diff --git a/crypto/external/bsd/openssh/Makefile.inc b/crypto/external/bsd/openssh/Makefile.inc
index 5d17dfe3e2e6..976772bdcb53 100644
--- a/crypto/external/bsd/openssh/Makefile.inc
+++ b/crypto/external/bsd/openssh/Makefile.inc
@@ -1,4 +1,4 @@
-#	$NetBSD: Makefile.inc,v 1.1 2009/12/19 18:00:26 christos Exp $
+#	$NetBSD: Makefile.inc,v 1.2 2010/11/21 19:19:21 adam Exp $
 
 WARNS?=	1	# XXX -Wshadow -Wcast-qual
 
@@ -8,7 +8,10 @@ USE_FORT?= yes	# network client/server
 
 SSHDIST?= ${NETBSDSRCDIR}/crypto/external/bsd/openssh/dist
 
-CPPFLAGS+=-I${SSHDIST} -DHAVE_LOGIN_CAP -DHAVE_MMAP -DHAVE_OPENPTY
+CPPFLAGS+=-I${SSHDIST} -DHAVE_LOGIN_CAP -DHAVE_MMAP -DHAVE_OPENPTY -DENABLE_PKCS11
+.if !defined(NOPIC)
+CPPFLAGS+=-DHAVE_DLOPEN
+.endif
 .PATH: ${SSHDIST}
 
 .if (${USE_PAM} != "no")
@@ -24,6 +27,10 @@ CPPFLAGS+=-DGSSAPI -I${DESTDIR}/usr/include/gssapi
 CPPFLAGS+=-DKRB5 -I${DESTDIR}/usr/include/krb5 -DHEIMDAL
 .endif
 
+.if (${USE_LDAP} != "no")
+CPPFLAGS+=-DWITH_LDAP_PUBKEY
+.endif
+
 .if ${X11FLAVOUR} == "Xorg"
 CPPFLAGS+=-DX11BASE=\"/usr/X11R7\"
 .endif
diff --git a/crypto/external/bsd/openssh/bin/Makefile b/crypto/external/bsd/openssh/bin/Makefile
index 2805c87ef8c3..ddba16b71113 100644
--- a/crypto/external/bsd/openssh/bin/Makefile
+++ b/crypto/external/bsd/openssh/bin/Makefile
@@ -1,12 +1,11 @@
-#	$NetBSD: Makefile,v 1.2 2009/07/21 00:47:23 mrg Exp $
+#	$NetBSD: Makefile,v 1.3 2010/11/21 19:19:21 adam Exp $
 
 .include <bsd.own.mk>
 
 SSHDIST?= ${NETBSDSRCDIR}/crypto/external/bsd/openssh/dist
 
 SUBDIR=	ssh sshd ssh-add ssh-keygen ssh-agent scp sftp-server \
-	ssh-keysign ssh-keyscan sftp
-#SUBDIR+=scard
+	ssh-keysign ssh-keyscan sftp ssh-pkcs11-helper
 
 .PATH: ${SSHDIST}
 .MADE: moduli
diff --git a/crypto/external/bsd/openssh/bin/sftp/Makefile b/crypto/external/bsd/openssh/bin/sftp/Makefile
index 97977be9942f..47d8a4749f7f 100644
--- a/crypto/external/bsd/openssh/bin/sftp/Makefile
+++ b/crypto/external/bsd/openssh/bin/sftp/Makefile
@@ -1,9 +1,9 @@
-#	$NetBSD: Makefile,v 1.2 2010/02/03 15:34:37 roy Exp $
+#	$NetBSD: Makefile,v 1.3 2010/11/21 19:19:22 adam Exp $
 
 BINDIR=	/usr/bin
 
 PROG=	sftp
-SRCS=	sftp.c sftp-client.c sftp-common.c sftp-glob.c misc.c fmt_scaled.c
+SRCS=	sftp.c sftp-client.c sftp-common.c sftp-glob.c
 MAN=	sftp.1
 
 LDADD+=	-ledit -lterminfo
@@ -12,5 +12,6 @@ DPADD+=	${LIBEDIT} ${LIBTERMINFO}
 .include <bsd.prog.mk>
 
 .if (defined(HAVE_GCC) && ${HAVE_GCC} == 4) || defined(HAVE_PCC)
-COPTS.sftp-client.c+=       -Wno-pointer-sign
+COPTS.sftp.c+=		-Wno-pointer-sign
+COPTS.sftp-client.c+=	-Wno-pointer-sign
 .endif
diff --git a/crypto/external/bsd/openssh/bin/ssh-agent/Makefile b/crypto/external/bsd/openssh/bin/ssh-agent/Makefile
index 3fa124bcd539..91b9290831f6 100644
--- a/crypto/external/bsd/openssh/bin/ssh-agent/Makefile
+++ b/crypto/external/bsd/openssh/bin/ssh-agent/Makefile
@@ -1,8 +1,8 @@
-#	$NetBSD: Makefile,v 1.1 2009/06/07 22:38:45 christos Exp $
+#	$NetBSD: Makefile,v 1.2 2010/11/21 19:19:22 adam Exp $
 
 BINDIR=/usr/bin
 
 PROG=	ssh-agent
-SRCS=	ssh-agent.c
+SRCS=	ssh-agent.c ssh-pkcs11-client.c
 
 .include <bsd.prog.mk>
diff --git a/crypto/external/bsd/openssh/bin/ssh-keygen/Makefile b/crypto/external/bsd/openssh/bin/ssh-keygen/Makefile
index da2c20c3227d..12ea24c0d431 100644
--- a/crypto/external/bsd/openssh/bin/ssh-keygen/Makefile
+++ b/crypto/external/bsd/openssh/bin/ssh-keygen/Makefile
@@ -1,4 +1,4 @@
-#	$NetBSD: Makefile,v 1.1 2009/06/07 22:38:45 christos Exp $
+#	$NetBSD: Makefile,v 1.2 2010/11/21 19:19:22 adam Exp $
 
 BINDIR=	/usr/bin
 
@@ -6,3 +6,7 @@ PROG=	ssh-keygen
 SRCS=	ssh-keygen.c moduli.c
 
 .include <bsd.prog.mk>
+
+.if (defined(HAVE_GCC) && ${HAVE_GCC} == 4) || defined(HAVE_PCC)
+COPTS.ssh-keygen.c=	-Wno-pointer-sign
+.endif
diff --git a/crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile b/crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile
new file mode 100644
index 000000000000..ff37de0f792c
--- /dev/null
+++ b/crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile
@@ -0,0 +1,11 @@
+#	$NetBSD: Makefile,v 1.1 2010/11/21 19:19:22 adam Exp $
+
+BINOWN= root
+BINMODE=555
+BINDIR= /usr/libexec
+
+PROG=	ssh-pkcs11-helper
+SRCS=	ssh-pkcs11-helper.c
+MAN=	ssh-pkcs11-helper.8
+
+.include <bsd.prog.mk>
diff --git a/crypto/external/bsd/openssh/bin/ssh/Makefile b/crypto/external/bsd/openssh/bin/ssh/Makefile
index 8a219ffe422b..1f4e9f5479d1 100644
--- a/crypto/external/bsd/openssh/bin/ssh/Makefile
+++ b/crypto/external/bsd/openssh/bin/ssh/Makefile
@@ -1,4 +1,4 @@
-#	$NetBSD: Makefile,v 1.1 2009/06/07 22:38:45 christos Exp $
+#	$NetBSD: Makefile,v 1.2 2010/11/21 19:19:22 adam Exp $
 
 .include <bsd.own.mk>
 
@@ -6,10 +6,12 @@ BINDIR = /usr/bin
 
 PROG=	ssh
 SRCS=	ssh.c readconf.c clientloop.c sshtty.c \
-	sshconnect.c sshconnect1.c sshconnect2.c mux.c
+	sshconnect.c sshconnect1.c sshconnect2.c mux.c \
+	roaming_client.c
 
 COPTS.sshconnect1.c=	-fno-strict-aliasing
 .if (defined(HAVE_GCC) && ${HAVE_GCC} == 4) || defined(HAVE_PCC)
+COPTS.mux.c=		-Wno-pointer-sign
 COPTS.sshconnect2.c=	-Wno-pointer-sign
 .endif
 
@@ -18,7 +20,6 @@ MAN=	ssh.1 ssh_config.5
 MLINKS=	ssh.1 slogin.1
 
 .if (${USE_KERBEROS} != "no")
-
 # this is not entirely true, libgssapi might be independent of krb5
 SRCS +=	gss-genr.c
 LDADD+=	-lgssapi -lheimntlm
diff --git a/crypto/external/bsd/openssh/bin/sshd/Makefile b/crypto/external/bsd/openssh/bin/sshd/Makefile
index fcd84cb82d9e..72736c0430ad 100644
--- a/crypto/external/bsd/openssh/bin/sshd/Makefile
+++ b/crypto/external/bsd/openssh/bin/sshd/Makefile
@@ -1,4 +1,4 @@
-#	$NetBSD: Makefile,v 1.1 2009/06/07 22:38:46 christos Exp $
+#	$NetBSD: Makefile,v 1.2 2010/11/21 19:19:23 adam Exp $
 
 .include <bsd.own.mk>
 
@@ -8,16 +8,20 @@ MAN=	sshd.8 sshd_config.5 moduli.5
 BINDIR=	/usr/sbin
 
 SRCS=	sshd.c auth-rhosts.c auth-passwd.c auth-rsa.c auth-rh-rsa.c \
-	sshpty.c sshlogin.c servconf.c serverloop.c uidswap.c \
+	sshpty.c sshlogin.c servconf.c serverloop.c \
 	auth.c auth1.c auth2.c auth-options.c session.c \
 	auth-chall.c auth2-chall.c groupaccess.c \
 	auth-skey.c auth-bsdauth.c auth2-hostbased.c auth2-kbdint.c \
 	auth2-none.c auth2-passwd.c auth2-pubkey.c \
 	monitor_mm.c monitor.c monitor_wrap.c \
-	kexdhs.c kexgexs.c sftp-server.c sftp-common.c
+	kexdhs.c kexgexs.c sftp-server.c sftp-common.c auth2-jpake.c
+
+.if (defined(HAVE_GCC) && ${HAVE_GCC} == 4) || defined(HAVE_PCC)
+COPTS.auth-options.c=	-Wno-pointer-sign
+.endif
 
 .if (${USE_PAM} != "no")
-SRCS+= auth-pam.c
+SRCS+=	auth-pam.c
 LDADD+=	-lpam ${PAM_STATIC_LDADD}
 DPADD+=	${LIBPAM} ${PAM_STATIC_DPADD}
 
@@ -36,8 +40,7 @@ DPADD+=	${LIBSKEY}
 .endif	# USE_PAM == no
 
 .if (${USE_KERBEROS} != "no")
-
-SRCS +=	gss-genr.c auth2-gss.c gss-serv.c gss-serv-krb5.c
+SRCS+=	gss-genr.c auth2-gss.c gss-serv.c gss-serv-krb5.c
 LDADD+=	-lgssapi -lheimntlm
 DPADD+=	${LIBGSSAPI} ${LIBHEIMNTLM}
 
@@ -52,6 +55,12 @@ LDADD+=	-lcom_err -lroken
 DPADD+=	${LIBCOM_ERR} ${LIBROKEN}
 .endif
 
+.if (${USE_LDAP} != "no")
+SRCS+=	ldapauth.c
+LDADD+=	-lldap
+DPADD+=	${LIBLDAP}
+.endif
+
 .include <bsd.prog.mk>
 
 LDADD+=	-lcrypt -lutil
diff --git a/crypto/external/bsd/openssh/lib/Makefile b/crypto/external/bsd/openssh/lib/Makefile
index 9ef5c89c14a2..375c696db43e 100644
--- a/crypto/external/bsd/openssh/lib/Makefile
+++ b/crypto/external/bsd/openssh/lib/Makefile
@@ -1,19 +1,20 @@
-#	$NetBSD: Makefile,v 1.4 2009/12/27 01:40:47 christos Exp $
+#	$NetBSD: Makefile,v 1.5 2010/11/21 19:19:23 adam Exp $
 
 .include <bsd.own.mk>
 
 LIB=	ssh
 SRCS=	authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c \
-	cipher.c cipher-3des1.c cipher-ctr.c cipher-ctr-mt.c cipher-bf1.c \
-	cleanup.c compat.c compress.c crc32.c deattack.c dns.c fatal.c \
+	cipher.c cipher-3des1.c cipher-bf1.c cipher-ctr.c \
+	cleanup.c compat.c compress.c crc32.c deattack.c fatal.c \
 	hostfile.c log.c match.c nchan.c packet.c readpass.c \
-	rsa.c strtonum.c ttymodes.c xmalloc.c atomicio.c \
-	key.c dispatch.c kex.c mac.c uuencode.c misc.c \
+	rsa.c ttymodes.c xmalloc.c atomicio.c \
+	key.c dispatch.c kex.c mac.c uidswap.c uuencode.c misc.c \
 	ssh-dss.c ssh-rsa.c dh.c kexdh.c kexgex.c \
-	kexdhc.c kexgexc.c scard.c msg.c progressmeter.c \
-	monitor_fdpass.c uidswap.c addrmatch.c roaming_common.c
+	kexdhc.c kexgexc.c msg.c progressmeter.c dns.c \
+	monitor_fdpass.c addrmatch.c schnorr.c jpake.c ssh-pkcs11.c \
+	roaming_common.c
 #	umac.c
-SRCS+=	random.c
+SRCS+=	fmt_scaled.c random.c strtonum.c
 SRCS+=	readpassphrase.c getpeereid.c getrrsetbyname.c
 COPTS.monitor_fdpass.c = -Wno-stack-protector
 
@@ -28,7 +29,7 @@ LIBDPLIBS+=	crypto	${NETBSDSRCDIR}/crypto/external/bsd/openssl/lib/libcrypto \
 		z	${NETBSDSRCDIR}/lib/libz
 
 .if (defined(HAVE_GCC) && ${HAVE_GCC} == 4) || defined(HAVE_PCC)
-.for f in dns channels hostfile
+.for f in dns channels hostfile roaming_common ssh-pkcs11
 COPTS.${f}.c+=	-Wno-pointer-sign
 .endfor
 .endif
diff --git a/crypto/external/bsd/openssh/lib/shlib_version b/crypto/external/bsd/openssh/lib/shlib_version
index a0fd802c75d9..a7b1b35a0f2a 100644
--- a/crypto/external/bsd/openssh/lib/shlib_version
+++ b/crypto/external/bsd/openssh/lib/shlib_version
@@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.3 2009/12/27 01:40:47 christos Exp $
+#	$NetBSD: shlib_version,v 1.4 2010/11/21 19:19:23 adam Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
 major=15
-minor=0
+minor=1