Installing FreeBSD-ssh alone (without FreeBSD-pam) produces a sshd that starts and listens fine, but refuses every connection: the per-connection auth process hits a fatal PAM error as soon as auth begins. Steps to Reproduce: 1) Minimal FreeBSD 15.1 system with only FreeBSD-runtime installed. 2) pkg install FreeBSD-ssh (do not install FreeBSD-pam) 3) ssh-keygen -A; /usr/sbin/sshd -p 2222 4) ssh -p 2222 user@host [ahze@saturn ~]$ pkg rquery "%B" FreeBSD-ssh|grep pam libpam.so.6 [ahze@saturn ~]$ pkg rquery "%dn" FreeBSD-ssh [ahze@saturn ~]$ Suggested fix: add FreeBSD-pam as a dependency of FreeBSD-ssh. Related bug: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296383
FreeBSD-ssh doesn't require PAM. an obvious example of this would be if you're only using the client, but that would also be the case if UsePAM is set to no, which might be appropriate in some embedded environments. for a normal sshd setup on a multi-user system, FreeBSD-pam is already part of FreeBSD-set-minimal(-jail), so it will always be installed. this only affects people who don't want to use package sets because they have specific requirements for what packages are installed; for those people, adding a dependency on FreeBSD-pam would install unnecessary additional packages in the case where PAM isn't used, which is unhelpful for space-constrained environments. so, i'm not inclined to change this. (bug 296383 is not related, that's a pkg(8) bug.)
For context, this missing dependency also breaks the official freebsd-runtime container image (https://github.com/orgs/freebsd/packages/container/package/freebsd-runtime) out-of-the-box. We hit this fatal PAM error when sshd stopped working in our downstream builds for https://daemonless.io/images/forgejo/.
it may be worth adding FreeBSD-pam to the runtime image, since a few things are likely to use it. dch: what do you think? for 15.1/amd64, the package is 232KB.
Agree that FreeBSD-ssh should not have a dependency on FreeBSD-pam. We could express the relationship if we had a richer, Debian-style dependency scheme (i.e., Depends/Recommends/Suggests), but not with the current scheme. I agree with ivy@ that having FreeBSD-pam in the runtime image is likely the most appropriate change.
(In reply to Michael Johnson from comment #2) Referencing your 1st link, there are the likes of: docker pull ghcr.io/freebsd/freebsd-runtime:14.snap 14.snap 14.5.beta1 As 14.* do not have official pkgbase support, just the old experimental materials that are not organized like the official 15.* pkgbase support, if you want changes to any 14.* pgbase context as well, you may need to ask about getting such explicitly.
To clarify, the command at the top of the GitHub package page (docker pull ghcr.io/freebsd/freebsd-runtime:14.snap) is automatically populated based on the most recent push, which happened to be 14.snap. We are strictly targeting 15.0 and 15.1 (not 14.x). Regarding the missing dependency: we've already worked around this downstream by adding FreeBSD-pam directly in the Forgejo container (https://github.com/daemonless/forgejo/commit/de72d84d70eed375e9f20859029f77575f9bb1d0). We're happy to keep managing it there -- I just wanted to flag it in case it was an oversight in the runtime image.
forgot to add the PR tag to the commit: https://cgit.freebsd.org/src/commit/?id=c85a2539cd18bfc88d88547773d919e116b8bd6d Author: Lexi Winter <ivy@FreeBSD.org> Date: Wed Sep 2 17:19:32 2026 +0100 oci: Install FreeBSD-pam in the runtime image In 16.0/15.1, the PAM modules were split from FreeBSD-runtime into a new FreeBSD-pam package. FreeBSD-runtime does not install FreeBSD-pam, which means if a user starts from runtime, then installs sshd, sshd will fail to authenticate users because of missing PAM modules. Since FreeBSD-pam is relatively small (about 230kB on amd64), and is already part of FreeBSD-set-minimal, add it to the runtime image as well. Users who absolutely don't want this can still build their own images without it. MFC after: 1 week Reviewed by: dfr Reported by: Michael Johnson <ahze@ahze.net> Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59194