
             ..
             event
             ..
+            hdb
+            ..
+            heimbase
+            ..
+            heimntlm
+            ..
+            hx509
+            ..
+            kafs5
+            ..
+            kdc
+            ..
+            krb5
+            ..
+            roken
+            ..
             sqlite3
             ..
             ucl
             ..
+            wind
+            ..
             zstd
             ..
         ..
diff --git a/kerberos5/Makefile.inc b/kerberos5/Makefile.inc
index eeb8d3a20bb..d00bd919427 100644
--- a/kerberos5/Makefile.inc
+++ b/kerberos5/Makefile.inc
@@ -6,7 +6,7 @@ NO_LINT=
 
 KRB5DIR=	${SRCTOP}/crypto/heimdal
 
-CFLAGS+=	-DHAVE_CONFIG_H -I${.CURDIR:H:H}/include
+CFLAGS+=	-DHAVE_CONFIG_H -I${.CURDIR:H:H}/include -I${KRB5DIR}/include
 
 .if ${MK_OPENLDAP} != "no" && !defined(COMPAT_32BIT)
 OPENLDAPBASE?=	/usr/local
diff --git a/kerberos5/lib/libasn1/Makefile b/kerberos5/lib/libasn1/Makefile
index d9594392cb7..696adbd347e 100644
--- a/kerberos5/lib/libasn1/Makefile
+++ b/kerberos5/lib/libasn1/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	asn1
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 INCS=	asn1_err.h asn1-common.h heim_asn1.h der.h der-protos.h der-private.h
 LIBADD=	com_err roken
@@ -21,7 +22,8 @@ SRCS=	asn1_err.c \
 	timegm.c \
 	${GEN:S/.x$/.c/:S/.hx$/.h/}
 
-CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
+	-I${.OBJDIR:H}/libroken -I.
 
 GEN_RFC2459=	asn1_rfc2459_asn1.x rfc2459_asn1.hx rfc2459_asn1-priv.hx
 GEN_CMS= 	asn1_cms_asn1.x cms_asn1.hx cms_asn1-priv.hx
diff --git a/kerberos5/lib/libgssapi_krb5/Makefile b/kerberos5/lib/libgssapi_krb5/Makefile
index 905b824d0a5..d2763e8bc55 100644
--- a/kerberos5/lib/libgssapi_krb5/Makefile
+++ b/kerberos5/lib/libgssapi_krb5/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	gssapi_krb5
+PRIVATELIB=	true
 LDFLAGS= -Wl,-Bsymbolic -Wl,--no-undefined
 LIBADD=	gssapi krb5 crypto roken asn1 com_err
 SHLIB_MAJOR=	10
@@ -77,8 +78,16 @@ CFLAGS+=-I${KRB5DIR}/lib/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/krb5
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/krb5
+CFLAGS+=-I${.OBJDIR:H}/libkrb5
 CFLAGS+=-I${KRB5DIR}/lib/asn1
-CFLAGS+=-I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${.OBJDIR:H}/libasn1
+CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${.OBJDIR:H}/libroken
+CFLAGS+=-I${KRB5DIR}/lib/wind
+CFLAGS+=-I${.OBJDIR:H}/libwind
+CFLAGS+=-I${KRB5DIR}/lib/hx509
+CFLAGS+=-I${.OBJDIR:H}/libhx509
+CFLAGS+=-I${KRB5DIR}/base -I.
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libgssapi_ntlm/Makefile b/kerberos5/lib/libgssapi_ntlm/Makefile
index b5edb08a8d4..957d62c0ae0 100644
--- a/kerberos5/lib/libgssapi_ntlm/Makefile
+++ b/kerberos5/lib/libgssapi_ntlm/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	gssapi_ntlm
+PRIVATELIB=	true
 LDFLAGS= -Wl,-Bsymbolic -Wl,--no-undefined
 LIBADD=	crypto gssapi krb5 heimntlm roken
 SHLIB_MAJOR=	10
@@ -41,7 +42,14 @@ CFLAGS+=-I${KRB5DIR}/lib/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/ntlm
 CFLAGS+=-I${KRB5DIR}/lib/krb5
+CFLAGS+=-I${.OBJDIR:H}/libkrb5
 CFLAGS+=-I${KRB5DIR}/lib/ntlm
+CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${.OBJDIR:H}/libroken
+CFLAGS+=-I${KRB5DIR}/lib/asn1
+CFLAGS+=-I${.OBJDIR:H}/libasn1
+CFLAGS+=-I${KRB5DIR}/lib/ntlm
+CFLAGS+=-I${.OBJDIR:H}/libheimntlm
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libgssapi_spnego/Makefile b/kerberos5/lib/libgssapi_spnego/Makefile
index 1ccf1377e8b..3982c843496 100644
--- a/kerberos5/lib/libgssapi_spnego/Makefile
+++ b/kerberos5/lib/libgssapi_spnego/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	gssapi_spnego
+PRIVATELIB=	true
 LDFLAGS= -Wl,-Bsymbolic -Wl,--no-undefined
 LIBADD=	gssapi heimbase asn1 roken
 SHLIB_MAJOR=	10
@@ -31,8 +32,11 @@ CFLAGS+=-I${KRB5DIR}/lib/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/gssapi
 CFLAGS+=-I${KRB5DIR}/lib/gssapi/spnego
 CFLAGS+=-I${KRB5DIR}/lib/asn1
+CFLAGS+=-I${.OBJDIR:H}/libasn1
 CFLAGS+=-I${SRCTOP}/lib/libgssapi
-CFLAGS+=-I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${.OBJDIR:H}/libroken
+CFLAGS+=-I${KRB5DIR}/base -I.
 
 CLEANFILES=	${GEN} ${GEN:S/.x$/.c/:S/.hx$/.h/} \
 		spnego_asn1_files spnego_asn1-template.c
diff --git a/kerberos5/lib/libhdb/Makefile b/kerberos5/lib/libhdb/Makefile
index df67359404c..268b5c10fce 100644
--- a/kerberos5/lib/libhdb/Makefile
+++ b/kerberos5/lib/libhdb/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	hdb
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined ${LDAPLDFLAGS}
 VERSION_MAP=	${KRB5DIR}/lib/hdb/version-script.map
 LIBADD=	asn1 com_err krb5 roken sqlite3
@@ -56,9 +57,13 @@ SRCS=	common.c \
 	print.c \
 	${GEN:S/.x$/.c/:S/.hx$/.h/}
 
-CFLAGS+=-I${KRB5DIR}/lib/hdb -I${KRB5DIR}/lib/asn1 \
-	-I${KRB5DIR}/lib/roken -I${SRCTOP}/contrib/sqlite3/ \
-	-I${KRB5DIR}/lib/krb5 \
+CFLAGS+=-I${KRB5DIR}/lib/hdb -I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
+	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+	-I${SRCTOP}/contrib/sqlite3/ \
+	-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H}/libkrb5 \
+	-I${KRB5DIR}/lib/wind -I${.OBJDIR:H}/libwind \
+	-I${KRB5DIR}/lib/hx509 -I${.OBJDIR:H}/libhx509 \
+	-I${KRB5DIR}/base \
 	-I. ${LDAPCFLAGS}
 CFLAGS+=-DHDB_DB_DIR="\"/var/heimdal\""
 
diff --git a/kerberos5/lib/libheimbase/Makefile b/kerberos5/lib/libheimbase/Makefile
index b6bf526b352..6feb1088031 100644
--- a/kerberos5/lib/libheimbase/Makefile
+++ b/kerberos5/lib/libheimbase/Makefile
@@ -1,6 +1,7 @@
 #$FreeBSD$
 
 LIB=	heimbase
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 LIBADD=	pthread
 VERSION_MAP= ${KRB5DIR}/base/version-script.map
diff --git a/kerberos5/lib/libheimipcc/Makefile b/kerberos5/lib/libheimipcc/Makefile
index 9ec71257237..badf85b6578 100644
--- a/kerberos5/lib/libheimipcc/Makefile
+++ b/kerberos5/lib/libheimipcc/Makefile
@@ -9,6 +9,8 @@ SRCS=	\
 	common.c
 
 CFLAGS+=	-I${KRB5DIR}/lib/roken \
+		-I${.OBJDIR:H}/libroken \
+		-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/base \
 		-I${KRB5DIR}/lib/ipc \
 		-I${KRB5DIR}/include
diff --git a/kerberos5/lib/libheimipcs/Makefile b/kerberos5/lib/libheimipcs/Makefile
index b1201f65a84..9aa5b538bd5 100644
--- a/kerberos5/lib/libheimipcs/Makefile
+++ b/kerberos5/lib/libheimipcs/Makefile
@@ -8,7 +8,8 @@ SRCS=	\
 	server.c \
 	common.c
 
-CFLAGS+=	-I${KRB5DIR}/lib/roken \
+CFLAGS+=	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+		-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
 		-I${KRB5DIR}/base \
 		-I${KRB5DIR}/lib/ipc -I.
 
diff --git a/kerberos5/lib/libheimntlm/Makefile b/kerberos5/lib/libheimntlm/Makefile
index bcb45f3b8f0..90c6e0681a9 100644
--- a/kerberos5/lib/libheimntlm/Makefile
+++ b/kerberos5/lib/libheimntlm/Makefile
@@ -1,11 +1,15 @@
 # $FreeBSD$
 
 LIB=	heimntlm
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 LIBADD=	crypto com_err krb5 roken
 SRCS=	ntlm.c ntlm_err.c ntlm_err.h
 INCS=	heimntlm.h heimntlm-protos.h ntlm_err.h
-CFLAGS+=-I${KRB5DIR}/lib/ntlm -I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/ntlm -I${.OBJDIR:H}/libheimntlm \
+	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+	-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H}/libkrb5 \
+	-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1
 VERSION_MAP= ${KRB5DIR}/lib/ntlm/version-script.map
 
 MAN=	ntlm_buf.3 \
diff --git a/kerberos5/lib/libhx509/Makefile b/kerberos5/lib/libhx509/Makefile
index 553eac13f0e..23b3208a94d 100644
--- a/kerberos5/lib/libhx509/Makefile
+++ b/kerberos5/lib/libhx509/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	hx509
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 VERSION_MAP= ${KRB5DIR}/lib/hx509/version-script.map
 LIBADD=	asn1 com_err crypto roken wind
@@ -209,9 +210,9 @@ SRCS+=	${GEN_OCSP:S/.x$/.c/:S/.hx$/.h/} \
 
 CFLAGS+=-I${KRB5DIR}/lib/hx509
 CFLAGS+=-I${KRB5DIR}/lib/hx509/ref
-CFLAGS+=-I${KRB5DIR}/lib/asn1
-CFLAGS+=-I${KRB5DIR}/lib/wind
-CFLAGS+=-I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1
+CFLAGS+=-I${KRB5DIR}/lib/wind -I${.OBJDIR:H}/libwind
+CFLAGS+=-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken -I.
 
 GEN_OCSP= \
 	asn1_OCSPBasicOCSPResponse.x \
diff --git a/kerberos5/lib/libkadm5clnt/Makefile b/kerberos5/lib/libkadm5clnt/Makefile
index 1f3401e636d..281fc65ae5b 100644
--- a/kerberos5/lib/libkadm5clnt/Makefile
+++ b/kerberos5/lib/libkadm5clnt/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	kadm5clnt
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 LIBADD=	com_err krb5 roken
 
@@ -34,7 +35,10 @@ SRCS=	ad.c \
 	rename_c.c \
 	send_recv.c
 
-CFLAGS+=-I${KRB5DIR}/lib/kadm5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/kadm5 -I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
+	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+	-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H}/libkrb5 \
+	-I${KRB5DIR}/lib/hdb -I${.OBJDIR:H}/libhdb -I.
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libkadm5srv/Makefile b/kerberos5/lib/libkadm5srv/Makefile
index adf49a5b1af..1e80e509d14 100644
--- a/kerberos5/lib/libkadm5srv/Makefile
+++ b/kerberos5/lib/libkadm5srv/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	kadm5srv
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 LIBADD=	com_err hdb krb5 roken
 VERSION_MAP= ${KRB5DIR}/lib/kadm5/version-script.map
@@ -35,7 +36,10 @@ SRCS=	acl.c \
 	set_keys.c \
 	set_modifier.c
 
-CFLAGS+=-I${KRB5DIR}/lib/kadm5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/kadm5 -I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
+	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+	-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H}/libkrb5 \
+	-I${KRB5DIR}/lib/hdb -I${.OBJDIR:H}/libhdb -I.
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libkafs5/Makefile b/kerberos5/lib/libkafs5/Makefile
index 24400b8b2ed..eab4c4de8ef 100644
--- a/kerberos5/lib/libkafs5/Makefile
+++ b/kerberos5/lib/libkafs5/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	kafs5
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 LIBADD=	asn1 krb5 roken
 INCS=	kafs.h
@@ -27,7 +28,10 @@ SRCS=	afssys.c afskrb5.c common.c
 CFLAGS+=	-I${KRB5DIR}/lib/kafs \
 		-I${KRB5DIR}/lib/krb5 \
 		-I${.OBJDIR:H}/libkrb5 \
-		-I${KRB5DIR}/lib/roken
+		-I${KRB5DIR}/lib/roken \
+		-I${.OBJDIR:H}/libroken \
+		-I${KRB5DIR}/lib/asn1 \
+		-I${.OBJDIR:H}/libasn1
 
 CLEANFILES= kafs5.3
 
diff --git a/kerberos5/lib/libkdc/Makefile b/kerberos5/lib/libkdc/Makefile
index 14b0797e273..423b20d0dc8 100644
--- a/kerberos5/lib/libkdc/Makefile
+++ b/kerberos5/lib/libkdc/Makefile
@@ -1,6 +1,7 @@
 #$FreeBSD$
 
 LIB=	kdc
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 VERSION_MAP= ${KRB5DIR}/kdc/version-script.map
 LIBADD=	roken hdb hx509 krb5 heimntlm asn1 crypto
@@ -25,10 +26,15 @@ SRCS=	\
 	process.c \
 	windc.c
 
-CFLAGS+=	-I${KRB5DIR}/lib/roken \
-		-I${KRB5DIR}/lib/krb5 \
-		-I${KRB5DIR}/lib/hdb \
-		-I${KRB5DIR}/kdc
+CFLAGS+=	-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+		-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
+		-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H}/libkrb5 \
+		-I${KRB5DIR}/lib/wind -I${.OBJDIR:H}/libwind \
+		-I${KRB5DIR}/lib/hx509 -I${.OBJDIR:H}/libhx509 \
+		-I${KRB5DIR}/lib/hdb -I${.OBJDIR:H}/libhdb \
+		-I${KRB5DIR}/lib/ntlm -I${.OBJDIR:H}/libheimntlm \
+		-I${KRB5DIR}/kdc \
+		-I${KRB5DIR}/base
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libkrb5/Makefile b/kerberos5/lib/libkrb5/Makefile
index 0eac57c803f..034b59e7bb3 100644
--- a/kerberos5/lib/libkrb5/Makefile
+++ b/kerberos5/lib/libkrb5/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	krb5
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 VERSION_MAP= ${KRB5DIR}/lib/krb5/version-script.map
 LIBADD=	asn1 com_err crypt crypto hx509 roken wind heimbase heimipcc
@@ -618,8 +619,10 @@ SRCS+=	heim_err.c \
 	krb_err.h
 
 CFLAGS+=	-I${KRB5DIR}/lib/krb5 \
-		-I${KRB5DIR}/lib/asn1 \
-		-I${KRB5DIR}/lib/roken \
+		-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H}/libasn1 \
+		-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken \
+		-I${KRB5DIR}/lib/wind -I${.OBJDIR:H}/libwind \
+		-I${KRB5DIR}/lib/hx509 -I${.OBJDIR:H}/libhx509 \
 		-I${KRB5DIR}/lib/ipc \
 		-I${KRB5DIR}/base -I.
 
diff --git a/kerberos5/lib/libroken/Makefile b/kerberos5/lib/libroken/Makefile
index 95505d2a1ff..448d78cf8a5 100644
--- a/kerberos5/lib/libroken/Makefile
+++ b/kerberos5/lib/libroken/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 LIB=	roken
+PRIVATELIB=	true
 LIBADD=	crypt
 VERSION_MAP=	${KRB5DIR}/lib/roken/version-script.map
 INCS=	roken.h \
diff --git a/kerberos5/lib/libsl/Makefile b/kerberos5/lib/libsl/Makefile
index 71a38a5729d..18afc97b3c7 100644
--- a/kerberos5/lib/libsl/Makefile
+++ b/kerberos5/lib/libsl/Makefile
@@ -3,7 +3,7 @@
 LIB=	sl
 INTERNALLIB=
 SRCS=	sl.c
-CFLAGS+=-I${KRB5DIR}/lib/sl
+CFLAGS+=-I${KRB5DIR}/lib/sl -I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/lib/libwind/Makefile b/kerberos5/lib/libwind/Makefile
index a489566efbb..1f90e3c3e33 100644
--- a/kerberos5/lib/libwind/Makefile
+++ b/kerberos5/lib/libwind/Makefile
@@ -1,6 +1,7 @@
 #$FreeBSD$
 
 LIB=	wind
+PRIVATELIB=	true
 LDFLAGS=	-Wl,--no-undefined
 VERSION_MAP= ${KRB5DIR}/lib/wind/version-script.map
 LIBADD=	com_err roken
@@ -27,7 +28,7 @@ SRCS=	bidi.c \
 SRCS+=	wind_err.c \
 	wind_err.h
 
-CFLAGS+=-I${KRB5DIR}/lib/roken -I.
+CFLAGS+=-I${KRB5DIR}/lib/roken -I${.OBJDIR:H}/libroken -I.
 
 .include <bsd.lib.mk>
 
diff --git a/kerberos5/libexec/digest-service/Makefile b/kerberos5/libexec/digest-service/Makefile
index 840f2c4d2fe..764006cf71a 100644
--- a/kerberos5/libexec/digest-service/Makefile
+++ b/kerberos5/libexec/digest-service/Makefile
@@ -2,12 +2,23 @@
 
 PROG=	digest-service
 MAN=
-CFLAGS+=	-I${KRB5DIR}/kdc \
+CFLAGS+=	-I${KRB5DIR}/base \
+		-I${KRB5DIR}/kdc \
 		-I${KRB5DIR}/lib/asn1 \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
 		-I${KRB5DIR}/lib/krb5 \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
 		-I${KRB5DIR}/lib/ipc \
 		-I${KRB5DIR}/lib/wind \
-		-I${KRB5DIR}/lib/roken
+		-I${.OBJDIR:H:H}/lib/libwind \
+		-I${KRB5DIR}/lib/roken \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${KRB5DIR}/lib/hx509 \
+		-I${.OBJDIR:H:H}/lib/libhx509 \
+		-I${KRB5DIR}/lib/hdb \
+		-I${.OBJDIR:H:H}/lib/libhdb \
+		-I${KRB5DIR}/lib/ntlm \
+		-I${.OBJDIR:H:H}/lib/libheimntlm
 LIBADD=	hdb kdc heimipcs krb5 roken asn1 crypto vers heimntlm
 LDFLAGS=${LDAPLDFLAGS}
 
diff --git a/kerberos5/libexec/hprop/Makefile b/kerberos5/libexec/hprop/Makefile
index b267571315f..680daf569e0 100644
--- a/kerberos5/libexec/hprop/Makefile
+++ b/kerberos5/libexec/hprop/Makefile
@@ -8,8 +8,18 @@ CFLAGS+=-I${KRB5DIR}/lib/krb5
 CFLAGS+=-I${KRB5DIR}/lib/asn1
 CFLAGS+=-I${KRB5DIR}/lib/hx509
 CFLAGS+=-I${KRB5DIR}/lib/ntlm
+CFLAGS+=-I${KRB5DIR}/lib/wind
+CFLAGS+=-I${KRB5DIR}/lib/hdb
+CFLAGS+=-I${KRB5DIR}/base
 CFLAGS+=-I${KRB5DIR}/kdc
 CFLAGS+=-I${.OBJDIR:H:H}/lib/libkrb5
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libroken
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libasn1
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libhx509
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libheimntlm
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libwind
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libhdb
+CFLAGS+=-I${.OBJDIR:H:H}/lib/libheimbase
 LIBADD=	hdb krb5 roken vers
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/libexec/hpropd/Makefile b/kerberos5/libexec/hpropd/Makefile
index 9f7f9e71283..b85c0fae60b 100644
--- a/kerberos5/libexec/hpropd/Makefile
+++ b/kerberos5/libexec/hpropd/Makefile
@@ -3,7 +3,20 @@
 PROG=	hpropd
 MAN=	hpropd.8
 CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 \
-	-I${KRB5DIR}/kdc ${LDAPCFLAGS}
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${KRB5DIR}/lib/ntlm \
+	-I${KRB5DIR}/kdc \
+	-I${KRB5DIR}/base \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libhx509 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	-I${.OBJDIR:H:H}/lib/libheimntlm \
+	${LDAPCFLAGS}
 LIBADD=	hdb krb5 roken vers
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/libexec/ipropd-master/Makefile b/kerberos5/libexec/ipropd-master/Makefile
index 9f0bddbae4f..10ce1cdfe74 100644
--- a/kerberos5/libexec/ipropd-master/Makefile
+++ b/kerberos5/libexec/ipropd-master/Makefile
@@ -4,7 +4,13 @@ PROG=	ipropd-master
 MAN=	iprop.8
 SRCS=	ipropd_common.c ipropd_master.c kadm5_err.h
 CFLAGS+=-I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/hdb \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
 	-I. ${LDAPCFLAGS}
+
 LIBADD=	kadm5srv hdb krb5 roken vers
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/libexec/ipropd-slave/Makefile b/kerberos5/libexec/ipropd-slave/Makefile
index cae84aa5ffb..3913499b3ab 100644
--- a/kerberos5/libexec/ipropd-slave/Makefile
+++ b/kerberos5/libexec/ipropd-slave/Makefile
@@ -4,6 +4,11 @@ PROG=	ipropd-slave
 MAN=
 SRCS=	ipropd_common.c ipropd_slave.c kadm5_err.h
 CFLAGS+=-I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/hdb \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	-I${.OBJDIR:H:H}/lib/libroken \
 	-I. ${LDAPCFLAGS}
 LIBADD=	kadm5srv hdb krb5 roken vers
 DPADD=	${LDAPDPADD}
diff --git a/kerberos5/libexec/kadmind/Makefile b/kerberos5/libexec/kadmind/Makefile
index 27200d6d98c..4af001b57d0 100644
--- a/kerberos5/libexec/kadmind/Makefile
+++ b/kerberos5/libexec/kadmind/Makefile
@@ -8,6 +8,16 @@ SRCS=	rpc.c \
 	kadm_conn.c
 
 CFLAGS+=-I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/base \
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libhx509 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
 	${LDAPCFLAGS}
 LIBADD=	kadm5srv gssapi hdb krb5 roken vers
 DPADD=	${LDAPDPADD}
diff --git a/kerberos5/libexec/kcm/Makefile b/kerberos5/libexec/kcm/Makefile
index fa7a0cfce9c..b20d558e82c 100644
--- a/kerberos5/libexec/kcm/Makefile
+++ b/kerberos5/libexec/kcm/Makefile
@@ -18,7 +18,13 @@ SRCS=	acl.c \
 	renew.c
 
 CFLAGS+=-I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
-	-I${KRB5DIR}/kcm -I${KRB5DIR}/lib/ipc ${LDAPCFLAGS}
+	-I${KRB5DIR}/kcm -I${KRB5DIR}/lib/ipc \
+	-I${KRB5DIR}/lib/ntlm \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libheimntlm \
+	${LDAPCFLAGS}
 LIBADD=	krb5 roken heimntlm heimipcs crypto
 DPADD=	${LDAPDPADD}
 LDADD=	${LIBVERS} ${LDAPLDADD}
diff --git a/kerberos5/libexec/kdc/Makefile b/kerberos5/libexec/kdc/Makefile
index aa4584e4ac7..9b22469705d 100644
--- a/kerberos5/libexec/kdc/Makefile
+++ b/kerberos5/libexec/kdc/Makefile
@@ -9,7 +9,20 @@ SRCS=	config.c \
 	main.c
 
 CFLAGS+=-I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/roken \
-	-I${KRB5DIR}/kdc ${LDAPCFLAGS}
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${KRB5DIR}/lib/ntlm \
+	-I${KRB5DIR}/kdc \
+	-I${KRB5DIR}/base \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libhx509 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	-I${.OBJDIR:H:H}/lib/libheimntlm \
+	${LDAPCFLAGS}
 LIBADD=	kdc hdb krb5 roken crypt vers
 LDFLAGS=${LDAPLDFLAGS}
 
diff --git a/kerberos5/libexec/kdigest/Makefile b/kerberos5/libexec/kdigest/Makefile
index 5f3fb245064..6fbaa74a13c 100644
--- a/kerberos5/libexec/kdigest/Makefile
+++ b/kerberos5/libexec/kdigest/Makefile
@@ -4,7 +4,15 @@ PROG=	kdigest
 MAN=	kdigest.8
 CFLAGS+=	-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/lib/roken \
-		-I${KRB5DIR}/lib/sl -I.
+		-I${KRB5DIR}/lib/sl \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${KRB5DIR}/lib/kafs \
+		-I${KRB5DIR}/lib/ntlm \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libheimntlm \
+		-I.
 LIBADD=	krb5 heimntlm roken crypto edit sl vers
 SRCS=	kdigest.c \
 	kdigest-commands.c \
diff --git a/kerberos5/libexec/kfd/Makefile b/kerberos5/libexec/kfd/Makefile
index 82df3adbb6d..395091f183b 100644
--- a/kerberos5/libexec/kfd/Makefile
+++ b/kerberos5/libexec/kfd/Makefile
@@ -3,7 +3,11 @@
 PROG=	kfd
 MAN=	kfd.8
 CFLAGS+=	-I${KRB5DIR}/lib/asn1 \
-		-I${KRB5DIR}/lib/roken
+		-I${KRB5DIR}/lib/roken \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libkrb5
 LIBADD=	krb5 roken vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/libexec/kimpersonate/Makefile b/kerberos5/libexec/kimpersonate/Makefile
index 3c94db6857d..5daefb7ae7d 100644
--- a/kerberos5/libexec/kimpersonate/Makefile
+++ b/kerberos5/libexec/kimpersonate/Makefile
@@ -5,7 +5,13 @@ MAN=	kimpersonate.8
 CFLAGS+=	-I${KRB5DIR}/lib/hx509 \
 		-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/lib/roken \
-		-I${KRB5DIR}/lib/sl -I.
+		-I${KRB5DIR}/lib/sl \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${KRB5DIR}/lib/kafs \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
+		-I.
 LIBADD=	krb5 roken asn1 vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/libexec/kpasswdd/Makefile b/kerberos5/libexec/kpasswdd/Makefile
index ec36c24fc03..db1e7ae24de 100644
--- a/kerberos5/libexec/kpasswdd/Makefile
+++ b/kerberos5/libexec/kpasswdd/Makefile
@@ -2,7 +2,15 @@
 
 PROG=	kpasswdd
 MAN=	kpasswdd.8
-CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/libhdb ${LDAPCFLAGS}
+CFLAGS+=-I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${KRB5DIR}/lib/asn1 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	${LDAPCFLAGS}
 LIBADD=	kadm5srv hdb krb5 roken vers asn1
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/tools/asn1_compile/Makefile b/kerberos5/tools/asn1_compile/Makefile
index 68715facfcb..20482e207b5 100644
--- a/kerberos5/tools/asn1_compile/Makefile
+++ b/kerberos5/tools/asn1_compile/Makefile
@@ -2,7 +2,7 @@
 
 PROG=	asn1_compile
 MAN=
-LIBROKEN_A=	${.OBJDIR:H:H}/lib/libroken/libroken.a
+LIBROKEN_A=	${.OBJDIR:H:H}/lib/libroken/libprivateroken.a
 LIBADD=	vers
 LDADD=	${LIBROKEN_A}
 DPADD=	${LIBROKEN_A}
diff --git a/kerberos5/tools/slc/Makefile b/kerberos5/tools/slc/Makefile
index 34092a56644..b6bd2a2b4ca 100644
--- a/kerberos5/tools/slc/Makefile
+++ b/kerberos5/tools/slc/Makefile
@@ -1,7 +1,7 @@
 # $FreeBSD$
 
 PROG=	slc
-LIBROKEN_A=     ${.OBJDIR:H:H}/lib/libroken/libroken.a
+LIBROKEN_A=     ${.OBJDIR:H:H}/lib/libroken/libprivateroken.a
 LIBADD=	vers
 LDADD=  ${LIBROKEN_A}
 DPADD=  ${LIBROKEN_A}
diff --git a/kerberos5/usr.bin/Makefile b/kerberos5/usr.bin/Makefile
index e9c50308b3f..9737aafd94c 100644
--- a/kerberos5/usr.bin/Makefile
+++ b/kerberos5/usr.bin/Makefile
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-SUBDIR=	hxtool kadmin kcc kdestroy kgetcred kf kinit kpasswd krb5-config ksu \
+SUBDIR=	hxtool kadmin kcc kdestroy kgetcred kf kinit kpasswd ksu \
 	string2key verify_krb5_conf
 SUBDIR_PARALLEL=
 
diff --git a/kerberos5/usr.bin/hxtool/Makefile b/kerberos5/usr.bin/hxtool/Makefile
index af85a446928..ae70e20add4 100644
--- a/kerberos5/usr.bin/hxtool/Makefile
+++ b/kerberos5/usr.bin/hxtool/Makefile
@@ -5,6 +5,9 @@ MAN=
 CFLAGS+=	-I${KRB5DIR}/lib/hx509 \
 		-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/lib/roken \
+		-I${.OBJDIR:H:H}/lib/libhx509 \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libroken \
 		-I${KRB5DIR}/lib/sl -I.
 LIBADD=	hx509 roken asn1 crypto sl vers edit
 SRCS=	hxtool.c hxtool-commands.c hxtool-commands.h
diff --git a/kerberos5/usr.bin/kadmin/Makefile b/kerberos5/usr.bin/kadmin/Makefile
index e7aff44c223..e36c449a2b8 100644
--- a/kerberos5/usr.bin/kadmin/Makefile
+++ b/kerberos5/usr.bin/kadmin/Makefile
@@ -25,7 +25,19 @@ SRCS=	add_enctype.c \
 	util.c
 
 CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/roken \
-	-I${KRB5DIR}/lib/sl -I. ${LDAPCFLAGS}
+	-I${KRB5DIR}/lib/sl \
+	-I${KRB5DIR}/base \
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libhx509 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	-I. \
+	${LDAPCFLAGS}
 LIBADD=	kadm5clnt kadm5srv hdb krb5 roken vers sl asn1 crypto edit
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/usr.bin/kcc/Makefile b/kerberos5/usr.bin/kcc/Makefile
index 7c4b7ab3962..9f2db1698b1 100644
--- a/kerberos5/usr.bin/kcc/Makefile
+++ b/kerberos5/usr.bin/kcc/Makefile
@@ -7,7 +7,13 @@ LINKS=	${BINDIR}/kcc ${BINDIR}/klist \
 CFLAGS+=	-I${KRB5DIR}/lib/hx509 \
 		-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/lib/roken \
-		-I${KRB5DIR}/lib/sl -I.
+		-I${KRB5DIR}/lib/sl \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${KRB5DIR}/lib/kafs \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
+		-I.
 LIBADD=	krb5 roken asn1 kafs5 edit sl vers
 SRCS=	kcc.c \
 	kcc-commands.c \
diff --git a/kerberos5/usr.bin/kdestroy/Makefile b/kerberos5/usr.bin/kdestroy/Makefile
index 23e90237c65..19f5d5785a5 100644
--- a/kerberos5/usr.bin/kdestroy/Makefile
+++ b/kerberos5/usr.bin/kdestroy/Makefile
@@ -1,7 +1,12 @@
 # $FreeBSD$
 
 PROG=	kdestroy
-CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${KRB5DIR}/lib/kafs \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1
 LIBADD=	kafs5 krb5 roken vers
 MAN=	kdestroy.1
 
diff --git a/kerberos5/usr.bin/kf/Makefile b/kerberos5/usr.bin/kf/Makefile
index 44d91830baa..f682f9a0644 100644
--- a/kerberos5/usr.bin/kf/Makefile
+++ b/kerberos5/usr.bin/kf/Makefile
@@ -3,7 +3,11 @@
 PROG=	kf
 MAN=	kf.1
 CFLAGS+=	-I${KRB5DIR}/lib/asn1 \
-		-I${KRB5DIR}/lib/roken
+		-I${KRB5DIR}/lib/roken \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libkrb5
 LIBADD=	krb5 roken vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.bin/kgetcred/Makefile b/kerberos5/usr.bin/kgetcred/Makefile
index 1451154f9cf..fec3f9c48d6 100644
--- a/kerberos5/usr.bin/kgetcred/Makefile
+++ b/kerberos5/usr.bin/kgetcred/Makefile
@@ -2,7 +2,12 @@
 
 PROG=	kgetcred
 CFLAGS+=	-I${KRB5DIR}/lib/asn1 \
-		-I${KRB5DIR}/lib/roken
+		-I${KRB5DIR}/lib/roken \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${KRB5DIR}/lib/kafs \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libkrb5
 LIBADD=	krb5 roken asn1 vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.bin/kinit/Makefile b/kerberos5/usr.bin/kinit/Makefile
index 7622b8da956..db26b4f6888 100644
--- a/kerberos5/usr.bin/kinit/Makefile
+++ b/kerberos5/usr.bin/kinit/Makefile
@@ -1,7 +1,14 @@
 # $FreeBSD$
 
 PROG=	kinit
-CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${KRB5DIR}/lib/kafs \
+	-I${KRB5DIR}/lib/ntlm \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libheimntlm \
+	-I${.OBJDIR:H:H}/lib/libasn1
 LIBADD=	kafs5 krb5 heimntlm roken crypto vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.bin/kpasswd/Makefile b/kerberos5/usr.bin/kpasswd/Makefile
index 05e07dddc03..ee3fca98658 100644
--- a/kerberos5/usr.bin/kpasswd/Makefile
+++ b/kerberos5/usr.bin/kpasswd/Makefile
@@ -1,7 +1,11 @@
 # $FreeBSD$
 
 PROG=	kpasswd
-CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1
 LIBADD=	hdb krb5 roken vers crypto
 LDFLAGS=${LDAPLDFLAGS}
 
diff --git a/kerberos5/usr.bin/ksu/Makefile b/kerberos5/usr.bin/ksu/Makefile
index ebd39c677b5..e5bee61ca6d 100644
--- a/kerberos5/usr.bin/ksu/Makefile
+++ b/kerberos5/usr.bin/ksu/Makefile
@@ -7,7 +7,12 @@ PRECIOUSPROG=
 .endif
 MAN=
 SRCS=	su.c
-CFLAGS+=-I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${KRB5DIR}/lib/kafs \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1
 LIBADD=	kafs5 krb5 roken vers crypto crypt
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.bin/string2key/Makefile b/kerberos5/usr.bin/string2key/Makefile
index eb7b2043fac..c35fcdd08e5 100644
--- a/kerberos5/usr.bin/string2key/Makefile
+++ b/kerberos5/usr.bin/string2key/Makefile
@@ -6,7 +6,18 @@ CFLAGS+=	-I${KRB5DIR}/kdc \
 		-I${KRB5DIR}/lib/asn1 \
 		-I${KRB5DIR}/lib/krb5 \
 		-I${KRB5DIR}/lib/roken \
-		-I${KRB5DIR}/lib/windc
+		-I${KRB5DIR}/lib/wind \
+		-I${KRB5DIR}/lib/hx509 \
+		-I${KRB5DIR}/lib/hdb \
+		-I${KRB5DIR}/lib/ntlm \
+		-I${KRB5DIR}/base \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
+		-I${.OBJDIR:H:H}/lib/libwind \
+		-I${.OBJDIR:H:H}/lib/libhx509 \
+		-I${.OBJDIR:H:H}/lib/libhdb \
+		-I${.OBJDIR:H:H}/lib/libheimntlm
 LIBADD=	krb5 roken crypto vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.bin/verify_krb5_conf/Makefile b/kerberos5/usr.bin/verify_krb5_conf/Makefile
index ced75436e52..dafbce881ae 100644
--- a/kerberos5/usr.bin/verify_krb5_conf/Makefile
+++ b/kerberos5/usr.bin/verify_krb5_conf/Makefile
@@ -2,7 +2,15 @@
 
 PROG=	verify_krb5_conf
 MAN=	verify_krb5_conf.8
-CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/roken
+CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/roken \
+	-I${KRB5DIR}/base \
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libhx509
 LIBADD=	krb5 roken  vers
 
 .include <bsd.prog.mk>
diff --git a/kerberos5/usr.sbin/iprop-log/Makefile b/kerberos5/usr.sbin/iprop-log/Makefile
index 1f71f9b2a40..1253967036d 100644
--- a/kerberos5/usr.sbin/iprop-log/Makefile
+++ b/kerberos5/usr.sbin/iprop-log/Makefile
@@ -7,6 +7,12 @@ CFLAGS+=	-I${KRB5DIR}/lib/kadm5 \
 		-I${KRB5DIR}/lib/krb5 \
 		-I${KRB5DIR}/lib/roken \
 		-I${KRB5DIR}/lib/sl \
+		-I${KRB5DIR}/lib/hdb \
+		-I${KRB5DIR}/lib/asn1 \
+		-I${.OBJDIR:H:H}/lib/libkrb5 \
+		-I${.OBJDIR:H:H}/lib/libroken \
+		-I${.OBJDIR:H:H}/lib/libhdb \
+		-I${.OBJDIR:H:H}/lib/libasn1 \
 		-I.
 LIBADD=	kadm5srv hdb krb5 roken edit sl vers
 LDFLAGS=${LDAPLDFLAGS}
diff --git a/kerberos5/usr.sbin/kstash/Makefile b/kerberos5/usr.sbin/kstash/Makefile
index d96c96c7512..65769ce1c30 100644
--- a/kerberos5/usr.sbin/kstash/Makefile
+++ b/kerberos5/usr.sbin/kstash/Makefile
@@ -3,7 +3,20 @@
 PROG=	kstash
 MAN=	kstash.8
 CFLAGS+=-I${KRB5DIR}/lib/asn1 -I${KRB5DIR}/lib/krb5 -I${KRB5DIR}/lib/roken \
-	-I${KRB5DIR}/kdc ${LDAPCFLAGS}
+	-I${KRB5DIR}/kdc \
+	-I${KRB5DIR}/base \
+	-I${KRB5DIR}/lib/wind \
+	-I${KRB5DIR}/lib/hx509 \
+	-I${KRB5DIR}/lib/hdb \
+	-I${KRB5DIR}/lib/ntlm \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libwind \
+	-I${.OBJDIR:H:H}/lib/libhx509 \
+	-I${.OBJDIR:H:H}/lib/libhdb \
+	-I${.OBJDIR:H:H}/lib/libheimntlm \
+	${LDAPCFLAGS}
 LIBADD=	hdb krb5 crypto vers
 DPADD=	${LDAPDPADD}
 LDADD=	${LDAPLDADD}
diff --git a/kerberos5/usr.sbin/ktutil/Makefile b/kerberos5/usr.sbin/ktutil/Makefile
index c79d09e6d94..a9f63ae5f94 100644
--- a/kerberos5/usr.sbin/ktutil/Makefile
+++ b/kerberos5/usr.sbin/ktutil/Makefile
@@ -16,7 +16,12 @@ SRCS=	add.c \
 	remove.c \
 	rename.c
 
-CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/sl -I.
+CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/sl \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${.OBJDIR:H:H}/lib/libroken \
+	-I${.OBJDIR:H:H}/lib/libkrb5 \
+	-I${.OBJDIR:H:H}/lib/libasn1 \
+	-I.
 LIBADD=	kadm5clnt krb5 roken crypto edit sl vers
 
 CLEANFILES=	ktutil-commands.h ktutil-commands.c
diff --git a/lib/libgssapi/Makefile b/lib/libgssapi/Makefile
index 052bf73a12f..b6d71ad924a 100644
--- a/lib/libgssapi/Makefile
+++ b/lib/libgssapi/Makefile
@@ -2,6 +2,7 @@
 
 PACKAGE=lib${LIB}
 LIB=		gssapi
+PRIVATELIB=	true
 SHLIB_MAJOR=	10
 VERSION_DEF=	${SRCTOP}/lib/libc/Versions.def
 SYMBOL_MAPS=	${.CURDIR}/Symbol.map
diff --git a/lib/libpam/modules/pam_krb5/Makefile b/lib/libpam/modules/pam_krb5/Makefile
index 97fd4909229..b89e70cb80d 100644
--- a/lib/libpam/modules/pam_krb5/Makefile
+++ b/lib/libpam/modules/pam_krb5/Makefile
@@ -34,4 +34,15 @@ WARNS?=	3
 
 LIBADD+=	krb5
 
+# XXX Must be the same as in kerberos5/Makefile.inc
+# XXX There will be a better way to reduce duplication but
+# XXX for now this will do.
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+
+CFLAGS+=	-I${SRCTOP}/kerberos5/include \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${.OBJDIR:H:H:H:H}/kerberos5/lib/libkrb5 \
+ 		-I${KRB5DIR}/lib/asn1 \
+		-I${.OBJDIR:H:H:H:H}/kerberos5/lib/libasn1
+
 .include <bsd.lib.mk>
diff --git a/lib/libpam/modules/pam_ksu/Makefile b/lib/libpam/modules/pam_ksu/Makefile
index 26f3f850daa..ad97914cf1c 100644
--- a/lib/libpam/modules/pam_ksu/Makefile
+++ b/lib/libpam/modules/pam_ksu/Makefile
@@ -30,4 +30,15 @@ MAN=	pam_ksu.8
 
 LIBADD+=	krb5
 
+# XXX Must be the same as in kerberos5/Makefile.inc
+# XXX There will be a better way to reduce duplication but
+# XXX for now this will do.
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+
+CFLAGS+=	-I${SRCTOP}/kerberos5/include \
+		-I${KRB5DIR}/lib/krb5 \
+		-I${.OBJDIR:H:H:H:H}/kerberos5/lib/libkrb5 \
+ 		-I${KRB5DIR}/lib/asn1 \
+		-I${.OBJDIR:H:H:H:H}/kerberos5/lib/libasn1
+
 .include <bsd.lib.mk>
diff --git a/lib/libtelnet/Makefile b/lib/libtelnet/Makefile
index 27bd2d5a22e..9c047317998 100644
--- a/lib/libtelnet/Makefile
+++ b/lib/libtelnet/Makefile
@@ -3,6 +3,11 @@
 
 .include <src.opts.mk>
 
+# XXX Must be the same as in kerberos5/Makefile.inc
+# XXX There will be a better way to reduce duplication but
+# XXX for now this will do.
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+
 PACKAGE=lib${LIB}
 TELNETDIR=	${SRCTOP}/contrib/telnet
 .PATH:		${TELNETDIR}/libtelnet
@@ -24,6 +29,9 @@ CFLAGS+=	-DENCRYPTION -DAUTHENTICATION -DSRA
 .if ${MK_KERBEROS_SUPPORT} != "no"
 SRCS+=		kerberos5.c
 CFLAGS+=	-DKRB5 -DFORWARD -Dnet_write=telnet_net_write
+CFLAGS+= 	-I${SRCTOP}/kerberos5/include \
+		-I${KRB5DIR}/lib/krb5 -I${.OBJDIR:H:H}/kerberos5/lib/libkrb5 \
+		-I${KRB5DIR}/lib/asn1 -I${.OBJDIR:H:H}/kerberos5/lib/libasn1
 .endif
 
 .include <bsd.lib.mk>
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
index 03f61b317ab..866efd78a3b 100644
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -24,7 +24,11 @@ CFLAGS+=	-DHAVE_LDNS=1
 .endif
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
-CFLAGS+= -include krb5_config.h
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+KERBEROS5_DIR=	${SRCTOP}/kerberos5
+CFLAGS+= -include krb5_config.h \
+	-I${KERBEROS5_DIR}/include \
+	-I${KRB5DIR}/lib/krb5
 SRCS+=	krb5_config.h
 LIBADD+=	gssapi
 .endif
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index 93832a9c758..faf5eab8153 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -48,7 +48,13 @@ LDFLAGS+=-L${LIBBLACKLISTDIR}
 .endif
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
-CFLAGS+= -include krb5_config.h
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+CFLAGS+= -include krb5_config.h \
+	-I${KRB5DIR}/lib/krb5 \
+	-I${SRCTOP}/kerberos5/include \
+	-I${.OBJDIR:H:H:H}/kerberos5/lib/libkrb5 \
+	-I${.OBJDIR:H:H:H}/kerberos5/lib/libroken \
+	-I${.OBJDIR:H:H:H}/kerberos5/lib/libasn1
 SRCS+=	krb5_config.h
 LIBADD+=	gssapi_krb5 gssapi krb5
 .endif
diff --git a/share/mk/src.libnames.mk b/share/mk/src.libnames.mk
index 1ff6ca3ed22..adf32c04be3 100644
--- a/share/mk/src.libnames.mk
+++ b/share/mk/src.libnames.mk
@@ -13,19 +13,35 @@ __<src.libnames.mk>__:
 .include <src.opts.mk>
 
 _PRIVATELIBS=	\
+		asn1 \
 		atf_c \
 		atf_cxx \
 		bsdstat \
 		devdctl \
 		event \
+		gssapi \
+		gssapi_krb5 \
+		gssapi_ntlm \
+		gssapi_spnego \
+		hdb \
+		heimbase \
 		heimipcc \
 		heimipcs \
+		heimntlm \
 		ifconfig \
+		hx509 \
+		kadm5clnt \
+		kadm5srv \
+		kafs5 \
+		kdc \
+		krb5 \
 		ldns \
+		roken \
 		sqlite3 \
 		ssh \
 		ucl \
 		unbound \
+		wind \
 		zstd
 
 _INTERNALLIBS=	\
@@ -59,7 +75,6 @@ _LIBRARIES=	\
 		80211 \
 		alias \
 		archive \
-		asn1 \
 		auditd \
 		avl \
 		begemot \
@@ -104,22 +119,11 @@ _LIBRARIES=	\
 		geom \
 		gnuregex \
 		gpio \
-		gssapi \
-		gssapi_krb5 \
-		hdb \
-		heimbase \
-		heimntlm \
 		heimsqlite \
-		hx509 \
 		ipsec \
 		ipt \
 		jail \
-		kadm5clnt \
-		kadm5srv \
-		kafs5 \
-		kdc \
 		kiconv \
-		krb5 \
 		kvm \
 		l \
 		lzma \
@@ -150,7 +154,6 @@ _LIBRARIES=	\
 		pthread \
 		radius \
 		regex \
-		roken \
 		rpcsec_gss \
 		rpcsvc \
 		rt \
@@ -176,7 +179,6 @@ _LIBRARIES=	\
 		util \
 		uutil \
 		vmmapi \
-		wind \
 		wrap \
 		xo \
 		y \
@@ -309,6 +311,8 @@ _DP_heimipcs=	heimbase roken pthread
 _DP_kafs5=	asn1 krb5 roken
 _DP_krb5+=	asn1 com_err crypt crypto hx509 roken wind heimbase heimipcc
 _DP_gssapi_krb5+=	gssapi krb5 crypto roken asn1 com_err
+_DP_gssapi_ntlm+=	crypto gssapi krb5 heimntlm roken
+_DP_gssapi_spnego+=	gssapi heimbase asn1 roken
 _DP_lzma=	pthread
 _DP_ucl=	m
 _DP_vmmapi=	util
diff --git a/usr.bin/compile_et/Makefile b/usr.bin/compile_et/Makefile
index aeccbf3fd55..780bee4b58e 100644
--- a/usr.bin/compile_et/Makefile
+++ b/usr.bin/compile_et/Makefile
@@ -5,7 +5,11 @@
 PROG=	compile_et
 SRCS=	compile_et.c parse.y lex.l
 LIBADD=	roken vers
-CFLAGS+=-I. -I${SRCTOP}/contrib/com_err
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+CFLAGS+=-I. -I${SRCTOP}/contrib/com_err \
+	-I${KRB5DIR}/lib/roken \
+	-I${.OBJDIR:H:H}/kerberos5/lib/libroken \
+	-I${.OBJDIR:H:H}/kerberos5/lib/libasn1
 
 WARNS?=	0
 
diff --git a/usr.sbin/gssd/Makefile b/usr.sbin/gssd/Makefile
index e40017016f1..318e9deb5fa 100644
--- a/usr.sbin/gssd/Makefile
+++ b/usr.sbin/gssd/Makefile
@@ -11,6 +11,11 @@ WARNS?= 1
 
 LIBADD=	gssapi
 .if ${MK_KERBEROS_SUPPORT} != "no"
+KRB5DIR=	${SRCTOP}/crypto/heimdal
+CFLAGS+=	-I${KRB5DIR}/lib/krb5 \
+		-I${SRCTOP}/kerberos5/include \
+		-I${.OBJDIR:H:H}/kerberos5/lib/libkrb5 \
+		-I${.OBJDIR:H:H}/kerberos5/lib/libasn1
 LIBADD+=	krb5 roken
 .else
 CFLAGS+= -DWITHOUT_KERBEROS