Merged with current trunk, no new function added. Everything builds

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/mkey_migrate@21722 dc483132-0cff-0310-8789-dd5450dbe970

75 files changed, 894 insertions, 5356 deletions

diff --git a/src/appl/bsd/Makefile.in b/src/appl/bsd/Makefile.in
index ec0fcb9..5ec3c95 100644
--- a/src/appl/bsd/Makefile.in
+++ b/src/appl/bsd/Makefile.in
@@ -2,7 +2,6 @@ thisconfigdir=.
 myfulldir=appl/bsd
 mydir=.
 BUILDTOP=$(REL)..$(S)..
-LOCALINCLUDES=@KRB4_INCLUDES@
 PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
@@ -11,16 +10,13 @@ SETENVOBJ=@SETENVOBJ@
 
 LOGINLIBS=@LOGINLIBS@
 LIBOBJS=@LIBOBJS@
-V4RCP=@V4RCP@
-V4RCPO=@V4RCPO@
 KRSHDLIBS=@KRSHDLIBS@
 
 SRCS= $(srcdir)/krcp.c $(srcdir)/krlogin.c $(srcdir)/krsh.c $(srcdir)/kcmd.c \
-	$(srcdir)/forward.c $(srcdir)/compat_recv.c \
-	$(srcdir)/login.c $(srcdir)/krshd.c $(srcdir)/krlogind.c \
-	$(srcdir)/v4rcp.c
-OBJS= krcp.o krlogin.o krsh.o kcmd.o forward.o compat_recv.o $(SETENVOBJ) \
-	login.o krshd.o krlogind.o $(V4RCPO) $(LIBOBJS)
+	$(srcdir)/forward.c $(srcdir)/login.c $(srcdir)/krshd.c \
+	$(srcdir)/krlogind.c
+OBJS= krcp.o krlogin.o krsh.o kcmd.o forward.o $(SETENVOBJ) login.o krshd.o \
+	krlogind.o $(LIBOBJS)
 
 UCB_RLOGIN = @UCB_RLOGIN@
 UCB_RSH = @UCB_RSH@
@@ -34,22 +30,19 @@ DEFINES = $(RSH) $(BSD) $(RPROGS) -DKERBEROS \
 	-DLOGIN_PROGRAM=\"$(SERVER_BINDIR)/login.krb5\" -DKPROGDIR=\"$(CLIENT_BINDIR)\" \
 	-DHEIMDAL_FRIENDLY
 
-all:: rsh rcp rlogin kshd klogind login.krb5 $(V4RCP)
+all:: rsh rcp rlogin kshd klogind login.krb5
 
 clean:: 
-	$(RM) rsh rcp rlogin kshd klogind login.krb5 v4rcp
+	$(RM) rsh rcp rlogin kshd klogind login.krb5
 
-rsh: krsh.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o rsh krsh.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_LIBS)
+rsh: krsh.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o rsh krsh.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_LIBS)
 
-rcp: krcp.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o rcp krcp.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_LIBS)
+rcp: krcp.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o rcp krcp.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_LIBS)
 
-v4rcp: v4rcp.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o v4rcp v4rcp.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_LIBS)
-
-rlogin: krlogin.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o rlogin krlogin.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB4COMPAT_LIBS)
+rlogin: krlogin.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o rlogin krlogin.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRB5_BASE_LIBS)
 
 install::
 	for f in rsh rcp rlogin; do \
@@ -59,18 +52,12 @@ install::
 		${DESTDIR}$(CLIENT_MANDIR)/`echo $$f|sed '$(transform)'`.1 \
 	  ) || exit 1; \
 	done
-	f=$(V4RCP); \
-	if test -n "$$f" ; then	$(INSTALL_SETUID) $$f \
-		$(DESTDIR)$(CLIENT_BINDIR)/`echo $$f|sed '$(transform)'`; \
-	$(INSTALL_DATA) $(srcdir)/$$f.M \
-		${DESTDIR}$(CLIENT_MANDIR)/`echo $$f|sed '$(transform)'`.1; \
-	fi
 
-kshd: krshd.o kcmd.o forward.o compat_recv.o $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB4COMPAT_DEPLIBS) $(APPUTILS_DEPLIB)
-	$(CC_LINK) -o kshd krshd.o kcmd.o forward.o compat_recv.o $(SETENVOBJ) $(LIBOBJS) $(KRSHDLIBS) $(PTY_LIB) $(UTIL_LIB) $(KRB4COMPAT_LIBS) $(APPUTILS_LIB)
+kshd: krshd.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB5_BASE_DEPLIBS) $(APPUTILS_DEPLIB)
+	$(CC_LINK) -o kshd krshd.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(KRSHDLIBS) $(PTY_LIB) $(UTIL_LIB) $(KRB5_BASE_LIBS) $(APPUTILS_LIB)
 
-klogind: krlogind.o kcmd.o forward.o compat_recv.o $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB4COMPAT_DEPLIBS) $(APPUTILS_DEPLIB)
-	$(CC_LINK) -o klogind krlogind.o  kcmd.o forward.o compat_recv.o $(SETENVOBJ) $(LIBOBJS) $(PTY_LIB) $(UTIL_LIB) $(KRB4COMPAT_LIBS) $(APPUTILS_LIB)
+klogind: krlogind.o kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB5_BASE_DEPLIBS) $(APPUTILS_DEPLIB)
+	$(CC_LINK) -o klogind krlogind.o  kcmd.o forward.o $(SETENVOBJ) $(LIBOBJS) $(PTY_LIB) $(UTIL_LIB) $(KRB5_BASE_LIBS) $(APPUTILS_LIB)
 
 install::
 	for f in kshd klogind; do \
@@ -84,8 +71,8 @@ install::
 # No program name transformation is done with login.krb5 since it is directly
 # referenced by klogind.
 #
-login.krb5: login.o  $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o login.krb5 login.o $(SETENVOBJ) $(LIBOBJS) $(LOGINLIBS) $(PTY_LIB) $(KRB4COMPAT_LIBS)
+login.krb5: login.o  $(SETENVOBJ) $(LIBOBJS) $(PTY_DEPLIB) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o login.krb5 login.o $(SETENVOBJ) $(LIBOBJS) $(LOGINLIBS) $(PTY_LIB) $(KRB5_BASE_LIBS)
 
 install::
 	$(INSTALL_PROGRAM) login.krb5 $(DESTDIR)$(SERVER_BINDIR)/login.krb5
@@ -95,111 +82,3 @@ install::
 getdtablesize.o: $(srcdir)/getdtablesize.c
 
 kcmd.o krcp.o krlogin.o krlogind.o krsh.o krshd.o forward.o: defines.h
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)krcp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
-  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/k5-util.h \
-  $(SRCTOP)/include/kerberosIV/des.h $(SRCTOP)/include/kerberosIV/krb.h \
-  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
-  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h defines.h krcp.c
-$(OUTPRE)krlogin.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h krlogin.c rpaths.h
-$(OUTPRE)krsh.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h krsh.c
-$(OUTPRE)kcmd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
-  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h kcmd.c
-$(OUTPRE)forward.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
-  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h forward.c
-$(OUTPRE)compat_recv.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
-  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  compat_recv.c defines.h
-$(OUTPRE)login.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  login.c loginpaths.h
-$(OUTPRE)krshd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-err.h \
-  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
-  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/k5-util.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h krshd.c loginpaths.h
-$(OUTPRE)krlogind.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-err.h \
-  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
-  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/k5-util.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  defines.h krlogind.c
-$(OUTPRE)v4rcp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h \
-  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
-  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/k5-util.h $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/kerberosIV/krbports.h \
-  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
-  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h rpaths.h v4rcp.c
diff --git a/src/appl/bsd/compat_recv.c b/src/appl/bsd/compat_recv.c
deleted file mode 100644
index 1e54941..0000000
--- a/src/appl/bsd/compat_recv.c
+++ /dev/null
@@ -1,581 +0,0 @@
-/*
- * lib/krb5/krb/compat_recv.c
- *
- * Copyright 1993, 2008 by the Massachusetts Institute of Technology.
- * All Rights Reserved.
- *
- * Export of this software from the United States of America may
- *   require a specific license from the United States Government.
- *   It is the responsibility of any person or organization contemplating
- *   export to obtain such a license before exporting.
- * 
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- * 
- *
- * convenience sendauth/recvauth functions, with compatibility with V4
- * recvauth.
- *
- * NOTE: linking in this function will pull in V4 kerberos routines.
- *
- * WARNING: In the V4-style arguments, the ticket and kdata arguments
- * have different types than the V4 recvauth; in V4, they were KTEXT
- * and AUTH_DAT *, respectively.  Here, they are KTEXT * and AUTH_DAT **
- * and they are allocated by recvauth if and only if we end up talking
- * to a V4 sendauth.
- */
-
-#include "k5-int.h"
-#if !defined(_MACINTOSH)
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
-#include "com_err.h"
-#include <errno.h>
-
-#include <stdio.h>
-#include <string.h>
-
-#include "defines.h"
-
-#ifdef KRB5_KRB4_COMPAT
-static int krb_v4_recvauth(long options, int fd, KTEXT ticket,
-			   char *service, char *instance, 
-			   struct sockaddr_in *faddr,
-			   struct sockaddr_in *laddr,
-			   AUTH_DAT *kdata,
-			   char *filename,
-			   Key_schedule schedule,
-			   char *version);
-#endif
-
-#define	KRB_V4_SENDAUTH_VERS	"AUTHV0.1" /* MUST be 8 chars long */
-#define KRB_V5_SENDAUTH_VERS	"KRB5_SENDAUTH_V1.0"
-
-#define KRB5_RECVAUTH_V4	4
-#define KRB5_RECVAUTH_V5	5
-
-#ifdef KRB5_KRB4_COMPAT
-krb5_error_code
-krb5_compat_recvauth(context, auth_context,
-	             /* IN */
-		     fdp, appl_version, server, flags, keytab,
-		     v4_options, v4_service, v4_instance, v4_faddr, v4_laddr,
-		     v4_filename, 
-		     /* OUT */
-		     ticket,
-		     auth_sys, v4_kdata, v4_schedule, v4_version)
-    krb5_context context;
-    krb5_auth_context  *auth_context;
-	krb5_pointer	fdp;
-	char	*appl_version;
-	krb5_principal	server;
-	krb5_int32	flags;
-	krb5_keytab    	keytab;
-	krb5_ticket  ** ticket;
-        krb5_int32      *auth_sys;
-
-	/*
-	 * Version 4 arguments
-	 */
-	krb5_int32 v4_options;	 /* bit-pattern of options */
-	char *v4_service;	 /* service expected */
-	char *v4_instance;	 /* inst expected (may be filled in) */
-	struct sockaddr_in *v4_faddr; /* foreign address */
-	struct sockaddr_in *v4_laddr; /* local address */
-	AUTH_DAT **v4_kdata;	 /* kerberos data (returned) */
-	char *v4_filename;	 /* name of file with service keys */
-	Key_schedule v4_schedule; /* key schedule (return) */
-	char *v4_version;		 /* version string (filled in) */
-{
-	union verslen {
-		krb5_int32	len;
-		char		vers[4];
-	} vers;
-	char	*buf;
-	int	len, length;
-	krb5_int32	retval;
-	int		fd = *( (int *) fdp);
-#ifdef KRB5_KRB4_COMPAT
-	KTEXT		v4_ticket;	 /* storage for client's ticket */
-#endif
-		
-	if ((retval = krb5_net_read(context, fd, vers.vers, 4)) != 4)
-		return((retval < 0) ? errno : ECONNABORTED);
-
-#ifdef KRB5_KRB4_COMPAT
-	if (!strncmp(vers.vers, KRB_V4_SENDAUTH_VERS, 4)) {
-		/*
-		 * We must be talking to a V4 sendauth; read in the
-		 * rest of the version string and make sure.
-		 */
-		if ((retval = krb5_net_read(context, fd, vers.vers, 4)) != 4)
-			return((retval < 0) ? errno : ECONNABORTED);
-		
-		if (strncmp(vers.vers, KRB_V4_SENDAUTH_VERS+4, 4))
-			return KRB5_SENDAUTH_BADAUTHVERS;
-
-		*auth_sys = KRB5_RECVAUTH_V4;
-
-		*v4_kdata = (AUTH_DAT *) malloc( sizeof(AUTH_DAT) );
-		v4_ticket = (KTEXT) malloc(sizeof(KTEXT_ST));
-
-		retval = krb_v4_recvauth(v4_options, fd, v4_ticket,
-					 v4_service, v4_instance, v4_faddr,
-					 v4_laddr, *v4_kdata, v4_filename,
-					 v4_schedule, v4_version);
-		krb5_xfree(v4_ticket);
-		/*
-		 * XXX error code translation?
-		 */
-		switch (retval) {
-		case RD_AP_OK:
-		    return 0;
-		case RD_AP_TIME:
-		    return KRB5KRB_AP_ERR_SKEW;
-		case RD_AP_EXP:
-		    return KRB5KRB_AP_ERR_TKT_EXPIRED;
-		case RD_AP_NYV:
-		    return KRB5KRB_AP_ERR_TKT_NYV;
-		case RD_AP_NOT_US:
-		    return KRB5KRB_AP_ERR_NOT_US;
-		case RD_AP_UNDEC:
-		    return KRB5KRB_AP_ERR_BAD_INTEGRITY;
-		case RD_AP_REPEAT:
-		    return KRB5KRB_AP_ERR_REPEAT;
-		case RD_AP_MSG_TYPE:
-		    return KRB5KRB_AP_ERR_MSG_TYPE;
-		case RD_AP_MODIFIED:
-		    return KRB5KRB_AP_ERR_MODIFIED;
-		case RD_AP_ORDER:
-		    return KRB5KRB_AP_ERR_BADORDER;
-		case RD_AP_BADD:
-		    return KRB5KRB_AP_ERR_BADADDR;
-		default:
-		    return KRB5_SENDAUTH_BADRESPONSE;
-		}
-	}
-#endif
-
-	/*
-	 * Assume that we're talking to a V5 recvauth; read in the
-	 * the version string, and make sure it matches.
-	 */
-	
-	len = (int) ntohl(vers.len);
-
-	if (len < 0 || len > 255)
-		return KRB5_SENDAUTH_BADAUTHVERS;
-
-	buf = malloc((unsigned) len);
-	if (!buf)
-		return ENOMEM;
-	
-	length = krb5_net_read(context, fd, buf, len);
-	if (len != length) {
-		krb5_xfree(buf);
-		if (len < 0)
-			return errno;
-		else
-			return ECONNABORTED;
-	}
-
-	if (strcmp(buf, KRB_V5_SENDAUTH_VERS)) {
-		krb5_xfree(buf);
-		return KRB5_SENDAUTH_BADAUTHVERS;
-	}
-	krb5_xfree(buf);
-
-	*auth_sys = KRB5_RECVAUTH_V5;
-	
-	retval = krb5_recvauth(context, auth_context, fdp, appl_version, server,
-			       flags | KRB5_RECVAUTH_SKIP_VERSION, 
-			       keytab, ticket);
-
-	return retval;
-}
-
-krb5_error_code
-krb5_compat_recvauth_version(context, auth_context,
-			     /* IN */
-			     fdp, server, flags, keytab,
-			     v4_options, v4_service, v4_instance, v4_faddr,
-			     v4_laddr,
-			     v4_filename, 
-			     /* OUT */
-			     ticket,
-			     auth_sys, v4_kdata, v4_schedule,
-			     version)
-    krb5_context context;
-    krb5_auth_context  *auth_context;
-	krb5_pointer	fdp;
-	krb5_principal	server;
-	krb5_int32	flags;
-	krb5_keytab    	keytab;
-	krb5_ticket  ** ticket;
-        krb5_int32      *auth_sys;
-
-	/*
-	 * Version 4 arguments
-	 */
-	krb5_int32 v4_options;	 /* bit-pattern of options */
-	char *v4_service;	 /* service expected */
-	char *v4_instance;	 /* inst expected (may be filled in) */
-	struct sockaddr_in *v4_faddr; /* foreign address */
-	struct sockaddr_in *v4_laddr; /* local address */
-	AUTH_DAT **v4_kdata;	 /* kerberos data (returned) */
-	char *v4_filename;	 /* name of file with service keys */
-	Key_schedule v4_schedule; /* key schedule (return) */
-    krb5_data *version;		/* application version filled in */
-{
-	union verslen {
-		krb5_int32	len;
-		char		vers[4];
-	} vers;
-	char	*buf;
-	int	len, length;
-	krb5_int32	retval;
-	int		fd = *( (int *) fdp);
-#ifdef KRB5_KRB4_COMPAT
-	KTEXT		v4_ticket;	 /* storage for client's ticket */
-#endif
-		
-	if ((retval = krb5_net_read(context, fd, vers.vers, 4)) != 4)
-		return((retval < 0) ? errno : ECONNABORTED);
-
-#ifdef KRB5_KRB4_COMPAT
-	if (v4_faddr->sin_family == AF_INET
-	    && !strncmp(vers.vers, KRB_V4_SENDAUTH_VERS, 4)) {
-		/*
-		 * We must be talking to a V4 sendauth; read in the
-		 * rest of the version string and make sure.
-		 */
-		if ((retval = krb5_net_read(context, fd, vers.vers, 4)) != 4)
-			return((retval < 0) ? errno : ECONNABORTED);
-		
-		if (strncmp(vers.vers, KRB_V4_SENDAUTH_VERS+4, 4))
-			return KRB5_SENDAUTH_BADAUTHVERS;
-
-		*auth_sys = KRB5_RECVAUTH_V4;
-
-		*v4_kdata = (AUTH_DAT *) malloc( sizeof(AUTH_DAT) );
-		v4_ticket = (KTEXT) malloc(sizeof(KTEXT_ST));
-
-		version->length = KRB_SENDAUTH_VLEN; /* no trailing \0! */
-		version->data = malloc (KRB_SENDAUTH_VLEN + 1);
-		version->data[KRB_SENDAUTH_VLEN] = 0;
-		if (version->data == 0)
-		    return ENOMEM;
-		retval = krb_v4_recvauth(v4_options, fd, v4_ticket,
-					 v4_service, v4_instance, v4_faddr,
-					 v4_laddr, *v4_kdata, v4_filename,
-					 v4_schedule, version->data);
-		krb5_xfree(v4_ticket);
-		/*
-		 * XXX error code translation?
-		 */
-		switch (retval) {
-		case RD_AP_OK:
-		    return 0;
-		case RD_AP_TIME:
-		    return KRB5KRB_AP_ERR_SKEW;
-		case RD_AP_EXP:
-		    return KRB5KRB_AP_ERR_TKT_EXPIRED;
-		case RD_AP_NYV:
-		    return KRB5KRB_AP_ERR_TKT_NYV;
-		case RD_AP_NOT_US:
-		    return KRB5KRB_AP_ERR_NOT_US;
-		case RD_AP_UNDEC:
-		    return KRB5KRB_AP_ERR_BAD_INTEGRITY;
-		case RD_AP_REPEAT:
-		    return KRB5KRB_AP_ERR_REPEAT;
-		case RD_AP_MSG_TYPE:
-		    return KRB5KRB_AP_ERR_MSG_TYPE;
-		case RD_AP_MODIFIED:
-		    return KRB5KRB_AP_ERR_MODIFIED;
-		case RD_AP_ORDER:
-		    return KRB5KRB_AP_ERR_BADORDER;
-		case RD_AP_BADD:
-		    return KRB5KRB_AP_ERR_BADADDR;
-		default:
-		    return KRB5_SENDAUTH_BADRESPONSE;
-		}
-	}
-#endif
-
-	/*
-	 * Assume that we're talking to a V5 recvauth; read in the
-	 * the version string, and make sure it matches.
-	 */
-	
-	len = (int) ntohl(vers.len);
-
-	if (len < 0 || len > 255)
-		return KRB5_SENDAUTH_BADAUTHVERS;
-
-	buf = malloc((unsigned) len);
-	if (!buf)
-		return ENOMEM;
-	
-	length = krb5_net_read(context, fd, buf, len);
-	if (len != length) {
-		krb5_xfree(buf);
-		if (len < 0)
-			return errno;
-		else
-			return ECONNABORTED;
-	}
-
-	if (strcmp(buf, KRB_V5_SENDAUTH_VERS)) {
-		krb5_xfree(buf);
-		return KRB5_SENDAUTH_BADAUTHVERS;
-	}
-	krb5_xfree(buf);
-
-	*auth_sys = KRB5_RECVAUTH_V5;
-	
-	retval = krb5_recvauth_version(context, auth_context, fdp, server,
-				       flags | KRB5_RECVAUTH_SKIP_VERSION, 
-				       keytab, ticket, version);
-
-	return retval;
-}
-#endif /* KRB5_KRB4_COMPAT */
-
-
-#ifndef max
-#define	max(a,b) (((a) > (b)) ? (a) : (b))
-#endif /* max */
-
-#ifdef KRB5_KRB4_COMPAT	
-static int
-krb_v4_recvauth(options, fd, ticket, service, instance, faddr, laddr, kdata,
-		filename, schedule, version)
-long options;			 /* bit-pattern of options */
-int fd;				 /* file descr. to read from */
-KTEXT ticket;			 /* storage for client's ticket */
-char *service;			 /* service expected */
-char *instance;			 /* inst expected (may be filled in) */
-struct sockaddr_in *faddr;	 /* address of foreign host on fd */
-struct sockaddr_in *laddr;	 /* local address */
-AUTH_DAT *kdata;		 /* kerberos data (returned) */
-char *filename;			 /* name of file with service keys */
-Key_schedule schedule;		 /* key schedule (return) */
-char *version;			 /* version string (filled in) */
-{
-    int cc, old_vers = 0;
-    int rem;
-    krb5_int32 tkt_len, priv_len;
-    krb5_ui_4 cksum;
-    u_char tmp_buf[MAX_KTXT_LEN+max(KRB_SENDAUTH_VLEN+1,21)];
-
-    /* read the application version string */
-    if ((krb_net_read(fd, version, KRB_SENDAUTH_VLEN) !=
-	 KRB_SENDAUTH_VLEN))
-	return(errno);
-    version[KRB_SENDAUTH_VLEN] = '\0';
-
-    /* get the length of the ticket */
-    if (krb_net_read(fd, (char *)&tkt_len, sizeof(tkt_len)) !=
-	sizeof(tkt_len))
-	return(errno);
-    
-    /* sanity check */
-    ticket->length = ntohl((unsigned long)tkt_len);
-    if ((ticket->length <= 0) || (ticket->length > MAX_KTXT_LEN)) {
-	if (options & KOPT_DO_MUTUAL) {
-	    rem = KFAILURE;
-	    goto mutual_fail;
-	} else
-	    return(KFAILURE); /* XXX there may still be junk on the fd? */
-    }		
-
-    /* read the ticket */
-    if (krb_net_read(fd, (char *) ticket->dat, ticket->length)
-	!= ticket->length)
-	return(errno);
-
-    /*
-     * now have the ticket.  decrypt it to get the authenticated
-     * data.
-     */
-    rem = krb_rd_req(ticket,service,instance,faddr->sin_addr.s_addr,
-		     kdata,filename);
-
-    if (old_vers) return(rem);	 /* XXX can't do mutual with old client */
-
-    /* if we are doing mutual auth, compose a response */
-    if (options & KOPT_DO_MUTUAL) {
-	if (rem != KSUCCESS)
-	    /* the krb_rd_req failed */
-	    goto mutual_fail;
-
-	/* add one to the (formerly) sealed checksum, and re-seal it
-	   for return to the client */
-	cksum = kdata->checksum + 1;
-	cksum = htonl(cksum);
-#ifndef NOENCRYPTION
-	key_sched(kdata->session,schedule);
-#endif /* !NOENCRYPTION */
-	priv_len = krb_mk_priv((unsigned char *)&cksum,
-			       tmp_buf,
-			       (unsigned long) sizeof(cksum),
-			       schedule,
-			       &kdata->session,
-			       laddr,
-			       faddr);
-	if (priv_len < 0) {
-	    /* re-sealing failed; notify the client */
-	    rem = KFAILURE;	 /* XXX */
-mutual_fail:
-	    priv_len = -1;
-	    tkt_len = htonl((unsigned long) priv_len);
-	    /* a length of -1 is interpreted as an authentication
-	       failure by the client */
-	    if ((cc = krb_net_write(fd, (char *)&tkt_len, sizeof(tkt_len)))
-		!= sizeof(tkt_len))
-		return(cc);
-	    return(rem);
-	} else {
-	    /* re-sealing succeeded, send the private message */
-	    tkt_len = htonl((unsigned long)priv_len);
-	    if ((cc = krb_net_write(fd, (char *)&tkt_len, sizeof(tkt_len)))
-		 != sizeof(tkt_len))
-		return(cc);
-	    if ((cc = krb_net_write(fd, (char *)tmp_buf, (int) priv_len))
-		!= (int) priv_len)
-		return(cc);
-	}
-    }
-    return(rem);
-}
-#endif
-#endif
-
-#ifdef HAVE_SYS_SELECT_H
-#include <sys/select.h>
-#endif
-#include "port-sockets.h"
-
-int
-accept_a_connection (int debug_port, struct sockaddr *from,
-		     socklen_t *fromlenp)
-{
-    int n, s, fd, s4 = -1, s6 = -1, on = 1;
-    fd_set sockets;
-
-    FD_ZERO(&sockets);
-
-#ifdef KRB5_USE_INET6
-    {
-	struct sockaddr_in6 sock_in6;
-
-	if ((s = socket(AF_INET6, SOCK_STREAM, PF_UNSPEC)) < 0) {
-	    if ((errno == EPROTONOSUPPORT) || (errno == EAFNOSUPPORT))
-		goto skip_ipv6;
-	    fprintf(stderr, "Error in socket(INET6): %s\n", strerror(errno));
-	    exit(2);
-	}
-
-	memset((char *) &sock_in6, 0,sizeof(sock_in6));
-	sock_in6.sin6_family = AF_INET6;
-	sock_in6.sin6_port = htons(debug_port);
-	sock_in6.sin6_addr = in6addr_any;
-
-	(void) setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
-			  (char *)&on, sizeof(on));
-
-	if ((bind(s, (struct sockaddr *) &sock_in6, sizeof(sock_in6))) < 0) {
-	    fprintf(stderr, "Error in bind(INET6): %s\n", strerror(errno));
-	    exit(2);
-	}
-
-	if ((listen(s, 5)) < 0) {
-	    fprintf(stderr, "Error in listen(INET6): %s\n", strerror(errno));
-	    exit(2);
-	}
-	s6 = s;
-	FD_SET(s, &sockets);
-    skip_ipv6:
-	;
-    }
-#endif
-
-    {
-	struct sockaddr_in sock_in;
-
-	if ((s = socket(AF_INET, SOCK_STREAM, PF_UNSPEC)) < 0) {
-	    fprintf(stderr, "Error in socket: %s\n", strerror(errno));
-	    exit(2);
-	}
-
-	memset((char *) &sock_in, 0,sizeof(sock_in));
-	sock_in.sin_family = AF_INET;
-	sock_in.sin_port = htons(debug_port);
-	sock_in.sin_addr.s_addr = INADDR_ANY;
-
-	(void) setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
-			  (char *)&on, sizeof(on));
-
-	if ((bind(s, (struct sockaddr *) &sock_in, sizeof(sock_in))) < 0) {
-	    if (s6 >= 0 && errno == EADDRINUSE)
-		goto try_ipv6_only;
-	    fprintf(stderr, "Error in bind: %s\n", strerror(errno));
-	    exit(2);
-	}
-
-	if ((listen(s, 5)) < 0) {
-	    fprintf(stderr, "Error in listen: %s\n", strerror(errno));
-	    exit(2);
-	}
-	s4 = s;
-	FD_SET(s, &sockets);
-    try_ipv6_only:
-	;
-    }
-    if (s4 == -1 && s6 == -1) {
-	fprintf(stderr, "No valid sockets established, exiting\n");
-	exit(2);
-    }
-    n = select(((s4 < s6) ? s6 : s4) + 1, &sockets, 0, 0, 0);
-    if (n < 0) {
-	fprintf(stderr, "select error: %s\n", strerror(errno));
-	exit(2);
-    } else if (n == 0) {
-	fprintf(stderr, "internal error? select returns 0\n");
-	exit(2);
-    }
-    if (s6 != -1 && FD_ISSET(s6, &sockets)) {
-	if (s4 != -1)
-	    close(s4);
-	s = s6;
-    } else if (FD_ISSET(s4, &sockets)) {
-	if (s6 != -1)
-	    close(s6);
-	s = s4;
-    } else {
-	fprintf(stderr,
-		"internal error? select returns positive, "
-		"but neither fd available\n");
-	exit(2);
-    }
-
-    if ((fd = accept(s, from, fromlenp)) < 0) {
-	fprintf(stderr, "Error in accept: %s\n", strerror(errno));
-	exit(2);
-    }
-
-    close(s);
-    return fd;
-}
diff --git a/src/appl/bsd/configure.in b/src/appl/bsd/configure.in
index 5c70d8b..330c87d 100644
--- a/src/appl/bsd/configure.in
+++ b/src/appl/bsd/configure.in
@@ -42,30 +42,15 @@ alpha*-dec-osf*)
 	;;
 esac
 dnl
-dnl krshd does not use krb524...
-dnl
 KRSHDLIBS="$LOGINLIBS"
-dnl 
-if test "$with_krb4" = "" || test "$with_krb4" = no; then
-	AC_MSG_RESULT(no krb4 support)
-	V4RCP=
-	V4RCPO=
-else 
-	AC_MSG_RESULT(Adding in krb4 rcp support)
-	V4RCP=v4rcp
-	V4RCPO=v4rcp.o
-fi
-dnl
 dnl
 AC_SUBST(KRSHDLIBS)
 AC_SUBST(LOGINLIBS)
-AC_SUBST(V4RCP)
-AC_SUBST(V4RCPO)
 dnl
 AC_FUNC_VFORK
 AC_TYPE_MODE_T
 AC_CHECK_FUNCS(isatty inet_aton getenv gettosbyname killpg initgroups setpriority setreuid setresuid waitpid setsid ptsname setlogin tcgetpgrp tcsetpgrp setpgid strsave utimes rmufile rresvport_af)
-AC_CHECK_HEADERS(unistd.h stdlib.h string.h sys/filio.h sys/sockio.h sys/label.h sys/tty.h ttyent.h lastlog.h sys/select.h sys/ptyvar.h utmp.h sys/time.h krb4-proto.h sys/ioctl_compat.h paths.h arpa/nameser.h)
+AC_CHECK_HEADERS(unistd.h stdlib.h string.h sys/filio.h sys/sockio.h sys/label.h sys/tty.h ttyent.h lastlog.h sys/select.h sys/ptyvar.h utmp.h sys/time.h sys/ioctl_compat.h paths.h arpa/nameser.h)
 AC_HEADER_STDARG
 AC_REPLACE_FUNCS(getdtablesize)
 dnl
@@ -168,17 +153,7 @@ K5_AC_CHECK_FILES(/etc/environment /etc/TIMEZONE)
 dnl
 dnl
 AC_C_CONST
-if test "$krb5_cv_build_krb4_libs" = yes; then
-	AC_DEFINE(HAVE_KRB_GET_ERR_TEXT)
-	AC_DEFINE(HAVE_KRB_SAVE_CREDENTIALS)
-else
-	oldlibs=$LIBS
-	LIBS=" $KRB4_LIB -lkrb5 -lcrypto -lcom_err"
-	AC_CHECK_FUNCS(krb_get_err_text krb_save_credentials)
-	LIBS=$oldlibs
-fi
 
-AC_CHECK_HEADERS(krb4-proto.h)
 KRB5_AC_LIBUTIL
 KRB5_BUILD_PROGRAM
 V5_AC_OUTPUT_MAKEFILE
diff --git a/src/appl/bsd/defines.h b/src/appl/bsd/defines.h
index ac7948a..d04182b 100644
--- a/src/appl/bsd/defines.h
+++ b/src/appl/bsd/defines.h
@@ -44,18 +44,6 @@ extern void rcmd_stream_init_krb5 (krb5_keyblock *in_keyblock,
 
 extern void rcmd_stream_init_normal(void);
 
-#if defined(KRB5_KRB4_COMPAT) && !defined(SKIP_V4_PROTO)
-extern void rcmd_stream_init_krb4(C_Block, int, int, int);
-
-extern int k4cmd(int *sock, char **ahost, unsigned int rport,
-		 char *locuser,
-		 char *remuser, char *cmd, int *fd2p, KTEXT ticket,
-		 char *service, char *realm, CREDENTIALS *cred, 
-		 Key_schedule schedule, MSG_DAT *msg_data, 
-		 struct sockaddr_in *laddr, struct sockaddr_in *faddr, 
-		 long authopts, int anyport);
-#endif
-
 #ifndef HAVE_STRSAVE
 extern char *strsave(const char *sp);
 #endif
@@ -95,6 +83,3 @@ krb5_compat_recvauth_version(krb5_context, krb5_auth_context *,
 #endif
 
 #include "port-sockets.h"
-
-int accept_a_connection (int debug_port, struct sockaddr *from,
-			 socklen_t *fromlenp);
diff --git a/src/appl/bsd/deps b/src/appl/bsd/deps
new file mode 100644
index 0000000..f86eafa
--- /dev/null
+++ b/src/appl/bsd/deps
@@ -0,0 +1,78 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)krcp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/k5-util.h $(SRCTOP)/include/krb5.h \
+  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  defines.h krcp.c
+$(OUTPRE)krlogin.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h krlogin.c \
+  rpaths.h
+$(OUTPRE)krsh.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h krsh.c
+$(OUTPRE)kcmd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h kcmd.c
+$(OUTPRE)forward.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h forward.c
+$(OUTPRE)login.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h login.c loginpaths.h
+$(OUTPRE)krshd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-buf.h \
+  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
+  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/k5-util.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h krshd.c \
+  loginpaths.h
+$(OUTPRE)krlogind.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-buf.h \
+  $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
+  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/k5-util.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h defines.h krlogind.c
diff --git a/src/appl/bsd/forward.c b/src/appl/bsd/forward.c
index 53f67e6..1ac2a2a 100644
--- a/src/appl/bsd/forward.c
+++ b/src/appl/bsd/forward.c
@@ -27,7 +27,6 @@
 
 #include "k5-int.h"
 
-#define SKIP_V4_PROTO /* To skip the krb4 prototypes */
 #include "defines.h"
 
 /* Decode, decrypt and store the forwarded creds in the local ccache. */
@@ -54,7 +53,7 @@ rd_and_store_for_creds(context, auth_context, inbuf, ticket, ccache)
      * the rlogind or rshd. Set the environment variable as well.
      */
   
-    sprintf(ccname, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+    snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_p%ld", (long) getpid());
     setenv("KRB5CCNAME", ccname, 1);
   
     retval = krb5_cc_resolve(context, ccname, ccache);
diff --git a/src/appl/bsd/kcmd.c b/src/appl/bsd/kcmd.c
index 64da72f..c4212b3 100644
--- a/src/appl/bsd/kcmd.c
+++ b/src/appl/bsd/kcmd.c
@@ -90,16 +90,10 @@
 
 #include <errno.h>
 #include "k5-int.h"
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
 
 #include "defines.h"
 
 extern krb5_context bsd_context;
-#ifdef KRB5_KRB4_COMPAT
-extern Key_schedule v4_schedule;
-#endif
 
 
 #define START_PORT      5120     /* arbitrary */
@@ -140,27 +134,8 @@ static char *store_ptr = storage;
 static int twrite(int, char *, size_t, int);
 static int v5_des_read(int, char *, size_t, int), 
     v5_des_write(int, char *, size_t, int);
-#ifdef KRB5_KRB4_COMPAT
-static int v4_des_read(int, char *, size_t, int), 
-    v4_des_write(int, char *, size_t, int);
-static C_Block v4_session;
-static int right_justify;
-#endif
 static int do_lencheck;
 
-#ifdef KRB5_KRB4_COMPAT
-extern int
-krb_sendauth(long options, int fd, KTEXT ticket,
-	     char *service, char *inst, char *realm,
-	     unsigned KRB4_32 checksum,
-	     MSG_DAT *msg_data,
-	     CREDENTIALS *cred,
-	     Key_schedule schedule,
-	     struct sockaddr_in *laddr,
-	     struct sockaddr_in *faddr,
-	     char *version);
-#endif
-
 #ifdef POSIX_SIGNALS
 typedef sigset_t masktype;
 #else
@@ -205,7 +180,7 @@ kcmd_connect (int *sp, int *addrfamilyp, struct sockaddr_in *sockinp,
 	fprintf(stderr, "can't connect to %s port 0\n", hname);
 	return -1;
     }
-    sprintf(rport_buf, "%d", ntohs(rport));
+    snprintf(rport_buf, sizeof(rport_buf), "%d", ntohs(rport));
     memset(&aihints, 0, sizeof(aihints));
     aihints.ai_socktype = SOCK_STREAM;
     aihints.ai_flags = AI_CANONNAME;
@@ -334,7 +309,7 @@ setup_secondary_channel (int s, int *fd2p, int *lportp, int *addrfamilyp,
 	FD_SET(s, &xfds);
 	listen(s2, 1);
 	FD_SET(s2, &rfds);
-    	(void) sprintf(num, "%d", *lportp);
+    	(void) snprintf(num, sizeof(num), "%d", *lportp);
 	slen = strlen(num)+1;
     	if (write(s, num, slen) != slen) {
 	    perror("write: setting up stderr");
@@ -424,13 +399,10 @@ kcmd(sock, ahost, rport, locuser, remuser, cmd, fd2p, service, realm,
     enum kcmd_proto protonum = *protonump;
     int addrfamily = /* AF_INET */0;
 
-    if ((cksumbuf = malloc(strlen(cmd)+strlen(remuser)+64)) == 0 ) {
+    if (asprintf(&cksumbuf, "%u:%s%s", ntohs(rport), cmd, remuser) < 0) {
 	fprintf(stderr, "Unable to allocate memory for checksum buffer.\n");
 	return(-1);
     }
-    sprintf(cksumbuf, "%u:", ntohs(rport));
-    strcat(cksumbuf, cmd);
-    strcat(cksumbuf, remuser);
     cksumdat.data = cksumbuf;
     cksumdat.length = strlen(cksumbuf);
 	
@@ -634,133 +606,6 @@ kcmd(sock, ahost, rport, locuser, remuser, cmd, fd2p, service, realm,
 }
 
 
-
-#ifdef KRB5_KRB4_COMPAT
-int
-k4cmd(sock, ahost, rport, locuser, remuser, cmd, fd2p, ticket, service, realm,
-      cred, schedule, msg_data, laddr, faddr, authopts, anyport)
-     int *sock;
-     char **ahost;
-     unsigned int rport;
-     char *locuser, *remuser, *cmd;
-     int *fd2p;
-     KTEXT ticket;
-     char *service;
-     char *realm;
-     CREDENTIALS *cred;
-     Key_schedule schedule;
-     MSG_DAT *msg_data;
-     struct sockaddr_in *laddr, *faddr;
-     long authopts;
-     int anyport;
-{
-    int s;
-    masktype oldmask;
-    struct sockaddr_in sockin, from;
-    char c;
-    int lport = START_PORT;
-    int rc;
-    char *host_save;
-    int status;
-    int addrfamily = AF_INET;
-
-    block_urgent(&oldmask);
-    if (kcmd_connect (&s, &addrfamily, &sockin, *ahost, &host_save, rport, &lport, laddr) == -1) {
-	restore_sigs(&oldmask);
-	return -1;
-    }
-    *ahost = host_save;
-    /* If realm is null, look up from table */
-    if ((realm == NULL) || (realm[0] == '\0')) {
-	realm = krb_realmofhost(host_save);
-    }
-    lport--;
-    status = setup_secondary_channel(s, fd2p, &lport, &addrfamily, &from,
-				     anyport);
-    if (status)
-	goto bad;
-
-    /* set up the needed stuff for mutual auth */
-    *faddr = sockin;
-
-    status = krb_sendauth(authopts, s, ticket, service, *ahost,
-			  realm, (unsigned long) getpid(), msg_data,
-			  cred, schedule, laddr, faddr, "KCMDV0.1");
-    if (status != KSUCCESS) {
-	fprintf(stderr, "krb_sendauth failed: %s\n", krb_get_err_text(status));
-	status = -1;
-	goto bad2;
-    }
-    (void) write(s, remuser, strlen(remuser)+1);
-    (void) write(s, cmd, strlen(cmd)+1);
-
-reread:
-    if ((rc=read(s, &c, 1)) != 1) {
-	if (rc==-1) {
-	    perror(*ahost);
-	} else {
-	    fprintf(stderr,"rcmd: bad connection with remote host\n");
-	}
-	status = -1;
-	goto bad2;
-    }
-    if (c != 0) {
-	/* If rlogind was compiled on SunOS4, and it somehow
-	   got the shared library version numbers wrong, it
-	   may give an ld.so warning about an old version of a
-	   shared library.  Just ignore any such warning.
-	   Note that the warning is a characteristic of the
-	   server; we may not ourselves be running under
-	   SunOS4.  */
-	if (c == 'l') {
-	    char *check = "d.so: warning:";
-	    char *p;
-	    char cc;
-
-	    p = check;
-	    while (read(s, &c, 1) == 1) {
-		if (*p == '\0') {
-		    if (c == '\n')
-			break;
-		} else {
-		    if (c != *p)
-			break;
-		    ++p;
-		}
-	    }
-
-	    if (*p == '\0')
-		goto reread;
-
-	    cc = 'l';
-	    (void) write(2, &cc, 1);
-	    if (p != check)
-		(void) write(2, check, (unsigned) (p - check));
-	}
-
-	(void) write(2, &c, 1);
-	while (read(s, &c, 1) == 1) {
-	    (void) write(2, &c, 1);
-	    if (c == '\n')
-		break;
-	}
-	status = -1;
-	goto bad2;
-    }
-    restore_sigs(&oldmask);
-    *sock = s;
-    return (KSUCCESS);
- bad2:
-    if (lport)
-	(void) close(*fd2p);
- bad:
-    (void) close(s);
-    restore_sigs(&oldmask);
-    return (status);
-}
-#endif /* KRB5_KRB4_COMPAT */
-
-
 static int
 setup_socket (struct sockaddr *sa, GETSOCKNAME_ARG3_TYPE len)
 {
@@ -940,25 +785,6 @@ void rcmd_stream_init_krb5(in_keyblock, encrypt_flag, lencheck, am_client,
     abort();
     }
 
-#ifdef KRB5_KRB4_COMPAT
-void rcmd_stream_init_krb4(session, encrypt_flag, lencheck, justify)
-     C_Block session;
-     int encrypt_flag;
-     int lencheck;
-     int justify;
-{
-    if (!encrypt_flag) {
-	rcmd_stream_init_normal();
-	return;
-    }
-    do_lencheck = lencheck;
-    right_justify = justify;
-    input = v4_des_read;
-    output = v4_des_write;
-    memcpy(v4_session, session, sizeof(v4_session));
-}
-#endif
-
 int rcmd_stream_read(fd, buf, len, sec)
      int fd;
      register char *buf;
@@ -1014,7 +840,6 @@ static int v5_des_read(fd, buf, len, secondary)
 	nstored = 0;
     }
 
-    /* See the comment in v4_des_read. */
     while (1) {
 	cc = krb5_net_read(bsd_context, fd, &c, 1);
 	/* we should check for non-blocking here, but we'd have
@@ -1153,162 +978,6 @@ static int v5_des_write(fd, buf, len, secondary)
 }
 
 
-
-#ifdef KRB5_KRB4_COMPAT
-
-static int
-v4_des_read(fd, buf, len, secondary)
-int fd;
-char *buf;
-size_t len;
-int secondary;
-{
-	int nreturned = 0;
-	krb5_ui_4 net_len, rd_len;
-	int cc;
-	unsigned char c;
-
-	if (nstored >= len) {
-		memcpy(buf, store_ptr, len);
-		store_ptr += len;
-		nstored -= len;
-		return(len);
-	} else if (nstored) {
-		memcpy(buf, store_ptr, nstored);
-		nreturned += nstored;
-		buf += nstored;
-		len -= nstored;
-		nstored = 0;
-	}
-
-	/* We're fetching the length which is MSB first, and the MSB
-	   has to be zero unless the client is sending more than 2^24
-	   (16M) bytes in a single write (which is why this code is used
-	   in rlogin but not rcp or rsh.) The only reasons we'd get
-	   something other than zero are:
-		-- corruption of the tcp stream (which will show up when
-		   everything else is out of sync too)
-		-- un-caught Berkeley-style "pseudo out-of-band data" which
-		   happens any time the user hits ^C twice.
-	   The latter is *very* common, as shown by an 'rlogin -x -d' 
-	   using the CNS V4 rlogin.         Mark EIchin 1/95
-	   */
-	while (1) {
-	    cc = krb_net_read(fd, &c, 1);
-	    if (cc <= 0) return cc; /* read error */
-	    if (cc == 1) {
-		if (c == 0 || !do_lencheck) break;
-	    }
-	}
-
-	net_len = c;
-	if ((cc = krb_net_read(fd, &c, 1)) != 1) return 0;
-	net_len = (net_len << 8) | c;
-	if ((cc = krb_net_read(fd, &c, 1)) != 1) return 0;
-	net_len = (net_len << 8) | c;
-	if ((cc = krb_net_read(fd, &c, 1)) != 1) return 0;
-	net_len = (net_len << 8) | c;
-
-	/* Note: net_len is unsigned */
-	if (net_len > sizeof(des_inbuf)) {
-		errno = EIO;
-		return(-1);
-	}
-	/* the writer tells us how much real data we are getting, but
-	   we need to read the pad bytes (8-byte boundary) */
-	rd_len = roundup(net_len, 8);
-	if ((cc = krb_net_read(fd, des_inbuf, rd_len)) != rd_len) {
-		errno = EIO;
-		return(-1);
-	}
-	(void) pcbc_encrypt((des_cblock *) des_inbuf,
-			    (des_cblock *) storage,
-			    (int) ((net_len < 8) ? 8 : net_len),
-			    v4_schedule,
-			    &v4_session,
-			    DECRYPT);
-	/* 
-	 * when the cleartext block is < 8 bytes, it is "right-justified"
-	 * in the block, so we need to adjust the pointer to the data
-	 */
-	if (net_len < 8 && right_justify)
-		store_ptr = storage + 8 - net_len;
-	else
-		store_ptr = storage;
-	nstored = net_len;
-	if (nstored > len) {
-		memcpy(buf, store_ptr, len);
-		nreturned += len;
-		store_ptr += len;
-		nstored -= len;
-	} else {
-		memcpy(buf, store_ptr, nstored);
-		nreturned += nstored;
-		nstored = 0;
-	}
-	
-	return(nreturned);
-}
-
-static int
-v4_des_write(fd, buf, len, secondary)
-int fd;
-char *buf;
-size_t len;
-int secondary;
-{
-	static char garbage_buf[8];
-	unsigned char *len_buf = (unsigned char *) des_outpkt;
-
-	/* 
-	 * pcbc_encrypt outputs in 8-byte (64 bit) increments
-	 *
-	 * it zero-fills the cleartext to 8-byte padding,
-	 * so if we have cleartext of < 8 bytes, we want
-	 * to insert random garbage before it so that the ciphertext
-	 * differs for each transmission of the same cleartext.
-	 * if len < 8 - sizeof(long), sizeof(long) bytes of random
-	 * garbage should be sufficient; leave the rest as-is in the buffer.
-	 * if len > 8 - sizeof(long), just garbage fill the rest.
-	 */
-
-#ifdef min
-#undef min
-#endif
-#define min(a,b) ((a < b) ? a : b)
-
-	if (len < 8) {
-		if (right_justify) {
-			krb5_random_confounder(8 - len, garbage_buf);
-			/* this "right-justifies" the data in the buffer */
-			(void) memcpy(garbage_buf + 8 - len, buf, len);
-		} else {
-			krb5_random_confounder(8 - len, garbage_buf + len);
-			(void) memcpy(garbage_buf, buf, len);
-		}
-	}
-	(void) pcbc_encrypt((des_cblock *) ((len < 8) ? garbage_buf : buf),
-			    (des_cblock *) (des_outpkt+4),
-			    (int) ((len < 8) ? 8 : len),
-			    v4_schedule,
-			    &v4_session,
-			    ENCRYPT);
-
-	/* tell the other end the real amount, but send an 8-byte padded
-	   packet */
-	len_buf[0] = (len & 0xff000000) >> 24;
-	len_buf[1] = (len & 0xff0000) >> 16;
-	len_buf[2] = (len & 0xff00) >> 8;
-	len_buf[3] = (len & 0xff);
-	if (write(fd, des_outpkt, roundup(len,8)+4) != roundup(len,8)+4) {
-		errno = EIO;
-		return(-1);
-	}
-	return(len);
-}
-
-#endif /* KRB5_KRB4_COMPAT */
-
 #ifndef HAVE_STRSAVE
 /* Strsave was a routine in the version 4 krb library: we put it here
    for compatablilty with version 5 krb library, since kcmd.o is linked
@@ -1320,11 +989,10 @@ strsave(sp)
 {
     register char *ret;
     
-    if((ret = (char *) malloc((unsigned) strlen(sp)+1)) == NULL) {
+    if((ret = strdup(sp)) == NULL) {
 	fprintf(stderr, "no memory for saving args\n");
 	exit(1);
     }
-    (void) strcpy(ret,sp);
     return(ret);
 }
 #endif
diff --git a/src/appl/bsd/klogind.M b/src/appl/bsd/klogind.M
index de4cd34..574ae67 100644
--- a/src/appl/bsd/klogind.M
+++ b/src/appl/bsd/klogind.M
@@ -10,7 +10,7 @@ klogind \- remote login server
 .SH SYNOPSIS
 .B klogind
 [
-.B \-kr54cpPef
+.B \-rcpPef
 ]
 [[ \fB\-w\fP[\fBip\fP|\fImaxhostlen\fP[\fB,\fP[\fBno\fP]\fBstriplocal\fP ]] ]
 [ \fB\-D\fP \fIport\fP ]
@@ -40,37 +40,19 @@ Check authorization via the access-control files \fI.k5login\fP and
 Prompt for password if any checks fail and the \fI-p\fP option was supplied.
 .PP
 If the authentication succeeds, login the user by calling the accompanying 
-login.krb5 or /bin/login, according to the definition of 
-DO_NOT_USE_K_LOGIN.
+login.krb5.
+.PP
+klogind allows Kerberos V5 authentication with the \fI.k5login\fP
+access control file to be trusted.  If this authorization check is
+passed, then the user is allowed to log in.  If the user has no
+\fI.k5login\fP file, the login will be authorized if the results of
+krb5_aname_to_localname conversion matches the account name.  Unless
+special rules are configured, this will be true if and only if the
+Kerberos principal of the connecting user is in the default local
+realm and the principal portion matches the account name.
 .PP 
 The configuration of \fIklogind\fP is done
 by command line arguments passed by inetd.  The options are:
-.IP \fB\-5\fP 10
-Allow Kerberos V5 authentication with the \fI.k5login\fP access control
-file to be trusted.  If this authentication system is used by the client
-and the authorization check is passed, then the user is allowed to log in.
-If the user has no \fI.k5login\fP file, the login will be authorized if
-the results of krb5_aname_to_localname conversion matches the account
-name.  Unless special rules are configured, this will be true if and only
-if the Kerberos principal of the connecting user is in the default local
-realm and the principal portion matches the account name.
-
-.IP \fB\-4\fP 
-Allow Kerberos V4 authentication with the \fI.klogin\fP access control
-file to be trusted.  If this authentication system is used by the client
-and the authorization check is passed, then the user is allowed to log
-in.
-
-.IP \fB\-k\fP 
-Allow Kerberos V5 and Kerberos V4 as acceptable authentication
-mechanisms.  This is the same as including \fB\-4\fP and \fB\-5\fP.
-
-
-.IP \fB\-p\fP
- If all other authorization checks fail, prompt the user
-for a password If this option is not included, access is denied
-without successful authentication and authorization using one of the
-previous mechanisms.
 
 .IP \fB\-P\fP
 Prompt the user for a password.
@@ -82,15 +64,13 @@ Create an encrypted session.
 
 .IP \fB\-c\fP 
 Require Kerberos V5 clients to present a cryptographic checksum of
-initial connection information like the name of the user that the client
-is trying to access in the initial authenticator.  This checksum
-provides additionl security by preventing an attacker from changing the
-initial connection information.  To benefit from this security, only
-Kerberos V5 should be trusted; Kerberos V4 and rhosts authentication do
-not include this checksum.  If this option is specified, older Kerberos
-V5 clients that do not send a checksum in the authenticator will not be
-able to authenticate to this server.  This option is mutually exclusive
-with the \fB-i\fP option.
+initial connection information like the name of the user that the
+client is trying to access in the initial authenticator.  This
+checksum provides additionl security by preventing an attacker from
+changing the initial connection information.  If this option is
+specified, older Kerberos V5 clients that do not send a checksum in
+the authenticator will not be able to authenticate to this server.
+This option is mutually exclusive with the \fB-i\fP option.
 
 	If neither the \fB-c\fP or \fB-i\fP options are specified,then
 checksums are validated if presented.  Since it is difficult to remove
diff --git a/src/appl/bsd/krcp.c b/src/appl/bsd/krcp.c
index a24dde0..07a747b 100644
--- a/src/appl/bsd/krcp.c
+++ b/src/appl/bsd/krcp.c
@@ -68,30 +68,18 @@ char copyright[] =
 #include <k5-util.h>
 #include <com_err.h>
 
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
-
 #include "defines.h"
 
 #define RCP_BUFSIZ 4096
      
 int sock;
-struct sockaddr_in local, foreign; /* set up by kcmd used by v4_send_auth */
 char *krb_realm = NULL;
 char *krb_cache = NULL;
 char *krb_config = NULL;
 krb5_encrypt_block eblock;         /* eblock for encrypt/decrypt */
 krb5_context bsd_context;
 
-#ifdef KRB5_KRB4_COMPAT
-Key_schedule v4_schedule;
-CREDENTIALS v4_cred;
-KTEXT_ST v4_ticket;
-MSG_DAT v4_msg_data;
-#endif
-
-void	v4_send_auth(char *, char *), try_normal(char **);
+void	try_normal(char **);
 char	**save_argv(int, char **);
 #ifndef HAVE_STRSAVE
 char	*strsave();
@@ -146,7 +134,6 @@ int main(argc, argv)
     char *targ, *host, *src;
     char *suser, *tuser, *thost;
     int i;
-    unsigned int cmdsiz = 30;
     char buf[RCP_BUFSIZ], cmdbuf[30];
     char *cmd = cmdbuf;
     struct servent *sp;
@@ -206,31 +193,28 @@ int main(argc, argv)
 	    argc--, argv++;
 	    if (argc == 0) 
 	      usage();
-	    if(!(krb_realm = (char *)malloc(strlen(*argv) + 1))){
+	    if(!(krb_realm = strdup(*argv))){
 		fprintf(stderr, "rcp: Cannot malloc.\n");
 		exit(1);
 	    }
-	    strcpy(krb_realm, *argv);	
 	    goto next_arg;
 	  case 'c':		/* Change default ccache file */
 	    argc--, argv++;
 	    if (argc == 0) 
 	      usage();
-	    if(!(krb_cache = (char *)malloc(strlen(*argv) + 1))){
+	    if(!(krb_cache = strdup(*argv))){
 		fprintf(stderr, "rcp: Cannot malloc.\n");
 		exit(1);
 	    }
-	    strcpy(krb_cache, *argv);	
 	    goto next_arg;
 	  case 'C':		/* Change default config file */
 	    argc--, argv++;
 	    if (argc == 0) 
 	      usage();
-	    if(!(krb_config = (char *)malloc(strlen(*argv) + 1))){
+	    if(!(krb_config = strdup(*argv))){
 		fprintf(stderr, "rcp: Cannot malloc.\n");
 		exit(1);
 	    }
-	    strcpy(krb_config, *argv);	
 	    goto next_arg;
 	  case 'P':
 	    if (!strcmp (*argv, "O"))
@@ -302,33 +286,25 @@ int main(argc, argv)
     }
 
 #ifdef KERBEROS
-    if (krb_realm != NULL)
-	cmdsiz += strlen(krb_realm);
-    if (krb_cache != NULL)
-	cmdsiz += strlen(krb_cache);
-    if (krb_config != NULL)
-	cmdsiz += strlen(krb_config);
-
-    if ((cmd = (char *)malloc(cmdsiz)) == NULL) {
+    if (asprintf(&cmd, "%srcp %s%s%s%s%s%s%s%s%s",
+		 encryptflag ? "-x " : "",
+
+		 iamrecursive ? " -r" : "", pflag ? " -p" : "", 
+		 targetshouldbedirectory ? " -d" : "",
+		 krb_realm != NULL ? " -k " : "",
+		 krb_realm != NULL ? krb_realm : "",
+		 krb_cache != NULL ? " -c " : "",
+		 krb_cache != NULL ? krb_cache : "",
+		 krb_config != NULL ? " -C " : "",
+		 krb_config != NULL ? krb_config : "") < 0) {
 	fprintf(stderr, "rcp: Cannot malloc.\n");
 	exit(1);
     }
-    (void) sprintf(cmd, "%srcp %s%s%s%s%s%s%s%s%s",
-		   encryptflag ? "-x " : "",
-
-		   iamrecursive ? " -r" : "", pflag ? " -p" : "", 
-		   targetshouldbedirectory ? " -d" : "",
-		   krb_realm != NULL ? " -k " : "",
-		   krb_realm != NULL ? krb_realm : "",
-		   krb_cache != NULL ? " -c " : "",
-		   krb_cache != NULL ? krb_cache : "",
-		   krb_config != NULL ? " -C " : "",
-		   krb_config != NULL ? krb_config : "");
 
 #else /* !KERBEROS */
-    (void) sprintf(cmd, "rcp%s%s%s",
-		   iamrecursive ? " -r" : "", pflag ? " -p" : "", 
-		   targetshouldbedirectory ? " -d" : "");
+    (void) snprintf(cmd, sizeof(cmdbuf), "rcp%s%s%s",
+		    iamrecursive ? " -r" : "", pflag ? " -p" : "", 
+		    targetshouldbedirectory ? " -d" : "");
 #endif /* KERBEROS */
     
 #ifdef POSIX_SIGNALS
@@ -392,22 +368,22 @@ int main(argc, argv)
 		      suser = pwd->pw_name;
 		    else if (!okname(suser))
 		      continue;
-		    (void) sprintf(buf,
+		    (void) snprintf(buf, sizeof(buf),
 #if defined(hpux) || defined(__hpux)
-				   "remsh %s -l %s -n %s %s '%s%s%s:%s'",
+				    "remsh %s -l %s -n %s %s '%s%s%s:%s'",
 #else
-				   "rsh %s -l %s -n %s %s '%s%s%s:%s'",
+				    "rsh %s -l %s -n %s %s '%s%s%s:%s'",
 #endif
-				   host, suser, cmd, src,
-				   tuser ? tuser : "",
-				   tuser ? "@" : "",
+				    host, suser, cmd, src,
+				    tuser ? tuser : "",
+				    tuser ? "@" : "",
 				   thost, targ);
 	       } else
-		   (void) sprintf(buf,
+		   (void) snprintf(buf, sizeof(buf),
 #if defined(hpux) || defined(__hpux)
-				  "remsh %s -n %s %s '%s%s%s:%s'",
+				   "remsh %s -n %s %s '%s%s%s:%s'",
 #else
-				  "rsh %s -n %s %s '%s%s%s:%s'",
+				   "rsh %s -n %s %s '%s%s%s:%s'",
 #endif
 				   argv[i], cmd, src,
 				   tuser ? tuser : "",
@@ -417,8 +393,8 @@ int main(argc, argv)
 	    } else {		/* local to remote */
 		krb5_creds *cred;
 		if (rem == -1) {
-		    (void) sprintf(buf, "%s -t %s",
-				   cmd, targ);
+		    (void) snprintf(buf, sizeof(buf), "%s -t %s",
+				    cmd, targ);
 		    host = thost;
 #ifdef KERBEROS
 		    authopts = AP_OPTS_MUTUAL_REQUIRED;
@@ -434,8 +410,8 @@ int main(argc, argv)
 				  &cred,  
 				  0,  /* No seq # */
 				  0,  /* No server seq # */
-				  &local,
-				  &foreign,
+				  (struct sockaddr_in *) 0,
+				  (struct sockaddr_in *) 0,
 				  &auth_context, authopts,
 				  0, /* Not any port # */
 				  0,
@@ -444,25 +420,7 @@ int main(argc, argv)
 			if (kcmd_proto == KCMD_NEW_PROTOCOL)
 			    /* Don't fall back to less safe methods.  */
 			    exit (1);
-#ifdef KRB5_KRB4_COMPAT
-			fprintf(stderr, "Trying krb4 rcp...\n");
-			if (strncmp(buf, "-x rcp", 6) == 0)
-			    memcpy(buf, "rcp -x", 6);
-			status = k4cmd(&sock, &host, port,
-				       pwd->pw_name,
-				       tuser ? tuser : pwd->pw_name, buf,
-				       0, &v4_ticket, "rcmd", krb_realm,
-				       NULL, NULL, NULL,
-				       &local, &foreign, 0L, 0);
-			if (status)
-			    try_normal(orig_argv);
-			if (encryptflag)
-			    v4_send_auth(host, krb_realm);
-			rcmd_stream_init_krb4(v4_cred.session, encryptflag, 0,
-					      0);
-#else
 			try_normal(orig_argv);
-#endif
 		    }
 		    else {
 			krb5_boolean similar;
@@ -528,10 +486,10 @@ int main(argc, argv)
 		}
 	    }
 	    if (src == 0) {		/* local to local */
-		(void) sprintf(buf, "/bin/cp%s%s %s %s",
-			       iamrecursive ? " -r" : "",
-			       pflag ? " -p" : "",
-			       argv[i], argv[argc - 1]);
+		(void) snprintf(buf, sizeof(buf), "/bin/cp%s%s %s %s",
+				iamrecursive ? " -r" : "",
+				pflag ? " -p" : "",
+				argv[i], argv[argc - 1]);
 		(void) susystem(buf);
 	    } else {		/* remote to local */
 		krb5_creds *cred;
@@ -550,7 +508,7 @@ int main(argc, argv)
 		    host = argv[i];
 		    suser = pwd->pw_name;
 		}
-		(void) sprintf(buf, "%s -f %s", cmd, src);
+		(void) snprintf(buf, sizeof(buf), "%s -f %s", cmd, src);
 #ifdef KERBEROS
 		authopts = AP_OPTS_MUTUAL_REQUIRED;
 		status = kcmd(&sock, &host,
@@ -564,7 +522,7 @@ int main(argc, argv)
 			      0,  /* No seq # */
 			      0,  /* No server seq # */
 			      (struct sockaddr_in *) 0,
-			      &foreign,
+			      (struct sockaddr_in *) 0,
 			      &auth_context, authopts,
 			      0, /* Not any port # */
 			      0,
@@ -573,24 +531,7 @@ int main(argc, argv)
 			if (kcmd_proto == KCMD_NEW_PROTOCOL)
 			    /* Don't fall back to less safe methods.  */
 			    exit (1);
-#ifdef KRB5_KRB4_COMPAT
-			fprintf(stderr, "Trying krb4 rcp...\n");
-			if (strncmp(buf, "-x rcp", 6) == 0)
-			    memcpy(buf, "rcp -x", 6);
-			status = k4cmd(&sock, &host, port,
-				       pwd->pw_name, suser, buf,
-				       0, &v4_ticket, "rcmd", krb_realm,
-				       NULL, NULL, NULL,
-				       &local, &foreign, 0L, 0);
-			if (status)
-			    try_normal(orig_argv);
-			if (encryptflag)
-			    v4_send_auth(host, krb_realm);
-			rcmd_stream_init_krb4(v4_cred.session, encryptflag, 0,
-					      0);
-#else
 			try_normal(orig_argv);
-#endif
 		} else {
 		    krb5_keyblock *key = &cred->keyblock;
 
@@ -815,16 +756,16 @@ void source(argc, argv)
 	     * Make it compatible with possible future
 	     * versions expecting microseconds.
 	     */
-	    (void) sprintf(buf, "T%ld 0 %ld 0\n",
-			   stb.st_mtime, stb.st_atime);
+	    (void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+			    stb.st_mtime, stb.st_atime);
 	    (void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	    if (response() < 0) {
 		(void) close(f);
 		continue;
 	    }
 	}
-	(void) sprintf(buf, "C%04o %ld %s\n",
-		       (int) stb.st_mode&07777, (long ) stb.st_size, last);
+	(void) snprintf(buf, sizeof(buf), "C%04o %ld %s\n",
+			(int) stb.st_mode&07777, (long ) stb.st_size, last);
 	(void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	if (response() < 0) {
 	    (void) close(f);
@@ -884,16 +825,16 @@ void rsource(name, statp)
     else
       last++;
     if (pflag) {
-	(void) sprintf(buf, "T%ld 0 %ld 0\n",
-		       statp->st_mtime, statp->st_atime);
+	(void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+			statp->st_mtime, statp->st_atime);
 	(void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	if (response() < 0) {
 	    closedir(d);
 	    return;
 	}
     }
-    (void) sprintf(buf, "D%04lo %d %s\n", (long) statp->st_mode&07777, 0, 
-		   last);
+    (void) snprintf(buf, sizeof(buf), "D%04lo %d %s\n",
+		    (long) statp->st_mode&07777, 0, last);
     (void) rcmd_stream_write(rem, buf, strlen(buf), 0);
     if (response() < 0) {
 	closedir(d);
@@ -908,7 +849,7 @@ void rsource(name, statp)
 	    error("%s/%s: Name too long.\n", name, dp->d_name);
 	    continue;
 	}
-	(void) sprintf(buf, "%s/%s", name, dp->d_name);
+	(void) snprintf(buf, sizeof(buf), "%s/%s", name, dp->d_name);
 	bufv[0] = buf;
 	source(1, bufv);
     }
@@ -1095,8 +1036,8 @@ void sink(argc, argv)
 	if (targisdir) {
           if(strlen(targ) + strlen(cp) + 2 >= sizeof(nambuf))
 	    SCREWUP("target name too long");
-	  (void) sprintf(nambuf, "%s%s%s", targ,
-			 *targ ? "/" : "", cp);
+	  (void) snprintf(nambuf, sizeof(nambuf), "%s%s%s", targ,
+			  *targ ? "/" : "", cp);
 	} else {
 	  if (strlen(targ) + 1 >= sizeof (nambuf))
 	    SCREWUP("target name too long");
@@ -1241,7 +1182,7 @@ error(fmt, va_alist)
 
     errs++;
     *cp++ = 1;
-    (void) vsprintf(cp, fmt, ap);
+    (void) vsnprintf(cp, sizeof(buf) - (cp - buf), fmt, ap);
     va_end(ap);
 
     if (iamremote)
@@ -1418,34 +1359,4 @@ char storage[2*RCP_BUFSIZ];		/* storage for the decryption */
 int nstored = 0;
 char *store_ptr = storage;
 
-#ifdef KRB5_KRB4_COMPAT
-void
-v4_send_auth(host,realm)
-char *host;
-char *realm;
-{
-	long authopts;
-
-	if ((realm == NULL) || (realm[0] == '\0'))
-	     realm = krb_realmofhost(host);
-	/* this needs to be sent again, because the
-	   rcp process needs the key.  the rshd has
-	   grabbed the first one. */
-	authopts = KOPT_DO_MUTUAL;
-	if ((rem = krb_sendauth(authopts, sock, &v4_ticket,
-				"rcmd", host,
-				realm, (unsigned long) getpid(),
-				&v4_msg_data,
-				&v4_cred, v4_schedule,
-				&local,
-				&foreign,
-				"KCMDV0.1")) != KSUCCESS) {
-		fprintf(stderr,
-			"krb_sendauth mutual fail: %s\n",
-			krb_get_err_text(rem));
-		exit(1);
-	}
-}
-#endif /* KRB5_KRB4_COMPAT */
-
 #endif /* KERBEROS */
diff --git a/src/appl/bsd/krlogin.c b/src/appl/bsd/krlogin.c
index 0a0f591..98b61ac 100644
--- a/src/appl/bsd/krlogin.c
+++ b/src/appl/bsd/krlogin.c
@@ -157,9 +157,6 @@ char copyright[] =
 #ifdef KERBEROS
 #include <krb5.h>
 #include <com_err.h>
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
 #include "defines.h"
      
 #define RLOGIN_BUFSIZ 5120
@@ -173,11 +170,6 @@ struct sockaddr_in local, foreign;
 krb5_context bsd_context;
 krb5_auth_context auth_context;
 
-#ifdef KRB5_KRB4_COMPAT
-Key_schedule v4_schedule;
-CREDENTIALS v4_cred;
-#endif
-
 #ifndef UCB_RLOGIN
 #define UCB_RLOGIN      "/usr/ucb/rlogin"
 #endif
@@ -381,11 +373,6 @@ main(argc, argv)
     int sock;
     krb5_flags authopts;
     krb5_error_code status;
-#ifdef KRB5_KRB4_COMPAT
-    KTEXT_ST v4_ticket;
-    MSG_DAT v4_msg_data;
-    int v4only = 0;
-#endif
 #endif
     int port, debug_port = 0;
     enum kcmd_proto kcmd_proto = KCMD_PROTOCOL_COMPAT_HACK;
@@ -483,11 +470,10 @@ main(argc, argv)
 		    "rlogin: -k flag must be followed with a realm name.\n");
 	    exit (1);
 	}
-	if(!(krb_realm = (char *)malloc(strlen(*argv) + 1))){
+	if(!(krb_realm = strdup(*argv))){
 	    fprintf(stderr, "rlogin: Cannot malloc.\n");
 	    exit(1);
 	}
-	strcpy(krb_realm, *argv);
 	argv++, argc--;
 	goto another;
     }
@@ -524,25 +510,11 @@ main(argc, argv)
 	argv++, argc--;
 	goto another;
     }
-#ifdef KRB5_KRB4_COMPAT
-    if (argc > 0 && !strcmp(*argv, "-4")) {
-	v4only++;
-	argv++, argc--;
-	goto another;
-    }
-#endif /* krb4 */
 #endif /* KERBEROS */
     if (host == 0)
       goto usage;
     if (argc > 0)
       goto usage;
-#ifdef KRB5_KRB4_COMPAT
-    if (kcmd_proto != KCMD_PROTOCOL_COMPAT_HACK && v4only) {
-	com_err (argv[0], 0,
-		 "-4 is incompatible with -PO/-PN");
-	exit(1);
-    }
-#endif
     pwd = getpwuid(getuid());
     if (pwd == 0) {
 	fprintf(stderr, "Who are you?\n");
@@ -600,7 +572,8 @@ main(argc, argv)
 		if (ospeed >= 50)
 			/* On some systems, ospeed is the baud rate itself,
 			   not a table index.  */
-			sprintf (term + strlen (term), "%d", ospeed);
+			snprintf (term + strlen (term),
+				  sizeof(term) - strlen(term), "%d", ospeed);
 		else if (ospeed >= sizeof(speeds)/sizeof(char*))
 			/* Past end of table, but not high enough to
 			   look like a real speed.  */
@@ -661,10 +634,6 @@ main(argc, argv)
     if (Fflag)
       authopts |= OPTS_FORWARDABLE_CREDS;
 
-#ifdef KRB5_KRB4_COMPAT
-    if (v4only)
-	goto try_v4;
-#endif
     status = kcmd(&sock, &host, port,
 		  null_local_username ? "" : pwd->pw_name,
 		  name ? name : pwd->pw_name, term,
@@ -681,21 +650,7 @@ main(argc, argv)
 	if (kcmd_proto == KCMD_NEW_PROTOCOL && encrypt_flag)
 	    /* Don't fall back to something less secure.  */
 	    exit (1);
-#ifdef KRB5_KRB4_COMPAT
-	fprintf(stderr, "Trying krb4 rlogin...\n");
-    try_v4:
-	status = k4cmd(&sock, &host, port,
-		       null_local_username ? "" : pwd->pw_name,
-		       name ? name : pwd->pw_name, term,
-		       0, &v4_ticket, "rcmd", krb_realm,
-		       &v4_cred, v4_schedule, &v4_msg_data, &local, &foreign,
-		       (encrypt_flag) ? KOPT_DO_MUTUAL : 0L, 0);
-	if (status)
-	    try_normal(orig_argv);
-	rcmd_stream_init_krb4(v4_cred.session, encrypt_flag, 1, 1);
-#else
 	try_normal(orig_argv);
-#endif
     } else {
 	krb5_keyblock *key = 0;
 
@@ -739,11 +694,7 @@ main(argc, argv)
 #ifdef KERBEROS
     fprintf (stderr,
 	     "usage: rlogin host [-option] [-option...] [-k realm ] [-t ttytype] [-l username]\n");
-#ifdef KRB5_KRB4_COMPAT
-    fprintf (stderr, "     where option is e, 7, 8, noflow, n, a, x, f, F, c, 4, PO, or PN\n");
-#else
     fprintf (stderr, "     where option is e, 7, 8, noflow, n, a, x, f, F, c, PO, or PN\n");
-#endif
 #else /* !KERBEROS */
     fprintf (stderr,
 	     "usage: rlogin host [-option] [-option...] [-t ttytype] [-l username]\n");
@@ -762,7 +713,7 @@ static int confirm_death ()
     if (!confirm) return (1);	/* no confirm, just die */
     
     if (gethostname (hostname, sizeof(hostname)-1) != 0)
-      strcpy (hostname, "???");
+      strlcpy (hostname, "???", sizeof(hostname));
     else
       hostname[sizeof(hostname)-1] = '\0';
     
diff --git a/src/appl/bsd/krlogind.c b/src/appl/bsd/krlogind.c
index cd362a4..01b4ef2 100644
--- a/src/appl/bsd/krlogind.c
+++ b/src/appl/bsd/krlogind.c
@@ -75,9 +75,7 @@ char copyright[] =
  * The configuration is done either by command-line arguments passed by 
  * inetd, or by the name of the daemon. If command-line arguments are
  * present, they  take priority. The options are:
- * -k means trust krb4 or krb5
-* -5 means trust krb5
-* -4 means trust krb4
+ * -k means trust krb5
  * -p and -P means prompt for password.
  *    If the -P option is passed, then the password is verified in 
  * addition to all other checks. If -p is not passed with -k or -r,
@@ -97,9 +95,6 @@ char copyright[] =
  *   CRYPT    - Define this if encryption is to be an option.
  *   DO_NOT_USE_K_LOGIN - Define this if you want to use /bin/login
  *              instead  of the accompanying login.krb5. 
- *   KRB5_KRB4_COMPAT - Define this if v4 rlogin clients are also to be served.
- *   ALWAYS_V5_KUSEROK - Define this if you want .k5login to be
- *              checked even for v4 clients (instead of .klogin).
  *   LOG_ALL_LOGINS - Define this if you want to log all logins.
  *   LOG_OTHER_USERS - Define this if you want to log all principals
  *              that do not map onto the local user.
@@ -234,28 +229,15 @@ struct winsize {
 #ifdef KERBEROS
      
 #include "k5-int.h"
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
 #include <libpty.h>
 #ifdef HAVE_UTMP_H
 #include <utmp.h>
 #include <k5-util.h>
 #endif
 
-int auth_sys = 0;	/* Which version of Kerberos used to authenticate */
-
-#define KRB5_RECVAUTH_V4	4
-#define KRB5_RECVAUTH_V5	5
-
 int non_privileged = 0; /* set when connection is seen to be from */
 			/* a non-privileged port */
 
-#ifdef KRB5_KRB4_COMPAT
-AUTH_DAT	*v4_kdata;
-Key_schedule v4_schedule;
-#endif
-
 #include "com_err.h"
 #include "defines.h"
      
@@ -268,7 +250,7 @@ krb5_ccache ccache = NULL;
 
 krb5_keytab keytab = NULL;
 
-#define ARGSTR	"k54ciepPD:S:M:L:fw:?"
+#define ARGSTR	"k5ciepPD:S:M:L:fw:?"
 #else /* !KERBEROS */
 #define ARGSTR	"rpPD:f?"
 #endif /* KERBEROS */
@@ -334,18 +316,7 @@ int	princ_maps_to_lname(krb5_principal, char *), default_realm(krb5_principal);
 krb5_sigtype	cleanup(int);
 krb5_error_code recvauth(int *);
 
-/* There are two authentication related masks:
-   * auth_ok and auth_sent.
-* The auth_ok mask is the oring of authentication systems any one
-* of which can be used.  
-* The auth_sent mask is the oring of one or more authentication/authorization
-* systems that succeeded.  If the anding
-* of these two masks is true, then authorization is successful.
-*/
-#define AUTH_KRB4 (0x1)
-#define AUTH_KRB5 (0x2)
-int auth_ok = 0, auth_sent = 0;
-int do_encrypt = 0, passwd_if_fail = 0, passwd_req = 0;
+int do_encrypt = 0, passwd_req = 0;
 int checksum_required = 0, checksum_ignored = 0;
 
 int stripdomain = 1;
@@ -397,15 +368,9 @@ int main(argc, argv)
       switch (ch) {
 #ifdef KERBEROS
 	case 'k':
-#ifdef KRB5_KRB4_COMPAT
-	auth_ok |= (AUTH_KRB5|AUTH_KRB4);
-#else
-	auth_ok |= AUTH_KRB5;
-#endif /* KRB5_KRB4_COMPAT*/
 	break;
 	
       case '5':
-	  auth_ok |= AUTH_KRB5;
 	break;
       case 'c':
 	checksum_required = 1;
@@ -414,11 +379,6 @@ int main(argc, argv)
 	checksum_ignored = 1;
 	break;
 	
-#ifdef KRB5_KRB4_COMPAT
-      case '4':
-	auth_ok |= AUTH_KRB4;
-	break;
-#endif
 #ifdef CRYPT
 	case 'x':         /* Use encryption. */
 	case 'X':
@@ -439,7 +399,6 @@ int main(argc, argv)
 	  break;
 #endif
 	case 'p':
-	  passwd_if_fail = 1; /* Passwd reqd if any check fails */
 	  break;
 	case 'P':         /* passwd is a must */
 	  passwd_req = 1;
@@ -618,10 +577,6 @@ void doit(f, fromp)
     if (setsockopt(f, SOL_SOCKET, SO_KEEPALIVE,
 		   (const char *) &on, sizeof (on)) < 0)
 	syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
-    if (auth_ok == 0) {
-	syslog(LOG_CRIT, "No authentication systems were enabled; all connections will be refused.");
-	fatal(f, "All authentication systems disabled; connection refused.");
-    }
 
     if (checksum_required&&checksum_ignored) {
 	syslog( LOG_CRIT, "Checksums are required and ignored; these options are mutually exclusive--check the documentation.");
@@ -858,7 +813,7 @@ void doit(f, fromp)
 	/*
 	 * Problems read failed ...
 	 */
-	sprintf(buferror, "Cannot read slave pty %s ",line);
+	snprintf(buferror, sizeof(buferror), "Cannot read slave pty %s ",line);
 	fatalperror(p,buferror);
     }
     close(syncpipe[0]);
@@ -867,7 +822,8 @@ void doit(f, fromp)
 #if defined(KERBEROS) 
     if (do_encrypt) {
 	if (rcmd_stream_write(f, SECURE_MESSAGE, sizeof(SECURE_MESSAGE), 0) < 0){
-	    sprintf(buferror, "Cannot encrypt-write network.");
+	    snprintf(buferror, sizeof(buferror),
+		     "Cannot encrypt-write network.");
 	    fatal(p,buferror);
 	}
     }
@@ -900,7 +856,8 @@ void doit(f, fromp)
 	/*
 	 * Problems write failed ...
 	 */
-	sprintf(buferror,"Cannot write slave pty %s ",line);
+	snprintf(buferror, sizeof(buferror), "Cannot write slave pty %s ",
+		 line);
 	fatalperror(f,buferror);
     }
 
@@ -1179,7 +1136,7 @@ void fatal(f, msg)
 #endif
     
     buf[0] = '\01';		/* error indicator */
-    (void) sprintf(buf + 1, "%s: %s.\r\n",progname, msg);
+    (void) snprintf(buf + 1, sizeof(buf) - 1, "%s: %s.\r\n", progname, msg);
     if ((f == netf) && (pid > 0))
       (void) rcmd_stream_write(f, buf, strlen(buf), 0);
     else
@@ -1213,7 +1170,7 @@ void fatalperror(f, msg)
 {
     char buf[512];
     
-    (void) sprintf(buf, "%s: %s", msg, error_message(errno));
+    (void) snprintf(buf, sizeof(buf), "%s: %s", msg, error_message(errno));
     fatal(f, buf);
 }
 
@@ -1231,8 +1188,7 @@ do_krb_login(host_addr, hostname)
 	exit(1);
     }
 
-    /* Check authentication. This can be either Kerberos V5, */
-    /* Kerberos V4, or host-based. */
+    /* Check authentication. */
     if ((status = recvauth(&valid_checksum))) {
 	if (ticket)
 	  krb5_free_ticket(bsd_context, ticket);
@@ -1247,60 +1203,22 @@ do_krb_login(host_addr, hostname)
     /* OK we have authenticated this user - now check authorization. */
     /* The Kerberos authenticated programs must use krb5_kuserok or kuserok*/
     
-#ifndef KRB5_KRB4_COMPAT
-    if (auth_sys == KRB5_RECVAUTH_V4) {
-	  fatal(netf, "This server does not support Kerberos V4");
-  }
-#endif
-    
-
-#if (defined(ALWAYS_V5_KUSEROK) || !defined(KRB5_KRB4_COMPAT))
-	/* krb5_kuserok returns 1 if OK */
-	if (client && krb5_kuserok(bsd_context, client, lusername))
-	  auth_sent |= ((auth_sys == KRB5_RECVAUTH_V4)?AUTH_KRB4:AUTH_KRB5);
-#else
-	if (auth_sys == KRB5_RECVAUTH_V4) {
-	    /* kuserok returns 0 if OK */
-	    if (!kuserok(v4_kdata, lusername))
-	      auth_sent |= AUTH_KRB4;
-	} else {
-	    /* krb5_kuserok returns 1 if OK */
-	    if (client && krb5_kuserok(bsd_context, client, lusername))
-	      auth_sent |= AUTH_KRB5;
-	}
-#endif
-
-    
+    /* krb5_kuserok returns 1 if OK */
+    if (!client || !krb5_kuserok(bsd_context, client, lusername)) {
+	if (asprintf(&msg_fail,
+		      "User %s is not authorized to login to account %s",
+		      krusername, lusername) >= 0)
+	    fatal(netf, msg_fail);
+	else
+	    fatal(netf,
+		  "User is not authorized to login to specified account");
+    }
 
     if (checksum_required && !valid_checksum) {
-	if (auth_sent & AUTH_KRB5) {
-	    syslog(LOG_WARNING, "Client did not supply required checksum--connection rejected.");
+	syslog(LOG_WARNING, "Client did not supply required checksum--connection rejected.");
 	
-	    fatal(netf, "You are using an old Kerberos5 without initial connection support; only newer clients are authorized.");
-	} else {
-	  syslog(LOG_WARNING,
-		 "Configuration error: Requiring checksums with -c is inconsistent with allowing Kerberos V4 connections.");
-	}
+	fatal(netf, "You are using an old Kerberos5 without initial connection support; only newer clients are authorized.");
     }
-    if (auth_ok&auth_sent) /* This should be bitwise.*/
-	return;
-    
-    if (ticket)
-	krb5_free_ticket(bsd_context, ticket);
-
-    if (krusername)
-	msg_fail = (char *)malloc(strlen(krusername) + strlen(lusername) + 80);
-    if (!msg_fail)
-	fatal(netf, "User is not authorized to login to specified account");
-
-    if (auth_sent)
-	sprintf(msg_fail, "Access denied because of improper credentials");
-    else
-	sprintf(msg_fail, "User %s is not authorized to login to account %s",
-		krusername, lusername);
-    
-    fatal(netf, msg_fail);
-    /* NOTREACHED */
 }
 
 #endif /* KERBEROS */
@@ -1334,10 +1252,10 @@ void usage()
 {
 #ifdef KERBEROS
     syslog(LOG_ERR, 
-	   "usage: klogind [-ke45pPf] [-D port] [-w[ip|maxhostlen[,[no]striplocal]]] or [r/R][k/K][x/e][p/P]logind");
+	   "usage: klogind [-ePf] [-D port] [-w[ip|maxhostlen[,[no]striplocal]]] or [r/R][k/K][x/e][p/P]logind");
 #else
     syslog(LOG_ERR, 
-	   "usage: rlogind [-rpPf] [-D port] or [r/R][p/P]logind");
+	   "usage: rlogind [-rPf] [-D port] or [r/R][p/P]logind");
 #endif
 }
 
@@ -1361,9 +1279,6 @@ recvauth(valid_checksum)
     struct sockaddr_storage peersin, laddr;
     socklen_t len;
     krb5_data inbuf;
-#ifdef KRB5_KRB4_COMPAT
-    char v4_instance[INST_SZ];	/* V4 Instance */
-#endif
     krb5_data version;
     krb5_authenticator *authenticator;
     krb5_rcache rcache;
@@ -1382,10 +1297,6 @@ recvauth(valid_checksum)
 	exit(1);
     }
 
-#ifdef KRB5_KRB4_COMPAT
-    strcpy(v4_instance, "*");
-#endif
-
     if ((status = krb5_auth_con_init(bsd_context, &auth_context)))
         return status;
  
@@ -1414,38 +1325,15 @@ recvauth(valid_checksum)
 	if (status) return status;
     }
 
-#ifdef KRB5_KRB4_COMPAT
-    status = krb5_compat_recvauth_version(bsd_context, &auth_context,
-					       &netf,
-				  NULL, 	/* Specify daemon principal */
-				  0, 		/* no flags */
-				  keytab, /* normally NULL to use v5srvtab */
-
-				  do_encrypt ? KOPT_DO_MUTUAL : 0, /*v4_opts*/
-				  "rcmd", 	/* v4_service */
-				  v4_instance, 	/* v4_instance */
-				  ss2sin(&peersin), /* foriegn address */
-				  ss2sin(&laddr), /* our local address */
-				  "", 		/* use default srvtab */
-
-				  &ticket, 	/* return ticket */
-				  &auth_sys, 	/* which authentication system*/
-				  &v4_kdata, v4_schedule,
-					       &version);
-#else
-    auth_sys = KRB5_RECVAUTH_V5;
     status = krb5_recvauth_version(bsd_context, &auth_context, &netf,
 				   NULL, 0, keytab, &ticket, &version);
-#endif
     if (status) {
-	if (auth_sys == KRB5_RECVAUTH_V5) {
-	    /*
-	     * clean up before exiting
-	     */
-	    getstr(netf, lusername, sizeof (lusername), "locuser");
-	    getstr(netf, term, sizeof(term), "Terminal type");
-	    getstr(netf, rusername, sizeof(rusername), "remuser");
-	}
+	/*
+	 * clean up before exiting
+	 */
+	getstr(netf, lusername, sizeof (lusername), "locuser");
+	getstr(netf, term, sizeof(term), "Terminal type");
+	getstr(netf, rusername, sizeof(rusername), "remuser");
 	return status;
     }
 
@@ -1453,41 +1341,29 @@ recvauth(valid_checksum)
     getstr(netf, term, sizeof(term), "Terminal type");
 
     kcmd_proto = KCMD_UNKNOWN_PROTOCOL;
-    if (auth_sys == KRB5_RECVAUTH_V5) {
-	if (version.length != 9) {
-	    fatal (netf, "bad application version length");
-	}
-	if (!memcmp (version.data, "KCMDV0.1", 9))
-	    kcmd_proto = KCMD_OLD_PROTOCOL;
-	else if (!memcmp (version.data, "KCMDV0.2", 9))
-	    kcmd_proto = KCMD_NEW_PROTOCOL;
+    if (version.length != 9) {
+	fatal (netf, "bad application version length");
     }
-#ifdef KRB5_KRB4_COMPAT
-    if (auth_sys == KRB5_RECVAUTH_V4)
-	kcmd_proto = KCMD_V4_PROTOCOL;
-#endif
+    if (!memcmp (version.data, "KCMDV0.1", 9))
+	kcmd_proto = KCMD_OLD_PROTOCOL;
+    else if (!memcmp (version.data, "KCMDV0.2", 9))
+	kcmd_proto = KCMD_NEW_PROTOCOL;
+
+    if (!(checksum_ignored && kcmd_proto == KCMD_OLD_PROTOCOL)) {
 
-    if ((auth_sys == KRB5_RECVAUTH_V5)
-	&& !(checksum_ignored
-	     && kcmd_proto == KCMD_OLD_PROTOCOL)) {
-      
       if ((status = krb5_auth_con_getauthenticator(bsd_context, auth_context,
 						   &authenticator)))
 	return status;
-    
+
       if (authenticator->checksum) {
 	struct sockaddr_in adr;
 	socklen_t adr_length = sizeof(adr);
-	char * chksumbuf = (char *) malloc(strlen(term)+strlen(lusername)+32);
+	char * chksumbuf = NULL;
 	if (getsockname(netf, (struct sockaddr *) &adr, &adr_length) != 0)
 	    goto error_cleanup;
-	if (chksumbuf == 0)
+	if (asprintf(&chksumbuf, "%u:%s%s", ntohs(adr.sin_port), term, lusername) < 0)
 	    goto error_cleanup;
 
-	sprintf(chksumbuf,"%u:", ntohs(adr.sin_port));
-	strcat(chksumbuf,term);
-	strcat(chksumbuf,lusername);
-
 	status = krb5_verify_checksum(bsd_context,
 				      authenticator->checksum->checksum_type,
 				      authenticator->checksum,
@@ -1506,32 +1382,6 @@ recvauth(valid_checksum)
       krb5_free_authenticator(bsd_context, authenticator);
     }
 
-
-#ifdef KRB5_KRB4_COMPAT
-    if (auth_sys == KRB5_RECVAUTH_V4) {
-
-	rcmd_stream_init_krb4(v4_kdata->session, do_encrypt, 1, 1);
-
-	/* We do not really know the remote user's login name.
-         * Assume it to be the same as the first component of the
-	 * principal's name. 
-         */
-	strncpy(rusername, v4_kdata->pname, sizeof(rusername) - 1);
-	rusername[sizeof(rusername) - 1] = '\0';
-
-	status = krb5_425_conv_principal(bsd_context, v4_kdata->pname,
-					 v4_kdata->pinst, v4_kdata->prealm,
-					 &client);
-	if (status) return status;
-
-	status = krb5_unparse_name(bsd_context, client, &krusername);
-	
-	return status;
-    }
-#endif
-
-    /* Must be V5  */
-	
     if ((status = krb5_copy_principal(bsd_context, ticket->enc_part2->client, 
 				      &client)))
 	return status;
diff --git a/src/appl/bsd/krsh.c b/src/appl/bsd/krsh.c
index 155223f..1999bb5 100644
--- a/src/appl/bsd/krsh.c
+++ b/src/appl/bsd/krsh.c
@@ -64,17 +64,9 @@ char copyright[] =
 #ifdef KERBEROS
 #include <krb5.h>
 #include <com_err.h>
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-#endif
 #include "defines.h"
 #endif /* KERBEROS */
 
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-Key_schedule v4_schedule;
-#endif
-
 /*
  * rsh - remote shell
  */
@@ -96,11 +88,6 @@ krb5_sigtype  sendsig(int);
 krb5_context bsd_context;
 krb5_creds *cred;
 
-#ifdef KRB5_KRB4_COMPAT
-Key_schedule v4_schedule;
-CREDENTIALS v4_cred;
-#endif
-
 int	encrypt_flag = 0;
 char	*krb_realm = (char *)0;
 void	try_normal(char **);
@@ -128,7 +115,7 @@ main(argc, argv0)
      char **argv0;
 {
     int rem, pid = 0;
-    char *host=0, *cp, **ap, buf[RCMD_BUFSIZ], *args, **argv = argv0, *user = 0;
+    char *host=0, **ap, buf[RCMD_BUFSIZ], *args, **argv = argv0, *user = 0;
     register int cc;
     struct passwd *pwd;
     fd_set readfrom, ready;
@@ -149,10 +136,6 @@ main(argc, argv0)
     krb5_error_code status;
     krb5_auth_context auth_context;
     int fflag = 0, Fflag = 0;
-#ifdef KRB5_KRB4_COMPAT
-    KTEXT_ST v4_ticket;
-    MSG_DAT v4_msg_data;
-#endif
 #endif  /* KERBEROS */
     int debug_port = 0;
     enum kcmd_proto kcmd_proto = KCMD_PROTOCOL_COMPAT_HACK;
@@ -202,11 +185,10 @@ main(argc, argv0)
 	    fprintf(stderr, "rsh(kerberos): -k flag must have a realm after it.\n");
 	    exit (1);
 	}
-	if(!(krb_realm = (char *)malloc(strlen(*argv) + 1))){
+	if(!(krb_realm = strdup(*argv))){
 	    fprintf(stderr, "rsh(kerberos): Cannot malloc.\n");
 	    exit(1);
 	}
-	strcpy(krb_realm, *argv);
 	argv++, argc--;
 	goto another;
     }
@@ -321,17 +303,14 @@ main(argc, argv0)
       cc += strlen(*ap) + 1;
     if (encrypt_flag)
       cc += 3;
-    cp = args = (char *) malloc((unsigned) cc);
-    if (encrypt_flag) {
-      strcpy(args, "-x ");
-      cp += 3;
-    }
+    args = (char *) malloc((unsigned) cc);
+    *args = '\0';
+    if (encrypt_flag)
+      strlcpy(args, "-x ", cc);
     for (ap = argv; *ap; ap++) {
-	(void) strcpy(cp, *ap);
-	while (*cp)
-	  cp++;
+      (void) strlcat(args, *ap, cc);
 	if (ap[1])
-	  *cp++ = ' ';
+	  strlcat(args, " ", cc);
     }
 
     if(debug_port == 0) {
@@ -387,26 +366,7 @@ main(argc, argv0)
 	   ones.  */
 	if (kcmd_proto == KCMD_NEW_PROTOCOL)
 	    exit (1);
-#ifdef KRB5_KRB4_COMPAT
-	/* No encrypted Kerberos 4 rsh. */
-	if (encrypt_flag)
-	    exit(1);
-#ifdef HAVE_ISATTY
-	if (isatty(fileno(stderr)))
-	    fprintf(stderr, "Trying krb4 rsh...\n");
-#endif
-	status = k4cmd(&rem, &host, debug_port,
-		       pwd->pw_name,
-		       user ? user : pwd->pw_name, args,
-		       &rfd2, &v4_ticket, "rcmd", krb_realm,
-		       &v4_cred, v4_schedule, &v4_msg_data,
-		       &local, &foreign, 0L, 0);
-	if (status)
-	    try_normal(argv0);
-	rcmd_stream_init_krb4(v4_cred.session, encrypt_flag, 0, 1);
-#else
 	try_normal(argv0);
-#endif
     } else {
 	krb5_keyblock *key = &cred->keyblock;
 
diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 5a9baa3..aa3f2ed 100644
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -39,25 +39,14 @@ char copyright[] =
  * This is the rshell daemon. The very basic protocol for checking 
  * authentication and authorization is:
  * 1) Check authentication.
- * 2) Check authorization via the access-control files: 
- *    ~/.k5login (using krb5_kuserok) and/or
+ * 2) Check authorization via the access-control files:
+ *    ~/.k5login (using krb5_kuserok)
  * Execute command if configured authoriztion checks pass, else deny 
  * permission.
- *
- * The configuration is done either by command-line arguments passed by inetd, 
- * or by the name of the daemon. If command-line arguments are present, they 
- * take priority. The options are:
- * -k means trust krb4 or krb5
- * -5 means trust krb5
- * -4 means trust krb4 (using .klogin)
- * 
  */
      
 /* DEFINES:
  *   KERBEROS - Define this if application is to be kerberised.
- *   KRB5_KRB4_COMPAT - Define this if v4 rlogin clients are also to be served.
- *   ALWAYS_V5_KUSEROK - Define this if you want .k5login to be
- *              checked even for v4 clients (instead of .klogin).
  *   LOG_ALL_LOGINS - Define this if you want to log all logins.
  *   LOG_OTHER_USERS - Define this if you want to log all principals that do
  *              not map onto the local user.
@@ -87,10 +76,7 @@ char copyright[] =
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/param.h>
-#if !defined(KERBEROS) || !defined(KRB5_KRB4_COMPAT)
-/* Ultrix doesn't protect it vs multiple inclusion, and krb.h includes it */
 #include <sys/socket.h>
-#endif
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/time.h>
@@ -122,10 +108,7 @@ char copyright[] =
 #include <stdarg.h>
 
 #include <signal.h>
-#if !defined(KERBEROS) || !defined(KRB5_KRB4_COMPAT)
-/* Ultrix doesn't protect it vs multiple inclusion, and krb.h includes it */
 #include <netdb.h>
-#endif
 
 #ifdef CRAY
 #ifndef NO_UDB
@@ -159,11 +142,8 @@ char copyright[] =
 #include "k5-int.h"
 #include <com_err.h>
 #include "loginpaths.h"
-#ifdef KRB5_KRB4_COMPAT
-#include <kerberosIV/krb.h>
-Key_schedule v4_schedule;
-#endif
 #include <k5-util.h>
+#include <k5-platform.h>
 
 #ifdef HAVE_PATHS_H
 #include <paths.h>
@@ -185,7 +165,7 @@ Key_schedule v4_schedule;
 #define MAXDNAME 256 /*per the rfc*/
 #endif
 
-#define ARGSTR	"ek54ciD:S:M:AP:?L:w:"
+#define ARGSTR	"ek5ciD:S:M:AP:?L:w:"
 
 
 
@@ -217,22 +197,13 @@ static krb5_error_code recvauth(int netfd, struct sockaddr *peersin,
      
 #endif /* KERBEROS */
 
+static int accept_a_connection (int debug_port, struct sockaddr *from,
+				socklen_t *fromlenp);
      
 #ifndef HAVE_KILLPG
 #define killpg(pid, sig) kill(-(pid), (sig))
 #endif
 
-/* There are two authentication related masks:
-   * auth_ok and auth_sent.
-* The auth_ok mask is the oring of authentication systems any one
-* of which can be used.  
-* The auth_sent mask is the oring of one or more authentication/authorization
-* systems that succeeded.  If the anding
-* of these two masks is true, then authorization is successful.
-*/
-#define AUTH_KRB4 (0x1)
-#define AUTH_KRB5 (0x2)
-int auth_ok = 0, auth_sent = 0;
 int checksum_required = 0, checksum_ignored = 0;
 char *progname;
 
@@ -320,15 +291,9 @@ int main(argc, argv)
       switch (ch) {
 #ifdef KERBEROS
 	case 'k':
-#ifdef KRB5_KRB4_COMPAT
-	auth_ok |= (AUTH_KRB5|AUTH_KRB4);
-#else
-	auth_ok |= AUTH_KRB5;
-#endif /* KRB5_KRB4_COMPAT*/
 	break;
 	
       case '5':
-	  auth_ok |= AUTH_KRB5;
 	break;
       case 'c':
 	checksum_required = 1;
@@ -337,12 +302,6 @@ int main(argc, argv)
 	checksum_ignored = 1;
 	break;
 	
-#ifdef KRB5_KRB4_COMPAT
-      case '4':
-	auth_ok |= AUTH_KRB4;
-	break;
-#endif
-	  
         case 'e':
 	require_encrypt = 1;
 	  break;
@@ -537,16 +496,6 @@ char *kremuser;
 krb5_principal client;
 krb5_authenticator *kdata;
 
-#ifdef KRB5_KRB4_COMPAT
-AUTH_DAT	*v4_kdata;
-KTEXT		v4_ticket;
-#endif
-
-int auth_sys = 0;	/* Which version of Kerberos used to authenticate */
-
-#define KRB5_RECVAUTH_V4	4
-#define KRB5_RECVAUTH_V5	5
-
 static void
 ignore_signals()
 {
@@ -940,7 +889,7 @@ void doit(f, fromp)
        privileges. */
     if (port) {
 	/* Place entry into wtmp */
-	sprintf(ttyn,"krsh%ld",(long) (getpid() % 9999999));
+	snprintf(ttyn,sizeof(ttyn),"krsh%ld",(long) (getpid() % 9999999));
 	pty_logwtmp(ttyn,locuser,sane_host);
     }
     /*      We are simply execing a program over rshd : log entry into wtmp,
@@ -1090,31 +1039,14 @@ void doit(f, fromp)
     }
 
 #ifdef KERBEROS
-
-#if defined(KRB5_KRB4_COMPAT) && !defined(ALWAYS_V5_KUSEROK)
-	if (auth_sys == KRB5_RECVAUTH_V4) {
-	    /* kuserok returns 0 if OK */
-	    if (kuserok(v4_kdata, locuser)){
-		syslog(LOG_ERR ,
-		       "Principal %s (%s@%s (%s)) for local user %s failed kuserok.\n",
-		       kremuser, remuser, hostaddra, hostname, locuser);
-		}
-	    else auth_sent |= AUTH_KRB4;
-	} else
-#endif
-	{
-	    /* krb5_kuserok returns 1 if OK */
-	    if (!krb5_kuserok(bsd_context, client, locuser)){
-		syslog(LOG_ERR ,
-		       "Principal %s (%s@%s (%s)) for local user %s failed krb5_kuserok.\n",
-		       kremuser, remuser, hostaddra, hostname, locuser);
-	    }
-	    else
-		auth_sent |=
-		    ((auth_sys == KRB5_RECVAUTH_V4) ? AUTH_KRB4 : AUTH_KRB5);
-	}
-
-	
+    /* krb5_kuserok returns 1 if OK */
+    if (!krb5_kuserok(bsd_context, client, locuser)){
+	syslog(LOG_ERR ,
+	       "Principal %s (%s@%s (%s)) for local user %s failed krb5_kuserok.\n",
+	       kremuser, remuser, hostaddra, hostname, locuser);
+	error("Permission denied.\n");
+	goto signout_please;
+    }
 #else
     if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' &&
 	ruserok(hostname[0] ? hostname : hostaddra,
@@ -1126,26 +1058,14 @@ void doit(f, fromp)
 
 
     if (checksum_required && !valid_checksum) {
-	if (auth_sent & AUTH_KRB5) {
-	    syslog(LOG_WARNING, "Client did not supply required checksum--connection rejected.");
-	    error( "You are using an old Kerberos5 client without checksum support; only newer clients are authorized.\n");
-	    goto signout_please;
-	} else {
-	    syslog(LOG_WARNING,
-   "Configuration error: Requiring checksums with -c is inconsistent with allowing Kerberos V4 connections.");
-	}
+	syslog(LOG_WARNING, "Client did not supply required checksum--connection rejected.");
+	error( "You are using an old Kerberos5 client without checksum support; only newer clients are authorized.\n");
+	goto signout_please;
     }
     if (require_encrypt&&(!do_encrypt)) {
 	error("You must use encryption.\n");
 	goto signout_please;
     }
-    if (!(auth_ok&auth_sent)) {
-	if (auth_sent)
-	    error("Another authentication mechanism must be used to access this host.\n");
-	else
-	    error("Permission denied.\n");
-	goto signout_please;
-    }
     
     if (pwd->pw_uid && !access(NOLOGIN, F_OK)) {
 	error("Logins currently disabled.\n");
@@ -1422,12 +1342,10 @@ void doit(f, fromp)
     strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
     strncat(shell, pwd->pw_shell, sizeof(shell)-7);
     strncat(username, pwd->pw_name, sizeof(username)-6);
-    path = (char *) malloc(strlen(kprogdir) + strlen(path_rest) + 7);
-    if (path == NULL) {
+    if (asprintf(&path, "PATH=%s:%s", kprogdir, path_rest) < 0) {
         perror("malloc");
 	_exit(1);
     }
-    sprintf(path, "PATH=%s:%s", kprogdir, path_rest);
     envinit[PATHENV] = path;
 
     /* If we have KRB5CCNAME set, then copy into the
@@ -1436,10 +1354,8 @@ void doit(f, fromp)
      */
     if (getenv("KRB5CCNAME")) {
 	int i;
-	char *buf2 = (char *)malloc(strlen(getenv("KRB5CCNAME"))
-			 		   +strlen("KRB5CCNAME=")+1);
-	if (buf2) {
-	  sprintf(buf2, "KRB5CCNAME=%s",getenv("KRB5CCNAME"));
+	char *buf2;
+	if (asprintf(&buf2, "KRB5CCNAME=%s",getenv("KRB5CCNAME")) >= 0) {
 
 	  for (i = 0; envinit[i]; i++);
 	  envinit[i] = buf2;
@@ -1459,10 +1375,10 @@ void doit(f, fromp)
 			  NI_NUMERICHOST | NI_NUMERICSERV);
       if (aierr)
 	  goto skip_localaddr_env;
-      sprintf(local_addr,  "KRB5LOCALADDR=%s", hbuf);
+      snprintf(local_addr, sizeof(local_addr), "KRB5LOCALADDR=%s", hbuf);
       envinit[i++] =local_addr;
 
-      sprintf(local_port,  "KRB5LOCALPORT=%s", sbuf);
+      snprintf(local_port, sizeof(local_port), "KRB5LOCALPORT=%s", sbuf);
       envinit[i++] =local_port;
     skip_localaddr_env:
 
@@ -1471,10 +1387,10 @@ void doit(f, fromp)
 			  NI_NUMERICHOST | NI_NUMERICSERV);
       if (aierr)
 	  goto skip_remoteaddr_env;
-      sprintf(remote_addr, "KRB5REMOTEADDR=%s", hbuf);
+      snprintf(remote_addr, sizeof(remote_addr), "KRB5REMOTEADDR=%s", hbuf);
       envinit[i++] =remote_addr;
 
-      sprintf(remote_port, "KRB5REMOTEPORT=%s", sbuf);
+      snprintf(remote_port, sizeof(remote_port), "KRB5REMOTEPORT=%s", sbuf);
       envinit[i++] =remote_port;
 
     skip_remoteaddr_env:
@@ -1488,11 +1404,8 @@ void doit(f, fromp)
 	    char *buf2;
 
 	    if(getenv(save_env[cnt])) {
-		    buf2 = (char *)malloc(strlen(getenv(save_env[cnt]))
-					 +strlen(save_env[cnt])+2);
-		    if (buf2) {
-			    sprintf(buf2, "%s=%s", save_env[cnt], 
-				    getenv(save_env[cnt]));
+		    if (asprintf(&buf2, "%s=%s", save_env[cnt], 
+				 getenv(save_env[cnt])) >= 0) {
 			    for (i = 0; envinit[i]; i++);
 			    envinit[i] = buf2;
 		    }
@@ -1513,29 +1426,24 @@ void doit(f, fromp)
 	struct stat s2;
 	int offst = 0;
 
-	copy = malloc(strlen(cmdbuf) + 1);
+	copy = strdup(cmdbuf);
 	if (copy == NULL) {
 	    perror("malloc");
 	    _exit(1);
 	}
-	strcpy(copy, cmdbuf);
 	if (do_encrypt && !strncmp(cmdbuf, "-x ", 3)) {
 		offst = 3;
 	}
 
-        strcpy((char *) cmdbuf + offst, kprogdir);
+        strlcpy(cmdbuf + offst, kprogdir, sizeof(cmdbuf) - offst);
 	cp = copy + 3 + offst;
 
-	cmdbuf[sizeof(cmdbuf) - 1] = '\0';
-	if (auth_sys == KRB5_RECVAUTH_V4) {
-	  strncat(cmdbuf, "/v4rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
-	} else {
-	  strncat(cmdbuf, "/rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
-	}
+	strlcat(cmdbuf, "/rcp", sizeof(cmdbuf));
+
 	if (stat((char *)cmdbuf + offst, &s2) >= 0)
-	  strncat(cmdbuf, cp, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
+	  strlcat(cmdbuf, cp, sizeof(cmdbuf));
 	else
-	  strncpy(cmdbuf, copy, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
+	  strlcpy(cmdbuf, copy, sizeof(cmdbuf));
 	free(copy);
     }
 #endif
@@ -1585,8 +1493,8 @@ error(fmt, va_alist)
 #endif
 
     *cp++ = 1;
-    (void) sprintf(cp, "%s: ", progname);
-    (void) vsprintf(buf+strlen(buf), fmt, ap);
+    (void) snprintf(cp, sizeof(buf) - (cp - buf), "%s: ", progname);
+    (void) vsnprintf(buf+strlen(buf), sizeof(buf) - strlen(buf), fmt, ap);
     va_end(ap);
     (void) write(2, buf, strlen(buf));
     syslog(LOG_ERR ,"%s",buf+1);
@@ -1619,7 +1527,8 @@ char *makejtmp(uid, gid, jid)
     register char *endc, *tdp = &tmpdir[strlen(tmpdir)];
     register int i;
     
-    sprintf(tdp, "%s/jtmp.%06d", JTMPDIR, jid);
+    snprintf(tdp, sizeof(tmpdir) - (tdp - tmpdir), "%s/jtmp.%06d",
+	     JTMPDIR, jid);
     endc = &tmpdir[strlen(tmpdir)];
     
     endc[1] = '\0';
@@ -1778,7 +1687,7 @@ loglogin(host, flag, failures, ue)
 void usage()
 {
 #ifdef KERBEROS
-    syslog(LOG_ERR, "usage: kshd [-54ecikK]  ");
+    syslog(LOG_ERR, "usage: kshd [-eciK]  ");
 #else
     syslog(LOG_ERR, "usage: rshd");
 #endif
@@ -1805,9 +1714,6 @@ recvauth(netfd, peersin, valid_checksum)
     struct sockaddr_in laddr;
     socklen_t len;
     krb5_data inbuf;
-#ifdef KRB5_KRB4_COMPAT
-    char v4_instance[INST_SZ];	/* V4 Instance */
-#endif
     krb5_authenticator *authenticator;
     krb5_ticket        *ticket;
     krb5_rcache		rcache;
@@ -1829,10 +1735,6 @@ recvauth(netfd, peersin, valid_checksum)
 #define SIZEOF_INADDR sizeof(struct in_addr)
 #endif
 
-#ifdef KRB5_KRB4_COMPAT
-    strcpy(v4_instance, "*");
-#endif
-
     status = krb5_auth_con_init(bsd_context, &auth_context);
     if (status)
 	return status;
@@ -1862,66 +1764,25 @@ recvauth(netfd, peersin, valid_checksum)
 	if (status) return status;
     }
 
-#ifdef KRB5_KRB4_COMPAT
-    status = krb5_compat_recvauth_version(bsd_context, &auth_context, &netfd,
-				  NULL,		/* Specify daemon principal */
-				  0, 		/* no flags */
-				  keytab, /* normally NULL to use v5srvtab */
-				  0, 		/* v4_opts */
-				  "rcmd", 	/* v4_service */
-				  v4_instance, 	/* v4_instance */
-				  (struct sockaddr_in *)peersin, /* foreign address */
-				  &laddr, 	/* our local address */
-				  "", 		/* use default srvtab */
-
-				  &ticket, 	/* return ticket */
-				  &auth_sys, 	/* which authentication system*/
-				  &v4_kdata, 0, &version);
-#else
     status = krb5_recvauth_version(bsd_context, &auth_context, &netfd,
 				   NULL,        /* daemon principal */
 				   0,           /* no flags */
 				   keytab,      /* normally NULL to use v5srvtab */
 				   &ticket,    /* return ticket */
 				   &version); /* application version string */
-    auth_sys = KRB5_RECVAUTH_V5;
-#endif
     if (status) {
-	if (auth_sys == KRB5_RECVAUTH_V5) {
-	    /*
-	     * clean up before exiting
-	     */
-	    getstr(netfd, locuser, sizeof(locuser), "locuser");
-	    getstr(netfd, cmdbuf, sizeof(cmdbuf), "command");
-	    getstr(netfd, remuser, sizeof(locuser), "remuser");
-	}
+	/*
+	 * clean up before exiting
+	 */
+	getstr(netfd, locuser, sizeof(locuser), "locuser");
+	getstr(netfd, cmdbuf, sizeof(cmdbuf), "command");
+	getstr(netfd, remuser, sizeof(locuser), "remuser");
 	return status;
     }
 
     getstr(netfd, locuser, sizeof(locuser), "locuser");
     getstr(netfd, cmdbuf, sizeof(cmdbuf), "command");
 
-#ifdef KRB5_KRB4_COMPAT
-    if (auth_sys == KRB5_RECVAUTH_V4) {
-	rcmd_stream_init_normal();
-	
-	/* We do not really know the remote user's login name.
-         * Assume it to be the same as the first component of the
-	 * principal's name. 
-         */
-	strcpy(remuser, v4_kdata->pname);
-
-	status = krb5_425_conv_principal(bsd_context, v4_kdata->pname,
-					 v4_kdata->pinst, v4_kdata->prealm,
-					 &client);
-	if (status) return status;
-
-	status = krb5_unparse_name(bsd_context, client, &kremuser);
-	
-	return status;
-    }
-#endif /* KRB5_KRB4_COMPAT */
-
     /* Must be V5  */
 	
     kcmd_proto = KCMD_UNKNOWN_PROTOCOL;
@@ -1949,27 +1810,17 @@ recvauth(netfd, peersin, valid_checksum)
 	struct sockaddr_storage adr;
 	unsigned int adr_length = sizeof(adr);
 	int e;
-	unsigned int buflen = strlen(cmdbuf)+strlen(locuser)+32;
-	char * chksumbuf = (char *) malloc(buflen);
+	char namebuf[32], *chksumbuf = NULL;
 
-	if (chksumbuf == 0)
-	    goto error_cleanup;
 	if (getsockname(netfd, (struct sockaddr *) &adr, &adr_length) != 0)
 	    goto error_cleanup;
 
 	e = getnameinfo((struct sockaddr *)&adr, adr_length, 0, 0,
-			chksumbuf, buflen, NI_NUMERICSERV);
-	if (e) {
-	    free(chksumbuf);
+			namebuf, sizeof(namebuf), NI_NUMERICSERV);
+	if (e)
 	    fatal(netfd, "local error: can't examine port number");
-	}
-	if (strlen(chksumbuf) > 30) {
-	    free(chksumbuf);
-	    fatal(netfd, "wacky local port number?!");
-	}
-	strcat(chksumbuf, ":");
-	strcat(chksumbuf,cmdbuf);
-	strcat(chksumbuf,locuser);
+	if (asprintf(&chksumbuf, "%s:%s%s", namebuf, cmdbuf, locuser) < 0)
+	    goto error_cleanup;
 
 	status = krb5_verify_checksum(bsd_context,
 				      authenticator->checksum->checksum_type,
@@ -2060,7 +1911,7 @@ void fatal(f, msg)
 #endif
 
     buf[0] = '\01';             /* error indicator */
-    (void) sprintf(buf + 1, "%s: %s.\r\n",progname, msg);
+    (void) snprintf(buf + 1, sizeof(buf) - 1, "%s: %s.\r\n",progname, msg);
     if ((f == netf) && (pid > 0))
       (void) rcmd_stream_write(f, buf, strlen(buf), 0);
     else
@@ -2078,3 +1929,115 @@ void fatal(f, msg)
     }
     exit(1);
 }
+
+static int
+accept_a_connection (int debug_port, struct sockaddr *from,
+		     socklen_t *fromlenp)
+{
+    int n, s, fd, s4 = -1, s6 = -1, on = 1;
+    fd_set sockets;
+
+    FD_ZERO(&sockets);
+
+#ifdef KRB5_USE_INET6
+    {
+	struct sockaddr_in6 sock_in6;
+
+	if ((s = socket(AF_INET6, SOCK_STREAM, PF_UNSPEC)) < 0) {
+	    if ((errno == EPROTONOSUPPORT) || (errno == EAFNOSUPPORT))
+		goto skip_ipv6;
+	    fprintf(stderr, "Error in socket(INET6): %s\n", strerror(errno));
+	    exit(2);
+	}
+
+	memset((char *) &sock_in6, 0,sizeof(sock_in6));
+	sock_in6.sin6_family = AF_INET6;
+	sock_in6.sin6_port = htons(debug_port);
+	sock_in6.sin6_addr = in6addr_any;
+
+	(void) setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
+			  (char *)&on, sizeof(on));
+
+	if ((bind(s, (struct sockaddr *) &sock_in6, sizeof(sock_in6))) < 0) {
+	    fprintf(stderr, "Error in bind(INET6): %s\n", strerror(errno));
+	    exit(2);
+	}
+
+	if ((listen(s, 5)) < 0) {
+	    fprintf(stderr, "Error in listen(INET6): %s\n", strerror(errno));
+	    exit(2);
+	}
+	s6 = s;
+	FD_SET(s, &sockets);
+    skip_ipv6:
+	;
+    }
+#endif
+
+    {
+	struct sockaddr_in sock_in;
+
+	if ((s = socket(AF_INET, SOCK_STREAM, PF_UNSPEC)) < 0) {
+	    fprintf(stderr, "Error in socket: %s\n", strerror(errno));
+	    exit(2);
+	}
+
+	memset((char *) &sock_in, 0,sizeof(sock_in));
+	sock_in.sin_family = AF_INET;
+	sock_in.sin_port = htons(debug_port);
+	sock_in.sin_addr.s_addr = INADDR_ANY;
+
+	(void) setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
+			  (char *)&on, sizeof(on));
+
+	if ((bind(s, (struct sockaddr *) &sock_in, sizeof(sock_in))) < 0) {
+	    if (s6 >= 0 && errno == EADDRINUSE)
+		goto try_ipv6_only;
+	    fprintf(stderr, "Error in bind: %s\n", strerror(errno));
+	    exit(2);
+	}
+
+	if ((listen(s, 5)) < 0) {
+	    fprintf(stderr, "Error in listen: %s\n", strerror(errno));
+	    exit(2);
+	}
+	s4 = s;
+	FD_SET(s, &sockets);
+    try_ipv6_only:
+	;
+    }
+    if (s4 == -1 && s6 == -1) {
+	fprintf(stderr, "No valid sockets established, exiting\n");
+	exit(2);
+    }
+    n = select(((s4 < s6) ? s6 : s4) + 1, &sockets, 0, 0, 0);
+    if (n < 0) {
+	fprintf(stderr, "select error: %s\n", strerror(errno));
+	exit(2);
+    } else if (n == 0) {
+	fprintf(stderr, "internal error? select returns 0\n");
+	exit(2);
+    }
+    if (s6 != -1 && FD_ISSET(s6, &sockets)) {
+	if (s4 != -1)
+	    close(s4);
+	s = s6;
+    } else if (FD_ISSET(s4, &sockets)) {
+	if (s6 != -1)
+	    close(s6);
+	s = s4;
+    } else {
+	fprintf(stderr,
+		"internal error? select returns positive, "
+		"but neither fd available\n");
+	exit(2);
+    }
+
+    if ((fd = accept(s, from, fromlenp)) < 0) {
+	fprintf(stderr, "Error in accept: %s\n", strerror(errno));
+	exit(2);
+    }
+
+    close(s);
+    return fd;
+}
diff --git a/src/appl/bsd/login.M b/src/appl/bsd/login.M
index 0fceb35..3a1b05b 100644
--- a/src/appl/bsd/login.M
+++ b/src/appl/bsd/login.M
@@ -19,8 +19,8 @@ tickets for the user.
 will prompt for a username, or take one on the command line, as
 .I login.krb5 username
 and will then prompt for a password. This password will be used to
-acquire Kerberos Version 5 tickets and Kerberos Version 4 tickets (if
-possible.) It will also attempt to run
+acquire Kerberos Version 5 tickets (if possible.) It will also attempt
+to run
 .I aklog
 to get \fIAFS\fP tokens for the user. The version 5 tickets will be
 tested against a local 
@@ -40,12 +40,6 @@ pass hostname to rlogind.  Must be the last argument.
 \fB\-h\fP \fIhostname\fP
 pass hostname to telnetd, etc.  Must be the last argument.
 .TP
-\fB\-k\fP \fIhostname\fP
-Use Kerberos V4 to login.  Must be the last argument.
-.TP
-\fB\-K\fP \fIhostname\fP
-Use Kerberos V4 to login.  Must be the last argument.
-.TP
 \fB\-f\fP \fIname\fP
 Perform pre-authenticated login, e.g., datakit, xterm, etc.; 
 allows preauthenticated login as root.
@@ -66,17 +60,6 @@ stanza. A collection of options dealing with initial authentication are
 provided:
 .IP krb5_get_tickets
 Use password to get V5 tickets. Default value true.
-.IP krb4_get_tickets
-Use password to get V4 tickets. Default value false.
-.IP krb4_convert
-Use Kerberos conversion daemon to get V4 tickets. Default value
-false. If false, and krb4_get_tickets is true, then login will get
-the V5 tickets directly using the Kerberos V4 protocol directly.  
-This does not currently work with non MIT-V4 salt types
-(such as the AFS3 salt type.)  Note that if configuration parameter 
-is true, and the krb524d is not running, login will hang for 
-approximately a minute  under Solaris, 
-due to a Solaris socket emulation bug.
 .IP krb_run_aklog
 Attempt to run aklog. Default value false.
 .IP aklog_path
@@ -92,6 +75,3 @@ associated with
 .PP
 .SH SEE ALSO
 rlogind(8), rlogin(1), telnetd(8)
-.SH BUGS
-Should use a config file to select use of V5, V4, and AFS, as well as
-policy for startup.
diff --git a/src/appl/bsd/login.c b/src/appl/bsd/login.c
index 861b9a5..57680ad 100644
--- a/src/appl/bsd/login.c
+++ b/src/appl/bsd/login.c
@@ -32,10 +32,6 @@ char copyright[] =
    # login stanza
    krb5_get_tickets = 1
    # use password to get v5 tickets
-   krb4_get_tickets = 0
-   # use password to get v4 tickets
-   krb4_convert = 0
-   # use kerberos conversion daemon to get v4 tickets
    krb_run_aklog = 0
    # attempt to run aklog
    aklog_path = $(prefix)/bin/aklog
@@ -46,14 +42,8 @@ char copyright[] =
 #define KRB5_GET_TICKETS
 int login_krb5_get_tickets = 1;
 
-#ifdef KRB5_KRB4_COMPAT
-#define KRB4_GET_TICKETS
-int login_krb4_get_tickets = 0;
-#define KRB4_CONVERT
-int login_krb4_convert = 0;
 #define KRB_RUN_AKLOG
 int login_krb_run_aklog = 0;
-#endif /* KRB5_KRB4_COMPAT */
 
 int login_accept_passwd = 0;
 
@@ -67,10 +57,6 @@ int login_accept_passwd = 0;
  *			 allows preauthenticated login as root)
  * login -e name	(for pre-authenticated encrypted, must do term
  *			 negotiation)
- * ifdef KRB4_KLOGIN
- * login -k hostname (for Kerberos V4 rlogind with password access)
- * login -K hostname (for Kerberos V4 rlogind with restricted access)
- * endif KRB4_KLOGIN
  *
  * only one of: -r -f -e -k -K -F
  * only one of: -r -h -k -K
@@ -159,44 +145,6 @@ typedef sigtype (*handler)();
 #include "osconf.h"
 #endif /* KRB5_GET_TICKETS */
 
-#ifdef KRB4_KLOGIN
-/* support for running under v4 klogind, -k -K flags */
-#define KRB4
-#endif
-
-#if (defined(KRB4_GET_TICKETS) || defined(KRB4_CONVERT))
-/* support for prompting for v4 initial tickets */
-#define KRB4
-#endif
-
-#ifdef KRB4
-#include <krb.h>
-#include <netinet/in.h>
-#ifdef HAVE_KRB4_PROTO_H
-#include <krb4-proto.h>
-#endif
-#include <arpa/inet.h>
-#ifdef BIND_HACK
-#include <arpa/nameser.h>
-#include <arpa/resolv.h>
-#endif /* BIND_HACK */
-
-/* Hacks to maintain compatability with Athena libkrb*/
-#ifndef HAVE_KRB_SAVE_CREDENTIALS
-#define krb_save_credentials save_credentials
-#endif /*HAVE_KRB_SAVE_CREDENTIALS*/
-
-#ifndef HAVE_KRB_GET_ERR_TEXT
-
-static const char *krb_get_err_text(kerror)
-     int kerror;
-{
-    return krb_err_txt[kerror];
-}
-
-#endif /*HAVE_KRB_GET_ERR_TEXT*/
-#endif /* KRB4 */
-
 #ifndef __STDC__
 #ifndef volatile
 #define volatile
@@ -302,13 +250,8 @@ char term[64], *username;
 
 
 
-#ifdef KRB4
-#define KRB_ENVIRON	"KRBTKFILE"	/* Ticket file environment variable */
-#define KRB_TK_DIR	"/tmp/tkt_"	/* Where to put the ticket */
-#endif /* KRB4_GET_TICKETS */
-
-#if defined(KRB4_GET_TICKETS) || defined(KRB5_GET_TICKETS)
-#define MAXPWSIZE	128		/* Biggest string accepted for KRB4
+#ifdef KRB5_GET_TICKETS
+#define MAXPWSIZE	128		/* Biggest string accepted for KRB5
 					   passsword */
 #endif
 
@@ -353,12 +296,8 @@ static struct login_confs {
 } login_conf_set[] = {
 #ifdef KRB5_GET_TICKETS
     {"krb5_get_tickets", &login_krb5_get_tickets},
+    {"krb_run_aklog", &login_krb_run_aklog},
 #endif
-#ifdef KRB5_KRB4_COMPAT
-    {"krb4_get_tickets", &login_krb4_get_tickets},
-    {"krb4_convert", &login_krb4_convert},
-    {"krb4_run_aklog", &login_krb_run_aklog},
-#endif /* KRB5_KRB4_COMPAT */
 };
 
 static char *conf_yes[] = {
@@ -501,20 +440,8 @@ char ccfile[MAXPATHLEN+6];	/* FILE:path+\0 */
 int krbflag;			/* set if tickets have been obtained */
 #endif /* KRB5_GET_TICKETS */
 
-#ifdef KRB4_GET_TICKETS
-static int got_v4_tickets;
-AUTH_DAT *kdata = (AUTH_DAT *) NULL;
-char tkfile[MAXPATHLEN];
-#endif
-
-#ifdef KRB4_GET_TICKETS
-static void k_init (ttyn, realm)
-    char *ttyn;
-    char *realm;
-#else
 void k_init (ttyn)
     char *ttyn;
-#endif
 {
 #ifdef KRB5_GET_TICKETS
     krb5_error_code retval;
@@ -529,7 +456,8 @@ void k_init (ttyn)
 
     /* Set up the credential cache environment variable */
     if (!getenv(KRB5_ENV_CCNAME)) {
-	sprintf(ccfile, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+	snprintf(ccfile, sizeof(ccfile), "FILE:/tmp/krb5cc_p%ld",
+		 (long) getpid());
 	setenv(KRB5_ENV_CCNAME, ccfile, 1);
 	krb5_cc_set_default_name(kcontext, ccfile);
 	unlink(ccfile+strlen("FILE:"));
@@ -540,22 +468,6 @@ void k_init (ttyn)
     }
 #endif
 
-#ifdef KRB4_GET_TICKETS
-    if (krb_get_lrealm(realm, 1) != KSUCCESS) {
-	strncpy(realm, KRB_REALM, sizeof(realm));
-	realm[sizeof(realm) - 1] = '\0';
-    }
-    if (login_krb4_get_tickets || login_krb4_convert) {
-	/* Set up the ticket file environment variable */
-	strncpy(tkfile, KRB_TK_DIR, sizeof(tkfile));
-	tkfile[sizeof(tkfile) - 1] = '\0';
-	strncat(tkfile, strrchr(ttyn, '/')+1,
-		sizeof(tkfile) - strlen(tkfile));
-	(void) unlink (tkfile);
-	setenv(KRB_ENVIRON, tkfile, 1);
-    }
-#endif
-
 #ifdef BIND_HACK
     /* Set name server timeout to be reasonable,
        so that people don't take 5 minutes to
@@ -571,7 +483,7 @@ static int k5_get_password (user_pwstring, pwsize)
 {
     krb5_error_code code;
     char prompt[255];			
-    sprintf(prompt,"Password for %s", username);
+    snprintf(prompt, sizeof(prompt), "Password for %s", username);
 
     /* reduce opportunities to be swapped out */
     code = krb5_read_password(kcontext, prompt, 0, user_pwstring, &pwsize);
@@ -636,236 +548,8 @@ static int have_v5_tickets (me)
 }
 #endif /* KRB5_GET_TICKETS */
 
-#ifdef KRB4_CONVERT
-static int
-try_convert524(kctx, me, use_ccache)
-    krb5_context kctx;
-    krb5_principal me;
-    int use_ccache;
-{
-    krb5_principal kpcserver;
-    krb5_error_code kpccode;
-    int kpcval;
-    krb5_creds increds, *v5creds;
-    CREDENTIALS v4creds;
-
-
-    /* If we have forwarded v5 tickets, retrieve the credentials from
-     * the cache; otherwise, the v5 credentials are in my_creds.
-     */
-    if (use_ccache) {
-	/* cc->ccache, already set up */
-	/* client->me, already set up */
-	kpccode = krb5_build_principal(kctx, &kpcserver, 
-				       krb5_princ_realm(kctx, me)->length,
-				       krb5_princ_realm(kctx, me)->data,
-				       "krbtgt",
-				       krb5_princ_realm(kctx, me)->data,
-				       NULL);
-	if (kpccode) {
-	    com_err("login/v4", kpccode,
-		    "while creating service principal name");
-	    return 0;
-	}
-
-	memset((char *) &increds, 0, sizeof(increds));
-	increds.client = me;
-	increds.server = kpcserver;
-	increds.times.endtime = 0;
-	increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
-	kpccode = krb5_get_credentials(kctx, 0, ccache,
-				       &increds, &v5creds);
-	krb5_free_principal(kctx, kpcserver);
-	increds.server = NULL;
-	if (kpccode) {
-	    com_err("login/v4", kpccode, "getting V5 credentials");
-	    return 0;
-	}
-
-	kpccode = krb524_convert_creds_kdc(kctx, v5creds, &v4creds);
-	krb5_free_creds(kctx, v5creds);
-    } else
-	kpccode = krb524_convert_creds_kdc(kctx, &my_creds, &v4creds);
-    if (kpccode) {
-	com_err("login/v4", kpccode, "converting to V4 credentials");
-	return 0;
-    }
-    /* this is stolen from the v4 kinit */
-    /* initialize ticket cache */
-    if ((kpcval = in_tkt(v4creds.pname,v4creds.pinst)
-	 != KSUCCESS)) {
-	com_err("login/v4", kpcval,
-		"trying to create the V4 ticket file");
-	return 0;
-    }
-    /* stash ticket, session key, etc. for future use */
-    if ((kpcval = krb_save_credentials(v4creds.service,
-				       v4creds.instance,
-				       v4creds.realm, 
-				       v4creds.session,
-				       v4creds.lifetime,
-				       v4creds.kvno,
-				       &(v4creds.ticket_st), 
-				       v4creds.issue_date))) {
-	com_err("login/v4", kpcval,
-		"trying to save the V4 ticket");
-	return 0;
-    }
-    got_v4_tickets = 1;
-    strncpy(tkfile, tkt_string(), sizeof(tkfile));
-    tkfile[sizeof(tkfile) - 1] = '\0';
-    return 1;
-}
-#endif
-
-#ifdef KRB4_GET_TICKETS
-static int
-try_krb4 (user_pwstring, realm)
-    char *user_pwstring;
-    char *realm;
-{
-    int krbval, kpass_ok = 0;
-
-    krbval = krb_get_pw_in_tkt(username, "", realm,
-			       "krbtgt", realm, 
-			       DEFAULT_TKT_LIFE,
-			       user_pwstring);
-
-    switch (krbval) {
-    case INTK_OK:
-	kpass_ok = 1;
-	krbflag = 1;
-	strncpy(tkfile, tkt_string(), sizeof(tkfile));
-	tkfile[sizeof(tkfile) - 1] = '\0';
-	break;	
-	/* These errors should be silent */
-	/* So the Kerberos database can't be probed */
-    case KDC_NULL_KEY:
-    case KDC_PR_UNKNOWN:
-    case INTK_BADPW:
-    case KDC_PR_N_UNIQUE:
-    case -1:
-	break;
-#if 0 /* I want to see where INTK_W_NOTALL comes from before letting
-	 kpass_ok be set in that case.  KR  */
-	/* These should be printed but are not fatal */
-    case INTK_W_NOTALL:
-	krbflag = 1;
-	kpass_ok = 1;
-	fprintf(stderr, "Kerberos error: %s\n",
-		krb_get_err_text(krbval));
-	break;
-#endif
-    default:
-	fprintf(stderr, "Kerberos error: %s\n",
-		krb_get_err_text(krbval));
-	break;
-    }
-    got_v4_tickets = kpass_ok;
-    return kpass_ok;
-}
-#endif /* KRB4_GET_TICKETS */
-
 /* Kerberos ticket-handling routines */
 
-#ifdef KRB4_GET_TICKETS
-/* call already conditionalized on login_krb4_get_tickets */
-/*
- * Verify the Kerberos ticket-granting ticket just retrieved for the
- * user.  If the Kerberos server doesn't respond, assume the user is
- * trying to fake us out (since we DID just get a TGT from what is
- * supposedly our KDC).  If the rcmd.<host> service is unknown (i.e.,
- * the local srvtab doesn't have it), let her in.
- *
- * Returns 1 for confirmation, -1 for failure, 0 for uncertainty.
- */
-static int verify_krb_v4_tgt (realm)
-    char *realm;
-{
-    char hostname[MAXHOSTNAMELEN], phost[BUFSIZ];
-    struct hostent *hp;
-    KTEXT_ST ticket;
-    AUTH_DAT authdata;
-    unsigned KRB4_32 addr;
-    static /*const*/ char rcmd_str[] = "rcmd";
-#if 0
-    char key[8];
-#endif
-    int krbval, retval, have_keys;
-
-    if (gethostname(hostname, sizeof(hostname)) == -1) {
-	perror ("cannot retrieve local hostname");
-	return -1;
-    }
-    strncpy (phost, krb_get_phost (hostname), sizeof (phost));
-    phost[sizeof(phost)-1] = 0;
-    hp = gethostbyname (hostname);
-    if (!hp) {
-	perror ("cannot retrieve local host address");
-	return -1;
-    }
-    memcpy ((char *) &addr, (char *)hp->h_addr, sizeof (addr));
-    /* Do we have rcmd.<host> keys? */
-#if 0 /* Be paranoid.  If srvtab exists, assume it must contain the
-	 right key.  The more paranoid mode also helps avoid a
-	 possible DNS spoofing issue.  */
-    have_keys = read_service_key (rcmd_str, phost, realm, 0, KEYFILE, key)
-	? 0 : 1;
-    memset (key, 0, sizeof (key));
-#else
-    have_keys = 0 == access (KEYFILE, F_OK);
-#endif
-    krbval = krb_mk_req (&ticket, rcmd_str, phost, realm, 0);
-    if (krbval == KDC_PR_UNKNOWN) {
-	/*
-	 * Our rcmd.<host> principal isn't known -- just assume valid
-	 * for now?  This is one case that the user _could_ fake out.
-	 */
-	if (have_keys)
-	    return -1;
-	else
-	    return 0;
-    }
-    else if (krbval != KSUCCESS) {
-	printf ("Unable to verify Kerberos TGT: %s\n", 
-		krb_get_err_text(krbval));
-#ifndef SYSLOG42
-	syslog (LOG_NOTICE|LOG_AUTH, "Kerberos TGT bad: %s",
-		krb_get_err_text(krbval));
-#endif
-	return -1;
-    }
-    /* got ticket, try to use it */
-    krbval = krb_rd_req (&ticket, rcmd_str, phost, addr, &authdata, "");
-    if (krbval != KSUCCESS) {
-	if (krbval == RD_AP_UNDEC && !have_keys)
-	    retval = 0;
-	else {
-	    retval = -1;
-	    printf ("Unable to verify `rcmd' ticket: %s\n",
-		    krb_get_err_text(krbval));
-	}
-#ifndef SYSLOG42
-	syslog (LOG_NOTICE|LOG_AUTH, "can't verify rcmd ticket: %s;%s\n",
-		krb_get_err_text(krbval),
-		retval
-		? "srvtab found, assuming failure"
-		: "no srvtab found, assuming success");
-#endif
-	goto EGRESS;
-    }
-    /*
-     * The rcmd.<host> ticket has been received _and_ verified.
-     */
-    retval = 1;
-    /* do cleanup and return */
-EGRESS:
-    memset (&ticket, 0, sizeof (ticket));
-    memset (&authdata, 0, sizeof (authdata));
-    return retval;
-}
-#endif /* KRB4_GET_TICKETS */
-
 static void destroy_tickets()
 {
 #ifdef KRB5_GET_TICKETS
@@ -876,10 +560,6 @@ static void destroy_tickets()
 	  krb5_cc_destroy (kcontext, cache);
     }
 #endif
-#ifdef KRB4_GET_TICKETS
-    if (login_krb4_get_tickets || login_krb4_convert)
-	dest_tkt();
-#endif /* KRB4_GET_TICKETS */
 }
 
 /* AFS support routines */
@@ -926,15 +606,15 @@ static int try_afscall (scall)
 static void
 afs_login ()
 {
-#if defined(KRB4_GET_TICKETS) && defined(SETPAG)
-    if (login_krb4_get_tickets && pwd->pw_uid) {
+#if defined(SETPAG)
+    if (login_krb5_get_tickets && pwd->pw_uid) {
 	/* Only reset the pag for non-root users. */
 	/* This allows root to become anything. */
 	pagflag = try_setpag ();
     }
 #endif
 #ifdef KRB_RUN_AKLOG
-    if (got_v4_tickets && login_krb_run_aklog) {
+    if (got_v5_tickets && login_krb_run_aklog) {
 	/* KPROGDIR is $(prefix)/bin */
 	char aklog_path[MAXPATHLEN];
 	struct stat st;
@@ -1047,10 +727,6 @@ int main(argc, argv)
     krb5_creds save_v5creds;
     krb5_ccache xtra_creds = NULL;
 #endif
-#ifdef KRB4_GET_TICKETS
-    CREDENTIALS save_v4creds;
-    char realm[REALM_SZ];
-#endif
     char *ccname = 0;   /* name of forwarded cache */
     char *tz = 0;
     char *hostname = 0;
@@ -1079,9 +755,6 @@ int main(argc, argv)
      * 	login as root.
      * -h is used by other servers to pass the name of the
      * remote host to login so that it may be placed in utmp and wtmp
-     * -k is used by klogind to cause the Kerberos V4 autologin protocol;
-     * -K is used by klogind to cause the Kerberos V4 autologin
-     *    protocol with restricted access.
      */
     (void)gethostname(tbuf, sizeof(tbuf));
     domain = strchr(tbuf, '.');
@@ -1132,33 +805,6 @@ int main(argc, argv)
 		*p = '\0';
 	    hostname = optarg;
 	    break;
-#ifdef KRB4_KLOGIN
-	case 'k':
-	case 'K':
-	    EXCL_AUTH_TEST;
-	    EXCL_HOST_TEST;
-	    if (getuid()) {
-		fprintf(stderr,
-			"login: -%c for super-user only.\n", ch);
-		exit(1);
-	    }
-	    /* "-k hostname" must be last args */
-	    if (optind != argc) {
-		fprintf(stderr, "Syntax error.\n");
-		exit(1);
-	    }
-	    if (ch == 'K')
-		Kflag = 1;
-	    else
-		kflag = 1;
-	    passwd_req = (do_krb_login(optarg, Kflag ? 1 : 0) == -1);
-	    if (domain && 
-		(p = strchr(optarg, '.')) &&
-		(!strcmp(p, domain))) 
-		*p = '\0';
-	    hostname = optarg;
-	    break;
-#endif /* KRB4_KLOGIN */
 	case 'e':
 	    EXCL_AUTH_TEST;
 	    if (getuid()) {
@@ -1242,18 +888,13 @@ int main(argc, argv)
        ask for username if we don't have it already
        look it up in local pw or shadow file (to get crypt string)
        ask for password
-       try and get v4, v5 tickets with it
+       try and get v5 tickets with it
        try and use the tickets against the local srvtab
        if the password matches, always let them in
        if the ticket decrypts, let them in.
-       v5 needs to work, does v4?
     */
 
-#ifdef KRB4_GET_TICKETS
-    k_init (ttyn, realm);
-#else
     k_init (ttyn);
-#endif
 
     for (cnt = 0;; username = NULL) {
 #ifdef KRB5_GET_TICKETS
@@ -1292,17 +933,6 @@ int main(argc, argv)
 	if (!unix_needs_passwd())
 	    break;
 
-	/* we have several sets of code:
-	   1) get v5 tickets alone -DKRB5_GET_TICKETS
-	   2) get v4 tickets alone [** don't! only get them *with* v5 **]
-	   3) get both tickets -DKRB5_GET_TICKETS -DKRB4_GET_TICKETS
-	   3a) use krb524 calls to get the v4 tickets -DKRB4_CONVERT plus (3).
-	   4) get no tickets and use the password file (none of thes defined.)
-		   
-	   Likewise we need to (optionally?) test these tickets against
-	   local srvtabs.
-	*/
-
 #ifdef KRB5_GET_TICKETS
 	if (login_krb5_get_tickets) {
 	    /* rename these to something more verbose */
@@ -1324,16 +954,7 @@ int main(argc, argv)
 	    if (pwd->pw_uid != 0) { /* Don't get tickets for root */
 		try_krb5(&me, user_pwstring);
 
-#ifdef KRB4_GET_TICKETS
-		if (login_krb4_get_tickets &&
-		    !(got_v5_tickets && login_krb4_convert))
-		    try_krb4(user_pwstring, realm);
-#endif
-		krbflag = (got_v5_tickets
-#ifdef KRB4_GET_TICKETS
-			   || got_v4_tickets
-#endif
-			   );
+		krbflag = got_v5_tickets;
 		memset (user_pwstring, 0, sizeof(user_pwstring));
 		/* password wiped, so we can relax */
 		setpriority(PRIO_PROCESS, 0, 0 + PRIO_OFFSET);
@@ -1370,13 +991,6 @@ int main(argc, argv)
 		    break;	/* we're ok */
 		}
 	    }
-#ifdef KRB4_GET_TICKETS
-	    else if (got_v4_tickets) {
-		if (login_krb4_get_tickets &&
-		    (verify_krb_v4_tgt(realm) != -1))
-		    break;	/* we're ok */
-	    }
-#endif /* KRB4_GET_TICKETS */
 
 	bad_login:
 	    setpriority(PRIO_PROCESS, 0, 0 + PRIO_OFFSET);
@@ -1480,21 +1094,10 @@ int main(argc, argv)
 	forwarded_v5_tickets = 1;
 #endif /* KRB5_GET_TICKETS */
 
-#if defined(KRB5_GET_TICKETS) && defined(KRB4_CONVERT)
-    if (login_krb4_convert && !got_v4_tickets) {
-	if (got_v5_tickets||forwarded_v5_tickets)
-	    try_convert524(kcontext, me, forwarded_v5_tickets);
-    }
-#endif
-
 #ifdef KRB5_GET_TICKETS
     if (login_krb5_get_tickets)
 	dofork();
 #endif
-#ifdef KRB4_GET_TICKETS
-    else if (login_krb4_get_tickets)
-	dofork();
-#endif
 
 /* If the user's shell does not do job control we should put it in a
    different process group than than us, and set the tty process group
@@ -1551,17 +1154,16 @@ int main(argc, argv)
     (void) initgroups(username, pwd->pw_gid);
 
     /*
-     * The V5 ccache and V4 ticket file are both created as root.
-     * They need to be owned by the user, and chown (a) assumes
-     * they are stored in a file and (b) allows a race condition
-     * in which a user can delete the file (if the directory
-     * sticky bit is not set) and make it a symlink to somewhere
-     * else; on some platforms, chown() on a symlink actually
-     * changes the owner of the pointed-to file.  This is Bad.
+     * The V5 ccache is created as root.  It needs to be owned by the
+     * user, and chown (a) assumes they are stored in a file and (b)
+     * allows a race condition in which a user can delete the file (if
+     * the directory sticky bit is not set) and make it a symlink to
+     * somewhere else; on some platforms, chown() on a symlink
+     * actually changes the owner of the pointed-to file.  This is
+     * Bad.
      *
-     * So, we suck the V5 and V4 krbtgts into memory here, destroy
-     * the ccache/ticket file, and recreate them later after the
-     * setuid.
+     * So, we suck the V5 krbtgt into memory here, destroy the
+     * ccache/ticket file, and recreate them later after the setuid.
      *
      * With the new v5 api, v5 tickets are kept in memory until written
      * out after the setuid.  However, forwarded tickets still
@@ -1605,28 +1207,10 @@ int main(argc, argv)
     }
 #endif /* KRB5_GET_TICKETS */
 
-#ifdef KRB4_GET_TICKETS
-    if (got_v4_tickets) {
-	memset(&save_v4creds, 0, sizeof(save_v4creds));
-	     
-	retval = krb_get_cred("krbtgt", realm, realm, &save_v4creds);
-	if (retval != KSUCCESS) {
-	    syslog(LOG_ERR,
-		   "%s while retrieving V4 initial ticket for copy",
-		   error_message(retval));
-	    rewrite_ccache = 0;
-	}
-    }
-#endif /* KRB4_GET_TICKETS */
-
 #ifdef KRB5_GET_TICKETS
     if (forwarded_v5_tickets)
 	destroy_tickets();
 #endif
-#ifdef KRB4_GET_TICKETS
-    else if (got_v4_tickets)
-        destroy_tickets();
-#endif
 
 #ifdef OQUOTA
     quota(Q_DOWARN, pwd->pw_uid, (dev_t)-1, 0);
@@ -1701,29 +1285,6 @@ int main(argc, argv)
     }
 #endif /* KRB5_GET_TICKETS */
 
-#ifdef KRB4_GET_TICKETS
-    if (got_v4_tickets && rewrite_ccache) {
-	if ((retval = in_tkt(save_v4creds.pname, save_v4creds.pinst))
-	    != KSUCCESS) {
-	    syslog(LOG_ERR,
-		   "%s while re-initializing V4 ticket cache as user",
-		   error_message((retval == -1)?errno:retval));
-	} else if ((retval = krb_save_credentials(save_v4creds.service,
-						  save_v4creds.instance,
-						  save_v4creds.realm, 
-						  save_v4creds.session,
-						  save_v4creds.lifetime,
-						  save_v4creds.kvno,
-						  &(save_v4creds.ticket_st), 
-						  save_v4creds.issue_date))
-		   != KSUCCESS) {
-	    syslog(LOG_ERR,
-		   "%s while re-storing V4 tickets as user",
-		   error_message(retval));
-	}
-    }
-#endif /* KRB4_GET_TICKETS */
-
     if (*pwd->pw_shell == '\0')
 	pwd->pw_shell = BSHELL;
 
@@ -1778,12 +1339,6 @@ int main(argc, argv)
     if (term[0])
 	(void)setenv("TERM", term, 0);
 
-#ifdef KRB4_GET_TICKETS
-    /* tkfile[0] is only set if we got tickets above */
-    if (login_krb4_get_tickets && tkfile[0])
-	(void) setenv(KRB_ENVIRON, tkfile, 1);
-#endif /* KRB4_GET_TICKETS */
-
 #ifdef KRB5_GET_TICKETS
     /* ccfile[0] is only set if we got tickets above */
     if (login_krb5_get_tickets && ccfile[0]) {
@@ -1795,33 +1350,6 @@ int main(argc, argv)
     if (tty[sizeof("tty")-1] == 'd')
 	syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
     if (pwd->pw_uid == 0)
-#ifdef KRB4_KLOGIN
-	if (kdata) {
-	    if (hostname) {
-		char buf[BUFSIZ];
-#ifdef UT_HOSTSIZE
-		(void) sprintf(buf,
-			       "ROOT LOGIN (krb) %s from %.*s, %s.%s@%s",
-			       tty, UT_HOSTSIZE, hostname,
-			       kdata->pname, kdata->pinst,
-			       kdata->prealm);
-#else
-		(void) sprintf(buf,
-			       "ROOT LOGIN (krb) %s from %s, %s.%s@%s",
-			       tty, hostname,
-			       kdata->pname, kdata->pinst,
-			       kdata->prealm);
-#endif
-		syslog(LOG_NOTICE, "%s", buf);
-	    } else {
-		syslog(LOG_NOTICE,
-		       "ROOT LOGIN (krb) %s, %s.%s@%s",
-		       tty,
-		       kdata->pname, kdata->pinst,
-		       kdata->prealm);
-	    }
-	} else
-#endif /* KRB4_KLOGIN */
 	    {
 		if (hostname) {
 #ifdef UT_HOSTSIZE
@@ -1839,10 +1367,6 @@ int main(argc, argv)
     afs_login();
 
     if (!quietlog) {
-#ifdef KRB4_KLOGIN
-	if (!krbflag && !fflag && !eflag )
-	    printf("\nWarning: No Kerberos tickets obtained.\n\n");
-#endif /* KRB4_KLOGIN */
 	motd();
 	check_mail();
     }
@@ -2104,7 +1628,7 @@ void check_mail()
 {
     char tbuf[MAXPATHLEN+2];
     struct stat st;
-    (void)sprintf(tbuf, "%s/%s", MAILDIR, pwd->pw_name);
+    (void)snprintf(tbuf, sizeof(tbuf), "%s/%s", MAILDIR, pwd->pw_name);
     if (stat(tbuf, &st) == 0 && st.st_size != 0)
 	printf("You have %smail.\n",
 	       (st.st_mtime > st.st_atime) ? "new " : "");
@@ -2217,100 +1741,6 @@ int doremotelogin(host)
     return(ruserok(host, (pwd->pw_uid == 0), rusername, username));
 }
 
-#ifdef KRB4_KLOGIN
-int do_krb_login(host, strict)
-     char *host;
-     int strict;
-{
-    int rc;
-    struct sockaddr_in sin;
-    char instance[INST_SZ], version[9];
-    long authoptions = 0L;
-    struct hostent *hp = gethostbyname(host);
-    static char lusername[UT_NAMESIZE+1];
-    
-    /*
-     * Kerberos autologin protocol.
-     */
-
-    (void) memset((char *) &sin, 0, (int) sizeof(sin));
-    
-    if (hp)
-	(void) memcpy ((char *)&sin.sin_addr, hp->h_addr,
-		       sizeof(sin.sin_addr));
-    else
-	sin.sin_addr.s_addr = inet_addr(host);
-    
-    if ((hp == NULL) && (sin.sin_addr.s_addr == -1)) {
-	printf("Hostname did not resolve to an address, so Kerberos authentication failed\r\n");
-	/*
-	 * No host addr prevents auth, so
-	 * punt krb and require password
-	 */
-	if (strict) {
-	    goto paranoid;
-	} else {
-	    pwd = NULL;
-	    return(-1);
-	}
-    }
-
-    kdata = (AUTH_DAT *)malloc( sizeof(AUTH_DAT) );
-    ticket = (KTEXT) malloc(sizeof(KTEXT_ST));
-
-    (void) strcpy(instance, "*");
-    if ((rc=krb_recvauth(authoptions, 0, ticket, "rcmd",
-			 instance, &sin,
-			 (struct sockaddr_in *)0,
-			 kdata, "", (bit_64 *) 0, version))) {
-	printf("Kerberos rlogin failed: %s\r\n",krb_get_err_text(rc));
-	if (strict) {
-paranoid:
-	    /*
-	     * Paranoid hosts, such as a Kerberos server,
-	     * specify the Klogind daemon to disallow
-	     * even password access here.
-	     */
-	    printf("Sorry, you must have Kerberos authentication to access this host.\r\n");
-	    exit(1);
-	}
-    }
-    (void) lgetstr(lusername, sizeof (lusername), "Local user");
-    (void) lgetstr(term, sizeof(term), "Terminal type");
-    username = lusername;
-    if (getuid()) {
-	pwd = NULL;
-	return(-1);
-    }
-    pwd = getpwnam(lusername);
-    if (pwd == NULL) {
-	pwd = NULL;
-	return(-1);
-    }
-
-    /*
-     * if Kerberos login failed because of an error in krb_recvauth,
-     * return the indication of a bad attempt.  User will be prompted
-     * for a password.  We CAN'T check the .rhost file, because we need 
-     * the remote username to do that, and the remote username is in the 
-     * Kerberos ticket.  This affects ONLY the case where there is
-     * Kerberos on both ends, but Kerberos fails on the server end. 
-     */
-    if (rc) {
-	return(-1);
-    }
-
-    if ((rc=kuserok(kdata,lusername))) {
-	printf("login: %s has not given you permission to login without a password.\r\n",lusername);
-	if (strict) {
-	    exit(1);
-	}
-	return(-1);
-    }
-    return(0);
-}
-#endif /* KRB4_KLOGIN */
-
 void lgetstr(buf, cnt, err)
      char *buf, *err;
      int cnt;
@@ -2334,15 +1764,11 @@ void lgetstr(buf, cnt, err)
 void sleepexit(eval)
      int eval;
 {
-#ifdef KRB4_GET_TICKETS
-    if (login_krb4_get_tickets && krbflag)
-	(void) destroy_tickets();
-#endif /* KRB4_GET_TICKETS */
     sleep((u_int)5);
     exit(eval);
 }
 
-#if defined(KRB4_GET_TICKETS) || defined(KRB5_GET_TICKETS)
+#ifdef KRB5_GET_TICKETS
 static int hungup = 0;
 
 static sigtype
@@ -2350,7 +1776,7 @@ sighup() {
     hungup = 1;
 }
 
-/* call already conditionalized on login_krb4_get_tickets */
+/* call already conditionalized on login_krb5_get_tickets */
 /*
  * This routine handles cleanup stuff, and the like.
  * It exits only in the child process.
@@ -2435,7 +1861,7 @@ dofork()
     /* Leave */
     exit(0);
 }
-#endif /* KRB4_GET_TICKETS */
+#endif /* KRB5_GET_TICKETS */
 
 
 #ifndef HAVE_STRSAVE
@@ -2448,11 +1874,10 @@ char *strsave(sp)
 {
     register char *ret;
     
-    if ((ret = (char *) malloc((unsigned) strlen(sp)+1)) == NULL) {
+    if ((ret = strdup(sp)) == NULL) {
 	fprintf(stderr, "no memory for saving args\n");
 	exit(1);
     }
-    (void) strcpy(ret,sp);
     return(ret);
 }
 #endif
diff --git a/src/appl/bsd/rlogin.M b/src/appl/bsd/rlogin.M
index e259782..5958842 100644
--- a/src/appl/bsd/rlogin.M
+++ b/src/appl/bsd/rlogin.M
@@ -25,7 +25,7 @@ rlogin \- remote login
 .I rhost
 [\fB\-e\fP\fI\|c\fP] [\fB\-8\fP] [\fB\-c\fP] [ \fB\-a\fP] [\fB\-f\fP]
 [\fB\-F\fP] [\fB\-t\fP \fItermtype\fP] [\fB\-n\fP] [\fB\-7\fP]
-[\fB\-PN | \-PO\fP] [\fB\-4\fP]
+[\fB\-PN | \-PO\fP]
 [\fB\-d\fP] [\fB\-k\fP \fIrealm\fP] [\fB\-x\fP] [\fB\-L\fP] [\fB\-l\fP
 \fIusername\fP]
 .PP
@@ -145,9 +145,6 @@ old one, but is not interoperable with older servers.  (An
 "input/output error" and a closed connection is the most likely result
 of attempting this combination.)  If neither option is specified, some
 simple heuristics are used to guess which to try.
-.TP
-\fB\-4\fP
-Use Kerberos V4 authentication only; don't try Kerberos V5.
 .SH SEE ALSO
 rsh(1), kerberos(1), krb_sendauth(3), krb_realmofhost(3), rlogin(1) [UCB
 version], klogind(8)
diff --git a/src/appl/bsd/v4rcp.M b/src/appl/bsd/v4rcp.M
deleted file mode 100644
index 97721a8..0000000
--- a/src/appl/bsd/v4rcp.M
+++ /dev/null
@@ -1,52 +0,0 @@
-.\" appl/bsd/v4rcp.M
-.TH V4RCP 1
-.SH NAME
-v4rcp \- back end for Kerberos V4 rcp
-.SH SYNOPSIS
-.B v4rcp
-.I not invoked by users
-.SH DESCRIPTION
-This program is
-.B not
-for user execution. The usage message indicates this. 
-.PP
-Kerberos Version 4 
-.I rsh
-did not support encryption. In order to perform
-encrypted file transfer, the version 4
-.I rcp
-program did a second authentication, directly to the 
-.I rcp
-process at the other end. This meant that
-.I rcp
-needed to be
-.IR setuid
-to root in order to read the
-.IR krb-srvtab
-file on the remote end.
-.PP
-Rather than add this complexity into the main Kerberos 5 
-.I rcp
-the Kerberos 5 
-.I kshd
-instead detects the use of Kerberos 4 authentication, and checks the
-command for the program name
-.I rcp
-and then substitutes the full pathname of
-.I v4rcp
-instead.  Since
-.I v4rcp
-is installed
-.IR setuid
-to root, it can perform the the authentication and get the session key
-needed to encrypt the file transfer.
-.PP
-Kerberos 5 
-.I rcp 
-instead uses the encryption support built in to Kerberos 5
-.I rsh
-and
-.I kshd
-directly.
-.SH SEE ALSO
-rsh(1), rcp(1), kshd(8)
diff --git a/src/appl/bsd/v4rcp.c b/src/appl/bsd/v4rcp.c
deleted file mode 100644
index 3cb7b3f..0000000
--- a/src/appl/bsd/v4rcp.c
+++ /dev/null
@@ -1,1107 +0,0 @@
-/* Stripped down Kerberos V4 rcp, for server-side use only */
-/* based on Cygnus CNS V4-96q1 src/appl/bsd/rcp.c. */
-
-/*
- *	rcp.c
- */
-
-/*
- * Copyright (c) 1983 The Regents of the University of California.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms are permitted
- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by the University of California, Berkeley.  The name of the
- * University may not be used to endorse or promote products derived
- * from this software without specific prior written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-#ifndef lint
-char copyright[] =
-"@(#) Copyright (c) 1983 The Regents of the University of California.\n\
- All rights reserved.\n";
-#endif /* not lint */
-
-#ifndef lint
-static char sccsid[] = "@(#)rcp.c	5.10 (Berkeley) 9/20/88";
-#endif /* not lint */
-
-/*
- * rcp
- */
-#ifdef KERBEROS
-#include "k5-int.h"
-#include <com_err.h>
-#include <k5-util.h>
-#endif
-
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/file.h>
-#ifndef KERBEROS
-/* Ultrix doesn't protect it vs multiple inclusion, and krb.h includes it */
-#include <sys/socket.h>
-#endif
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/ioctl.h>
-#ifdef NEED_SYS_FCNTL_H
-#include <sys/fcntl.h>
-#endif
-#include <netinet/in.h>
-
-#include <fcntl.h>
-#include <stdio.h>
-#include <string.h>
-#include <signal.h>
-#include <pwd.h>
-#include <ctype.h>
-#ifndef KERBEROS
-/* Ultrix doesn't protect it vs multiple inclusion, and krb.h includes it */
-#include <netdb.h>
-#endif
-#include <errno.h>
-#include <stdarg.h>
-
-#include "port-sockets.h"
-
-#ifdef KERBEROS
-#include <krb.h>
-#include <krbports.h>
-
-
-void sink(int, char **), source(int, char **), 
-    rsource(char *, struct stat *), usage(void);
-/*VARARGS*/
-void 	error (char *fmt, ...)
-#if !defined (__cplusplus) && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7))
-       __attribute__ ((__format__ (__printf__, 1, 2)))
-#endif
-     ;
-int	response(void);
-#if !defined(HAVE_UTIMES)
-int	utimes();
-#endif
-
-
-#if 0
-#include <kstream.h>
-#else
-/* we don't have full kstream in v5, so fake it... */
-
-typedef struct {
-  int encrypting;
-  int read_fd, write_fd;
-  des_key_schedule *sched;
-  des_cblock *ivec;
-  /* used on the read side */
-  char *inbuf;
-  char *outbuf;
-  int writelen;
-  char* retbuf;
-  int retbuflen;
-  int retlen;
-  int returned;
-} *kstream;
-
-static kstream kstream_create_rcp_from_fd(read_fd, write_fd, sched, ivec)
-     int read_fd, write_fd;
-     des_key_schedule *sched;
-     des_cblock *ivec;
-{
-  kstream tmp = (kstream)malloc(sizeof(*tmp));
-  if (tmp == NULL)
-      return NULL;
-  tmp->encrypting = 1;
-  tmp->read_fd = read_fd;
-  tmp->write_fd = write_fd;
-  /* they're static in this file, so just hang on to the pointers */
-  tmp->sched = sched;
-  tmp->ivec = ivec;
-  tmp->inbuf = 0;
-  tmp->outbuf = 0;
-  tmp->writelen = 0;
-  tmp->retbuf = 0;
-  tmp->retbuflen = 0;
-  tmp->returned = 0;
-  tmp->retlen = 0;
-  return tmp;
-}
-
-static kstream kstream_create_from_fd(read_fd, write_fd, sched, session)
-     int read_fd, write_fd;
-     Key_schedule *sched;
-     des_cblock *session;
-{
-  /* just set it up... */
-  kstream tmp = (kstream)malloc(sizeof(*tmp));
-  if (tmp == NULL)
-      return NULL;
-  tmp->encrypting = 0;
-  tmp->read_fd = read_fd;
-  tmp->write_fd = write_fd;
-  return tmp;
-}
-
-
-/* always set to 0 here anyway */
-#define kstream_set_buffer_mode(x,y)
-
-static int kstream_read(krem, buf, len)
-     kstream krem;
-     char *buf;
-     unsigned int len;
-{
-  if(krem->encrypting) {
-    /* when we get a length, we have to read the whole block. However,
-       we have to hand it to the user in the chunks they want, which 
-       may be smaller if BUFSIZ doesn't match. [the caller can deal if
-       the incoming blocks are smaller...] */
-    if (krem->returned) {
-      int remaining = krem->retlen - krem->returned;
-      int returning;
-      
-      if (remaining <= len) {
-	returning = remaining;
-      } else {
-	returning = len;
-      }
-      memcpy(buf, krem->retbuf+krem->returned, returning);
-      krem->returned += returning;
-      if (krem->returned == krem->retlen) krem->returned = 0;
-
-      return returning;
-    }
-
-    /* we need 4 bytes to get a length, and once we have that we know how
-       much to get to fill the buffer. Then we can hand back bits, or loop. */
-    {
-      int cc;
-      unsigned char clen[4];
-      unsigned int x = 0;
-      unsigned int sz, off;
-
-      cc = read(krem->read_fd, clen, 4);
-      if (cc != 4) return cc;
-      x <<= 8; x += clen[0] & 0xff;
-      x <<= 8; x += clen[1] & 0xff;
-      x <<= 8; x += clen[2] & 0xff;
-      x <<= 8; x += clen[3] & 0xff;
-      sz = (x + 7) & (~7U);
-
-      if (krem->retbuflen < sz) {
-	if (krem->retbuflen == 0) 
-	  krem->retbuf = (char*)malloc(sz>(BUFSIZ)?sz:(BUFSIZ));
-	else 
-	  krem->retbuf = (char*)realloc(krem->retbuf, sz);
-	if(!krem->retbuf) { errno = ENOMEM; return -1; }
-	krem->retbuflen = sz>(BUFSIZ)?sz:(BUFSIZ);
-      }
-
-      /* get all of it */
-      off = 0;
-      do {
-	cc = read(krem->read_fd, krem->retbuf+off, sz-off);
-	if (cc <= 0) return cc;
-	off += cc;
-      } while (off < sz);
-      
-      /* decrypt it */
-      des_pcbc_encrypt ((des_cblock *)krem->retbuf, 
-			(des_cblock *)krem->retbuf, 
-			(int) sz, *krem->sched, krem->ivec, 
-			DECRYPT);
-
-      /* now retbuf has sz bytes, return len or x of them to the user */
-      if (x <= len) {
-	memcpy(buf, krem->retbuf, x);
-	return x;
-      } else {
-	memcpy(buf, krem->retbuf, len);
-	/* defer the rest */
-	krem->returned = len;
-	krem->retlen = x;
-	return len;
-      }
-    }
-  } else {
-    return read(krem->read_fd, buf, len);
-  }
-}
-
-static int kstream_write(krem, buf, len)
-     kstream krem;
-     char *buf;
-     unsigned int len;
-{
-  if (krem->encrypting) {
-    unsigned long x;
-    int st;
-    unsigned int outlen = (len + 7) & (~7U);
-
-    if (krem->writelen < outlen || krem->outbuf == 0) {
-	krem->inbuf = (char*)realloc(krem->inbuf, outlen ? outlen : 1);
-	krem->outbuf = (char*)realloc(krem->outbuf, outlen+8);
-	if(!krem->inbuf || !krem->outbuf) { errno = ENOMEM; return -1; }
-	krem->writelen = outlen;
-    }
-
-    outlen = (len + 7) & (~7U);
-
-    memcpy(krem->inbuf, buf, len);
-    krb5_random_confounder(outlen-len, krem->inbuf+len);
-    buf = krem->inbuf;
-
-    x = len;
-    krem->outbuf[3+4] = x & 0xff; x >>= 8;
-    krem->outbuf[2+4] = x & 0xff; x >>= 8;
-    krem->outbuf[1+4] = x & 0xff; x >>= 8;
-    krem->outbuf[0+4] = x & 0xff; x >>= 8;
-    if (x)
-      abort ();
-    /* memset(outbuf+4+4, 0x42, BUFSIZ); */
-    st = des_pcbc_encrypt ((des_cblock *)buf, (des_cblock *)(krem->outbuf+4+4),
-			   (int) outlen,
-			   *krem->sched, krem->ivec, ENCRYPT);
-
-    if (st) abort();
-    return write(krem->write_fd, krem->outbuf+4, 4+outlen);
-  } else {
-    return write(krem->write_fd, buf, len);
-  }
-}
-
-/* 0 = stdin, read; 1 = stdout, write */
-#define rem 0,1
-
-#endif
-
-
-#ifdef _AUX_SOURCE
-#define vfork fork
-#endif
-#ifdef NOVFORK
-#define vfork fork
-#endif
-
-#ifndef roundup
-#define roundup(x,y) ((((x)+(y)-1)/(y))*(y))
-#endif
-
-int	sock;
-CREDENTIALS cred;
-MSG_DAT msg_data;
-struct sockaddr_in foreign, local;
-Key_schedule schedule;
-
-KTEXT_ST ticket;
-AUTH_DAT kdata;
-static des_cblock crypt_session_key;
-char	krb_realm[REALM_SZ];
-char	**save_argv(int, char **), *krb_realmofhost();
-#ifndef HAVE_STRSAVE
-static char *strsave(char *);
-#endif
-#ifdef NOENCRYPTION
-#define	des_read	read
-#define	des_write	write
-#else /* !NOENCRYPTION */
-void	answer_auth(void);
-int	encryptflag = 0;
-#endif /* NOENCRYPTION */
-#include "rpaths.h"
-#else /* !KERBEROS */
-#define	des_read	read
-#define	des_write	write
-#endif /* KERBEROS */
-
-kstream krem;
-int	errs;
-krb5_sigtype lostconn(int);
-int	iamremote, targetshouldbedirectory;
-int	iamrecursive;
-int	pflag;
-int	force_net;
-struct	passwd *pwd;
-int	userid;
-int	port;
-
-char	*getenv();
-
-struct buffer {
-	int	cnt;
-	char	*buf;
-} *allocbuf(struct buffer *, int, int);
-
-#define	NULLBUF	(struct buffer *) 0
-
-#define	ga()		(void) kstream_write (krem, "", 1)
-
-int main(argc, argv)
-	int argc;
-	char **argv;
-{
-	char portarg[20], rcpportarg[20];
-#ifdef ATHENA
-	static char curhost[256];
-#endif /* ATHENA */
-#ifdef KERBEROS
-	char realmarg[REALM_SZ + 5];
-#endif /* KERBEROS */
-
-	portarg[0] = '\0';
-	rcpportarg[0] = '\0';
-	realmarg[0] = '\0';
-
-	pwd = getpwuid(userid = getuid());
-	if (pwd == 0) {
-		fprintf(stderr, "who are you?\n");
-		exit(1);
-	}
-
-#ifdef KERBEROS
-	krb_realm[0] = '\0';		/* Initially no kerberos realm set */
-#endif /* KERBEROS */
-	for (argc--, argv++; argc > 0 && **argv == '-'; argc--, argv++) {
-		(*argv)++;
-		while (**argv) switch (*(*argv)++) {
-
-		    case 'r':
-			iamrecursive++;
-			break;
-
-		    case 'p':		/* preserve mtimes and atimes */
-			pflag++;
-			break;
-
-		    case 'P':		/* Set port to use.  */
-			port = atoi(*argv);
-			sprintf(portarg, " -p%d", port);
-			sprintf(rcpportarg, " -P%d", port);
-			port = htons(port);
-			goto next_arg;
-
-		    case 'N':
-			/* Force use of network even on local machine.  */
-			force_net++;
-			break;
-
-#ifdef KERBEROS
-#ifndef NOENCRYPTION
-		    case 'x':
-			encryptflag++;
-			break;
-#endif
-		    case 'k':		/* Change kerberos realm */
-			argc--, argv++;
-			if (argc == 0) 
-			  usage();
-			strncpy(krb_realm,*argv,REALM_SZ);
-			krb_realm[REALM_SZ-1] = 0;
-			sprintf(realmarg, " -k %s", krb_realm);
-			goto next_arg;
-#endif /* KERBEROS */
-		    /* The rest of these are not for users. */
-		    case 'd':
-			targetshouldbedirectory = 1;
-			break;
-
-		    case 'f':		/* "from" */
-			iamremote = 1;
-#if defined(KERBEROS) && !defined(NOENCRYPTION)
-			if (encryptflag) {
-				answer_auth();
-				krem = kstream_create_rcp_from_fd (rem,
-								   &schedule,
-								   &crypt_session_key);
-			} else
-				krem = kstream_create_from_fd (rem, 0, 0);
-			if (krem == NULL) {
-			    error("rcp: out of memory\n");
-			    exit(1);
-			}
-			kstream_set_buffer_mode (krem, 0);
-#endif /* KERBEROS && !NOENCRYPTION */
-			(void) response();
-			if (setuid(userid)) {
-			    error("rcp: can't setuid(user)\n");
-			    exit(1);
-			}
-			source(--argc, ++argv);
-			exit(errs);
-
-		    case 't':		/* "to" */
-			iamremote = 1;
-#if defined(KERBEROS) && !defined(NOENCRYPTION)
-			if (encryptflag) {
-				answer_auth();
-				krem = kstream_create_rcp_from_fd (rem,
-								   &schedule,
-								   &crypt_session_key);
-			} else
-				krem = kstream_create_from_fd (rem, 0, 0);
-			if (krem == NULL) {
-			    error("rcp: out of memory\n");
-			    exit(1);
-			}
-			kstream_set_buffer_mode (krem, 0);
-#endif /* KERBEROS && !NOENCRYPTION */
-			if (setuid(userid)) {
-			    error("rcp: can't setuid(user)\n");
-			    exit(1);
-			}
-			sink(--argc, ++argv);
-			exit(errs);
-
-		    default:
-			usage();
-		}
-#ifdef KERBEROS
-	      next_arg: ;
-#endif /* KERBEROS */
-	}
-	usage();
-	return 1;
-}
-
-static void verifydir(cp)
-	char *cp;
-{
-	struct stat stb;
-
-	if (stat(cp, &stb) >= 0) {
-		if ((stb.st_mode & S_IFMT) == S_IFDIR)
-			return;
-		errno = ENOTDIR;
-	}
-	error("rcp: %s: %s.\n", cp, error_message(errno));
-	exit(1);
-}
-
-void source(argc, argv)
-	int argc;
-	char **argv;
-{
-	char *last, *name;
-	struct stat stb;
-	static struct buffer buffer;
-	struct buffer *bp;
-	int x, readerr, f;
-	unsigned int amt;
-	off_t i;
-	char buf[BUFSIZ];
-
-	for (x = 0; x < argc; x++) {
-		name = argv[x];
-		if ((f = open(name, 0)) < 0) {
-			error("rcp: %s: %s\n", name, error_message(errno));
-			continue;
-		}
-		if (fstat(f, &stb) < 0)
-			goto notreg;
-		switch (stb.st_mode&S_IFMT) {
-
-		case S_IFREG:
-			break;
-
-		case S_IFDIR:
-			if (iamrecursive) {
-				(void) close(f);
-				rsource(name, &stb);
-				continue;
-			}
-			/* fall into ... */
-		default:
-notreg:
-			(void) close(f);
-			error("rcp: %s: not a plain file\n", name);
-			continue;
-		}
-		last = strrchr(name, '/');
-		if (last == 0)
-			last = name;
-		else
-			last++;
-		if (pflag) {
-			/*
-			 * Make it compatible with possible future
-			 * versions expecting microseconds.
-			 */
-			(void) sprintf(buf, "T%ld 0 %ld 0\n",
-			    stb.st_mtime, stb.st_atime);
-			kstream_write (krem, buf, strlen (buf));
-			if (response() < 0) {
-				(void) close(f);
-				continue;
-			}
-		}
-		(void) sprintf(buf, "C%04o %ld %s\n",
-		    (unsigned int) stb.st_mode&07777, (long) stb.st_size, last);
-		kstream_write (krem, buf, strlen (buf));
-		if (response() < 0) {
-			(void) close(f);
-			continue;
-		}
-		if ((bp = allocbuf(&buffer, f, BUFSIZ)) == NULLBUF) {
-			(void) close(f);
-			continue;
-		}
-		readerr = 0;
-		for (i = 0; i < stb.st_size; i += bp->cnt) {
-			amt = bp->cnt;
-			if (i + amt > stb.st_size)
-				amt = stb.st_size - i;
-			if (readerr == 0 && read(f, bp->buf, amt) != amt)
-				readerr = errno;
-			kstream_write (krem, bp->buf, amt);
-		}
-		(void) close(f);
-		if (readerr == 0)
-			ga();
-		else
-			error("rcp: %s: %s\n", name, error_message(readerr));
-		(void) response();
-	}
-}
-
-#ifndef USE_DIRENT_H
-#include <sys/dir.h>
-#else
-#include <dirent.h>
-#endif
-
-void rsource(name, statp)
-	char *name;
-	struct stat *statp;
-{
-	DIR *d = opendir(name);
-	char *last;
-	char buf[BUFSIZ];
-	char *bufv[1];
-#ifdef USE_DIRENT_H
-	struct dirent *dp;
-#else
-	struct direct *dp;
-#endif
-
-	if (d == 0) {
-		error("rcp: %s: %s\n", name, error_message(errno));
-		return;
-	}
-	last = strrchr(name, '/');
-	if (last == 0)
-		last = name;
-	else
-		last++;
-	if (pflag) {
-		(void) sprintf(buf, "T%ld 0 %ld 0\n",
-		    statp->st_mtime, statp->st_atime);
-		kstream_write (krem, buf, strlen (buf));
-		if (response() < 0) {
-			closedir(d);
-			return;
-		}
-	}
-	(void) sprintf(buf, "D%04o %d %s\n",
-		       (unsigned int) statp->st_mode&07777, 0, last);
-	kstream_write (krem, buf, strlen (buf));
-	if (response() < 0) {
-		closedir(d);
-		return;
-	}
-	while ((dp = readdir(d))) {
-		if (dp->d_ino == 0)
-			continue;
-		if (!strcmp(dp->d_name, ".") || !strcmp(dp->d_name, ".."))
-			continue;
-		if (strlen(name) + 1 + strlen(dp->d_name) >= BUFSIZ - 1) {
-			error("%s/%s: Name too long.\n", name, dp->d_name);
-			continue;
-		}
-		(void) sprintf(buf, "%s/%s", name, dp->d_name);
-		bufv[0] = buf;
-		source(1, bufv);
-	}
-	closedir(d);
-	kstream_write (krem, "E\n", 2);
-	(void) response();
-}
-
-int response()
-{
-	char resp, c, rbuf[BUFSIZ], *cp = rbuf;
-
-	if (kstream_read (krem, &resp, 1) != 1)
-		lostconn(0);
-	switch (resp) {
-
-	case 0:				/* ok */
-		return (0);
-
-	default:
-		*cp++ = resp;
-		/* fall into... */
-	case 1:				/* error, followed by err msg */
-	case 2:				/* fatal error, "" */
-		do {
-			if (kstream_read (krem, &c, 1) != 1)
-				lostconn(0);
-			*cp++ = c;
-		} while (cp < &rbuf[BUFSIZ] && c != '\n');
-		if (iamremote == 0)
-			(void) write(2, rbuf, (unsigned) (cp - rbuf));
-		errs++;
-		if (resp == 1)
-			return (-1);
-		exit(1);
-	}
-	/*NOTREACHED*/
-	return -1;
-}
-
-krb5_sigtype lostconn(signum)
-    int signum;
-{
-
-	if (iamremote == 0)
-		fprintf(stderr, "rcp: lost connection\n");
-	exit(1);
-}
-
-#if !defined(HAVE_UTIMES)
-#include <utime.h>
-#include <sys/time.h>
-
-/*
- * We emulate utimes() instead of utime() as necessary because
- * utimes() is more powerful than utime(), and rcp actually tries to
- * set the microsecond values; we don't want to take away
- * functionality unnecessarily.
- */
-int utimes(file, tvp)
-const char *file;
-struct timeval *tvp;
-{
-	struct utimbuf times;
-
-	times.actime = tvp[0].tv_sec;
-	times.modtime = tvp[1].tv_sec;
-	return(utime(file, &times));
-}
-#endif
-
-void sink(argc, argv)
-	int argc;
-	char **argv;
-{
-	off_t i, j;
-	char *targ, *whopp, *cp;
-	int of, wrerr, exists, first, amt;
-	mode_t mode;
-	unsigned int count;
-	off_t size;
-	struct buffer *bp;
-	static struct buffer buffer;
-	struct stat stb;
-	int targisdir = 0;
-	mode_t mask = umask(0);
-	char *myargv[1];
-	char cmdbuf[BUFSIZ], nambuf[BUFSIZ];
-	int setimes = 0;
-	struct timeval tv[2];
-#define atime	tv[0]
-#define mtime	tv[1]
-#define	SCREWUP(str)	{ whopp = str; goto screwup; }
-
-	if (!pflag)
-		(void) umask(mask);
-	if (argc != 1) {
-		error("rcp: ambiguous target\n");
-		exit(1);
-	}
-	targ = *argv;
-	if (targetshouldbedirectory)
-		verifydir(targ);
-	ga();
-	if (stat(targ, &stb) == 0 && (stb.st_mode & S_IFMT) == S_IFDIR)
-		targisdir = 1;
-	for (first = 1; ; first = 0) {
-		cp = cmdbuf;
-		if (kstream_read (krem, cp, 1) <= 0)
-			return;
-		if (*cp++ == '\n')
-			SCREWUP("unexpected '\\n'");
-		do {
-			if (kstream_read(krem, cp, 1) != 1)
-				SCREWUP("lost connection");
-		} while (*cp++ != '\n');
-		*cp = 0;
-		if (cmdbuf[0] == '\01' || cmdbuf[0] == '\02') {
-			if (iamremote == 0)
-				(void) write(2, cmdbuf+1, strlen(cmdbuf+1));
-			if (cmdbuf[0] == '\02')
-				exit(1);
-			errs++;
-			continue;
-		}
-		*--cp = 0;
-		cp = cmdbuf;
-		if (*cp == 'E') {
-			ga();
-			return;
-		}
-
-#define getnum(t) (t) = 0; while (isdigit((int) *cp)) (t) = (t) * 10 + (*cp++ - '0');
-		if (*cp == 'T') {
-			setimes++;
-			cp++;
-			getnum(mtime.tv_sec);
-			if (*cp++ != ' ')
-				SCREWUP("mtime.sec not delimited");
-			getnum(mtime.tv_usec);
-			if (*cp++ != ' ')
-				SCREWUP("mtime.usec not delimited");
-			getnum(atime.tv_sec);
-			if (*cp++ != ' ')
-				SCREWUP("atime.sec not delimited");
-			getnum(atime.tv_usec);
-			if (*cp++ != '\0')
-				SCREWUP("atime.usec not delimited");
-			ga();
-			continue;
-		}
-		if (*cp != 'C' && *cp != 'D') {
-			/*
-			 * Check for the case "rcp remote:foo\* local:bar".
-			 * In this case, the line "No match." can be returned
-			 * by the shell before the rcp command on the remote is
-			 * executed so the ^Aerror_message convention isn't
-			 * followed.
-			 */
-			if (first) {
-				error("%s\n", cp);
-				exit(1);
-			}
-			SCREWUP("expected control record");
-		}
-		cp++;
-		mode = 0;
-		for (; cp < cmdbuf+5; cp++) {
-			if (*cp < '0' || *cp > '7')
-				SCREWUP("bad mode");
-			mode = (mode << 3) | (*cp - '0');
-		}
-		if (*cp++ != ' ')
-			SCREWUP("mode not delimited");
-		size = 0;
-		while (isdigit((int) *cp))
-			size = size * 10 + (*cp++ - '0');
-		if (*cp++ != ' ')
-			SCREWUP("size not delimited");
-		if (targisdir) {
-			if (strlen(targ) + strlen(cp) + 1 < sizeof(nambuf)) {
-			    (void) snprintf(nambuf, sizeof(nambuf),
-					    "%s%s%s", targ,
-					    *targ ? "/" : "", cp);
-			} else {
-				SCREWUP("target directory name too long");
-			}
-		} else {
-		    if (strlen(targ) + 1 < sizeof(nambuf))
-			(void) strncpy(nambuf, targ, sizeof(nambuf)-1);
-		    else
-			SCREWUP("target pathname too long");
-		}
-		nambuf[sizeof(nambuf)-1] = '\0';
-		exists = stat(nambuf, &stb) == 0;
-		if (cmdbuf[0] == 'D') {
-			if (exists) {
-				if ((stb.st_mode&S_IFMT) != S_IFDIR) {
-					errno = ENOTDIR;
-					goto bad;
-				}
-				if (pflag)
-					(void) chmod(nambuf, mode);
-			} else if (mkdir(nambuf, mode) < 0)
-				goto bad;
-			myargv[0] = nambuf;
-			sink(1, myargv);
-			if (setimes) {
-				setimes = 0;
-				if (utimes(nambuf, tv) < 0)
-					error("rcp: can't set times on %s: %s\n",
-					    nambuf, error_message(errno));
-			}
-			continue;
-		}
-		if ((of = open(nambuf, O_WRONLY|O_CREAT|O_TRUNC, mode)) < 0) {
-	bad:
-			error("rcp: %s: %s\n", nambuf, error_message(errno));
-			continue;
-		}
-#ifdef NO_FCHMOD
-		if (exists && pflag)
-			(void) chmod(nambuf, mode);
-#else
-		if (exists && pflag)
-			(void) fchmod(of, mode);
-#endif
-		ga();
-		if ((bp = allocbuf(&buffer, of, BUFSIZ)) == NULLBUF) {
-			(void) close(of);
-			continue;
-		}
-		cp = bp->buf;
-		count = 0;
-		wrerr = 0;
-		for (i = 0; i < size; i += BUFSIZ) {
-			amt = BUFSIZ;
-			if (i + amt > size)
-				amt = size - i;
-			count += amt;
-			do {
-				j = kstream_read(krem, cp, amt);
-				if (j <= 0) {
-					if (j == 0)
-					    error("rcp: dropped connection");
-					else
-					    error("rcp: %s\n",
-						error_message(errno));
-					exit(1);
-				}
-				amt -= j;
-				cp += j;
-			} while (amt > 0);
-			if (count == bp->cnt) {
-				if (wrerr == 0 &&
-				    write(of, bp->buf, count) != count)
-					wrerr++;
-				count = 0;
-				cp = bp->buf;
-			}
-		}
-		if (count != 0 && wrerr == 0 &&
-		    write(of, bp->buf, count) != count)
-			wrerr++;
-#ifndef __SCO__
-		if (ftruncate(of, size))
-			error("rcp: can't truncate %s: %s\n",
-			    nambuf, error_message(errno));
-#endif
-		(void) close(of);
-		(void) response();
-		if (setimes) {
-			setimes = 0;
-			if (utimes(nambuf, tv) < 0)
-				error("rcp: can't set times on %s: %s\n",
-				    nambuf, error_message(errno));
-		}				   
-		if (wrerr)
-			error("rcp: %s: %s\n", nambuf, error_message(errno));
-		else
-			ga();
-	}
-screwup:
-	error("rcp: protocol screwup: %s\n", whopp);
-	exit(1);
-}
-
-struct buffer *
-allocbuf(bp, fd, blksize)
-	struct buffer *bp;
-	int fd, blksize;
-{
-	int size;
-#ifndef NOSTBLKSIZE
-	struct stat stb;
-
-	if (fstat(fd, &stb) < 0) {
-		error("rcp: fstat: %s\n", error_message(errno));
-		return (NULLBUF);
-	}
-	size = roundup(stb.st_blksize, blksize);
-	if (size == 0)
-#endif
-		size = blksize;
-	if (bp->cnt < size) {
-		if (bp->buf != 0)
-			free(bp->buf);
-		bp->buf = (char *)malloc((unsigned) size);
-		if (bp->buf == 0) {
-			error("rcp: malloc: out of memory\n");
-			return (NULLBUF);
-		}
-	}
-	bp->cnt = size;
-	return (bp);
-}
-
-void
-error(char *fmt, ...)
-{
-    va_list ap;
-    char buf[BUFSIZ], *cp = buf;
-    
-    va_start(ap, fmt);
-
-    errs++;
-    *cp++ = 1;
-    (void) vsnprintf(cp, sizeof(buf) - (cp-buf), fmt, ap);
-    va_end(ap);
-
-    if (krem)
-	(void) kstream_write(krem, buf, strlen(buf));
-    if (iamremote == 0)
-	(void) write(2, buf+1, strlen(buf+1));
-}
-
-void usage()
-{
-  fprintf(stderr,
-"v4rcp: this program only acts as a server, and is not for user function.\n");
-  exit(1);
-}
-
-#ifdef KERBEROS
-
-char **
-save_argv(argc, argv)
-int argc;
-char **argv;
-{
-	register int i;
-
-	char **local_argv = (char **)calloc((unsigned) argc+1,
-					    (unsigned) sizeof(char *));
-	/* allocate an extra pointer, so that it is initialized to NULL
-	   and execv() will work */
-	for (i = 0; i < argc; i++)
-		local_argv[i] = strsave(argv[i]);
-	return(local_argv);
-}
-
-#ifndef HAVE_STRSAVE
-static char *
-strsave(sp)
-char *sp;
-{
-	register char *ret;
-
-	ret = strdup(sp);
-	if (ret == NULL) {
-		fprintf(stderr, "rcp: no memory for saving args\n");
-		exit(1);
-	}
-	return ret;
-}
-#endif
-
-#ifndef NOENCRYPTION
-#undef rem
-#define rem 0
-
-void
-answer_auth()
-{
-	int status;
-	long authopts = KOPT_DO_MUTUAL;
-	char instance[INST_SZ];
-	char version[9];
-	char *srvtab;
-	char *envaddr;
-
-#if 0
-	int sin_len;
-	
-	sin_len = sizeof (struct sockaddr_in);
-	if (getpeername(rem, &foreign, &sin_len) < 0) {
-		perror("getpeername");
-		exit(1);
-	}
-
-	sin_len = sizeof (struct sockaddr_in);
-	if (getsockname(rem, &local, &sin_len) < 0) {
-		perror("getsockname");
-		exit(1);
-	}
-#else
-	if ((envaddr = getenv("KRB5LOCALADDR"))) {
-#ifdef HAVE_INET_ATON
-	  inet_aton(envaddr,  &local.sin_addr);
-#else
-	  local.sin_addr.s_addr = inet_addr(envaddr);
-#endif
-	  local.sin_family = AF_INET;
-	  envaddr = getenv("KRB5LOCALPORT");
-	  if (envaddr)
-	    local.sin_port = htons(atoi(envaddr));
-	  else
-	    local.sin_port = 0;
-	} else {
-	  fprintf(stderr, "v4rcp: couldn't get local address (KRB5LOCALADDR)\n");
-	  exit(1);
-	}
-	if ((envaddr = getenv("KRB5REMOTEADDR"))) {
-#ifdef HAVE_INET_ATON
-	  inet_aton(envaddr,  &foreign.sin_addr);
-#else
-	  foreign.sin_addr.s_addr = inet_addr(envaddr);
-#endif
-	  foreign.sin_family = AF_INET;
-	  envaddr = getenv("KRB5REMOTEPORT");
-	  if (envaddr)
-	    foreign.sin_port = htons(atoi(envaddr));
-	  else
-	    foreign.sin_port = 0;
-	} else {
-	  fprintf(stderr, "v4rcp: couldn't get remote address (KRB5REMOTEADDR)\n");
-	  exit(1);
-	}
-
-#endif
-	strcpy(instance, "*");
-
-	/* If rshd was invoked with the -s argument, it will set the
-           environment variable KRB_SRVTAB.  We use that to get the
-           srvtab file to use.  If we do use the environment variable,
-           we reset to our real user ID (which will already have been
-           set up by rsh).  Since rcp is setuid root, we would
-           otherwise have a security hole.  If we are using the normal
-           srvtab (KEYFILE in krb.h, normally set to /etc/krb-srvtab),
-           we must keep our effective uid of root, because that file
-           can only be read by root.  */
-	srvtab = (char *) getenv("KRB_SRVTAB");
-	if (srvtab == NULL)
-		srvtab = "";
-	if (*srvtab != '\0')
-		(void) setuid (userid);
-
-	if ((status = krb_recvauth(authopts, rem, &ticket, "rcmd", instance,
-				   &foreign,
-				   &local,
-				   &kdata,
-				   srvtab,
-				   schedule,
-				   version)) != KSUCCESS) {
-		fprintf(stderr, "krb_recvauth mutual fail: %s\n",
-			krb_get_err_text(status));
-		exit(1);
-	}
-	memcpy(&crypt_session_key, &kdata.session, sizeof (crypt_session_key));
-	return;
-}
-#endif /* !NOENCRYPTION */
-
-#endif /* KERBEROS */
diff --git a/src/appl/deps b/src/appl/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/gss-sample/Makefile.in b/src/appl/gss-sample/Makefile.in
index a77f3a2..e64e487 100644
--- a/src/appl/gss-sample/Makefile.in
+++ b/src/appl/gss-sample/Makefile.in
@@ -49,17 +49,3 @@ clean-unix::
 install-unix::
 	$(INSTALL_PROGRAM) gss-client $(DESTDIR)$(CLIENT_BINDIR)/gss-client
 	$(INSTALL_PROGRAM) gss-server $(DESTDIR)$(SERVER_BINDIR)/gss-server
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)gss-client.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssapi/gssapi_generic.h gss-client.c \
-  gss-misc.h
-$(OUTPRE)gss-misc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  gss-misc.c gss-misc.h
-$(OUTPRE)gss-server.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  $(SRCTOP)/include/port-sockets.h gss-misc.h gss-server.c
diff --git a/src/appl/gss-sample/deps b/src/appl/gss-sample/deps
new file mode 100644
index 0000000..34495ea
--- /dev/null
+++ b/src/appl/gss-sample/deps
@@ -0,0 +1,12 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)gss-client.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
+  $(BUILDTOP)/include/gssapi/gssapi_generic.h gss-client.c \
+  gss-misc.h
+$(OUTPRE)gss-misc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
+  gss-misc.c gss-misc.h
+$(OUTPRE)gss-server.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
+  $(SRCTOP)/include/port-sockets.h gss-misc.h gss-server.c
diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c
index 0ee2684..390d6e5 100644
--- a/src/appl/gss-sample/gss-client.c
+++ b/src/appl/gss-sample/gss-client.c
@@ -567,20 +567,24 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag,
 static void
 parse_oid(char *mechanism, gss_OID * oid)
 {
-    char   *mechstr = 0, *cp;
+    char   *mechstr = 0;
     gss_buffer_desc tok;
     OM_uint32 maj_stat, min_stat;
+    size_t i, mechlen = strlen(mechanism);
 
     if (isdigit((int) mechanism[0])) {
-	mechstr = malloc(strlen(mechanism) + 5);
+	mechstr = malloc(mechlen + 5);
 	if (!mechstr) {
 	    fprintf(stderr, "Couldn't allocate mechanism scratch!\n");
 	    return;
 	}
-	sprintf(mechstr, "{ %s }", mechanism);
-	for (cp = mechstr; *cp; cp++)
-	    if (*cp == '.')
-		*cp = ' ';
+	mechstr[0] = '{';
+	mechstr[1] = ' ';
+	for (i = 0; i < mechlen; i++)
+	  mechstr[i + 2] = (mechanism[i] == '.') ? ' ' : mechanism[i];
+	mechstr[mechlen + 2] = ' ';
+	mechstr[mechlen + 3] = ' ';
+	mechstr[mechlen + 4] = '\0';
 	tok.value = mechstr;
     } else
 	tok.value = mechanism;
diff --git a/src/appl/gssftp/deps b/src/appl/gssftp/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/gssftp/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/gssftp/ftp/Makefile.in b/src/appl/gssftp/ftp/Makefile.in
index 490b5dc..8026f1e 100644
--- a/src/appl/gssftp/ftp/Makefile.in
+++ b/src/appl/gssftp/ftp/Makefile.in
@@ -21,20 +21,13 @@ OBJS	= $(OUTPRE)cmds.$(OBJEXT) $(OUTPRE)cmdtab.$(OBJEXT) \
 	  $(OUTPRE)main.$(OBJEXT) $(OUTPRE)radix.$(OBJEXT) \
 	  $(OUTPRE)ruserpass.$(OBJEXT) $(OUTPRE)secure.$(OBJEXT)
 
-LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir) @KRB4_INCLUDES@
-
-#
-# We cannot have @KRB4_INCLUDES@ under Windows, since we do not use
-# configure, so we redefine LOCALINCLUDES not to have that.
-#
-
-##WIN32##LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)
+LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)
 
 all-unix::	ftp
 all-windows::	$(OUTPRE)ftp.exe
 
 ftp:	$(OBJS) $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS)
-	$(CC_LINK) -o ftp $(OBJS) $(GSS_LIBS) $(KRB4COMPAT_LIBS)
+	$(CC_LINK) -o ftp $(OBJS) $(GSS_LIBS) $(KRB5_BASE_LIBS)
 
 $(OUTPRE)ftp.exe: $(OBJS) $(GLIB) $(KLIB)
 	link $(EXE_LINKOPTS) -out:$@ $** ws2_32.lib advapi32.lib $(SCLIB)
@@ -70,35 +63,3 @@ radix.o: $(srcdir)/radix.c
 secure.o: $(srcdir)/secure.c
 
 # NOPOSTFIX
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)cmds.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
-  cmds.c ftp_var.h pathnames.h
-$(OUTPRE)cmdtab.$(OBJEXT): cmdtab.c ftp_var.h
-$(OUTPRE)domacro.$(OBJEXT): domacro.c ftp_var.h
-$(OUTPRE)ftp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  $(BUILDTOP)/include/gssapi/gssapi_krb5.h $(KRB_ERR_H_DEP) \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
-  $(srcdir)/../arpa/telnet.h ftp.c ftp_var.h secure.h
-$(OUTPRE)getpass.$(OBJEXT): ftp_var.h getpass.c
-$(OUTPRE)glob.$(OBJEXT): ftp_var.h glob.c
-$(OUTPRE)main.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) \
-  $(SRCTOP)/include/kerberosIV/des.h $(SRCTOP)/include/kerberosIV/krb.h \
-  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
-  ftp_var.h main.c
-$(OUTPRE)radix.$(OBJEXT): ftp_var.h radix.c
-$(OUTPRE)ruserpass.$(OBJEXT): ftp_var.h ruserpass.c
-$(OUTPRE)secure.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) \
-  $(SRCTOP)/include/kerberosIV/des.h $(SRCTOP)/include/kerberosIV/krb.h \
-  $(srcdir)/../arpa/ftp.h secure.c secure.h
diff --git a/src/appl/gssftp/ftp/cmds.c b/src/appl/gssftp/ftp/cmds.c
index e733781..ac7a803 100644
--- a/src/appl/gssftp/ftp/cmds.c
+++ b/src/appl/gssftp/ftp/cmds.c
@@ -66,6 +66,8 @@ static char sccsid[] = "@(#)cmds.c	5.26 (Berkeley) 3/5/91";
 #include <ctype.h>
 #include <time.h>
 
+#include <k5-platform.h>
+
 #ifdef HAVE_GETCWD
 #define getwd(x) getcwd(x,MAXPATHLEN)
 #endif
@@ -182,7 +184,7 @@ void setpeer(argc, argv)
 		form = FORM_N;
 		mode = MODE_S;
 		stru = STRU_F;
-		(void) strcpy(bytename, "8"), bytesize = 8;
+		(void) strlcpy(bytename, "8", sizeof(bytename)), bytesize = 8;
 		if (autoauth) {
 			if (do_auth() && autoencrypt) {
  				clevel = PROT_P;
@@ -1615,9 +1617,7 @@ void shell(argc, argv)
 		namep = strrchr(shellprog,'/');
 		if (namep == NULL)
 			namep = shellprog;
-		(void) strcpy(shellnam,"-");
-		(void) strncat(shellnam, ++namep, sizeof(shellnam) - 1 - strlen(shellnam));
-		shellnam[sizeof(shellnam) - 1] = '\0';
+		(void) snprintf(shellnam, sizeof(shellnam), "-%s", ++namep);
 		if (strcmp(namep, "sh") != 0)
 			shellnam[0] = '+';
 		if (debug) {
diff --git a/src/appl/gssftp/ftp/deps b/src/appl/gssftp/ftp/deps
new file mode 100644
index 0000000..7cee7b5
--- /dev/null
+++ b/src/appl/gssftp/ftp/deps
@@ -0,0 +1,28 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)cmds.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
+  cmds.c ftp_var.h pathnames.h
+$(OUTPRE)cmdtab.$(OBJEXT): cmdtab.c ftp_var.h
+$(OUTPRE)domacro.$(OBJEXT): domacro.c ftp_var.h
+$(OUTPRE)ftp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \
+  $(BUILDTOP)/include/gssapi/gssapi_generic.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
+  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
+  $(srcdir)/../arpa/telnet.h ftp.c ftp_var.h secure.h
+$(OUTPRE)getpass.$(OBJEXT): ftp_var.h getpass.c
+$(OUTPRE)glob.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  ftp_var.h glob.c
+$(OUTPRE)main.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
+  ftp_var.h main.c
+$(OUTPRE)radix.$(OBJEXT): ftp_var.h radix.c
+$(OUTPRE)ruserpass.$(OBJEXT): ftp_var.h ruserpass.c
+$(OUTPRE)secure.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
+  $(srcdir)/../arpa/ftp.h secure.c secure.h
diff --git a/src/appl/gssftp/ftp/ftp.M b/src/appl/gssftp/ftp/ftp.M
index ce16881..11bbc93 100644
--- a/src/appl/gssftp/ftp/ftp.M
+++ b/src/appl/gssftp/ftp/ftp.M
@@ -94,10 +94,6 @@ Enables debugging.
 .B \-g
 Disables file name globbing.
 .TP
-\fB\-k\fP \fIrealm\fP
-When using Kerberos v4 authentication, gets tickets in
-.IR realm .
-.TP
 .B \-f
 Causes credentials to be forwarded to the remote host.
 .TP
diff --git a/src/appl/gssftp/ftp/ftp.c b/src/appl/gssftp/ftp/ftp.c
index 227ca5e..3df233f 100644
--- a/src/appl/gssftp/ftp/ftp.c
+++ b/src/appl/gssftp/ftp/ftp.c
@@ -88,11 +88,8 @@ int gettimeofday(struct timeval *tv, void *tz);
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
-#ifndef KRB5_KRB4_COMPAT
-/* krb.h gets this, and Ultrix doesn't protect vs multiple inclusion */
 #include <sys/socket.h>
 #include <netdb.h>
-#endif
 #include <sys/time.h>
 #include <sys/file.h>
 #ifdef HAVE_SYS_SELECT_H
@@ -124,14 +121,8 @@ int gettimeofday(struct timeval *tv, void *tz);
 #define L_INCR 1
 #endif
 
-#ifdef KRB5_KRB4_COMPAT
-#include <krb.h>
+#include <k5-platform.h>
 
-KTEXT_ST ticket;
-CREDENTIALS cred;
-Key_schedule schedule;
-MSG_DAT msg_data;
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 #include <gssapi/gssapi.h>
 /* need to include the krb5 file, because we're doing manual fallback
@@ -411,7 +402,7 @@ int login(char *host)
 		return(1);
 	for (n = 0; n < macnum; ++n) {
 		if (!strcmp("init", macros[n].mac_name)) {
-			(void) strcpy(line, "$init");
+			(void) strlcpy(line, "$init", sizeof(line));
 			makeargv();
 			domacro(margc, margv);
 			break;
@@ -436,20 +427,6 @@ static int secure_command(char* cmd)
 	int length;
 
 	if (auth_type && clevel != PROT_C) {
-#ifdef KRB5_KRB4_COMPAT
-		if (strcmp(auth_type, "KERBEROS_V4") == 0)
-		    if ((length = clevel == PROT_P ?
-			krb_mk_priv((unsigned char *)cmd, (unsigned char *)out,
-				strlen(cmd), schedule,
-				&cred.session, &myctladdr, &hisctladdr)
-		      : krb_mk_safe((unsigned char *)cmd, (unsigned char *)out,
-				strlen(cmd), &cred.session,
-				&myctladdr, &hisctladdr)) == -1) {
-			fprintf(stderr, "krb_mk_%s failed for KERBEROS_V4\n",
-					clevel == PROT_P ? "priv" : "safe");
-			return(0);
-		    }
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 		/* secure_command (based on level) */
 		if (strcmp(auth_type, "GSSAPI") == 0) {
@@ -528,7 +505,7 @@ int command(char *fmt, ...)
 	}
 	oldintr = signal(SIGINT, cmdabort);
 	va_start(ap, fmt);
-	vsprintf(in, fmt, ap);
+	vsnprintf(in, FTP_BUFSIZ, fmt, ap);
 	va_end(ap);
 again:	if (secure_command(in) == 0)
 		return(0);
@@ -692,39 +669,6 @@ int getreply(int expecteof)
 					code, radix_error(kerror), obuf);
 			    n = '5';
 			}
-#ifdef KRB5_KRB4_COMPAT
-			else if (strcmp(auth_type, "KERBEROS_V4") == 0) {
-			    if (safe)
-				kerror = krb_rd_safe((unsigned char *)ibuf,
-						     (unsigned int) len,
-						     &cred.session,
-						     &hisctladdr,
-						     &myctladdr, &msg_data);
-			    else
-				kerror = krb_rd_priv((unsigned char *)ibuf,
-						     (unsigned int) len,
-						     schedule, &cred.session,
-						     &hisctladdr, &myctladdr,
-						     &msg_data);
-			    if (kerror != KSUCCESS) {
-				printf("%d reply %s! (krb_rd_%s: %s)\n", code,
-				       safe ? "modified" : "garbled",
-				       safe ? "safe" : "priv",
-				       krb_get_err_text(kerror));
-				n = '5';
-			    } else {
-				if (debug) printf("%c:", safe ? 'S' : 'P');
-				if(msg_data.app_length < sizeof(ibuf) - 2) {
-				    memmove(ibuf, msg_data.app_data,
-					    msg_data.app_length);
-				    strcpy(&ibuf[msg_data.app_length], "\r\n");
-				} else {
-			            printf("Message too long!");
-				}
-				continue;
-			    }
-			}
-#endif
 #ifdef GSSAPI
 			else if (strcmp(auth_type, "GSSAPI") == 0) {
 				gss_buffer_desc xmit_buf, msg_buf;
@@ -745,7 +689,7 @@ int getreply(int expecteof)
 				  if(msg_buf.length < sizeof(ibuf) - 2 - 1) {
 				    memcpy(ibuf, msg_buf.value, 
 					   msg_buf.length);
-				    strcpy(&ibuf[msg_buf.length], "\r\n");
+				    memcpy(&ibuf[msg_buf.length], "\r\n", 3);
 				  } else {
 				    user_gss_error(maj_stat, min_stat, 
 						   "reply was too long");
@@ -1661,10 +1605,6 @@ void pswitch(int flag)
 		char *authtype;
 		int clvl;
 	        int dlvl;
-#ifdef KRB5_KRB4_COMPAT
-		C_Block session;
-		Key_schedule schedule;
-#endif /* KRB5_KRB4_COMPAT */
 	} proxstruct, tmpstruct;
 	struct comvars *ip, *op;
 
@@ -1742,12 +1682,6 @@ void pswitch(int flag)
 	     clevel = PROT_C;
 	if (!dlevel)
 	     dlevel = PROT_C;
-#ifdef KRB5_KRB4_COMPAT
-	memcpy(ip->session, cred.session, sizeof(cred.session));
-	memcpy(cred.session, op->session, sizeof(cred.session));
-	memcpy(ip->schedule, schedule, sizeof(schedule));
-	memcpy(schedule, op->schedule, sizeof(schedule));
-#endif /* KRB5_KRB4_COMPAT */
 	(void) signal(SIGINT, oldintr);
 	if (abrtflag) {
 		abrtflag = 0;
@@ -1953,10 +1887,6 @@ gunique(char *local)
 	return(new);
 }
 
-#ifdef KRB5_KRB4_COMPAT
-char realm[REALM_SZ + 1];
-#endif /* KRB5_KRB4_COMPAT */
-
 #ifdef GSSAPI
 static const struct {
     gss_OID mech_type;
@@ -1971,14 +1901,10 @@ static const int n_gss_trials = sizeof(gss_trials)/sizeof(gss_trials[0]);
 int do_auth()
 {
 	int oldverbose = verbose;
-#ifdef KRB5_KRB4_COMPAT
-	char *service, inst[INST_SZ];
-	KRB4_32 cksum, checksum = getpid();
-#endif /* KRB5_KRB4_COMPAT */
-#if defined(KRB5_KRB4_COMPAT) || defined(GSSAPI)
+#ifdef GSSAPI
 	u_char out_buf[FTP_BUFSIZ];
 	int i;
-#endif /* KRB5_KRB4_COMPAT */
+#endif /* GSSAPI */
 
 	if (auth_type) return(1);	/* auth already succeeded */
 
@@ -2009,7 +1935,8 @@ int do_auth()
 	  for (trial = 0; trial < n_gss_trials; trial++) {
 	    /* ftp@hostname first, the host@hostname */
 	    /* the V5 GSSAPI binding canonicalizes this for us... */
-	    sprintf(stbuf, "%s@%s", gss_trials[trial].service_name, hostname);
+	    snprintf(stbuf, sizeof(stbuf), "%s@%s",
+		     gss_trials[trial].service_name, hostname);
 	    if (debug)
 	      fprintf(stderr, "Trying to authenticate to <%s>\n", stbuf);
 
@@ -2128,68 +2055,6 @@ int do_auth()
 	  }
 	}
 #endif /* GSSAPI */
-#ifdef KRB5_KRB4_COMPAT
-	if (command("AUTH %s", "KERBEROS_V4") == CONTINUE) {
-	    if (verbose)
-		printf("%s accepted as authentication type\n", "KERBEROS_V4");
-
-	    strncpy(inst, (char *) krb_get_phost(hostname), sizeof(inst) - 1);
-	    inst[sizeof(inst) - 1] = '\0';
-	    if (realm[0] == '\0')
-	    	strncpy(realm, (char *) krb_realmofhost(hostname), sizeof(realm) - 1);
-	    realm[sizeof(realm) - 1] = '\0';
-	    if ((kerror = krb_mk_req(&ticket, service = "ftp",
-					inst, realm, checksum))
-		&& (kerror != KDC_PR_UNKNOWN ||
-	        (kerror = krb_mk_req(&ticket, service = "rcmd",
-					inst, realm, checksum))))
-			fprintf(stderr, "Kerberos V4 krb_mk_req failed: %s\n",
-					krb_get_err_text(kerror));
-	    else if ((kerror = krb_get_cred(service, inst, realm, &cred)))
-			fprintf(stderr, "Kerberos V4 krb_get_cred failed: %s\n",
-					krb_get_err_text(kerror));
-	    else {
-		key_sched(cred.session, schedule);
-		reply_parse = "ADAT=";
-		oldverbose = verbose;
-		verbose = 0;
-		i = ticket.length;
-		if ((kerror = radix_encode(ticket.dat, out_buf, &i, 0)))
-			fprintf(stderr, "Base 64 encoding failed: %s\n",
-					radix_error(kerror));
-		else if (command("ADAT %s", out_buf) != COMPLETE)
-			fprintf(stderr, "Kerberos V4 authentication failed\n");
-		else if (!reply_parse)
-			fprintf(stderr,
-			       "No authentication data received from server\n");
-		else if ((kerror = radix_encode((unsigned char *)reply_parse, out_buf, &i, 1)))
-			fprintf(stderr, "Base 64 decoding failed: %s\n",
-					radix_error(kerror));
-		else if ((kerror = krb_rd_safe(out_buf, (unsigned )i,
-					       &cred.session,
-					       &hisctladdr, &myctladdr, 
-					       &msg_data)))
-			fprintf(stderr, "Kerberos V4 krb_rd_safe failed: %s\n",
-					krb_get_err_text(kerror));
-		else {
-		    /* fetch the (modified) checksum */
-		    (void) memcpy(&cksum, msg_data.app_data, sizeof(cksum));
-		    if (ntohl(cksum) == checksum + 1) {
-			verbose = oldverbose;
-			if (verbose)
-			   printf("Kerberos V4 authentication succeeded\n");
-			reply_parse = NULL;
-			auth_type = "KERBEROS_V4";
-			return(1);
-		    } else fprintf(stderr,
-				"Kerberos V4 mutual authentication failed\n");
-		}
-		verbose = oldverbose;
-		reply_parse = NULL;
-	    }
-	} else	fprintf(stderr, "%s rejected as an authentication type\n",
-				"KERBEROS_V4");
-#endif /* KRB5_KRB4_COMPAT */
 
 	/* Other auth types go here ... */
 
@@ -2233,7 +2098,7 @@ static void abort_remote(FILE *din)
 	 * send IAC in urgent mode instead of DM because 4.3BSD places oob mark
 	 * after urgent byte rather than before as is protocol now
 	 */
-	sprintf(buf, "%c%c%c", IAC, IP, IAC);
+	snprintf(buf, sizeof(buf), "%c%c%c", IAC, IP, IAC);
 	if (send(SOCKETNO(fileno(cout)), buf, 3, MSG_OOB) != 3)
 		PERROR_SOCKET("abort");
 	putc(DM, cout);
diff --git a/src/appl/gssftp/ftp/glob.c b/src/appl/gssftp/ftp/glob.c
index 272e503..bbbcb44 100644
--- a/src/appl/gssftp/ftp/glob.c
+++ b/src/appl/gssftp/ftp/glob.c
@@ -57,6 +57,8 @@ static char sccsid[] = "@(#)glob.c	5.9 (Berkeley) 2/25/91";
 #include <limits.h>
 #endif
 
+#include <k5-platform.h>
+
 #include "ftp_var.h"
 
 #ifdef ARG_MAX
@@ -211,7 +213,8 @@ expand(as)
 				*gpathp = 0;
 				if (gethdir(gpath + 1))
 					globerr = "Unknown user name after ~";
-				(void) strcpy(gpath, gpath + 1);
+				(void) memmove(gpath, gpath + 1,
+					       strlen(gpath));
 			} else
 				(void) strncpy(gpath, home, FTP_BUFSIZ - 1);
 			gpath[FTP_BUFSIZ - 1] = '\0';
@@ -258,10 +261,7 @@ matchdir(pattern)
 	char *base = *gpath ? gpath : ".";
 	char *buffer = 0;
 
-	buffer = malloc(strlen(base) + strlen("\\*") + 1);
-	if (!buffer) return;
-	strcpy(buffer, base);
-	strcat(buffer, "\\*");
+	if (asprintf(&buffer, "%s\\*", base) < 0) return;
 	hFile = FindFirstFile(buffer, &file_data);
 	if (hFile == INVALID_HANDLE_VALUE) {
 		if (!globbed)
@@ -732,12 +732,10 @@ char *
 strspl(cp, dp)
 	register char *cp, *dp;
 {
-	register char *ep = malloc((unsigned)(strlen(cp) + strlen(dp) + 1));
+	char *ep;
 
-	if (ep == (char *)0)
+	if (asprintf(&ep, "%s%s", cp, dp) < 0)
 		fatal("Out of memory");
-	(void) strcpy(ep, cp);
-	(void) strcat(ep, dp);
 	return (ep);
 }
 
@@ -775,10 +773,12 @@ static int gethdir(mhome)
 	char *mhome;
 {
 	register struct passwd *pp = getpwnam(mhome);
+	size_t bufsize = lastgpathp - mhome;
 
-	if (!pp || ((mhome + strlen(pp->pw_dir)) >= lastgpathp))
+	if (!pp)
+		return (1);
+	if (strlcpy(mhome, pp->pw_dir, bufsize) >= bufsize)
 		return (1);
-	(void) strcpy(mhome, pp->pw_dir);
 	return (0);
 }
 #endif
diff --git a/src/appl/gssftp/ftp/main.c b/src/appl/gssftp/ftp/main.c
index 2e8c2cb..6ec5ee1 100644
--- a/src/appl/gssftp/ftp/main.c
+++ b/src/appl/gssftp/ftp/main.c
@@ -55,11 +55,8 @@ static char sccsid[] = "@(#)main.c	5.18 (Berkeley) 3/1/91";
 #include <signal.h>
 #include "ftp_var.h"
 #ifndef _WIN32
-#ifndef KRB5_KRB4_COMPAT
-/* krb.h gets this, and Ultrix doesn't protect vs multiple inclusion */
 #include <sys/socket.h>
 #include <netdb.h>
-#endif
 #include <sys/ioctl.h>
 #include <sys/types.h>
 #include <pwd.h>
@@ -90,11 +87,6 @@ uid_t	getuid();
 sigtype	intr (int), lostpeer (int);
 extern	char *home;
 char	*getlogin();
-#ifdef KRB5_KRB4_COMPAT
-#include <krb.h>
-struct servent staticsp;
-extern char realm[];
-#endif /* KRB5_KRB4_COMPAT */
 
 static void cmdscanner (int);
 static char *slurpstring (void);
@@ -126,12 +118,6 @@ main(argc, argv)
 		fprintf(stderr, "ftp: ftp/tcp: unknown service\n");
 		exit(1);
 	}
-#ifdef KRB5_KRB4_COMPAT
-/* GDM need to static sp so that the information is not lost
-   when kerberos calls getservbyname */
-	memcpy(&staticsp,sp,sizeof(struct servent));
-	sp = &staticsp;
-#endif /* KRB5_KRB4_COMPAT */
 	doglob = 1;
 	interactive = 1;
 	autoauth = 1;
@@ -148,19 +134,6 @@ main(argc, argv)
 				debug++;
 				break;
 
-#ifdef KRB5_KRB4_COMPAT
-			case 'k':
-				if (*++cp != '\0')
-					strncpy(realm, ++cp, REALM_SZ);
-				else if (argc > 1) {
-					argc--, argv++;
-					strncpy(realm, *argv, REALM_SZ);
-				}
-				else
-					fprintf(stderr, "ftp: -k expects arguments\n");
-				goto nextopt;
-#endif
-
 			case 'v':
 				verbose++;
 				break;
diff --git a/src/appl/gssftp/ftp/ruserpass.c b/src/appl/gssftp/ftp/ruserpass.c
index acfabfa..6e603e4 100644
--- a/src/appl/gssftp/ftp/ruserpass.c
+++ b/src/appl/gssftp/ftp/ruserpass.c
@@ -136,7 +136,7 @@ ruserpass(host, aname, apass, aacct)
 	hdir = getenv("HOME");
 	if (hdir == NULL)
 		hdir = ".";
-	(void) sprintf(buf, "%s/.netrc", hdir);
+	(void) snprintf(buf, sizeof(buf), "%s/.netrc", hdir);
 	cfile = fopen(buf, "r");
 	if (cfile == NULL) {
 		if (errno != ENOENT)
@@ -187,8 +187,7 @@ next:
 		case LOGIN:
 			if (token()) {
 				if (*aname == 0) { 
-					*aname = malloc((unsigned) strlen(tokval) + 1);
-					(void) strcpy(*aname, tokval);
+					*aname = strdup(tokval);
 				} else {
 					if (strcmp(*aname, tokval))
 						goto next;
@@ -204,8 +203,7 @@ next:
 				goto bad;
 			}
 			if (token() && *apass == 0) {
-				*apass = malloc((unsigned) strlen(tokval) + 1);
-				(void) strcpy(*apass, tokval);
+				*apass = strdup(tokval);
 			}
 			break;
 		case ACCOUNT:
@@ -216,8 +214,7 @@ next:
 				goto bad;
 			}
 			if (token() && *aacct == 0) {
-				*aacct = malloc((unsigned) strlen(tokval) + 1);
-				(void) strcpy(*aacct, tokval);
+				*aacct = strdup(tokval);
 			}
 			break;
 		case MACDEF:
diff --git a/src/appl/gssftp/ftp/secure.c b/src/appl/gssftp/ftp/secure.c
index b8b9637..3ed15ee 100644
--- a/src/appl/gssftp/ftp/secure.c
+++ b/src/appl/gssftp/ftp/secure.c
@@ -13,15 +13,6 @@ extern gss_ctx_id_t gcontext;
 
 #include <secure.h>	/* stuff which is specific to client or server */
 
-#ifdef KRB5_KRB4_COMPAT
-#include <krb.h>
-
-CRED_DECL
-extern KTEXT_ST ticket;
-extern MSG_DAT msg_data;
-extern Key_schedule schedule;
-#endif /* KRB5_KRB4_COMPAT */
-
 #ifdef _WIN32
 #undef ERROR
 #endif
@@ -82,21 +73,6 @@ static unsigned int smaxbuf;    /* Internal saved value of maxbuf
 static unsigned int smaxqueue;  /* Maximum allowed to queue before 
 				   flush buffer. < smaxbuf by fudgefactor */
 
-#ifdef KRB5_KRB4_COMPAT
-#define KRB4_FUDGE_FACTOR 32	/* Amount of growth
-				 * from cleartext to ciphertext.
-				 * krb_mk_priv adds this # bytes.
-				 * Must be defined for each auth type.
-				 */
-#endif /* KRB5_KRB4_COMPAT */
-
-#ifdef KRB5_KRB4_COMPAT
-/* XXX - The following must be redefined if KERBEROS_V4 is not used
- * but some other auth type is.  They must have the same properties. */
-#define looping_write krb_net_write
-#define looping_read krb_net_read
-#endif
-
 /* perhaps use these in general, certainly use them for GSSAPI */
 
 #ifndef looping_write
@@ -167,12 +143,6 @@ static int secure_determine_constants()
     smaxbuf = maxbuf;
     smaxqueue = maxbuf;
 
-#ifdef KRB5_KRB4_COMPAT
-    /* For KRB4 - we know the fudge factor to be 32 */
-    if (strcmp(auth_type, "KERBEROS_V4") == 0) {
-	smaxqueue = smaxbuf - KRB4_FUDGE_FACTOR;
-    }
-#endif
 #ifdef GSSAPI
     if (strcmp(auth_type, "GSSAPI") == 0) {
 	OM_uint32 maj_stat, min_stat, mlen;
@@ -289,31 +259,6 @@ unsigned int nbyte;
 						     buffer lengths required */
 
 	/* Other auth types go here ... */
-#ifdef KRB5_KRB4_COMPAT
-	if (bufsize < nbyte + fudge) {
-		if (outbuf?
-		    (outbuf = realloc(outbuf, (unsigned) (nbyte + fudge))):
-		    (outbuf = malloc((unsigned) (nbyte + fudge)))) {
-		    bufsize = nbyte + fudge;
-		} else {
-			bufsize = 0;
-			secure_error("%s (in malloc of PROT buffer)",
-				     strerror(errno));
-			return(ERR);
-		}
-	}
-
-	if (strcmp(auth_type, "KERBEROS_V4") == 0)
-	  if ((length = dlevel == PROT_P ?
-	    krb_mk_priv(buf, (unsigned char *) outbuf, nbyte, schedule,
-			SESSION, &myaddr, &hisaddr)
-	  : krb_mk_safe(buf, (unsigned char *) outbuf, nbyte, SESSION,
-			&myaddr, &hisaddr)) == -1) {
-		secure_error("krb_mk_%s failed for KERBEROS_V4",
-				dlevel == PROT_P ? "priv" : "safe");
-		return(ERR);
-	  }
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 	if (strcmp(auth_type, "GSSAPI") == 0) {
 		gss_buffer_desc in_buf, out_buf;
@@ -392,22 +337,6 @@ int fd;
 			return(ERR);
 		}
 		/* Other auth types go here ... */
-#ifdef KRB5_KRB4_COMPAT
-		if (strcmp(auth_type, "KERBEROS_V4") == 0) {
-		  if ((kerror = dlevel == PROT_P ?
-		    krb_rd_priv(ucbuf, length, schedule, SESSION,
-				&hisaddr, &myaddr, &msg_data)
-		  : krb_rd_safe(ucbuf, length, SESSION,
-				&hisaddr, &myaddr, &msg_data))) {
-			secure_error("krb_rd_%s failed for KERBEROS_V4 (%s)",
-					dlevel == PROT_P ? "priv" : "safe",
-					krb_get_err_text(kerror));
-			return(ERR);
-		  }
-		  memmove(ucbuf, msg_data.app_data, msg_data.app_length);
-		  nin = bufp = msg_data.app_length;
-		}
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 		if (strcmp(auth_type, "GSSAPI") == 0) {
 		  gss_buffer_desc xmit_buf, msg_buf;
diff --git a/src/appl/gssftp/ftpd/Makefile.in b/src/appl/gssftp/ftpd/Makefile.in
index 6b184de..8e96a32 100644
--- a/src/appl/gssftp/ftpd/Makefile.in
+++ b/src/appl/gssftp/ftpd/Makefile.in
@@ -25,12 +25,12 @@ SRCS	= $(srcdir)/ftpd.c ftpcmd.c $(srcdir)/popen.c \
 OBJS	= ftpd.o ftpcmd.o glob.o popen.o vers.o radix.o \
 	  secure.o $(LIBOBJS) $(SETENVOBJ)
 
-LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir) @KRB4_INCLUDES@
+LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)
 
 all::	ftpd
 
-ftpd:	$(OBJS) $(PTY_DEPLIB) $(GSS_DEPLIBS) $(KRB4COMPAT_DEPLIBS)
-	$(CC_LINK) -o $@ $(OBJS) $(FTPD_LIBS) $(PTY_LIB) $(UTIL_LIB) $(GSS_LIBS) $(KRB4COMPAT_LIBS)
+ftpd:	$(OBJS) $(PTY_DEPLIB) $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS)
+	$(CC_LINK) -o $@ $(OBJS) $(FTPD_LIBS) $(PTY_LIB) $(UTIL_LIB) $(GSS_LIBS) $(KRB5_BASE_LIBS)
 
 generate-files-mac: ftpcmd.c
 
@@ -76,36 +76,3 @@ popen.o: $(srcdir)/popen.c
 vers.o: $(srcdir)/vers.c
 
 # NOPOSTFIX
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)ftpd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  $(BUILDTOP)/include/gssapi/gssapi_krb5.h $(KRB_ERR_H_DEP) \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-util.h \
-  $(SRCTOP)/include/kerberosIV/des.h $(SRCTOP)/include/kerberosIV/krb.h \
-  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/port-sockets.h \
-  $(srcdir)/../arpa/ftp.h $(srcdir)/../arpa/telnet.h \
-  ftpd.c ftpd_var.h pathnames.h secure.h
-$(OUTPRE)ftpcmd.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssapi/gssapi_generic.h $(KRB_ERR_H_DEP) \
-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(srcdir)/../arpa/ftp.h \
-  $(srcdir)/../arpa/telnet.h ftpcmd.c ftpd_var.h
-$(OUTPRE)popen.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
-  $(BUILDTOP)/include/gssapi/gssapi_generic.h ftpd_var.h \
-  popen.c
-$(OUTPRE)vers.$(OBJEXT): vers.c
-$(OUTPRE)glob.$(OBJEXT): $(srcdir)/../ftp/ftp_var.h \
-  $(srcdir)/../ftp/glob.c
-$(OUTPRE)radix.$(OBJEXT): $(srcdir)/../ftp/ftp_var.h \
-  $(srcdir)/../ftp/radix.c
-$(OUTPRE)secure.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) \
-  $(SRCTOP)/include/kerberosIV/des.h $(SRCTOP)/include/kerberosIV/krb.h \
-  $(srcdir)/../arpa/ftp.h $(srcdir)/../ftp/secure.c secure.h
-$(OUTPRE)getdtablesize.$(OBJEXT): $(srcdir)/../../bsd/getdtablesize.c
diff --git a/src/appl/gssftp/ftpd/deps b/src/appl/gssftp/ftpd/deps
new file mode 100644
index 0000000..1d0d355
--- /dev/null
+++ b/src/appl/gssftp/ftpd/deps
@@ -0,0 +1,29 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)ftpd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \
+  $(BUILDTOP)/include/gssapi/gssapi_generic.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/k5-util.h $(SRCTOP)/include/krb5.h \
+  $(SRCTOP)/include/port-sockets.h $(srcdir)/../arpa/ftp.h \
+  $(srcdir)/../arpa/telnet.h ftpd.c ftpd_var.h pathnames.h \
+  secure.h
+$(OUTPRE)ftpcmd.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
+  $(BUILDTOP)/include/gssapi/gssapi_generic.h $(SRCTOP)/include/k5-buf.h \
+  $(srcdir)/../arpa/ftp.h $(srcdir)/../arpa/telnet.h \
+  ftpcmd.c ftpd_var.h
+$(OUTPRE)popen.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \
+  $(BUILDTOP)/include/gssapi/gssapi_generic.h ftpd_var.h \
+  popen.c
+$(OUTPRE)vers.$(OBJEXT): vers.c
+$(OUTPRE)glob.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(srcdir)/../ftp/ftp_var.h $(srcdir)/../ftp/glob.c
+$(OUTPRE)radix.$(OBJEXT): $(srcdir)/../ftp/ftp_var.h \
+  $(srcdir)/../ftp/radix.c
+$(OUTPRE)secure.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_generic.h \
+  $(srcdir)/../arpa/ftp.h $(srcdir)/../ftp/secure.c secure.h
+$(OUTPRE)getdtablesize.$(OBJEXT): $(srcdir)/../../bsd/getdtablesize.c
diff --git a/src/appl/gssftp/ftpd/ftpcmd.y b/src/appl/gssftp/ftpd/ftpcmd.y
index 30bced0..a57b435 100644
--- a/src/appl/gssftp/ftpd/ftpcmd.y
+++ b/src/appl/gssftp/ftpd/ftpcmd.y
@@ -66,6 +66,7 @@ static char sccsid[] = "@(#)ftpcmd.y	5.24 (Berkeley) 2/25/91";
 #include <ctype.h>
 #include <stdlib.h>
 #include <string.h>
+#include <k5-buf.h>
 
 #include "ftpd_var.h"
 
@@ -75,13 +76,6 @@ unsigned int maxbuf, actualbuf;
 unsigned char *ucbuf;
 
 static int kerror;	/* XXX needed for all auth types */
-#ifdef KRB5_KRB4_COMPAT
-extern	struct sockaddr_in his_addr, ctrl_addr;
-#include <krb.h>
-extern AUTH_DAT kdata;
-extern Key_schedule schedule;
-extern MSG_DAT msg_data;
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 #include <gssapi/gssapi.h>
 #include <gssapi/gssapi_generic.h>
@@ -1089,27 +1083,6 @@ ftpd_getline(s, n, iop)
 	    if (debug) syslog(LOG_DEBUG, "getline got %d from %s <%s>\n", 
 			      len, cs, mic?"MIC":"ENC");
 	    clevel = mic ? PROT_S : PROT_P;
-#ifdef KRB5_KRB4_COMPAT
-	    if (strcmp(auth_type, "KERBEROS_V4") == 0) {
-		if ((kerror = mic ?
-		    krb_rd_safe((unsigned char *)out, len, &kdata.session,
-			    &his_addr, &ctrl_addr, &msg_data)
-		  : krb_rd_priv((unsigned char *)out, len, schedule,
-			    &kdata.session, &his_addr, &ctrl_addr, &msg_data))
-			!= KSUCCESS) {
-		    reply(535, "%s! (%s)",
-			   mic ? "MIC command modified" : "ENC command garbled",
-			   krb_get_err_text(kerror));
-		    syslog(LOG_ERR,"%s failed: %s",
-			   mic ? "MIC krb_rd_safe" : "ENC krb_rd_priv",
-			   krb_get_err_text(kerror));
-		    *s = '\0';
-		    return(s);
-		}
-		(void) memcpy(s, msg_data.app_data, msg_data.app_length);
-		(void) strcpy(s+msg_data.app_length, "\r\n");
-	    }
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 /* we know this is a MIC or ENC already, and out/len already has the bits */
 	    if (strcmp(auth_type, "GSSAPI") == 0) {
@@ -1139,7 +1112,7 @@ ftpd_getline(s, n, iop)
 		}
 
 		memcpy(s, msg_buf.value, msg_buf.length);
-		strcpy(s+msg_buf.length-(s[msg_buf.length-1]?0:1), "\r\n");
+		memcpy(s+msg_buf.length-(s[msg_buf.length-1]?0:1), "\r\n", 3);
 		gss_release_buffer(&min_stat, &msg_buf);
 	    }
 #endif /* GSSAPI */
@@ -1157,7 +1130,7 @@ ftpd_getline(s, n, iop)
 	    }
 
 	}
-#if defined KRB5_KRB4_COMPAT || defined GSSAPI	/* or other auth types */
+#ifdef GSSAPI	/* or other auth types */
 	else {	/* !auth_type */
 	    if ( (!(strncmp(s, "ENC", 3))) || (!(strncmp(s, "MIC", 3)))
 #ifndef NOCONFIDENTIAL
@@ -1169,7 +1142,7 @@ ftpd_getline(s, n, iop)
                 return(s);
 	    }
 	}
-#endif /* KRB5_KRB4_COMPAT || GSSAPI */
+#endif GSSAPI
 
 	if (debug) {
 		if (!strncmp(s, "PASS ", 5) && !guest)
@@ -1438,10 +1411,9 @@ copy(s)
 {
 	char *p;
 
-	p = malloc((unsigned) strlen(s) + 1);
+	p = strdup(s);
 	if (p == NULL)
 		fatal("Ran out of memory.");
-	(void) strcpy(p, s);
 	return (p);
 }
 
@@ -1471,6 +1443,7 @@ help(ctab, s)
 	if (s == 0) {
 		register int i, j, w;
 		int columns, lines;
+		struct k5buf buf;
 
 		lreply(214, "The following %scommands are recognized %s.",
 		    ftype, "(* =>'s unimplemented)");
@@ -1479,16 +1452,18 @@ help(ctab, s)
 			columns = 1;
 		lines = (NCMDS + columns - 1) / columns;
 		for (i = 0; i < lines; i++) {
-			strcpy(str, "   ");
+			krb5int_buf_init_fixed(&buf, str, sizeof(str));
+			krb5int_buf_add(&buf, "   ");
 			for (j = 0; j < columns; j++) {
 				c = ctab + j * lines + i;
-				sprintf(&str[strlen(str)], "%s%c", c->name,
-					c->implemented ? ' ' : '*');
+				krb5int_buf_add_fmt(&buf, "%s%c", c->name,
+						    c->implemented ? ' '
+						    : '*');
 				if (c + lines >= &ctab[NCMDS])
 					break;
 				w = strlen(c->name) + 1;
 				while (w < width) {
-					strcat(str, " ");
+					krb5int_buf_add(&buf, " ");
 					w++;
 				}
 			}
diff --git a/src/appl/gssftp/ftpd/ftpd.M b/src/appl/gssftp/ftpd/ftpd.M
index b26a4bd..33fc1d9 100644
--- a/src/appl/gssftp/ftpd/ftpd.M
+++ b/src/appl/gssftp/ftpd/ftpd.M
@@ -128,12 +128,6 @@ Sets the name of the
 file to use.  The default value is normally set by
 .IR /etc/krb5.conf .
 .TP
-\fB\-s\fP \fIsrvtab\fP
-Sets the name of the
-.I srvtab
-file to use for Kerberos V4 authentication.  The default value is normally
-.IR /etc/srvtab .
-.TP
 \fB\-w \fP{\fBip\fP|\fImaxhostlen\fP[\fB,\fP{\fBstriplocal\fP|\fBnostriplocal\fP}]}
 Controls the form of the remote hostname passed to login(1).
 Specifying \fBip\fP results in the numeric IP address always being
diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index 9d33260..69f7ac3 100644
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -47,10 +47,7 @@ static char sccsid[] = "@(#)ftpd.c	5.40 (Berkeley) 7/2/91";
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
-#ifndef KRB5_KRB4_COMPAT
-/* krb.h gets this, and Ultrix doesn't protect vs multiple inclusion */
 #include <sys/socket.h>
-#endif
 #include <sys/wait.h>
 #include <sys/file.h>
 #include <netinet/in.h>
@@ -80,10 +77,7 @@ static char sccsid[] = "@(#)ftpd.c	5.40 (Berkeley) 7/2/91";
 #define sigsetjmp(j,s)	setjmp(j)
 #define siglongjmp	longjmp
 #endif
-#ifndef KRB5_KRB4_COMPAT
-/* krb.h gets this, and Ultrix doesn't protect vs multiple inclusion */
 #include <netdb.h>
-#endif
 #include <errno.h>
 #include <syslog.h>
 #include <unistd.h>
@@ -102,6 +96,8 @@ static char sccsid[] = "@(#)ftpd.c	5.40 (Berkeley) 7/2/91";
 #include "pathnames.h"
 #include <libpty.h>
 
+#include <k5-platform.h>
+
 #ifdef NEED_SETENV
 extern int setenv(char *, char *, int);
 #endif
@@ -127,18 +123,6 @@ extern int yyparse(void);
 #include <k5-util.h>
 #include "port-sockets.h"
 
-#ifdef KRB5_KRB4_COMPAT
-#include <krb5.h>
-#include <krb.h>
-
-AUTH_DAT kdata;
-KTEXT_ST ticket;
-MSG_DAT msg_data;
-Key_schedule schedule;
-char *keyfile;
-static char *krb4_services[] = { "ftp", "rcmd", NULL };
-#endif /* KRB5_KRB4_COMPAT */
-
 #ifdef GSSAPI
 #include <gssapi/gssapi.h>
 #include <gssapi/gssapi_generic.h>
@@ -160,7 +144,7 @@ static void log_gss_error(int, OM_uint32, OM_uint32, const char *);
 
 char *auth_type;	/* Authentication succeeded?  If so, what type? */
 static char *temp_auth_type;
-int authorized;		/* Auth succeeded and was accepted by krb4 or gssapi */
+int authorized;		/* Auth succeeded and was accepted by gssapi */
 int have_creds;		/* User has credentials on disk */
 
 /*
@@ -292,16 +276,9 @@ main(argc, argv, envp)
 	int addrlen, c, on = 1, tos, port = -1;
 	extern char *optarg;
 	extern int optopt;
-#ifdef KRB5_KRB4_COMPAT
-	char *option_string = "AaCcdElp:r:s:T:t:U:u:vw:";
-#else /* !KRB5_KRB4_COMPAT */
 	char *option_string = "AaCcdElp:r:T:t:U:u:vw:";
-#endif /* KRB5_KRB4_COMPAT */
 	ftpusers = _PATH_FTPUSERS_DEFAULT;
 
-#ifdef KRB5_KRB4_COMPAT
-	keyfile = KEYFILE;
-#endif /* KRB5_KRB4_COMPAT */
 	debug = 0;
 #ifdef SETPROCTITLE
 	/*
@@ -361,12 +338,6 @@ main(argc, argv, envp)
 			setenv("KRB_CONF", optarg, 1);
 			break;
 
-#ifdef KRB5_KRB4_COMPAT
-		case 's':
-			keyfile = optarg;
-			break;
-#endif /* KRB5_KRB4_COMPAT */
-
 		case 't':
 			timeout = atoi(optarg);
 			if (maxtimeout < timeout)
@@ -572,14 +543,13 @@ static char *
 sgetsave(s)
 	char *s;
 {
-	char *new = malloc((unsigned) strlen(s) + 1);
+	char *new = strdup(s);
 
 	if (new == NULL) {
 		perror_reply(421, "Local resource failure: malloc");
 		dologout(1);
 		/* NOTREACHED */
 	}
-	(void) strcpy(new, s);
 	return (new);
 }
 
@@ -772,36 +742,13 @@ user(name)
 				syslog(LOG_ERR, "user: username too long");
 				name = "[username too long]";
 			}
-			sprintf(buf, "GSSAPI user %s is%s authorized as %s",
+			snprintf(buf, sizeof(buf),
+				 "GSSAPI user %s is%s authorized as %s",
 				(char *) client_name.value, 
 				authorized ? "" : " not",
 				name);
 		}
-#ifdef KRB5_KRB4_COMPAT
-		else
-#endif /* KRB5_KRB4_COMPAT */
 #endif /* GSSAPI */
-#ifdef KRB5_KRB4_COMPAT
-		if (auth_type && strcmp(auth_type, "KERBEROS_V4") == 0) {
-			int len;
-
-			authorized = kuserok(&kdata,name) == 0;
-			len = sizeof("Kerberos user .@ is not authorized as "
-				     "; Password required.")
-				+ strlen(kdata.pname)
-				+ strlen(kdata.pinst)
-				+ strlen(kdata.prealm)
-				+ strlen(name);
-			if (len >= sizeof(buf)) {
-				syslog(LOG_ERR, "user: username too long");
-				name = "[username too long]";
-			}
-			sprintf(buf, "Kerberos user %s%s%s@%s is%s authorized as %s",
-				kdata.pname, *kdata.pinst ? "." : "",
-				kdata.pinst, kdata.prealm,
-				authorized ? "" : " not", name);
-		}
-#endif /* KRB5_KRB4_COMPAT */
 
 		if (!authorized && authlevel == AUTHLEVEL_AUTHORIZE) {
 			strncat(buf, "; Access denied.",
@@ -907,9 +854,6 @@ end_login()
 #ifdef GSSAPI
 		krb5_cc_destroy(kcontext, ccache);
 #endif
-#ifdef KRB5_KRB4_COMPAT
-		dest_tkt();
-#endif
 		have_creds = 0;
 	}
 	pw = NULL;
@@ -926,18 +870,6 @@ char *name, *passwd;
 	krb5_creds my_creds;
 	krb5_timestamp now;
 #endif /* GSSAPI */
-#ifdef KRB5_KRB4_COMPAT
-	char realm[REALM_SZ];
-#ifndef GSSAPI
-	char **service;
-	KTEXT_ST ticket;
-	AUTH_DAT authdata;
-	des_cblock key;
-	char instance[INST_SZ];
-	unsigned long faddr;
-	struct hostent *hp;
-#endif /* GSSAPI */
-#endif /* KRB5_KRB4_COMPAT */
 	char ccname[MAXPATHLEN];
 
 #ifdef GSSAPI
@@ -946,7 +878,8 @@ char *name, *passwd;
 		return 0;
 	my_creds.client = me;
 
-	sprintf(ccname, "FILE:/tmp/krb5cc_ftpd%ld", (long) getpid());
+	snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_ftpd%ld",
+		 (long) getpid());
 	if (krb5_cc_resolve(kcontext, ccname, &ccache))
 		return(0);
 	if (krb5_cc_initialize(kcontext, ccache, me))
@@ -979,58 +912,10 @@ char *name, *passwd;
 		krb5_cc_destroy(kcontext, ccache);
 		return(1);
 	}
-#endif /* GSSAPI */
-
-#ifdef KRB5_KRB4_COMPAT
-	if (krb_get_lrealm(realm, 1) != KSUCCESS)
-		goto nuke_ccache;
-
-	sprintf(ccname, "%s_ftpd%ld", TKT_ROOT, (long) getpid());
-	krb_set_tkt_string(ccname);
 
-	if (krb_get_pw_in_tkt(name, "", realm, "krbtgt", realm, 1, passwd))
-		goto nuke_ccache;
-
-#ifndef GSSAPI
-	/* Verify the ticket since we didn't verify the krb5 one. */
-	strncpy(instance, krb_get_phost(hostname), sizeof(instance));
-
-	if ((hp = gethostbyname(instance)) == NULL)
-		goto nuke_ccache;
-	memcpy((char *) &faddr, (char *)hp->h_addr, sizeof(faddr));
-
-	for (service = krb4_services; *service; service++) {
-		if (!read_service_key(*service, instance,
-				      realm, 0, keyfile, key)) {
-			(void) memset(key, 0, sizeof(key));
-			if (krb_mk_req(&ticket, *service,
-				       instance, realm, 33) ||
-			    krb_rd_req(&ticket, *service, instance,
-				       faddr, &authdata,keyfile) ||
-			    kuserok(&authdata, name)) {
-				dest_tkt();
-				goto nuke_ccache;
-			} else
-				break;
-		}
-	}
-
-	if (!*service) {
-		dest_tkt();
-		goto nuke_ccache;
-	}
-
-	if (!want_creds) {
-		dest_tkt();
-		return(1);
-	}
-#endif /* GSSAPI */
-#endif /* KRB5_KRB4_COMPAT */
-
-#if defined(GSSAPI) || defined(KRB5_KRB4_COMPAT)
 	have_creds = 1;
 	return(1);
-#endif /* GSSAPI || KRB5_KRB4_COMPAT */
+#endif /* GSSAPI */
 
 nuke_ccache:
 #ifdef GSSAPI
@@ -1106,16 +991,13 @@ login(passwd, logincode)
 		const char *ccname = krb5_cc_get_name(kcontext, ccache);
 		chown(ccname, pw->pw_uid, pw->pw_gid);
 #endif
-#ifdef KRB5_KRB4_COMPAT
-		chown(tkt_string(), pw->pw_uid, pw->pw_gid);
-#endif
 	}
 
 	(void) krb5_setegid((gid_t)pw->pw_gid);
 	(void) initgroups(pw->pw_name, pw->pw_gid);
 
 	/* open wtmp before chroot */
-	(void) sprintf(ttyline, "ftp%ld", (long) getpid());
+	(void) snprintf(ttyline, sizeof(ttyline), "ftp%ld", (long) getpid());
 	pty_logwtmp(ttyline, pw->pw_name, rhost_sane);
 	logged_in = 1;
 
@@ -1167,9 +1049,8 @@ login(passwd, logincode)
 	if (guest) {
 		reply(230, "Guest login ok, access restrictions apply.");
 #ifdef SETPROCTITLE
-		sprintf(proctitle, "%s: anonymous/%.*s", rhost_sane,
-		    sizeof(proctitle) - strlen(rhost_sane) -
-		    sizeof(": anonymous/"), passwd);
+		snprintf(proctitle, sizeof(proctitle), "%s: anonymous/%.*s",
+			 rhost_sane, passwd);
 		setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 		if (logging)
@@ -1182,7 +1063,8 @@ login(passwd, logincode)
 			reply(230, "User %s logged in.", pw->pw_name);
 		}
 #ifdef SETPROCTITLE
-		sprintf(proctitle, "%s: %s", rhost_sane, pw->pw_name);
+		snprintf(proctitle, sizeof(proctitle), "%s: %s",
+			 rhost_sane, pw->pw_name);
 		setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 		if (logging)
@@ -1218,7 +1100,7 @@ retrieve(cmd, name)
 			reply(501, "filename too long");
 			return;
 		}
-		(void) sprintf(line, cmd, name), name = line;
+		(void) snprintf(line, sizeof(line), cmd, name), name = line;
 		fin = ftpd_popen(line, "r"), closefunc = ftpd_pclose;
 		st.st_size = -1;
 #ifndef NOSTBLKSIZE
@@ -1400,9 +1282,10 @@ dataconn(name, size, fmode)
 	byte_count = 0;
 	if (size != (off_t) -1)
 		/* cast size to long in case sizeof(off_t) > sizeof(long) */
-		(void) sprintf (sizebuf, " (%ld bytes)", (long)size);
+		(void) snprintf (sizebuf, sizeof(sizebuf), " (%ld bytes)",
+				 (long)size);
 	else
-		(void) strcpy(sizebuf, "");
+		sizebuf[0] = '\0';
 	if (pdata >= 0) {
 		int s, fromlen = sizeof(data_dest);
 
@@ -1664,7 +1547,7 @@ statfilecmd(filename)
 		reply(501, "filename too long");
 		return;
 	}
-	(void) sprintf(line, "/bin/ls -lgA %s", filename);
+	(void) snprintf(line, sizeof(line), "/bin/ls -lgA %s", filename);
 	fin = ftpd_popen(line, "r");
 	lreply(211, "status of %s:", filename);
 	p = str;
@@ -1713,8 +1596,8 @@ statcmd()
 
 	lreply(211, "%s FTP server status:", hostname);
 	reply(0, "     %s", version);
-	sprintf(str, "     Connected to %s", remotehost[0] ? remotehost : "");
-	sprintf(&str[strlen(str)], " (%s)", rhost_addra);
+	snprintf(str, sizeof(str), "     Connected to %s (%s)",
+		 remotehost[0] ? remotehost : "", rhost_addra);
 	reply(0, "%s", str);
 	if (auth_type) reply(0, "     Authentication type: %s", auth_type);
 	if (logged_in) {
@@ -1729,41 +1612,35 @@ statcmd()
 	else
 		reply(0, "     Waiting for user name");
 	reply(0, "     Protection level: %s", levelnames[dlevel]);
-	sprintf(str, "     TYPE: %s", typenames[type]);
-	if (type == TYPE_A || type == TYPE_E)
-		sprintf(&str[strlen(str)], ", FORM: %s", formnames[form]);
+	snprintf(str, sizeof(str), "     TYPE: %s", typenames[type]);
+	if (type == TYPE_A || type == TYPE_E) {
+		snprintf(&str[strlen(str)], sizeof(str) - strlen(str),
+			 ", FORM: %s", formnames[form]);
+	}
 	if (type == TYPE_L)
-#if 1
 		strncat(str, " 8", sizeof (str) - strlen(str) - 1);
-#else
-/* this is silly. -- eichin@cygnus.com */
-#if NBBY == 8
-		sprintf(&str[strlen(str)], " %d", NBBY);
-#else
-		sprintf(&str[strlen(str)], " %d", bytesize);	/* need definition! */
-#endif
-#endif
-	sprintf(&str[strlen(str)], "; STRUcture: %s; transfer MODE: %s",
-	    strunames[stru], modenames[mode]);
+	snprintf(&str[strlen(str)], sizeof(str) - strlen(str),
+		 "; STRUcture: %s; transfer MODE: %s",
+		 strunames[stru], modenames[mode]);
 	reply(0, "%s", str);
 	if (data != -1)
-		strcpy(str, "     Data connection open");
+		strlcpy(str, "     Data connection open", sizeof(str));
 	else if (pdata != -1) {
-		strcpy(str, "     in Passive mode");
+		strlcpy(str, "     in Passive mode", sizeof(str));
 		sin4 = &pasv_addr;
 		goto printaddr;
 	} else if (usedefault == 0) {
-		strcpy(str, "     PORT");
 		sin4 = &data_dest;
 printaddr:
 		a = (u_char *) &sin4->sin_addr;
 		p = (u_char *) &sin4->sin_port;
 #define UC(b) (((int) b) & 0xff)
-		sprintf(&str[strlen(str)], " (%d,%d,%d,%d,%d,%d)", UC(a[0]),
-			UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1]));
+		snprintf(str, sizeof(str), "     PORT (%d,%d,%d,%d,%d,%d)",
+			 UC(a[0]), UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]),
+			 UC(p[1]));
 #undef UC
 	} else
-		strcpy(str, "     No data connection");
+		strlcpy(str, "     No data connection", sizeof(str));
 	reply(0, "%s", str);
 	reply(211, "End of status");
 }
@@ -1800,10 +1677,10 @@ reply(n, fmt, p0, p1, p2, p3, p4, p5)
 	va_list ap;
 
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 #else
-	sprintf(buf, fmt, p0, p1, p2, p3, p4, p5);
+	snprintf(buf, sizeof(buf), fmt, p0, p1, p2, p3, p4, p5);
 #endif
 
 	if (auth_type) {
@@ -1813,33 +1690,9 @@ reply(n, fmt, p0, p1, p2, p3, p4, p5)
 		 */
 		char in[FTP_BUFSIZ*3/2], out[FTP_BUFSIZ*3/2];
 		int length = 0, kerror;
-		if (n) sprintf(in, "%d%c", n, cont_char);
+		if (n) snprintf(in, sizeof(in), "%d%c", n, cont_char);
 		else in[0] = '\0';
 		strncat(in, buf, sizeof (in) - strlen(in) - 1);
-#ifdef KRB5_KRB4_COMPAT
-		if (strcmp(auth_type, "KERBEROS_V4") == 0) {
-			if (clevel == PROT_P)
-				length = krb_mk_priv((unsigned char *)in,
-						     (unsigned char *)out,
-						     strlen(in),
-						     schedule, &kdata.session,
-						     &ctrl_addr,
-						     &his_addr);
-			else
-				length = krb_mk_safe((unsigned char *)in,
-						     (unsigned char *)out,
-						     strlen(in),
-						     &kdata.session,
-						     &ctrl_addr,
-						     &his_addr);
-			if (length == -1) {
-				syslog(LOG_ERR,
-				       "krb_mk_%s failed for KERBEROS_V4",
-				       clevel == PROT_P ? "priv" : "safe");
-				fputs(in,stdout);
-			}
-		} else
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 		/* reply (based on level) */
 		if (strcmp(auth_type, "GSSAPI") == 0) {
@@ -1918,10 +1771,10 @@ lreply(n, fmt, p0, p1, p2, p3, p4, p5)
 	va_list ap;
 
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 #else
-	sprintf(buf, fmt, p0, p1, p2, p3, p4, p5);
+	snprintf(buf, sizeof(buf), fmt, p0, p1, p2, p3, p4, p5);
 #endif
 	cont_char = '-';
 	reply(n, "%s", buf);
@@ -2083,7 +1936,7 @@ dolog(sin4)
 		exit(1);
 	}
 #ifdef SETPROCTITLE
-	sprintf(proctitle, "%s: connected", rhost_sane);
+	snprintf(proctitle, sizeof(proctitle), "%s: connected", rhost_sane);
 	setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 
@@ -2110,9 +1963,6 @@ dologout(status)
 #ifdef GSSAPI
 		krb5_cc_destroy(kcontext, ccache);
 #endif
-#ifdef KRB5_KRB4_COMPAT
-		dest_tkt();
-#endif
 	}
 	/* beware of flushing buffers after a SIGPIPE */
 	_exit(status);
@@ -2230,7 +2080,7 @@ gunique(local)
 	cp = new + strlen(new);
 	*cp++ = '.';
 	for (count = 1; count < 100; count++) {
-		(void) sprintf(cp, "%d", count);
+		(void) snprintf(cp, sizeof(new) - (cp - new), "%d", count);
 		if (stat(new, &st) < 0)
 			return(new);
 	}
@@ -2272,12 +2122,6 @@ char *atype;
 	if (auth_type)
 		reply(534, "Authentication type already set to %s", auth_type);
 	else
-#ifdef KRB5_KRB4_COMPAT
-	if (strcmp(atype, "KERBEROS_V4") == 0)
-		reply(334, "Using authentication type %s; ADAT must follow",
-				temp_auth_type = atype);
-	else
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 	if (strcmp(atype, "GSSAPI") == 0)
 		reply(334, "Using authentication type %s; ADAT must follow",
@@ -2293,13 +2137,6 @@ auth_data(adata)
 char *adata;
 {
 	int kerror, length;
-#ifdef KRB5_KRB4_COMPAT
-	static char **service=NULL;
-	char instance[INST_SZ];
-	KRB4_32 cksum;
-	char buf[FTP_BUFSIZ];
-	u_char out_buf[sizeof(buf)];
-#endif /* KRB5_KRB4_COMPAT */
 
 	if (auth_type) {
 		reply(503, "Authentication already established");
@@ -2309,61 +2146,6 @@ char *adata;
 		reply(503, "Must identify AUTH type before ADAT");
 		return(0);
 	}
-#ifdef KRB5_KRB4_COMPAT
-	if (strcmp(temp_auth_type, "KERBEROS_V4") == 0) {
-	        kerror = radix_encode(adata, out_buf, &length, 1);
-		if (kerror) {
-			reply(501, "Couldn't decode ADAT (%s)",
-			      radix_error(kerror));
-			syslog(LOG_ERR, "Couldn't decode ADAT (%s)",
-			       radix_error(kerror));
-			return(0);
-		}
-		(void) memcpy((char *)ticket.dat, (char *)out_buf, ticket.length = length);
-		strcpy(instance, "*");
-
-		kerror = 255;
-		for (service = krb4_services; *service; service++) {
-		  kerror = krb_rd_req(&ticket, *service, instance,
-				      his_addr.sin_addr.s_addr, 
-				      &kdata, keyfile);
-		  /* Success */
-		  if(!kerror) break;
-		} 
-		/* rd_req failed.... */
-		if(kerror) {
-		  secure_error("ADAT: Kerberos V4 krb_rd_req: %s",
-			       krb_get_err_text(kerror));
-		  return(0);
-		}
-
-		/* add one to the (formerly) sealed checksum, and re-seal it */
-		cksum = kdata.checksum + 1;
-		cksum = htonl(cksum);
-		key_sched(kdata.session,schedule);
-		if ((length = krb_mk_safe((u_char *)&cksum, out_buf, sizeof(cksum),
-					  &kdata.session,&ctrl_addr, &his_addr)) == -1) {
-			secure_error("ADAT: krb_mk_safe failed");
-			return(0);
-		}
-		if (length >= (FTP_BUFSIZ - sizeof("ADAT=")) / 4 * 3) {
-			secure_error("ADAT: reply too long");
-			return(0);
-		}
-
-		kerror = radix_encode(out_buf, buf, &length, 0);
-		if (kerror) {
-			secure_error("Couldn't encode ADAT reply (%s)",
-				     radix_error(kerror));
-			return(0);
-		}
-		reply(235, "ADAT=%s", buf);
-		/* Kerberos V4 authentication succeeded */
-		auth_type = temp_auth_type;
-		temp_auth_type = NULL;
-		return(1);
-	}
-#endif /* KRB5_KRB4_COMPAT */
 #ifdef GSSAPI
 	if (strcmp(temp_auth_type, "GSSAPI") == 0) {
 		int replied = 0;
@@ -2413,7 +2195,8 @@ char *adata;
 		localname[sizeof(localname) - 1] = '\0';
 
 		for (gservice = gss_services; *gservice; gservice++) {
-			sprintf(service_name, "%s@%s", *gservice, localname);
+			snprintf(service_name, sizeof(service_name),
+				 "%s@%s", *gservice, localname);
 			name_buf.value = service_name;
 			name_buf.length = strlen(name_buf.value) + 1;
 			if (debug)
@@ -2722,7 +2505,8 @@ send_file_list(whichfiles)
 				ret = -2; /* XXX */
 				goto data_err;
 			}
-			sprintf(nbuf, "%s/%s", dirname, dir->d_name);
+			snprintf(nbuf, sizeof(nbuf), "%s/%s",
+				 dirname, dir->d_name);
 
 			/*
 			 * We have to do a stat to insure it's
@@ -2918,17 +2702,13 @@ ftpd_gss_convert_creds(name, creds)
 	OM_uint32 major_status, minor_status;
 	krb5_principal me;
 	char ccname[MAXPATHLEN];
-#ifdef KRB5_KRB4_COMPAT
-	krb5_principal kpcserver;
-	krb5_creds increds, *v5creds;
-	CREDENTIALS v4creds;
-#endif
 
 	/* Set up ccache */
 	if (krb5_parse_name(kcontext, name, &me))
 		return;
 
-	sprintf(ccname, "FILE:/tmp/krb5cc_ftpd%ld", (long) getpid());
+	snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_ftpd%ld",
+		 (long) getpid());
 	if (krb5_cc_resolve(kcontext, ccname, &ccache))
 		return;
 	if (krb5_cc_initialize(kcontext, ccache, me))
@@ -2939,47 +2719,9 @@ ftpd_gss_convert_creds(name, creds)
 	if (major_status != GSS_S_COMPLETE)
 		goto cleanup;
 
-#ifdef KRB5_KRB4_COMPAT
-	/* Convert krb5 creds to krb4 */
-
-	if (krb5_build_principal_ext(kcontext, &kpcserver, 
-				     krb5_princ_realm(kcontext, me)->length,
-				     krb5_princ_realm(kcontext, me)->data,
-				     6, "krbtgt",
-				     krb5_princ_realm(kcontext, me)->length,
-				     krb5_princ_realm(kcontext, me)->data,
-				     0))
-		goto cleanup;
-
-	memset((char *) &increds, 0, sizeof(increds));
-	increds.client = me;
-	increds.server = kpcserver;
-	increds.times.endtime = 0;
-	increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
-	if (krb5_get_credentials(kcontext, 0, ccache, &increds, &v5creds))
-		goto cleanup;
-	if (krb524_convert_creds_kdc(kcontext, v5creds, &v4creds))
-		goto cleanup;
-
-	sprintf(ccname, "%s_ftpd%ld", TKT_ROOT, (long) getpid());
-	krb_set_tkt_string(ccname);
-
-	if (in_tkt(v4creds.pname, v4creds.pinst) != KSUCCESS)
-		goto cleanup;
-
-	if (krb_save_credentials(v4creds.service, v4creds.instance,
-				 v4creds.realm, v4creds.session,
-				 v4creds.lifetime, v4creds.kvno,
-				 &(v4creds.ticket_st), v4creds.issue_date))
-		goto cleanup_v4;
-#endif /* KRB5_KRB4_COMPAT */
 	have_creds = 1;
 	return;
 
-#ifdef KRB5_KRB4_COMPAT
-cleanup_v4:
-	dest_tkt();
-#endif
 cleanup:
 	krb5_cc_destroy(kcontext, ccache);
 }
diff --git a/src/appl/libpty/Makefile.in b/src/appl/libpty/Makefile.in
index 92b33f8..924ef1b 100644
--- a/src/appl/libpty/Makefile.in
+++ b/src/appl/libpty/Makefile.in
@@ -110,48 +110,3 @@ $(BUILDTOP)/include/autoconf.h: $(SRCTOP)/include/autoconf.h.in
 @lib_frag@
 @libobj_frag@
 
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-pty_err.so pty_err.po $(OUTPRE)pty_err.$(OBJEXT): $(COM_ERR_DEPS) \
-  pty_err.c
-cleanup.so cleanup.po $(OUTPRE)cleanup.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h cleanup.c \
-  libpty.h pty-int.h pty_err.h
-getpty.so getpty.po $(OUTPRE)getpty.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h getpty.c \
-  libpty.h pty-int.h pty_err.h
-init_slave.so init_slave.po $(OUTPRE)init_slave.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  init_slave.c libpty.h pty-int.h pty_err.h
-open_ctty.so open_ctty.po $(OUTPRE)open_ctty.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  libpty.h open_ctty.c pty-int.h pty_err.h
-open_slave.so open_slave.po $(OUTPRE)open_slave.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  libpty.h open_slave.c pty-int.h pty_err.h
-update_utmp.so update_utmp.po $(OUTPRE)update_utmp.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  libpty.h pty-int.h pty_err.h update_utmp.c
-update_wtmp.so update_wtmp.po $(OUTPRE)update_wtmp.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  libpty.h pty-int.h pty_err.h update_wtmp.c
-vhangup.so vhangup.po $(OUTPRE)vhangup.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h libpty.h \
-  pty-int.h pty_err.h vhangup.c
-void_assoc.so void_assoc.po $(OUTPRE)void_assoc.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
-  libpty.h pty-int.h pty_err.h void_assoc.c
-logwtmp.so logwtmp.po $(OUTPRE)logwtmp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h libpty.h \
-  logwtmp.c pty-int.h pty_err.h
-init.so init.po $(OUTPRE)init.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h init.c \
-  libpty.h pty-int.h pty_err.h
-sane_hostname.so sane_hostname.po $(OUTPRE)sane_hostname.$(OBJEXT): \
-  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  libpty.h pty-int.h pty_err.h sane_hostname.c
diff --git a/src/appl/libpty/deps b/src/appl/libpty/deps
new file mode 100644
index 0000000..841f663
--- /dev/null
+++ b/src/appl/libpty/deps
@@ -0,0 +1,45 @@
+# 
+# Generated makefile dependencies follow.
+#
+pty_err.so pty_err.po $(OUTPRE)pty_err.$(OBJEXT): $(COM_ERR_DEPS) \
+  pty_err.c
+cleanup.so cleanup.po $(OUTPRE)cleanup.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h cleanup.c \
+  libpty.h pty-int.h pty_err.h
+getpty.so getpty.po $(OUTPRE)getpty.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h getpty.c libpty.h \
+  pty-int.h pty_err.h
+init_slave.so init_slave.po $(OUTPRE)init_slave.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
+  init_slave.c libpty.h pty-int.h pty_err.h
+open_ctty.so open_ctty.po $(OUTPRE)open_ctty.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
+  libpty.h open_ctty.c pty-int.h pty_err.h
+open_slave.so open_slave.po $(OUTPRE)open_slave.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
+  libpty.h open_slave.c pty-int.h pty_err.h
+update_utmp.so update_utmp.po $(OUTPRE)update_utmp.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/port-sockets.h \
+  libpty.h pty-int.h pty_err.h update_utmp.c
+update_wtmp.so update_wtmp.po $(OUTPRE)update_wtmp.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
+  libpty.h pty-int.h pty_err.h update_wtmp.c
+vhangup.so vhangup.po $(OUTPRE)vhangup.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h libpty.h \
+  pty-int.h pty_err.h vhangup.c
+void_assoc.so void_assoc.po $(OUTPRE)void_assoc.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h \
+  libpty.h pty-int.h pty_err.h void_assoc.c
+logwtmp.so logwtmp.po $(OUTPRE)logwtmp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h libpty.h \
+  logwtmp.c pty-int.h pty_err.h
+init.so init.po $(OUTPRE)init.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/port-sockets.h init.c \
+  libpty.h pty-int.h pty_err.h
+sane_hostname.so sane_hostname.po $(OUTPRE)sane_hostname.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  libpty.h pty-int.h pty_err.h sane_hostname.c
diff --git a/src/appl/libpty/getpty.c b/src/appl/libpty/getpty.c
index 610a471..e5bf285 100644
--- a/src/appl/libpty/getpty.c
+++ b/src/appl/libpty/getpty.c
@@ -23,6 +23,7 @@
 #include "com_err.h"
 #include "libpty.h"
 #include "pty-int.h"
+#include "k5-platform.h"
 
 long
 ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
@@ -59,12 +60,11 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 	*fd = -1;
 	return PTY_GETPTY_NOPTY;
     }
-    if (strlen(slaveret) > slavelength - 1) {
+    if (strlcpy(slave, slaveret, slavelength) >= slavelength) {
 	close(*fd);
 	*fd = -1;
 	return PTY_GETPTY_SLAVE_TOOLONG;
     }
-    else strcpy(slave, slaveret);
     return 0;
 #else /*HAVE__GETPTY*/
     
@@ -92,12 +92,11 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 #endif
 #endif
 	if (p) {
-	    if (strlen(p) > slavelength - 1) {
+	    if (strlcpy(slave, p, slavelength) >= slavelength) {
 		    close (*fd);
 		    *fd = -1;
 		    return PTY_GETPTY_SLAVE_TOOLONG;
 	    }
-	    strcpy(slave, p);
 	    return 0;
 	}
 
@@ -106,7 +105,7 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 	    return PTY_GETPTY_FSTAT;
 	}
 	ptynum = (int)(stb.st_rdev&0xFF);
-	sprintf(slavebuf, "/dev/ttyp%x", ptynum);
+	snprintf(slavebuf, sizeof(slavebuf), "/dev/ttyp%x", ptynum);
 	if (strlen(slavebuf) > slavelength - 1) {
 	    close(*fd);
 	    *fd = -1;
@@ -116,7 +115,7 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 	return 0;
     } else {
     	for (cp = "pqrstuvwxyzPQRST";*cp; cp++) {
-	    sprintf(slavebuf,"/dev/ptyXX");
+	    snprintf(slavebuf,sizeof(slavebuf),"/dev/ptyXX");
 	    slavebuf[sizeof("/dev/pty") - 1] = *cp;
 	    slavebuf[sizeof("/dev/ptyp") - 1] = '0';
 	    if (stat(slavebuf, &stb) < 0)
diff --git a/src/appl/libpty/logwtmp.c b/src/appl/libpty/logwtmp.c
index 21a35d3..03cfab4 100644
--- a/src/appl/libpty/logwtmp.c
+++ b/src/appl/libpty/logwtmp.c
@@ -73,7 +73,7 @@ pty_logwtmp(const char *tty, const char *user, const char *host)
 	cp = tty + len - 2;
     else
 	cp = tty;
-    sprintf(utmp_id, "kr%s", cp);
+    snprintf(utmp_id, sizeof(utmp_id), "kr%s", cp);
     strncpy(utx.ut_id, utmp_id, sizeof(utx.ut_id));
 
 #ifdef HAVE_SETUTXENT
diff --git a/src/appl/libpty/update_utmp.c b/src/appl/libpty/update_utmp.c
index 8f3d6a6..292a167 100644
--- a/src/appl/libpty/update_utmp.c
+++ b/src/appl/libpty/update_utmp.c
@@ -319,6 +319,7 @@
 #include "com_err.h"
 #include "libpty.h"
 #include "pty-int.h"
+#include "k5-platform.h"
 
 #if !defined(UTMP_FILE) && defined(_PATH_UTMP)
 #define UTMP_FILE _PATH_UTMP
@@ -547,7 +548,7 @@ pty_update_utmp(int process_type, int pid, const char *username,
      * pain, and would eit cross-compiling.
      */
 #ifdef __hpux
-    strcpy(utmp_id, cp);
+    strlcpy(utmp_id, cp, sizeof(utmp_id));
 #else
     if (len > 2 && *(cp - 1) != '/')
 	snprintf(utmp_id, sizeof(utmp_id), "k%s", cp - 1);
diff --git a/src/appl/sample/deps b/src/appl/sample/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/sample/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/sample/sclient/deps b/src/appl/sample/sclient/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/sample/sclient/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/sample/sclient/sclient.c b/src/appl/sample/sclient/sclient.c
index 6ad305a..bd9c4e8 100644
--- a/src/appl/sample/sclient/sclient.c
+++ b/src/appl/sample/sclient/sclient.c
@@ -159,11 +159,16 @@ main(int argc, char *argv[])
 	if (getnameinfo(ap->ai_addr, ap->ai_addrlen, abuf, sizeof(abuf),
 			pbuf, sizeof(pbuf), NI_NUMERICHOST | NI_NUMERICSERV)) {
 	    memset(abuf, 0, sizeof(abuf));
+	    memset(pbuf, 0, sizeof(pbuf));
 	    strncpy(abuf, "[error, cannot print address?]",
 		    sizeof(abuf)-1);
-	    strcpy(pbuf, "[?]");
+	    strncpy(pbuf, "[?]", sizeof(pbuf)-1);
 	}
-	sprintf(mbuf, "error contacting %s port %s", abuf, pbuf);
+	memset(mbuf, 0, sizeof(mbuf));
+	strncpy(mbuf, "error contacting ", sizeof(mbuf)-1);
+	strncat(mbuf, abuf, sizeof(mbuf) - strlen(mbuf) - 1);
+	strncat(mbuf, " port ", sizeof(mbuf) - strlen(mbuf) - 1);
+	strncat(mbuf, pbuf, sizeof(mbuf) - strlen(mbuf) - 1);
 	sock = socket(ap->ai_family, SOCK_STREAM, 0);
 	if (sock < 0) {
 	    fprintf(stderr, "%s: socket: %s\n", mbuf, strerror(errno));
diff --git a/src/appl/sample/sserver/deps b/src/appl/sample/sserver/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/sample/sserver/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/sample/sserver/sserver.c b/src/appl/sample/sserver/sserver.c
index 2cb971b..39710fb 100644
--- a/src/appl/sample/sserver/sserver.c
+++ b/src/appl/sample/sserver/sserver.c
@@ -210,12 +210,15 @@ main(argc, argv)
     }
 
     /* Get client name */
+    repbuf[sizeof(repbuf) - 1] = '\0';
     retval = krb5_unparse_name(context, ticket->enc_part2->client, &cname);
     if (retval){
 	syslog(LOG_ERR, "unparse failed: %s", error_message(retval));
-        sprintf(repbuf, "You are <unparse error>\n");
+	strncpy(repbuf, "You are <unparse error>\n", sizeof(repbuf) - 1);
     } else {
-        sprintf(repbuf, "You are %s\n", cname);
+	strncpy(repbuf, "You are ", sizeof(repbuf) - 1);
+	strncat(repbuf, cname, sizeof(repbuf) - 1 - strlen(repbuf));
+	strncat(repbuf, "\n", sizeof(repbuf) - 1 - strlen(repbuf));
 	free(cname);
     }
     xmitlen = htons(strlen(repbuf));
diff --git a/src/appl/simple/client/deps b/src/appl/simple/client/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/simple/client/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/simple/client/sim_client.c b/src/appl/simple/client/sim_client.c
index d5a1607..4873f89 100644
--- a/src/appl/simple/client/sim_client.c
+++ b/src/appl/simple/client/sim_client.c
@@ -325,6 +325,12 @@ main(argc, argv)
     printf("Sent encrypted message: %d bytes\n", i);
     krb5_free_data_contents(context, &packet);
 
+    retval = krb5_rc_destroy(context, rcache);
+    if (retval) {
+	com_err(progname, retval, "while deleting replay cache");
+	exit(1);
+    }
+    krb5_auth_con_setrcache(context, auth_context, NULL);
     krb5_auth_con_free(context, auth_context);
     krb5_free_context(context);
     
diff --git a/src/appl/simple/deps b/src/appl/simple/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/simple/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/simple/server/deps b/src/appl/simple/server/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/simple/server/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/telnet/configure.in b/src/appl/telnet/configure.in
index 7285696..fc91a5a 100644
--- a/src/appl/telnet/configure.in
+++ b/src/appl/telnet/configure.in
@@ -18,12 +18,6 @@ fi
 dnl
 KRB5_NEED_PROTO([#include <stdlib.h>],setenv)
 AC_C_CONST
-if test "$KRB4_LIB" = ''; then
-	AC_MSG_RESULT(No Kerberos 4 authentication)
-else
-	AC_MSG_RESULT(Kerberos 4 authentication enabled)
-	AC_DEFINE(KRB4,1,[Define if krb4 authentication is enabled])
-fi
 KRB5_BUILD_LIBRARY
 KRB5_BUILD_LIBOBJS
 dnl
@@ -81,12 +75,6 @@ KRB5_NEED_PROTO([#include <sys/types.h>
 #include <netdb.h>],herror,1)
 dnl
 CHECK_SIGNALS
-if test "$KRB4_LIB" = ''; then
-	AC_MSG_RESULT(No Kerberos 4 authentication)
-else
-	AC_MSG_RESULT(Kerberos 4 authentication enabled)
-	AC_DEFINE(KRB4)
-fi
 dnl
 KRB5_BUILD_PROGRAM
 dnl
diff --git a/src/appl/telnet/deps b/src/appl/telnet/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/telnet/deps
@@ -0,0 +1 @@
+# No dependencies here.
diff --git a/src/appl/telnet/libtelnet/Makefile.in b/src/appl/telnet/libtelnet/Makefile.in
index a3b401b..2b8aff2 100644
--- a/src/appl/telnet/libtelnet/Makefile.in
+++ b/src/appl/telnet/libtelnet/Makefile.in
@@ -25,7 +25,7 @@ BUILDTOP=$(REL)..$(S)..$(S)..
 #
 AUTH_DEF=-DAUTHENTICATION -DENCRYPTION -DDES_ENCRYPTION -DKRB5 -DFORWARD \
 	-UNO_LOGIN_F -DLOGIN_CAP_F -DLOGIN_PROGRAM=KRB5_PATH_LOGIN
-LOCALINCLUDES=-I.. -I$(srcdir)/.. @KRB4_INCLUDES@
+LOCALINCLUDES=-I.. -I$(srcdir)/..
 DEFINES = -DTELNET_BUFSIZE=65535 $(AUTH_DEF)
 LIBOBJS=@LIBOBJS@
 
@@ -42,7 +42,6 @@ SRCS=   $(srcdir)/auth.c \
 	$(srcdir)/encrypt.c \
 	$(srcdir)/genget.c \
 	$(srcdir)/misc.c \
-	$(srcdir)/kerberos.c \
 	$(srcdir)/kerberos5.c \
 	$(srcdir)/forward.c \
 	$(srcdir)/enc_des.c \
@@ -57,7 +56,7 @@ SRCS=   $(srcdir)/auth.c \
 	$(srcdir)/strerror.c
 
 STLIBOBJS=   auth.o encrypt.o genget.o \
-	misc.o kerberos.o kerberos5.o forward.o enc_des.o \
+	misc.o kerberos5.o forward.o enc_des.o \
 	$(LIBOBJS) getent.o $(SETENVOBJ)
 
 TELNET_H= $(srcdir)/../arpa/telnet.h
@@ -73,10 +72,6 @@ auth.o: misc-proto.h
 encrypt.o: $(TELNET_H)
 encrypt.o: encrypt.h
 encrypt.o: misc.h
-kerberos.o: $(TELNET_H)
-kerberos.o: encrypt.h
-kerberos.o: auth.h
-kerberos.o: misc.h
 kerberos5.o: $(TELNET_H)
 kerberos5.o: encrypt.h
 kerberos5.o: auth.h
@@ -92,47 +87,3 @@ install::
 @lib_frag@
 @libobj_frag@
 
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-auth.so auth.po $(OUTPRE)auth.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  auth-proto.h auth.c auth.h enc-proto.h encrypt.h misc-proto.h
-encrypt.so encrypt.po $(OUTPRE)encrypt.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  enc-proto.h encrypt.c encrypt.h misc-proto.h misc.h
-genget.so genget.po $(OUTPRE)genget.$(OBJEXT): genget.c \
-  misc-proto.h misc.h
-misc.so misc.po $(OUTPRE)misc.$(OBJEXT): auth-proto.h \
-  auth.h enc-proto.h encrypt.h misc-proto.h misc.c misc.h
-kerberos.so kerberos.po $(OUTPRE)kerberos.$(OBJEXT): \
-  $(KRB_ERR_H_DEP) $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/kerberosIV/des.h \
-  $(SRCTOP)/include/kerberosIV/krb.h $(SRCTOP)/include/krb5.h \
-  $(srcdir)/../arpa/telnet.h auth-proto.h auth.h enc-proto.h \
-  encrypt.h kerberos.c misc-proto.h misc.h
-kerberos5.so kerberos5.po $(OUTPRE)kerberos5.$(OBJEXT): \
-  $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(SRCTOP)/include/krb5.h \
-  $(srcdir)/../arpa/telnet.h auth-proto.h auth.h enc-proto.h \
-  encrypt.h kerberos5.c krb5forw.h misc-proto.h misc.h
-forward.so forward.po $(OUTPRE)forward.$(OBJEXT): $(BUILDTOP)/include/krb5/krb5.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/krb5.h forward.c \
-  krb5forw.h
-enc_des.so enc_des.po $(OUTPRE)enc_des.$(OBJEXT): $(BUILDTOP)/include/krb5/krb5.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/krb5.h $(srcdir)/../arpa/telnet.h \
-  enc-proto.h enc_des.c encrypt.h key-proto.h misc-proto.h
-setenv.so setenv.po $(OUTPRE)setenv.$(OBJEXT): misc-proto.h \
-  setenv.c
-getent.so getent.po $(OUTPRE)getent.$(OBJEXT): getent.c \
-  gettytab.h
-parsetos.so parsetos.po $(OUTPRE)parsetos.$(OBJEXT): \
-  misc-proto.h parsetos.c
-strdup.so strdup.po $(OUTPRE)strdup.$(OBJEXT): strdup.c
-strcasecmp.so strcasecmp.po $(OUTPRE)strcasecmp.$(OBJEXT): \
-  strcasecmp.c
-strchr.so strchr.po $(OUTPRE)strchr.$(OBJEXT): strchr.c
-strrchr.so strrchr.po $(OUTPRE)strrchr.$(OBJEXT): strrchr.c
-strftime.so strftime.po $(OUTPRE)strftime.$(OBJEXT): \
-  strftime.c
-strerror.so strerror.po $(OUTPRE)strerror.$(OBJEXT): \
-  strerror.c
diff --git a/src/appl/telnet/libtelnet/auth-proto.h b/src/appl/telnet/libtelnet/auth-proto.h
index 6b49570..faf806f 100644
--- a/src/appl/telnet/libtelnet/auth-proto.h
+++ b/src/appl/telnet/libtelnet/auth-proto.h
@@ -86,15 +86,6 @@ void auth_debug (int);
 void auth_printsub (unsigned char *, int, unsigned char *, unsigned int);
 
 
-#ifdef	KRB4
-int kerberos4_init (Authenticator *, int);
-int kerberos4_send (Authenticator *);
-void kerberos4_is (Authenticator *, unsigned char *, int);
-void kerberos4_reply (Authenticator *, unsigned char *, int);
-int kerberos4_status (Authenticator *, char *, int);
-void kerberos4_printsub (unsigned char *, int, unsigned char *, unsigned int);
-#endif
-
 #ifdef	KRB5
 int kerberos5_init (Authenticator *, int);
 int kerberos5_send (Authenticator *);
diff --git a/src/appl/telnet/libtelnet/auth.c b/src/appl/telnet/libtelnet/auth.c
index 28b8ae8..1a10066 100644
--- a/src/appl/telnet/libtelnet/auth.c
+++ b/src/appl/telnet/libtelnet/auth.c
@@ -142,24 +142,6 @@ Authenticator authenticators[] = {
 				kerberos5_status,
 				kerberos5_printsub },
 #endif
-#ifdef	KRB4
-# ifdef ENCRYPTION
-	{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
-				kerberos4_init,
-				kerberos4_send,
-				kerberos4_is,
-				kerberos4_reply,
-				kerberos4_status,
-				kerberos4_printsub },
-# endif	/* ENCRYPTION */
-	{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
-				kerberos4_init,
-				kerberos4_send,
-				kerberos4_is,
-				kerberos4_reply,
-				kerberos4_status,
-				kerberos4_printsub },
-#endif
 	{ 0, },
 };
 
@@ -658,7 +640,7 @@ auth_gen_printsub(data, cnt, buf, buflen)
 	buf[buflen-2] = '*';
 	buflen -= 2;
 	for (; cnt > 0; cnt--, data++) {
-		sprintf((char *)tbuf, " %d", *data);
+		snprintf((char *)tbuf, sizeof(tbuf), " %d", *data);
 		for (cp = tbuf; *cp && buflen > 0; --buflen)
 			*buf++ = *cp++;
 		if (buflen <= 0)
diff --git a/src/appl/telnet/libtelnet/deps b/src/appl/telnet/libtelnet/deps
new file mode 100644
index 0000000..09cecf0
--- /dev/null
+++ b/src/appl/telnet/libtelnet/deps
@@ -0,0 +1,38 @@
+# 
+# Generated makefile dependencies follow.
+#
+auth.so auth.po $(OUTPRE)auth.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  auth-proto.h auth.c auth.h enc-proto.h encrypt.h misc-proto.h
+encrypt.so encrypt.po $(OUTPRE)encrypt.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  enc-proto.h encrypt.c encrypt.h misc-proto.h misc.h
+genget.so genget.po $(OUTPRE)genget.$(OBJEXT): genget.c \
+  misc-proto.h misc.h
+misc.so misc.po $(OUTPRE)misc.$(OBJEXT): auth-proto.h \
+  auth.h enc-proto.h encrypt.h misc-proto.h misc.c misc.h
+kerberos5.so kerberos5.po $(OUTPRE)kerberos5.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(srcdir)/../arpa/telnet.h \
+  auth-proto.h auth.h enc-proto.h encrypt.h kerberos5.c \
+  krb5forw.h misc-proto.h misc.h
+forward.so forward.po $(OUTPRE)forward.$(OBJEXT): $(BUILDTOP)/include/krb5/krb5.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/krb5.h forward.c \
+  krb5forw.h
+enc_des.so enc_des.po $(OUTPRE)enc_des.$(OBJEXT): $(BUILDTOP)/include/krb5/krb5.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/krb5.h $(srcdir)/../arpa/telnet.h \
+  enc-proto.h enc_des.c encrypt.h key-proto.h misc-proto.h
+setenv.so setenv.po $(OUTPRE)setenv.$(OBJEXT): misc-proto.h \
+  setenv.c
+getent.so getent.po $(OUTPRE)getent.$(OBJEXT): getent.c \
+  gettytab.h
+parsetos.so parsetos.po $(OUTPRE)parsetos.$(OBJEXT): \
+  misc-proto.h parsetos.c
+strdup.so strdup.po $(OUTPRE)strdup.$(OBJEXT): strdup.c
+strcasecmp.so strcasecmp.po $(OUTPRE)strcasecmp.$(OBJEXT): \
+  strcasecmp.c
+strchr.so strchr.po $(OUTPRE)strchr.$(OBJEXT): strchr.c
+strrchr.so strrchr.po $(OUTPRE)strrchr.$(OBJEXT): strrchr.c
+strftime.so strftime.po $(OUTPRE)strftime.$(OBJEXT): \
+  strftime.c
+strerror.so strerror.po $(OUTPRE)strerror.$(OBJEXT): \
+  strerror.c
diff --git a/src/appl/telnet/libtelnet/enc_des.c b/src/appl/telnet/libtelnet/enc_des.c
index c399d22..aa00ae2 100644
--- a/src/appl/telnet/libtelnet/enc_des.c
+++ b/src/appl/telnet/libtelnet/enc_des.c
@@ -550,28 +550,28 @@ fb64_printsub(data, cnt, buf, buflen, type)
 
 	switch(data[2]) {
 	case FB64_IV:
-		sprintf(lbuf, "%s_IV", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV", type);
 		cp = lbuf;
 		goto common;
 
 	case FB64_IV_OK:
-		sprintf(lbuf, "%s_IV_OK", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV_OK", type);
 		cp = lbuf;
 		goto common;
 
 	case FB64_IV_BAD:
-		sprintf(lbuf, "%s_IV_BAD", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV_BAD", type);
 		cp = lbuf;
 		goto common;
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[2]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[2]);
 		cp = lbuf;
 	common:
 		for (; (buflen > 0) && (*buf = *cp++); buf++)
 			buflen--;
 		for (i = 3; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			for (cp = lbuf; (buflen > 0) && (*buf = *cp++); buf++)
 				buflen--;
 		}
diff --git a/src/appl/telnet/libtelnet/encrypt.c b/src/appl/telnet/libtelnet/encrypt.c
index e99f346..6317ece 100644
--- a/src/appl/telnet/libtelnet/encrypt.c
+++ b/src/appl/telnet/libtelnet/encrypt.c
@@ -984,7 +984,7 @@ encrypt_gen_printsub(data, cnt, buf, buflen)
 	buf[buflen-2] = '*';
 	buflen -= 2;;
 	for (; cnt > 0; cnt--, data++) {
-		sprintf(tbuf, " %d", *data);
+		snprintf(tbuf, sizeof(tbuf), " %d", *data);
 		for (cp = tbuf; *cp && buflen > 0; --buflen)
 			*buf++ = *cp++;
 		if (buflen <= 0)
diff --git a/src/appl/telnet/libtelnet/forward.c b/src/appl/telnet/libtelnet/forward.c
index 09d5589..98dcb78 100644
--- a/src/appl/telnet/libtelnet/forward.c
+++ b/src/appl/telnet/libtelnet/forward.c
@@ -57,7 +57,7 @@ rd_and_store_for_creds(context, auth_context, inbuf, ticket)
     if ((retval = krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)))
 	return(retval);
 
-    sprintf(ccname, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+    snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_p%ld", (long) getpid());
     setenv("KRB5CCNAME", ccname, 1);
 
     if ((retval = krb5_cc_resolve(context, ccname, &ccache)))
diff --git a/src/appl/telnet/libtelnet/gettytab.c b/src/appl/telnet/libtelnet/gettytab.c
index aaad43a..d50f879 100644
--- a/src/appl/telnet/libtelnet/gettytab.c
+++ b/src/appl/telnet/libtelnet/gettytab.c
@@ -117,7 +117,7 @@ nchktc()
 		write(2, "Gettytab entry too long\n", 24);
 		q[TABBUFSIZ - (p-tbuf)] = 0;
 	}
-	strcpy(p, q+1);
+	strlcpy(p, q+1, TABBUFSIZ - (p-tbuf));
 	tbuf = holdtbuf;
 	return(1);
 }
diff --git a/src/appl/telnet/libtelnet/kerberos.c b/src/appl/telnet/libtelnet/kerberos.c
deleted file mode 100644
index 7e0d736..0000000
--- a/src/appl/telnet/libtelnet/kerberos.c
+++ /dev/null
@@ -1,744 +0,0 @@
-/*-
- * Copyright (c) 1991, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* based on @(#)kerberos.c	8.1 (Berkeley) 6/4/93 */
-
-/*
- * Copyright (C) 1990 by the Massachusetts Institute of Technology
- *
- * Export of this software from the United States of America may
- * require a specific license from the United States Government.
- * It is the responsibility of any person or organization contemplating
- * export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * Copyright (C) 1998 by the FundsXpress, INC.
- * 
- * All rights reserved.
- * 
- * Export of this software from the United States of America may require
- * a specific license from the United States Government.  It is the
- * responsibility of any person or organization contemplating export to
- * obtain such a license before exporting.
- * 
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of FundsXpress. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission.  FundsXpress makes no representations about the suitability of
- * this software for any purpose.  It is provided "as is" without express
- * or implied warranty.
- * 
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-#ifdef	KRB4
-/* this code must be compiled in the krb5 tree.  disgustingly, there
-   is code in here which declares structures which happen to mirror
-   the krb4 des structures.  I didn't want to rototill this *completely*
-   so this is how it's going to work. --marc */
-#include <krb5.h>
-#include <sys/types.h>
-#include <errno.h>
-#include <arpa/telnet.h>
-#include <stdio.h>
-#include <des.h>        /* BSD wont include this in krb.h, so we do it here */
-#include <krb.h>
-#ifdef	__STDC__
-#include <stdlib.h>
-#endif
-#ifdef	HAVE_STRING_H
-#include <string.h>
-#else
-#include <strings.h>
-#endif
-
-#include "encrypt.h"
-#include "auth.h"
-#include "misc.h"
-
-extern int auth_debug_mode;
-extern krb5_context telnet_context;
-
-int kerberos4_cksum (unsigned char *, int);
-
-static unsigned char str_data[1024] = { IAC, SB, TELOPT_AUTHENTICATION, 0,
-			  		AUTHTYPE_KERBEROS_V4, };
-#if 0
-static unsigned char str_name[1024] = { IAC, SB, TELOPT_AUTHENTICATION,
-					TELQUAL_NAME, };
-#endif
-
-#define	KRB_AUTH	0		/* Authentication data follows */
-#define	KRB_REJECT	1		/* Rejected (reason might follow) */
-#define	KRB_ACCEPT	2		/* Accepted */
-#define	KRB_CHALLENGE	3		/* Challenge for mutual auth. */
-#define	KRB_RESPONSE	4		/* Response for mutual auth. */
-
-#define KRB_SERVICE_NAME   "rcmd"
-
-static	KTEXT_ST auth;
-static	char name[ANAME_SZ];
-static	AUTH_DAT adat = { 0 };
-#ifdef	ENCRYPTION
-static Block	session_key	= { 0 };
-static krb5_keyblock krbkey;
-static Block	challenge	= { 0 };
-#endif	/* ENCRYPTION */
-
-	static int
-Data(ap, type, d, c)
-	Authenticator *ap;
-	int type;
-	const void *d;
-	int c;
-{
-        unsigned char *p = str_data + 4;
-	const unsigned char *cd = (const unsigned char *)d;
-	size_t spaceleft = sizeof(str_data) - 4;
-	if (c == -1)
-		c = strlen((const char *)cd);
-
-        if (auth_debug_mode) {
-                printf("%s:%d: [%d] (%d)",
-                        str_data[3] == TELQUAL_IS ? ">>>IS" : ">>>REPLY",
-                        str_data[3],
-                        type, c);
-                printd(d, c);
-                printf("\r\n");
-        }
-	*p++ = ap->type;
-	*p++ = ap->way;
-	*p++ = type;
-	spaceleft -= 3;
-        while (c-- > 0) {
-		if ((*p++ = *cd++) == IAC) {
-			*p++ = IAC;
-			spaceleft--;
-		}
-		if ((--spaceleft < 4) && c) {
-			errno = ENOMEM;
-			return -1;
-		}
-        }
-        *p++ = IAC;
-        *p++ = SE;
-	if (str_data[3] == TELQUAL_IS)
-		printsub('>', &str_data[2], p - (&str_data[2]));
-        return(net_write(str_data, p - str_data));
-}
-
-	int
-kerberos4_init(ap, server)
-	Authenticator *ap;
-	int server;
-{
-	FILE *fp;
-
-	if (server) {
-		str_data[3] = TELQUAL_REPLY;
-		if ((fp = fopen(KEYFILE, "r")) == NULL)
-			return(0);
-		fclose(fp);
-	} else {
-		str_data[3] = TELQUAL_IS;
-	}
-
-	kerberos5_init(NULL, server);
-
-	return(1);
-}
-
-char dst_realm_buf[REALM_SZ], *dest_realm = NULL;
-unsigned int dst_realm_sz = REALM_SZ;
-
-	int
-kerberos4_send(ap)
-	Authenticator *ap;
-{
-	KTEXT_ST kauth;
-	char instance[INST_SZ];
-	char *realm;
-	char *krb_realmofhost();
-	char *krb_get_phost();
-	CREDENTIALS cred;
-	int r;
-#ifdef ENCRYPTION
-	krb5_data data;
-	krb5_enc_data encdata;
-	krb5_error_code code;
-	krb5_keyblock rand_key;
-#endif
-
-	printf("[ Trying KERBEROS4 ... ]\r\n");	
-	if (!UserNameRequested) {
-		if (auth_debug_mode) {
-			printf("Kerberos V4: no user name supplied\r\n");
-		}
-		return(0);
-	}
-
-	memset(instance, 0, sizeof(instance));
-
-	if ((realm = krb_get_phost(RemoteHostName)))
-		strncpy(instance, realm, sizeof(instance));
-
-	instance[sizeof(instance)-1] = '\0';
-
-	realm = dest_realm ? dest_realm : krb_realmofhost(RemoteHostName);
-
-	if (!realm) {
-		printf("Kerberos V4: no realm for %s\r\n", RemoteHostName);
-		return(0);
-	}
-	if ((r = krb_mk_req(&kauth, KRB_SERVICE_NAME, instance, realm, 0))) {
-		printf("mk_req failed: %s\r\n", krb_get_err_text(r));
-		return(0);
-	}
-	if ((r = krb_get_cred(KRB_SERVICE_NAME, instance, realm, &cred))) {
-		printf("get_cred failed: %s\r\n", krb_get_err_text(r));
-		return(0);
-	}
-	if (!auth_sendname(UserNameRequested, strlen(UserNameRequested))) {
-		if (auth_debug_mode)
-			printf("Not enough room for user name\r\n");
-		return(0);
-	}
-	if (auth_debug_mode)
-		printf("Sent %d bytes of authentication data\r\n", kauth.length);
-	if (!Data(ap, KRB_AUTH, (void *)kauth.dat, kauth.length)) {
-		if (auth_debug_mode)
-			printf("Not enough room for authentication data\r\n");
-		return(0);
-	}
-#ifdef	ENCRYPTION
-	/*
-	 * If we are doing mutual authentication, get set up to send
-	 * the challenge, and verify it when the response comes back.
-	 */
-	if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) {
-		register int i;
-
-		data.data = cred.session;
-		data.length = 8; /* sizeof(cred.session) */;
-
-		if ((code = krb5_c_random_seed(telnet_context, &data))) {
-		    com_err("libtelnet", code,
-			    "while seeding random number generator");
-		    return(0);
-		}
-
-		if ((code = krb5_c_make_random_key(telnet_context,
-						   ENCTYPE_DES_CBC_RAW,
-						   &rand_key))) {
-		    com_err("libtelnet", code,
-			    "while creating random session key");
-		    return(0);
-		}
-
-		/* the krb4 code uses ecb mode, but on a single block
-		   with a zero ivec, ecb and cbc are the same */
-		krbkey.enctype = ENCTYPE_DES_CBC_RAW;
-		krbkey.length = 8;
-		krbkey.contents = cred.session;
-
-		encdata.ciphertext.data = rand_key.contents;
-		encdata.ciphertext.length = rand_key.length;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		data.data = session_key;
-		data.length = 8;
-
-		code = krb5_c_decrypt(telnet_context, &krbkey, 0, 0,
-				      &encdata, &data);
-
-		krb5_free_keyblock_contents(telnet_context, &rand_key);
-
-		if (code) {
-		    com_err("libtelnet", code, "while encrypting random key");
-		    return(0);
-		}
-
-		encdata.ciphertext.data = session_key;
-		encdata.ciphertext.length = 8;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		data.data = challenge;
-		data.length = 8;
-
-		code = krb5_c_decrypt(telnet_context, &krbkey, 0, 0,
-				      &encdata, &data);
-
-		/*
-		 * Increment the challenge by 1, and encrypt it for
-		 * later comparison.
-		 */
-		for (i = 7; i >= 0; --i) {
-			register int x;
-			x = (unsigned int)challenge[i] + 1;
-			challenge[i] = x;	/* ignore overflow */
-			if (x < 256)		/* if no overflow, all done */
-				break;
-		}
-
-		data.data = challenge;
-		data.length = 8;
-
-		encdata.ciphertext.data = challenge;
-		encdata.ciphertext.length = 8;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		if ((code = krb5_c_encrypt(telnet_context, &krbkey, 0, 0, 
-					   &data, &encdata))) {
-		    com_err("libtelnet", code, "while encrypting random key");
-		    return(0);
-		}
-	}
-#endif	/* ENCRYPTION */
-	
-	if (auth_debug_mode) {
-		printf("CK: %d:", kerberos4_cksum(kauth.dat, kauth.length));
-		printd(kauth.dat, kauth.length);
-		printf("\r\n");
-		printf("Sent Kerberos V4 credentials to server\r\n");
-	}
-	return(1);
-}
-
-	void
-kerberos4_is(ap, data, cnt)
-	Authenticator *ap;
-	unsigned char *data;
-	int cnt;
-{
-#ifdef	ENCRYPTION
-	Session_Key skey;
-	Block datablock, tmpkey;
-	krb5_data kdata;
-	krb5_enc_data encdata;
-	krb5_error_code code;
-#endif	/* ENCRYPTION */
-	char realm[REALM_SZ];
-	char instance[INST_SZ];
-	int r;
-
-	if (cnt-- < 1)
-		return;
-	switch (*data++) {
-	case KRB_AUTH:
-		if (krb_get_lrealm(realm, 1) != KSUCCESS) {
-			Data(ap, KRB_REJECT, (void *)"No local V4 Realm.", -1);
-			auth_finished(ap, AUTH_REJECT);
-			if (auth_debug_mode)
-				printf("No local realm\r\n");
-			return;
-		}
-		memcpy((void *)auth.dat, (void *)data, auth.length = cnt);
-		if (auth_debug_mode) {
-			printf("Got %d bytes of authentication data\r\n", cnt);
-			printf("CK: %d:", kerberos4_cksum(auth.dat, auth.length));
-			printd(auth.dat, auth.length);
-			printf("\r\n");
-		}
-		instance[0] = '*'; instance[1] = 0;
-		if ((r = krb_rd_req(&auth, KRB_SERVICE_NAME,
-				    instance, 0, &adat, ""))) {
-			if (auth_debug_mode)
-				printf("Kerberos failed him as %s\r\n", name);
-			Data(ap, KRB_REJECT, (const void *)krb_get_err_text(r), -1);
-			auth_finished(ap, AUTH_REJECT);
-			return;
-		}
-#ifdef	ENCRYPTION
-		memcpy((void *)session_key, (void *)adat.session, sizeof(Block));
-#endif	/* ENCRYPTION */
-		krb_kntoln(&adat, name);
-
-		if (UserNameRequested && !kuserok(&adat, UserNameRequested))
-			Data(ap, KRB_ACCEPT, (void *)0, 0);
-		else
-			Data(ap, KRB_REJECT,
-				(void *)"user is not authorized", -1);
-		auth_finished(ap, AUTH_USER);
-		break;
-
-	case KRB_CHALLENGE:
-#ifndef	ENCRYPTION
-		Data(ap, KRB_RESPONSE, (void *)0, 0);
-#else	/* ENCRYPTION */
-		if (!VALIDKEY(session_key)) {
-			/*
-			 * We don't have a valid session key, so just
-			 * send back a response with an empty session
-			 * key.
-			 */
-			Data(ap, KRB_RESPONSE, (void *)0, 0);
-			break;
-		}
-
-		/*
-		 * Initialize the random number generator since it's
-		 * used later on by the encryption routine.
-		 */
-
-		kdata.data = session_key;
-		kdata.length = 8;
-
-		if ((code = krb5_c_random_seed(telnet_context, &kdata))) {
-		    com_err("libtelnet", code,
-			    "while seeding random number generator");
-		    return;
-		}
-
-		memcpy((void *)datablock, (void *)data, sizeof(Block));
-		/*
-		 * Take the received encrypted challenge, and encrypt
-		 * it again to get a unique session_key for the
-		 * ENCRYPT option.
-		 */
-		krbkey.enctype = ENCTYPE_DES_CBC_RAW;
-		krbkey.length = 8;
-		krbkey.contents = session_key;
-
-		kdata.data = datablock;
-		kdata.length = 8;
-
-		encdata.ciphertext.data = tmpkey;
-		encdata.ciphertext.length = 8;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		if ((code = krb5_c_encrypt(telnet_context, &krbkey, 0, 0,
-					   &kdata, &encdata))) {
-		    com_err("libtelnet", code, "while encrypting random key");
-		    return;
-		}
-
-		skey.type = SK_DES;
-		skey.length = 8;
-		skey.data = tmpkey;
-		encrypt_session_key(&skey, 1);
-		/*
-		 * Now decrypt the received encrypted challenge,
-		 * increment by one, re-encrypt it and send it back.
-		 */
-		encdata.ciphertext.data = datablock;
-		encdata.ciphertext.length = 8;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		kdata.data = challenge;
-		kdata.length = 8;
-
-		if ((code = krb5_c_decrypt(telnet_context, &krbkey, 0, 0, 
-					   &encdata, &kdata))) {
-		    com_err("libtelnet", code, "while decrypting challenge");
-		    return;
-		}
-
-		for (r = 7; r >= 0; r--) {
-			register int t;
-			t = (unsigned int)challenge[r] + 1;
-			challenge[r] = t;	/* ignore overflow */
-			if (t < 256)		/* if no overflow, all done */
-				break;
-		}
-
-		kdata.data = challenge;
-		kdata.length = 8;
-
-		encdata.ciphertext.data = challenge;
-		encdata.ciphertext.length = 8;
-		encdata.enctype = ENCTYPE_UNKNOWN;
-
-		if ((code = krb5_c_encrypt(telnet_context, &krbkey, 0, 0,
-					   &kdata, &encdata))) {
-		    com_err("libtelnet", code, "while decrypting challenge");
-		    return;
-		}
-
-		Data(ap, KRB_RESPONSE, (void *)challenge, sizeof(challenge));
-#endif	/* ENCRYPTION */
-		break;
-
-	default:
-		if (auth_debug_mode)
-			printf("Unknown Kerberos option %d\r\n", data[-1]);
-		Data(ap, KRB_REJECT, 0, 0);
-		break;
-	}
-}
-
-	void
-kerberos4_reply(ap, data, cnt)
-	Authenticator *ap;
-	unsigned char *data;
-	int cnt;
-{
-#ifdef	ENCRYPTION
-	Session_Key skey;
-	krb5_data kdata;
-	krb5_enc_data encdata;
-	krb5_error_code code;
-
-#endif	/* ENCRYPTION */
-
-	if (cnt-- < 1)
-		return;
-	switch (*data++) {
-	case KRB_REJECT:
-		if (cnt > 0) {
-			printf("[ Kerberos V4 refuses authentication because %.*s ]\r\n",
-				cnt, data);
-		} else
-			printf("[ Kerberos V4 refuses authentication ]\r\n");
-		auth_send_retry();
-		return;
-	case KRB_ACCEPT:
-		printf("[ Kerberos V4 accepts you ]\r\n");
-		if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) {
-			/*
-			 * Send over the encrypted challenge.
-		 	 */
-#ifndef	ENCRYPTION
-			Data(ap, KRB_CHALLENGE, (void *)0, 0);
-#else	/* ENCRYPTION */
-			Data(ap, KRB_CHALLENGE, (void *)session_key,
-						sizeof(session_key));
-
-			kdata.data = session_key;
-			kdata.length = 8;
-
-			encdata.ciphertext.data = session_key;
-			encdata.ciphertext.length = 8;
-			encdata.enctype = ENCTYPE_UNKNOWN;
-
-			if ((code = krb5_c_encrypt(telnet_context, &krbkey,
-						   0, 0, &kdata, &encdata))) {
-				com_err("libtelnet", code,
-					"while encrypting session_key");
-				return;
-			}
-
-			skey.type = SK_DES;
-			skey.length = 8;
-			skey.data = session_key;
-			encrypt_session_key(&skey, 0);
-#endif	/* ENCRYPTION */
-			return;
-		}
-		auth_finished(ap, AUTH_USER);
-		return;
-	case KRB_RESPONSE:
-#ifdef	ENCRYPTION
-		/*
-		 * Verify that the response to the challenge is correct.
-		 */
-		if ((cnt != sizeof(Block)) ||
-		    (0 != memcmp((void *)data, (void *)challenge,
-						sizeof(challenge))))
-		{
-#endif	/* ENCRYPTION */
-			printf("[ Kerberos V4 challenge failed!!! ]\r\n");
-			auth_send_retry();
-			return;
-#ifdef	ENCRYPTION
-		}
-		printf("[ Kerberos V4 challenge successful ]\r\n");
-		auth_finished(ap, AUTH_USER);
-#endif	/* ENCRYPTION */
-		break;
-	default:
-		if (auth_debug_mode)
-			printf("Unknown Kerberos option %d\r\n", data[-1]);
-		return;
-	}
-}
-
-	int
-kerberos4_status(ap, kname, level)
-	Authenticator *ap;
-	char *kname;
-	int level;
-{
-	if (level < AUTH_USER)
-		return(level);
-
-	/*
-	 * Always copy in UserNameRequested if the authentication
-	 * is valid, because the higher level routines need it.
-	 */
-	if (UserNameRequested) {
-		/* the name buffer comes from telnetd/telnetd{-ktd}.c */
-		strncpy(kname, UserNameRequested, 255);
-		kname[255] = '\0';
-	}
-
-	if (UserNameRequested && !kuserok(&adat, UserNameRequested)) {
-		return(AUTH_VALID);
-	} else
-		return(AUTH_USER);
-}
-
-#define	BUMP(buf, len)		while (*(buf)) {++(buf), --(len);}
-#define	ADDC(buf, len, c)	if ((len) > 0) {*(buf)++ = (c); --(len);}
-
-	void
-kerberos4_printsub(data, cnt, buf, buflen)
-	unsigned char *data, *buf;
-	int cnt;
-	unsigned int buflen;
-{
-	char lbuf[32];
-	register int i;
-
-	buf[buflen-1] = '\0';		/* make sure its NULL terminated */
-	buflen -= 1;
-
-	switch(data[3]) {
-	case KRB_REJECT:		/* Rejected (reason might follow) */
-		strncpy((char *)buf, " REJECT ", buflen);
-		goto common;
-
-	case KRB_ACCEPT:		/* Accepted (name might follow) */
-		strncpy((char *)buf, " ACCEPT ", buflen);
-	common:
-		BUMP(buf, buflen);
-		if (cnt <= 4)
-			break;
-		ADDC(buf, buflen, '"');
-		for (i = 4; i < cnt; i++)
-			ADDC(buf, buflen, data[i]);
-		ADDC(buf, buflen, '"');
-		ADDC(buf, buflen, '\0');
-		break;
-
-	case KRB_AUTH:			/* Authentication data follows */
-		strncpy((char *)buf, " AUTH", buflen);
-		goto common2;
-
-	case KRB_CHALLENGE:
-		strncpy((char *)buf, " CHALLENGE", buflen);
-		goto common2;
-
-	case KRB_RESPONSE:
-		strncpy((char *)buf, " RESPONSE", buflen);
-		goto common2;
-
-	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
-		strncpy((char *)buf, lbuf, buflen);
-	common2:
-		BUMP(buf, buflen);
-		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
-			strncpy((char *)buf, lbuf, buflen);
-			BUMP(buf, buflen);
-		}
-		break;
-	}
-}
-
-	int
-kerberos4_cksum(d, n)
-	unsigned char *d;
-	int n;
-{
-	int ck = 0;
-
-	/*
-	 * A comment is probably needed here for those not
-	 * well versed in the "C" language.  Yes, this is
-	 * supposed to be a "switch" with the body of the
-	 * "switch" being a "while" statement.  The whole
-	 * purpose of the switch is to allow us to jump into
-	 * the middle of the while() loop, and then not have
-	 * to do any more switch()s.
-	 *
-	 * Some compilers will spit out a warning message
-	 * about the loop not being entered at the top.
-	 */
-	switch (n&03)
-	while (n > 0) {
-	case 0:
-		ck ^= (int)*d++ << 24;
-		--n;
-	case 3:
-		ck ^= (int)*d++ << 16;
-		--n;
-	case 2:
-		ck ^= (int)*d++ << 8;
-		--n;
-	case 1:
-		ck ^= (int)*d++;
-		--n;
-	}
-	return(ck);
-}
-#else
-#include <krb5.h>
-#include <errno.h>
-
-#endif
-
-#ifdef notdef
-
-prkey(msg, key)
-	char *msg;
-	unsigned char *key;
-{
-	register int i;
-	printf("%s:", msg);
-	for (i = 0; i < 8; i++)
-		printf(" %3d", key[i]);
-	printf("\r\n");
-}
-#endif
diff --git a/src/appl/telnet/libtelnet/kerberos5.c b/src/appl/telnet/libtelnet/kerberos5.c
index 1ef6fba..40eb184 100644
--- a/src/appl/telnet/libtelnet/kerberos5.c
+++ b/src/appl/telnet/libtelnet/kerberos5.c
@@ -66,6 +66,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include "krb5.h"
+#include "k5-platform.h"
 
 #include "com_err.h"
 #include <netdb.h>
@@ -266,12 +267,11 @@ kerberos5_send(ap)
 
 	    rdata.magic = 0;
 	    rdata.length = strlen(telnet_krb5_realm);
-	    rdata.data = (char *) malloc(rdata.length + 1);
+	    rdata.data = strdup(telnet_krb5_realm);
 	    if (rdata.data == NULL) {
 	        fprintf(stderr, "malloc failed\n");
 		return(0);
 	    }
-	    strcpy(rdata.data, telnet_krb5_realm);
 	    krb5_princ_set_realm(telnet_context, creds.server, &rdata);
 	}
 
@@ -440,9 +440,9 @@ kerberos5_is(ap, data, cnt)
 		    r = krb5_rd_req(telnet_context, &auth_context, &auth,
 				    NULL, keytabid, NULL, &ticket);
 		if (r) {
-			(void) strcpy(errbuf, "krb5_rd_req failed: ");
-			errbuf[sizeof(errbuf) - 1] = '\0';
-			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
+			(void) snprintf(errbuf, sizeof(errbuf),
+					"krb5_rd_req failed: %s",
+					error_message(r));
 			goto errout;
 		}
 
@@ -452,7 +452,8 @@ kerberos5_is(ap, data, cnt)
 		 * the default is of length 4.
 		 */
 		if (krb5_princ_size(telnet_context,ticket->server) < 1) {
-		    (void) strcpy(errbuf, "malformed service name");
+		    (void) strlcpy(errbuf, "malformed service name",
+				   sizeof(errbuf));
 		    goto errout;
 		}
 		if (krb5_princ_component(telnet_context,ticket->server,0)->length < 256) {
@@ -464,15 +465,16 @@ kerberos5_is(ap, data, cnt)
 					       ticket->server,0)->length] = '\0';
 		    if (strcmp("host", princ)) {
                         if(strlen(princ) < sizeof(errbuf) - 39) {
-                            (void) sprintf(errbuf, "incorrect service name: \"%s\" != \"host\"",
+			    (void) snprintf(errbuf, sizeof(errbuf), "incorrect service name: \"%s\" != \"host\"",
                                            princ);
                         } else {
-                            (void) sprintf(errbuf, "incorrect service name: principal != \"host\"");
+                            (void) snprintf(errbuf, sizeof(errbuf), "incorrect service name: principal != \"host\"");
                         }
 			goto errout;
 		    }
 		} else {
-		    (void) strcpy(errbuf, "service name too long");
+		    (void) strlcpy(errbuf, "service name too long",
+				   sizeof(errbuf));
 		    goto errout;
 		}
 
@@ -480,16 +482,16 @@ kerberos5_is(ap, data, cnt)
 						   auth_context,
 						   &authenticator);
 		if (r) {
-		    (void) strcpy(errbuf,
-				  "krb5_auth_con_getauthenticator failed: ");
-		    errbuf[sizeof(errbuf) - 1] = '\0';
-		    (void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
-		    goto errout;
+			(void) snprintf(errbuf, sizeof(errbuf),
+					"krb5_auth_con_getauthenticator failed: %s",
+					error_message(r));
+			goto errout;
 		}
 		if ((ap->way & AUTH_ENCRYPT_MASK) == AUTH_ENCRYPT_ON &&
 		    !authenticator->checksum) {
-			(void) strcpy(errbuf,
-				"authenticator is missing required checksum");
+			(void) strlcpy(errbuf,
+				"authenticator is missing required checksum",
+				       sizeof(errbuf));
 			goto errout;
 		}
 		if (authenticator->checksum) {
@@ -503,9 +505,9 @@ kerberos5_is(ap, data, cnt)
 		    r = krb5_auth_con_getkey(telnet_context, auth_context,
 					     &key);
 		    if (r) {
-			(void) strcpy(errbuf, "krb5_auth_con_getkey failed: ");
-			errbuf[sizeof(errbuf) - 1] = '\0';
-			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
+			(void) snprintf(errbuf, sizeof(errbuf),
+					"krb5_auth_con_getkey failed: %s",
+					error_message(r));
 			goto errout;
 		    }
 		    r = krb5_verify_checksum(telnet_context,
@@ -522,10 +524,9 @@ kerberos5_is(ap, data, cnt)
 		 * present at this time.
 		 */
 		    if (r) {
-			(void) strcpy(errbuf,
-				      "checksum verification failed: ");
-		        errbuf[sizeof(errbuf) - 1] = '\0';
-			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
+			(void) snprintf(errbuf, sizeof(errbuf),
+					"checksum verification failed: %s",
+					error_message(r));
 			goto errout;
 		    }
 		    krb5_free_keyblock(telnet_context, key);
@@ -535,9 +536,9 @@ kerberos5_is(ap, data, cnt)
 		    /* do ap_rep stuff here */
 		    if ((r = krb5_mk_rep(telnet_context, auth_context,
 					 &outbuf))) {
-			(void) strcpy(errbuf, "Make reply failed: ");
-		        errbuf[sizeof(errbuf) - 1] = '\0';
-			(void) strncat(errbuf, error_message(r), sizeof(errbuf) - 1 - strlen(errbuf));
+			(void) snprintf(errbuf, sizeof(errbuf),
+					"Make reply failed: %s",
+					error_message(r));
 			goto errout;
 		    }
 
@@ -589,11 +590,10 @@ kerberos5_is(ap, data, cnt)
 			   &inbuf, ticket))) {
 
 		    char kerrbuf[128];
-		    
-		    (void) strcpy(kerrbuf, "Read forwarded creds failed: ");
-		    kerrbuf[sizeof(kerrbuf) - 1] = '\0';
-		    (void) strncat(kerrbuf, error_message(r), 
-			sizeof(kerrbuf) - 1 - strlen(kerrbuf));
+
+		    (void) snprintf(kerrbuf, sizeof(kerrbuf),
+				    "Read forwarded creds failed: %s",
+				    error_message(r));
 		    Data(ap, KRB_FORWARD_REJECT, kerrbuf, -1);
 		    if (auth_debug_mode)
 		      printf(
@@ -618,9 +618,7 @@ kerberos5_is(ap, data, cnt)
 	{
 	    char eerrbuf[329];
 
-	    strcpy(eerrbuf, "telnetd: ");
-	    eerrbuf[sizeof(eerrbuf) - 1] = '\0';
-	    strncat(eerrbuf, errbuf, sizeof(eerrbuf) - 1 - strlen(eerrbuf));
+	    snprintf(eerrbuf, sizeof(eerrbuf), "telnetd: %s", errbuf);
 	    Data(ap, KRB_REJECT, eerrbuf, -1);
 	}
 	if (auth_debug_mode)
@@ -813,12 +811,12 @@ kerberos5_printsub(data, cnt, buf, buflen)
 #endif	/* FORWARD */
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[3]);
 		strncpy((char *)buf, lbuf, buflen);
 	common2:
 		BUMP(buf, buflen);
 		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			strncpy((char *)buf, lbuf, buflen);
 			BUMP(buf, buflen);
 		}
diff --git a/src/appl/telnet/libtelnet/spx.c b/src/appl/telnet/libtelnet/spx.c
index b3e0e9d..449ddc4 100644
--- a/src/appl/telnet/libtelnet/spx.c
+++ b/src/appl/telnet/libtelnet/spx.c
@@ -71,6 +71,7 @@
 #include <arpa/telnet.h>
 #include <stdio.h>
 #include "gssapi_defs.h"
+#include "k5-platform.h"
 #ifdef	__STDC__
 #include <stdlib.h>
 #endif
@@ -172,9 +173,8 @@ spx_init(ap, server)
 	if (server) {
 		str_data[3] = TELQUAL_REPLY;
 		gethostname(lhostname, sizeof(lhostname));
-		strcpy(targ_printable, "SERVICE:rcmd@");
-		strncat(targ_printable, lhostname, sizeof(targ_printable) - 1 - 13);
-		targ_printable[sizeof(targ_printable) - 1] = '\0';
+		snprintf(targ_printable, sizeof(targ_printable),
+			 "SERVICE:rcmd@%s", lhostname);
 		input_name_buffer.length = strlen(targ_printable);
 		input_name_buffer.value = targ_printable;
 		major_status = gss_import_name(&status,
@@ -216,9 +216,8 @@ spx_send(ap)
 	char *address;
 
 	printf("[ Trying SPX ... ]\n");
-	strcpy(targ_printable, "SERVICE:rcmd@");
-	strncat(targ_printable, RemoteHostName, sizeof(targ_printable) - 1 - 13);
-	targ_printable[sizeof(targ_printable) - 1] = '\0';
+	snprintf(targ_printable, sizeof(targ_printable), "SERVICE:rcmd@%s",
+		 RemoteHostName);
 
 	input_name_buffer.length = strlen(targ_printable);
 	input_name_buffer.value = targ_printable;
@@ -325,9 +324,8 @@ spx_is(ap, data, cnt)
 
 		gethostname(lhostname, sizeof(lhostname));
 
-		strcpy(targ_printable, "SERVICE:rcmd@");
-		strncat(targ_printable, lhostname, sizeof(targ_printable) - 1 - 13);
-		targ_printable[sizeof(targ_printable) - 1] = '\0';
+		snprintf(targ_printable, sizeof(targ_printable),
+			 "SERVICE:rcmd@%s", lhostname);
 
 		input_name_buffer.length = strlen(targ_printable);
 		input_name_buffer.value = targ_printable;
@@ -563,12 +561,12 @@ spx_printsub(data, cnt, buf, buflen)
 		goto common2;
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[3]);
 		strncpy((char *)buf, lbuf, buflen);
 	common2:
 		BUMP(buf, buflen);
 		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			strncpy((char *)buf, lbuf, buflen);
 			BUMP(buf, buflen);
 		}
diff --git a/src/appl/telnet/telnet/Makefile.in b/src/appl/telnet/telnet/Makefile.in
index 42a0578..7fae8f7 100644
--- a/src/appl/telnet/telnet/Makefile.in
+++ b/src/appl/telnet/telnet/Makefile.in
@@ -47,8 +47,8 @@ OBJS=	authenc.o commands.o main.o network.o ring.o sys_bsd.o \
 
 all:: telnet
 
-telnet:	$(OBJS) $(KRB4COMPAT_DEPLIBS) ../libtelnet/libtelnet.a
-	$(CC_LINK) -o $@ $(OBJS) ../libtelnet/libtelnet.a $(KRB4COMPAT_LIBS)
+telnet:	$(OBJS) $(KRB5_BASE_DEPLIBS) ../libtelnet/libtelnet.a
+	$(CC_LINK) -o $@ $(OBJS) ../libtelnet/libtelnet.a $(KRB5_BASE_LIBS)
 
 clean::
 	$(RM) telnet
@@ -72,41 +72,3 @@ telnet.o: defines.h externs.h general.h ring.h types.h $(ARPA_TELNET)
 terminal.o: externs.h ring.h types.h $(ARPA_TELNET)
 tn3270.o: defines.h externs.h fdset.h general.h ring.h $(ARPA_TELNET)
 utilities.o: defines.h externs.h fdset.h general.h ring.h $(ARPA_TELNET)
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)authenc.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
-  $(srcdir)/../libtelnet/misc-proto.h $(srcdir)/../libtelnet/misc.h \
-  authenc.c defines.h externs.h general.h ring.h types.h
-$(OUTPRE)commands.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/port-sockets.h \
-  $(SRCTOP)/include/socket-utils.h $(srcdir)/../arpa/telnet.h \
-  $(srcdir)/../libtelnet/auth-proto.h $(srcdir)/../libtelnet/auth.h \
-  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
-  $(srcdir)/../libtelnet/misc-proto.h commands.c defines.h \
-  externs.h general.h ring.h types.h
-$(OUTPRE)main.$(OBJEXT): $(srcdir)/../libtelnet/auth-proto.h \
-  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
-  $(srcdir)/../libtelnet/encrypt.h defines.h externs.h \
-  main.c ring.h
-$(OUTPRE)network.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  defines.h externs.h fdset.h network.c ring.h
-$(OUTPRE)ring.$(OBJEXT): general.h ring.c ring.h
-$(OUTPRE)sys_bsd.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  defines.h externs.h fdset.h ring.h sys_bsd.c types.h
-$(OUTPRE)telnet.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  $(srcdir)/../libtelnet/auth-proto.h $(srcdir)/../libtelnet/auth.h \
-  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
-  $(srcdir)/../libtelnet/misc-proto.h defines.h externs.h \
-  general.h ring.h telnet.c types.h
-$(OUTPRE)terminal.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
-  externs.h ring.h terminal.c types.h
-$(OUTPRE)utilities.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
-  $(srcdir)/../libtelnet/auth-proto.h $(srcdir)/../libtelnet/auth.h \
-  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
-  defines.h externs.h fdset.h general.h ring.h utilities.c
diff --git a/src/appl/telnet/telnet/commands.c b/src/appl/telnet/telnet/commands.c
index 57106de..f82f3e6 100644
--- a/src/appl/telnet/telnet/commands.c
+++ b/src/appl/telnet/telnet/commands.c
@@ -117,6 +117,8 @@ static	unsigned long sourceroute(char *, char **, int *);
 
 #include "fake-addrinfo.h"
 
+#include <k5-platform.h>
+
 char	*hostname;
 static char _hostname[MAXDNAME];
 static char hostaddrstring[NI_MAXHOST];
@@ -1745,8 +1747,8 @@ env_find(var)
 env_init()
 {
 	extern char **environ;
-	register char **epp, *cp;
-	register struct env_lst *ep;
+	char **epp, *cp;
+	struct env_lst *ep;
 
 	for (epp = environ; *epp; epp++) {
 		if ((cp = strchr(*epp, '='))) {
@@ -1770,8 +1772,7 @@ env_init()
 
 		gethostname(hbuf, 256);
 		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		asprintf(&cp, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}
@@ -2431,7 +2432,7 @@ tn(argc, argv)
 	return 0;
     }
     if (argc < 2) {
-	(void) strcpy(line, "open ");
+	(void) strlcpy(line, "open ", sizeof(line));
 	printf("(to) ");
 	(void) fgets(&line[strlen(line)], (int) (sizeof(line) - strlen(line)),
 		     stdin);
@@ -2580,7 +2581,8 @@ tn(argc, argv)
 	if (error) {
 	    fprintf (stderr, "getnameinfo() error printing address: %s\n",
 		     gai_strerror (error));
-	    strcpy (hostaddrstring, "[address unprintable]");
+	    strlcpy (hostaddrstring, "[address unprintable]",
+		     sizeof(hostaddrstring));
 	}
 	printf("Trying %s...\r\n", hostaddrstring);
 #if	defined(IP_OPTIONS) && defined(IPPROTO_IP)
diff --git a/src/appl/telnet/telnet/deps b/src/appl/telnet/telnet/deps
new file mode 100644
index 0000000..4015479
--- /dev/null
+++ b/src/appl/telnet/telnet/deps
@@ -0,0 +1,39 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)authenc.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
+  $(srcdir)/../libtelnet/misc-proto.h $(srcdir)/../libtelnet/misc.h \
+  authenc.c defines.h externs.h general.h ring.h types.h
+$(OUTPRE)commands.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../arpa/telnet.h \
+  $(srcdir)/../libtelnet/auth-proto.h $(srcdir)/../libtelnet/auth.h \
+  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
+  $(srcdir)/../libtelnet/misc-proto.h commands.c defines.h \
+  externs.h general.h ring.h types.h
+$(OUTPRE)main.$(OBJEXT): $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h defines.h externs.h \
+  main.c ring.h
+$(OUTPRE)network.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  defines.h externs.h fdset.h network.c ring.h
+$(OUTPRE)ring.$(OBJEXT): general.h ring.c ring.h
+$(OUTPRE)sys_bsd.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  defines.h externs.h fdset.h ring.h sys_bsd.c types.h
+$(OUTPRE)telnet.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h $(srcdir)/../libtelnet/misc-proto.h \
+  defines.h externs.h general.h ring.h telnet.c types.h
+$(OUTPRE)terminal.$(OBJEXT): $(srcdir)/../arpa/telnet.h \
+  $(srcdir)/../libtelnet/enc-proto.h $(srcdir)/../libtelnet/encrypt.h \
+  externs.h ring.h terminal.c types.h
+$(OUTPRE)utilities.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h defines.h externs.h \
+  fdset.h general.h ring.h utilities.c
diff --git a/src/appl/telnet/telnet/main.c b/src/appl/telnet/telnet/main.c
index 77832f9..c1dc204 100644
--- a/src/appl/telnet/telnet/main.c
+++ b/src/appl/telnet/telnet/main.c
@@ -235,14 +235,6 @@ main(argc, argv)
 #endif
 			break;
 		case 'k':
-#if defined(AUTHENTICATION) && defined(KRB4)
-		    {
-			extern char *dest_realm, dst_realm_buf[];
-			extern unsigned int dst_realm_sz;
-			dest_realm = dst_realm_buf;
-			(void)strncpy(dest_realm, optarg, dst_realm_sz);
-		    }
-#endif
 #if defined(AUTHENTICATION) && defined(KRB5)
 		    {
 			extern char *telnet_krb5_realm;
@@ -250,8 +242,7 @@ main(argc, argv)
 			telnet_krb5_realm = optarg;
 			break;
 		    }
-#endif
-#if !defined(AUTHENTICATION) || (!defined(KRB4) && !defined(KRB5))
+#else
 			fprintf(stderr,
 			   "%s: Warning: -k ignored, no Kerberos V4 support.\n",
 								prompt);
diff --git a/src/appl/telnet/telnet/telnet.c b/src/appl/telnet/telnet/telnet.c
index 3b8a82d..be00687 100644
--- a/src/appl/telnet/telnet/telnet.c
+++ b/src/appl/telnet/telnet/telnet.c
@@ -79,6 +79,8 @@
 #include <libtelnet/misc-proto.h>
 #endif	/* defined(AUTHENTICATION) || defined(ENCRYPTION)  */
 
+#include <k5-platform.h>
+
 static int is_unique (char *, char **, char **);
 
 
@@ -867,8 +869,8 @@ suboption()
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
-				TELQUAL_IS, name, IAC, SE);
+		snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+			 IAC, SB, TELOPT_TTYPE, TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
 	    } else {
@@ -889,8 +891,8 @@ suboption()
 
 	    TerminalSpeeds(&ispeed, &o_speed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
-		    TELQUAL_IS, o_speed, ispeed, IAC, SE);
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC,
+		     SB, TELOPT_TSPEED, TELQUAL_IS, o_speed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 
 	    if (len < NETROOM()) {
@@ -995,8 +997,8 @@ suboption()
 		send_wont(TELOPT_XDISPLOC, 1);
 		break;
 	    }
-	    sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
-		    TELQUAL_IS, dp, IAC, SE);
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+		     IAC, SB, TELOPT_XDISPLOC, TELQUAL_IS, dp, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 
 	    if (len < NETROOM()) {
diff --git a/src/appl/telnet/telnet/utilities.c b/src/appl/telnet/telnet/utilities.c
index 4b198da..4a076e5 100644
--- a/src/appl/telnet/telnet/utilities.c
+++ b/src/appl/telnet/telnet/utilities.c
@@ -61,6 +61,8 @@
 #include <libtelnet/encrypt.h>
 #endif
 
+#include <k5-platform.h>
+
 FILE	*NetTrace = 0;		/* Not in bss, since needs to stay */
 int	prettydump;
 
@@ -646,7 +648,7 @@ printsub(direction, pointer, length)
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
diff --git a/src/appl/telnet/telnetd/Makefile.in b/src/appl/telnet/telnetd/Makefile.in
index 606bfb6..ac27b78 100644
--- a/src/appl/telnet/telnetd/Makefile.in
+++ b/src/appl/telnet/telnetd/Makefile.in
@@ -30,7 +30,7 @@ LOCALINCLUDES=-I.. -I$(srcdir)/..
 DEFINES = -DTELNET_BUFSIZE=65535 $(AUTH_DEF) $(OTHERDEFS)
 ARPA_TELNET= $(srcdir)/../arpa/telnet.h
 
-PROG_LIBPATH=-L$(TOPLIBD) $(KRB4_LIBPATH)
+PROG_LIBPATH=-L$(TOPLIBD)
 PROG_RPATH=$(KRB5_LIBDIR)
 
 LIBS=	@TELNETD_LIBS@
@@ -60,8 +60,8 @@ OBJS=	telnetd.o \
 
 all:: telnetd
 
-telnetd: $(OBJS) $(PTY_DEPLIB) $(KRB4COMPAT_DEPLIBS) ../libtelnet/libtelnet.a
-	$(CC_LINK) -o $@ $(OBJS) ../libtelnet/libtelnet.a $(PTY_LIB) $(UTIL_LIB) $(KRB4COMPAT_LIBS)
+telnetd: $(OBJS) $(PTY_DEPLIB) $(KRB5_BASE_DEPLIBS) ../libtelnet/libtelnet.a
+	$(CC_LINK) -o $@ $(OBJS) ../libtelnet/libtelnet.a $(PTY_LIB) $(UTIL_LIB) $(KRB5_BASE_LIBS)
 
 clean::
 	$(RM) telnetd
@@ -82,63 +82,3 @@ sys_term.o: telnetd.h pathnames.h defs.h ext.h $(ARPA_TELNET)
 telnetd.o: telnetd.h defs.h ext.h $(ARPA_TELNET)
 termstat.o: telnetd.h defs.h ext.h $(ARPA_TELNET)
 utility.o: telnetd.h defs.h ext.h $(ARPA_TELNET)
-# +++ Dependency line eater +++
-# 
-# Makefile dependencies follow.  This must be the last section in
-# the Makefile.in file
-#
-$(OUTPRE)telnetd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
-  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
-  $(srcdir)/../libtelnet/encrypt.h $(srcdir)/../libtelnet/misc-proto.h \
-  defs.h ext.h pathnames.h telnetd.c telnetd.h
-$(OUTPRE)termio-tn.$(OBJEXT): termio-tn.c
-$(OUTPRE)termios-tn.$(OBJEXT): termios-tn.c
-$(OUTPRE)state.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
-  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
-  $(srcdir)/../libtelnet/encrypt.h defs.h ext.h state.c \
-  telnetd.h
-$(OUTPRE)termstat.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h defs.h ext.h telnetd.h termstat.c
-$(OUTPRE)slc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h defs.h ext.h slc.c telnetd.h
-$(OUTPRE)sys_term.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
-  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-gmt_mktime.h \
-  $(SRCTOP)/include/k5-int-pkinit.h $(SRCTOP)/include/k5-int.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
-  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
-  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
-  $(srcdir)/../libtelnet/auth.h defs.h ext.h pathnames.h \
-  sys_term.c telnetd.h
-$(OUTPRE)utility.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
-  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
-  $(srcdir)/../libtelnet/encrypt.h defs.h ext.h telnetd.h \
-  utility.c
-$(OUTPRE)global.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h defs.h ext.h global.c
-$(OUTPRE)authenc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
-  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
-  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/misc-proto.h \
-  $(srcdir)/../libtelnet/misc.h authenc.c defs.h ext.h \
-  telnetd.h
diff --git a/src/appl/telnet/telnetd/deps b/src/appl/telnet/telnetd/deps
new file mode 100644
index 0000000..88e768d
--- /dev/null
+++ b/src/appl/telnet/telnetd/deps
@@ -0,0 +1,58 @@
+# 
+# Generated makefile dependencies follow.
+#
+$(OUTPRE)telnetd.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/fake-addrinfo.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h $(srcdir)/../libtelnet/misc-proto.h \
+  defs.h ext.h pathnames.h telnetd.c telnetd.h
+$(OUTPRE)termio-tn.$(OBJEXT): termio-tn.c
+$(OUTPRE)termios-tn.$(OBJEXT): termios-tn.c
+$(OUTPRE)state.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h defs.h ext.h state.c \
+  telnetd.h
+$(OUTPRE)termstat.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h defs.h ext.h telnetd.h termstat.c
+$(OUTPRE)slc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h defs.h ext.h slc.c telnetd.h
+$(OUTPRE)sys_term.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/libpty.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-buf.h $(SRCTOP)/include/k5-err.h \
+  $(SRCTOP)/include/k5-gmt_mktime.h $(SRCTOP)/include/k5-int-pkinit.h \
+  $(SRCTOP)/include/k5-int.h $(SRCTOP)/include/k5-platform.h \
+  $(SRCTOP)/include/k5-plugin.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/krb5.h $(SRCTOP)/include/krb5/locate_plugin.h \
+  $(SRCTOP)/include/krb5/preauth_plugin.h $(SRCTOP)/include/port-sockets.h \
+  $(SRCTOP)/include/socket-utils.h $(srcdir)/../arpa/telnet.h \
+  $(srcdir)/../libtelnet/auth-proto.h $(srcdir)/../libtelnet/auth.h \
+  defs.h ext.h pathnames.h sys_term.c telnetd.h
+$(OUTPRE)utility.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/auth-proto.h \
+  $(srcdir)/../libtelnet/auth.h $(srcdir)/../libtelnet/enc-proto.h \
+  $(srcdir)/../libtelnet/encrypt.h defs.h ext.h telnetd.h \
+  utility.c
+$(OUTPRE)global.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h defs.h ext.h global.c
+$(OUTPRE)authenc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-thread.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  $(srcdir)/../arpa/telnet.h $(srcdir)/../libtelnet/misc-proto.h \
+  $(srcdir)/../libtelnet/misc.h authenc.c defs.h ext.h \
+  telnetd.h
diff --git a/src/appl/telnet/telnetd/slc.c b/src/appl/telnet/telnetd/slc.c
index 613674b..8f32f43 100644
--- a/src/appl/telnet/telnetd/slc.c
+++ b/src/appl/telnet/telnetd/slc.c
@@ -154,8 +154,8 @@ start_slc(getit)
 	slcchange = 0;
 	if (getit)
 		init_termbuf();
-	(void) sprintf((char *)slcbuf, "%c%c%c%c",
-					IAC, SB, TELOPT_LINEMODE, LM_SLC);
+	(void) snprintf((char *)slcbuf, sizeof(slcbuf), "%c%c%c%c",
+			IAC, SB, TELOPT_LINEMODE, LM_SLC);
 	slcptr = slcbuf + 4;
 
 }  /* end of start_slc */
@@ -195,8 +195,9 @@ end_slc(bufp)
 			*bufp = &slcbuf[4];
 			return(slcptr - slcbuf - 4);
 		} else {
-			(void) sprintf((char *)slcptr, "%c%c", IAC, SE);
-			slcptr += 2;
+			*slcptr++ = IAC;
+			*slcptr++ = SE;
+			*slcptr = 0;
 			len = slcptr - slcbuf;
 			netwrite(slcbuf, len);
 			netflush();  /* force it out immediately */
diff --git a/src/appl/telnet/telnetd/sys_term.c b/src/appl/telnet/telnetd/sys_term.c
index d78c2e8..5c08c76 100644
--- a/src/appl/telnet/telnetd/sys_term.c
+++ b/src/appl/telnet/telnetd/sys_term.c
@@ -1133,7 +1133,8 @@ startslave(host, autologin, autoname)
 	 */
 	if ((i = open(INIT_FIFO, O_WRONLY)) < 0) {
 		char tbuf[128];
-		(void) sprintf(tbuf, "Can't open %s\n", INIT_FIFO);
+		(void) snprintf(tbuf, sizeof(tbuf), "Can't open %s\n",
+				INIT_FIFO);
 		fatalperror(net, tbuf);
 	}
 	memset((char *)&request, 0, sizeof(request));
@@ -1156,7 +1157,8 @@ startslave(host, autologin, autoname)
 #endif /* BFTPDAEMON */
 	if (write(i, (char *)&request, sizeof(request)) < 0) {
 		char tbuf[128];
-		(void) sprintf(tbuf, "Can't write to %s\n", INIT_FIFO);
+		(void) snprintf(tbuf, sizeof(tbuf), "Can't write to %s\n",
+				INIT_FIFO);
 		fatalperror(net, tbuf);
 	}
 	(void) close(i);
@@ -1168,7 +1170,7 @@ startslave(host, autologin, autoname)
 		if (i == 3 || n >= 0 || !gotalarm)
 			break;
 		gotalarm = 0;
-		sprintf(tbuf, "telnetd: waiting for /etc/init to start login process on %s\r\n", line);
+		snprintf(tbuf, sizeof(tbuf), "telnetd: waiting for /etc/init to start login process on %s\r\n", line);
 		(void) write(net, tbuf, strlen(tbuf));
 	}
 	if (n < 0 && gotalarm)
@@ -1255,9 +1257,7 @@ start_login(host, autologin, name)
 		if (term == NULL || term[0] == 0) {
 			term = "-";
 		} else {
-			strcpy(termbuf, "TERM=");
-			strncat(termbuf, term, sizeof(termbuf) - 6);
-			termbuf[sizeof(termbuf) - 1] = '\0';
+			snprintf(termbuf, sizeof(termbuf), "TERM=%s", term);
 			term = termbuf;
 		}
 		argv = addarg(argv, term);
@@ -1357,13 +1357,9 @@ start_login(host, autologin, name)
 			write(xpty, name, len);
 			write(xpty, name, len);
 			memset(speed, 0, sizeof(speed));
-			strncpy(speed,
-				(cp = getenv("TERM")) ? cp : "",
-				sizeof(speed)-1-(10*sizeof(def_rspeed)/4)-1);
-			/* 1 for /, () for the number, 1 for trailing 0. */
-			sprintf(speed + strlen(speed),
-				"/%d",
-				(def_rspeed > 0) ? def_rspeed : 9600);
+			snprintf(speed, sizeof(speed), "%s/%d",
+				 (cp = getenv("TERM")) ? cp : "",
+				 (def_rspeed > 0) ? def_rspeed : 9600);
 			len = strlen(speed)+1;
 			write(xpty, speed, len);
 
diff --git a/src/appl/user_user/deps b/src/appl/user_user/deps
new file mode 100644
index 0000000..2feac3c
--- /dev/null
+++ b/src/appl/user_user/deps
@@ -0,0 +1 @@
+# No dependencies here.