diff --git a/etc/pam.conf b/etc/pam.conf
index 56ad8f30af0a..12e6fffaa83f 100644
--- a/etc/pam.conf
+++ b/etc/pam.conf
@@ -86,6 +86,10 @@ sshd	session	required	pam_permit.so
 # "csshd" is for challenge-based authentication with sshd (TIS auth, etc.)
 csshd	auth	required	pam_skey.so
 
+# SRA telnet. Non-SRA telnet uses 'login'.
+telnetd	auth	required	pam_unix.so			try_first_pass
+telnetd	account	required	pam_unix.so
+
 # Don't break startx
 xserver	auth	required	pam_permit.so
 
diff --git a/secure/libexec/telnetd/Makefile b/secure/libexec/telnetd/Makefile
index 7dffb39d6994..47b18415fa21 100644
--- a/secure/libexec/telnetd/Makefile
+++ b/secure/libexec/telnetd/Makefile
@@ -15,7 +15,7 @@ SRCS=		global.c slc.c state.c sys_term.c telnetd.c \
 
 DPADD=		${LIBUTIL} ${LIBTERMCAP} ${LIBTELNET} ${LIBCRYPTO} ${LIBMP} \
                 ${LIBCRYPT}
-LDADD=		-lutil -ltermcap ${LIBTELNET} -lcrypto -lcrypt -lmp
+LDADD=		-lutil -ltermcap ${LIBTELNET} -lcrypto -lcrypt -lmp -lpam
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/telnet/Makefile b/secure/usr.bin/telnet/Makefile
index 3e6aae234407..e3a33d986be5 100644
--- a/secure/usr.bin/telnet/Makefile
+++ b/secure/usr.bin/telnet/Makefile
@@ -12,7 +12,7 @@ SRCS=		authenc.c commands.c main.c network.c ring.c sys_bsd.c \
 DPADD=		${LIBTERMCAP} ${LIBTELNET} ${LIBCRYPTO} ${LIBCRYPT} ${LIBMP}
 DPADD+=		${LIBIPSEC}
 LDADD=		-ltermcap ${LIBTELNET} -lcrypto -lcrypt -lmp
-LDADD+=		-lipsec
+LDADD+=		-lipsec -lpam
 
 .include <bsd.prog.mk>