diff --git a/lib/libutil/login_auth.c b/lib/libutil/login_auth.c
index 70227a9b392f..a6778cb2fa45 100644
--- a/lib/libutil/login_auth.c
+++ b/lib/libutil/login_auth.c
@@ -65,7 +65,7 @@ __FBSDID("$FreeBSD$");
 void
 auth_checknologin(login_cap_t *lc)
 {
-  char *file;
+  const char *file;
 
   /* Do we ignore a nologin file? */
   if (login_getcapbool(lc, "ignorenologin", 0))
diff --git a/lib/libutil/login_cap.3 b/lib/libutil/login_cap.3
index d05426c2dec2..385916ccaf25 100644
--- a/lib/libutil/login_cap.3
+++ b/lib/libutil/login_cap.3
@@ -52,12 +52,12 @@
 .Fn login_getpwclass "const struct passwd *pwd"
 .Ft login_cap_t *
 .Fn login_getuserclass "const struct passwd *pwd"
-.Ft char *
-.Fn login_getcapstr "login_cap_t *lc" "const char *cap" "char *def" "char *error"
+.Ft "const char *"
+.Fn login_getcapstr "login_cap_t *lc" "const char *cap" "const char *def" "const char *error"
 .Ft char **
 .Fn login_getcaplist "login_cap_t *lc" "const char *cap" "const char *chars"
-.Ft char *
-.Fn login_getpath "login_cap_t *lc" "const char *cap" "char *error"
+.Ft "const char *"
+.Fn login_getpath "login_cap_t *lc" "const char *cap" "const char *error"
 .Ft rlim_t
 .Fn login_getcaptime "login_cap_t *lc" "const char *cap" "rlim_t def" "rlim_t error"
 .Ft rlim_t
@@ -66,8 +66,8 @@
 .Fn login_getcapsize "login_cap_t *lc" "const char *cap" "rlim_t def" "rlim_t error"
 .Ft int
 .Fn login_getcapbool "login_cap_t *lc" "const char *cap" "int def"
-.Ft char *
-.Fn login_getstyle "login_cap_t *lc" "char *style" "const char *auth"
+.Ft "const char *"
+.Fn login_getstyle "login_cap_t *lc" "const char *style" "const char *auth"
 .Ft const char *
 .Fn login_setcryptfmt "login_cap_t *lc" "const char *def" "const char *error"
 .Sh DESCRIPTION
diff --git a/lib/libutil/login_cap.c b/lib/libutil/login_cap.c
index 9797c8bcc6ab..55784d7a05da 100644
--- a/lib/libutil/login_cap.c
+++ b/lib/libutil/login_cap.c
@@ -344,8 +344,8 @@ login_getuserclass(const struct passwd *pwd)
  * an error string on error.
  */
 
-char *
-login_getcapstr(login_cap_t *lc, const char *cap, char *def, char *error)
+const char *
+login_getcapstr(login_cap_t *lc, const char *cap, const char *def, const char *error)
 {
     char    *res;
     int	    ret;
@@ -373,7 +373,7 @@ login_getcaplist(login_cap_t *lc, const char *cap, const char *chars)
 
     if (chars == NULL)
 	chars = ", \t";
-    if ((lstring = login_getcapstr(lc, cap, NULL, NULL)) != NULL)
+    if ((lstring = (char *)login_getcapstr(lc, cap, NULL, NULL)) != NULL)
 	return arrayize(lstring, chars, NULL);
     return NULL;
 }
@@ -387,15 +387,15 @@ login_getcaplist(login_cap_t *lc, const char *cap, const char *chars)
  * If there is an error of any kind, return <error>.
  */
 
-char *
-login_getpath(login_cap_t *lc, const char *cap, char * error)
+const char *
+login_getpath(login_cap_t *lc, const char *cap, const char *error)
 {
-    char    *str;
+    const char *str;
 
-    if ((str = login_getcapstr(lc, (char*)cap, NULL, NULL)) == NULL)
+    if ((str = login_getcapstr(lc, cap, NULL, NULL)) == NULL)
 	str = error;
     else {
-	char *ptr = str;
+	char *ptr = (char *)str;
 
 	while (*ptr) {
 	    int count = strcspn(ptr, ", \t");
@@ -764,8 +764,8 @@ login_getcapbool(login_cap_t *lc, const char *cap, int def)
  *     login_getstyle(lc, "skey", "network");
  */
 
-char *
-login_getstyle(login_cap_t *lc, char *style, const char *auth)
+const char *
+login_getstyle(login_cap_t *lc, const char *style, const char *auth)
 {
     int	    i;
     char    **authtypes = NULL;
diff --git a/lib/libutil/login_cap.h b/lib/libutil/login_cap.h
index 81983dade194..1b3f0a8d0040 100644
--- a/lib/libutil/login_cap.h
+++ b/lib/libutil/login_cap.h
@@ -102,13 +102,13 @@ login_cap_t *login_getclass(const char *);
 login_cap_t *login_getpwclass(const struct passwd *);
 login_cap_t *login_getuserclass(const struct passwd *);
 
-char *login_getcapstr(login_cap_t*, const char *, char *, char *);
+const char *login_getcapstr(login_cap_t*, const char *, const char *, const char *);
 char **login_getcaplist(login_cap_t *, const char *, const char *);
-char *login_getstyle(login_cap_t *, char *, const char *);
+const char *login_getstyle(login_cap_t *, const char *, const char *);
 rlim_t login_getcaptime(login_cap_t *, const char *, rlim_t, rlim_t);
 rlim_t login_getcapnum(login_cap_t *, const char *, rlim_t, rlim_t);
 rlim_t login_getcapsize(login_cap_t *, const char *, rlim_t, rlim_t);
-char *login_getpath(login_cap_t *, const char *, char *);
+const char *login_getpath(login_cap_t *, const char *, const char *);
 int login_getcapbool(login_cap_t *, const char *, int);
 const char *login_setcryptfmt(login_cap_t *, const char *, const char *);
 
diff --git a/lib/libutil/login_class.c b/lib/libutil/login_class.c
index b8b956b43f5f..dfd2d2cb1e03 100644
--- a/lib/libutil/login_class.c
+++ b/lib/libutil/login_class.c
@@ -126,7 +126,7 @@ static struct login_vars {
 };
 
 static char *
-substvar(char * var, const struct passwd * pwd, int hlen, int pch, int nlen)
+substvar(const char * var, const struct passwd * pwd, int hlen, int pch, int nlen)
 {
     char    *np = NULL;
 
@@ -137,12 +137,10 @@ substvar(char * var, const struct passwd * pwd, int hlen, int pch, int nlen)
 
 	if (pwd != NULL) {
 	    /* Count the number of ~'s in var to substitute */
-	    p = var;
-	    for (p = var; (p = strchr(p, '~')) != NULL; p++)
+	    for (p = (char *)var; (p = strchr(p, '~')) != NULL; p++)
 		++tildes;
 	    /* Count the number of $'s in var to substitute */
-	    p = var;
-	    for (p = var; (p = strchr(p, '$')) != NULL; p++)
+	    for (p = (char *)var; (p = strchr(p, '$')) != NULL; p++)
 		++dollas;
 	}
 
@@ -197,8 +195,8 @@ setclassenvironment(login_cap_t *lc, const struct passwd * pwd, int paths)
 	++pch;
 
     while (vars->tag != NULL) {
-	char * var = paths ? login_getpath(lc, vars->tag, NULL)
-	    		   : login_getcapstr(lc, vars->tag, NULL, NULL);
+	const char * var = paths ? login_getpath(lc, vars->tag, NULL)
+				 : login_getcapstr(lc, vars->tag, NULL, NULL);
 
 	char * np  = substvar(var, pwd, hlen, pch, nlen);
 
diff --git a/lib/libutil/login_crypt.c b/lib/libutil/login_crypt.c
index f3d83a8ec9c8..c65fc9b8328a 100644
--- a/lib/libutil/login_crypt.c
+++ b/lib/libutil/login_crypt.c
@@ -38,7 +38,7 @@ const char *
 login_setcryptfmt(login_cap_t *lc, const char *def, const char *error) {
 	const char *cipher;
 
-	cipher = login_getcapstr(lc, "passwd_format", (char *)def, NULL);
+	cipher = login_getcapstr(lc, "passwd_format", def, NULL);
 	if (getenv("CRYPT_DEBUG") != NULL)
 		fprintf(stderr, "login_setcryptfmt: "
 		    "passwd_format = %s\n", cipher);