diff --git a/security/Makefile b/security/Makefile
index 4731e886db5e..2e4ee0bf2b8d 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.294 2007/04/01 21:17:16 wiz Exp $
+# $NetBSD: Makefile,v 1.295 2007/04/01 21:26:48 wiz Exp $
 #
 
 COMMENT=	Security tools
@@ -109,7 +109,6 @@ SUBDIR+=	libtasn1
 SUBDIR+=	libtcpa
 SUBDIR+=	logcheck
 SUBDIR+=	lsh
-SUBDIR+=	lsh2
 SUBDIR+=	mcrypt
 SUBDIR+=	md4-collision
 SUBDIR+=	md5-collision
diff --git a/security/lsh/DESCR b/security/lsh/DESCR
index 168f4ade2d09..e61eb08139b5 100644
--- a/security/lsh/DESCR
+++ b/security/lsh/DESCR
@@ -1,2 +1,2 @@
 lsh is an alternative (GNU licensed) SSH2 client/server.
-This is version 1 of lsh.
+This is version 2 of lsh.
diff --git a/security/lsh/Makefile b/security/lsh/Makefile
index 8ea228360ce1..049d55475d56 100644
--- a/security/lsh/Makefile
+++ b/security/lsh/Makefile
@@ -1,23 +1,28 @@
-# $NetBSD: Makefile,v 1.15 2007/02/15 21:23:55 rillig Exp $
+# $NetBSD: Makefile,v 1.16 2007/04/01 21:26:48 wiz Exp $
 #
 
-DISTNAME=		lsh-1.4.3
-PKGREVISION=		5
+DISTNAME=		lsh-2.0.2
 CATEGORIES=		security
-MASTER_SITES=		ftp://ftp.lysator.liu.se/pub/security/lsh/
+MASTER_SITES=		http://www.lysator.liu.se/~nisse/archive/
 
 MAINTAINER=		pkgsrc-users@NetBSD.org
 HOMEPAGE=		http://www.lysator.liu.se/~nisse/lsh/
-COMMENT=		SSH2 client/server (version 1 of lsh)
+COMMENT=		SSH2 client/server
 
 GNU_CONFIGURE=		yes
-USE_TOOLS+=		gmake
+USE_TOOLS+=		gmake gm4
+CONFIGURE_ARGS+=	--disable-openssl --disable-pam
 INFO_FILES=		yes
 
-.include "options.mk"
+# lcp test depends on /bin/bash and thus fails, others work
+TEST_TARGET=		check
+
+# man/man8/sftp-server.8
+CONFLICTS+=		openssh-[0-9]* openssh+gssapi-[0-9]*
+
+# src/nettle/examples/nettle-openssl.c needs des_key*
+USE_OLD_DES_API=	yes
 
 .include "../../devel/gmp/buildlink3.mk"
 .include "../../devel/liboop/buildlink3.mk"
-.include "../../devel/zlib/buildlink3.mk"
-
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/lsh/PLIST b/security/lsh/PLIST
index 0a8056dbeb49..fe984d02d0ec 100644
--- a/security/lsh/PLIST
+++ b/security/lsh/PLIST
@@ -1,51 +1,81 @@
-@comment $NetBSD: PLIST,v 1.4 2006/06/16 18:43:18 jlam Exp $
+@comment $NetBSD: PLIST,v 1.5 2007/04/01 21:26:48 wiz Exp $
+bin/lcp
 bin/lsftp
 bin/lsh
 bin/lsh-authorize
 bin/lsh-decode-key
+bin/lsh-decrypt-key
 bin/lsh-export-key
 bin/lsh-keygen
 bin/lsh-make-seed
+bin/lsh-upgrade
+bin/lsh-upgrade-key
 bin/lsh-writekey
 bin/lshg
+bin/nettle-lfib-stream
+bin/pkcs1-conv
 bin/sexp-conv
 bin/srp-gen
 bin/ssh-conv
 include/nettle/aes.h
 include/nettle/arcfour.h
+include/nettle/arctwo.h
+include/nettle/asn1.h
+include/nettle/base16.h
 include/nettle/base64.h
+include/nettle/bignum.h
 include/nettle/blowfish.h
+include/nettle/buffer.h
 include/nettle/cast128.h
 include/nettle/cbc.h
+include/nettle/ctr.h
 include/nettle/des-compat.h
 include/nettle/des.h
+include/nettle/dsa.h
 include/nettle/hmac.h
 include/nettle/knuth-lfib.h
+include/nettle/macros.h
+include/nettle/md2.h
+include/nettle/md4.h
 include/nettle/md5-compat.h
 include/nettle/md5.h
+include/nettle/memxor.h
 include/nettle/nettle-meta.h
+include/nettle/nettle-stdint.h
+include/nettle/nettle-types.h
+include/nettle/pgp.h
+include/nettle/pkcs1.h
+include/nettle/realloc.h
+include/nettle/rsa-compat.h
 include/nettle/rsa.h
 include/nettle/serpent.h
+include/nettle/sexp.h
 include/nettle/sha.h
 include/nettle/twofish.h
 include/nettle/yarrow.h
 info/lsh.info
 info/nettle.info
-info/nettle.info-1
-info/nettle.info-2
 lib/libnettle.a
+man/man1/lsftp.1
+man/man1/lsh-authorize.1
+man/man1/lsh-decode-key.1
+man/man1/lsh-decrypt-key.1
+man/man1/lsh-export-key.1
+man/man1/lsh-keygen.1
+man/man1/lsh-make-seed.1
+man/man1/lsh-upgrade-key.1
+man/man1/lsh-upgrade.1
+man/man1/lsh-writekey.1
 man/man1/lsh.1
-man/man1/lsh_keygen.1
-man/man1/lsh_writekey.1
+man/man1/lshg.1
+man/man1/ssh-conv.1
 man/man5/DSA.5
 man/man5/SHA.5
 man/man5/SPKI.5
 man/man5/secsh.5
 man/man8/lshd.8
+man/man8/sftp-server.8
 sbin/lsh-execuv
-${KERBEROS}sbin/lsh-krb-checkpw
-${PAM}sbin/lsh-pam-checkpw
-sbin/lsh_proxy
 sbin/lshd
 sbin/sftp-server
 @dirrm include/nettle
diff --git a/security/lsh/distinfo b/security/lsh/distinfo
index 2d10d43a20f6..8642b78498f5 100644
--- a/security/lsh/distinfo
+++ b/security/lsh/distinfo
@@ -1,13 +1,7 @@
-$NetBSD: distinfo,v 1.6 2007/02/22 17:38:33 drochner Exp $
+$NetBSD: distinfo,v 1.7 2007/04/01 21:26:48 wiz Exp $
 
-SHA1 (lsh-1.4.3.tar.gz) = 25cb15a0851b3209cc5b3552344fedf80221ad6f
-RMD160 (lsh-1.4.3.tar.gz) = c5bc410396f6426e2e609ded97296424d8a3bd46
-Size (lsh-1.4.3.tar.gz) = 1414008 bytes
+SHA1 (lsh-2.0.2.tar.gz) = baaf8de1368b0bd3b6c0e67e03f66284b910b54c
+RMD160 (lsh-2.0.2.tar.gz) = fa876113924a6045ecd302892dc0fbbec764dabe
+Size (lsh-2.0.2.tar.gz) = 2179353 bytes
 SHA1 (patch-aa) = 08cb6cf3f28ae2281d109e20dc9585111009ea50
 SHA1 (patch-ab) = 179647434ecf7a4b42e301f1ac1c794f217d69d0
-SHA1 (patch-ac) = af2659ae7edb797481172c467936383e6d5a7f8a
-SHA1 (patch-ad) = 6ac62f9b78cddc7815f124543d3cb8b9a76563e6
-SHA1 (patch-ae) = 37e1be88117e2b559e0ac0f43739b7ba2574cb63
-SHA1 (patch-af) = cf4f49c7712b7671ae12c566680a4cfd86bfa87b
-SHA1 (patch-ag) = 3240576c0dd93e28b2cc09a661a571df3396fb96
-SHA1 (patch-ah) = 3812bcd443e315707076d84cdb8118f263660231
diff --git a/security/lsh/options.mk b/security/lsh/options.mk
deleted file mode 100644
index 61f27a40d93a..000000000000
--- a/security/lsh/options.mk
+++ /dev/null
@@ -1,30 +0,0 @@
-# $NetBSD: options.mk,v 1.1 2006/06/16 18:43:18 jlam Exp $
-
-PKG_OPTIONS_VAR=	PKG_OPTIONS.lsh
-PKG_SUPPORTED_OPTIONS=	kerberos pam
-
-.include "../../mk/bsd.options.mk"
-
-###
-### Kerberos password-checking support
-###
-.if !empty(PKG_OPTIONS:Mkerberos)
-.  include "../../mk/krb5.buildlink3.mk"
-CONFIGURE_ARGS+=	--enable-kerberos
-PLIST_SUBST+=		KERBEROS=
-.else
-CONFIGURE_ARGS+=	--disable-kerberos
-PLIST_SUBST+=		KERBEROS="@comment "
-.endif
-
-###
-### PAM password-checking support
-###
-.if !empty(PKG_OPTIONS:Mpam)
-.  include "../../mk/pam.buildlink3.mk"
-CONFIGURE_ARGS+=	--enable-pam
-PLIST_SUBST+=		PAM=
-.else
-CONFIGURE_ARGS+=	--disable-pam
-PLIST_SUBST+=		PAM="@comment "
-.endif
diff --git a/security/lsh/patches/patch-aa b/security/lsh/patches/patch-aa
index 95ad431386a6..1d2fe95d86d7 100644
--- a/security/lsh/patches/patch-aa
+++ b/security/lsh/patches/patch-aa
@@ -1,4 +1,4 @@
-$NetBSD: patch-aa,v 1.1.1.1 2004/01/12 15:55:11 drochner Exp $
+$NetBSD: patch-aa,v 1.2 2007/04/01 21:26:49 wiz Exp $
 
 --- src/unix_interact.c.orig	2003-10-14 19:12:21.000000000 +0200
 +++ src/unix_interact.c	2003-10-14 19:12:36.000000000 +0200
diff --git a/security/lsh/patches/patch-ab b/security/lsh/patches/patch-ab
index f6dc3b8f9623..81f976b0d27b 100644
--- a/security/lsh/patches/patch-ab
+++ b/security/lsh/patches/patch-ab
@@ -1,4 +1,4 @@
-$NetBSD: patch-ab,v 1.1.1.1 2004/01/12 15:55:11 drochner Exp $
+$NetBSD: patch-ab,v 1.2 2007/04/01 21:26:49 wiz Exp $
 
 --- src/Makefile.in.orig	2003-10-14 20:17:54.000000000 +0200
 +++ src/Makefile.in	2003-10-14 20:18:14.000000000 +0200
diff --git a/security/lsh/patches/patch-ac b/security/lsh/patches/patch-ac
deleted file mode 100644
index 533c8d39eda6..000000000000
--- a/security/lsh/patches/patch-ac
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-ac,v 1.1 2005/04/30 12:23:42 drochner Exp $
-
---- src/keyexchange.c.orig	2005-04-29 17:39:35.000000000 +0200
-+++ src/keyexchange.c
-@@ -113,7 +113,7 @@ parse_kexinit(struct lsh_string *packet)
-       /* Bad format */
-       int j;
-       for (j = 0; j<i; j++)
--	KILL(lists[i]);
-+	KILL(lists[j]);
-       KILL(res);
-       return NULL;
-     }
diff --git a/security/lsh/patches/patch-ad b/security/lsh/patches/patch-ad
deleted file mode 100644
index 051022949eee..000000000000
--- a/security/lsh/patches/patch-ad
+++ /dev/null
@@ -1,20 +0,0 @@
-$NetBSD: patch-ad,v 1.1 2006/04/05 23:59:33 salo Exp $
-
---- src/unix_random.c.orig	2001-12-12 19:23:51.000000000 +0100
-+++ src/unix_random.c	2006-04-06 01:45:14.000000000 +0200
-@@ -258,6 +258,7 @@
-       if (self->device_fd < 0)
- 	return 0;
- 
-+      io_set_close_on_exec(self->device_fd);
-       self->device_last_read = now;
-     }
- 
-@@ -382,6 +383,7 @@
- 	return NULL;
-       }
- 
-+    io_set_close_on_exec(self->seed_file_fd);
-     trace("random_init, reading seed file...\n");
-     
-     if (!read_initial_seed_file(&self->yarrow, self->seed_file_fd))
diff --git a/security/lsh/patches/patch-ae b/security/lsh/patches/patch-ae
deleted file mode 100644
index cada1d2eb13a..000000000000
--- a/security/lsh/patches/patch-ae
+++ /dev/null
@@ -1,14 +0,0 @@
-$NetBSD: patch-ae,v 1.1 2007/02/22 17:38:34 drochner Exp $
-
---- src/nettle/desCode.h.orig	2007-02-09 13:49:23.000000000 +0100
-+++ src/nettle/desCode.h
-@@ -9,9 +9,6 @@
- 
- #include "des.h"
- 
--extern const uint32_t des_keymap[];
--extern const uint32_t des_bigmap[];
--
- /* optional customization:
-  * the idea here is to alter the code so it will still run correctly
-  * on any machine,  but the quickest on the specific machine in mind.
diff --git a/security/lsh/patches/patch-af b/security/lsh/patches/patch-af
deleted file mode 100644
index 8edcf9227d9c..000000000000
--- a/security/lsh/patches/patch-af
+++ /dev/null
@@ -1,24 +0,0 @@
-$NetBSD: patch-af,v 1.1 2007/02/22 17:38:34 drochner Exp $
-
---- src/nettle/des.c.orig	2007-02-09 13:54:54.000000000 +0100
-+++ src/nettle/des.c
-@@ -36,9 +36,6 @@
- 
- #include <assert.h>
- 
--static ENCRYPT(DesSmallFipsEncrypt,TEMPSMALL, LOADFIPS,KEYMAPSMALL,SAVEFIPS)
--static DECRYPT(DesSmallFipsDecrypt,TEMPSMALL, LOADFIPS,KEYMAPSMALL,SAVEFIPS)
--
- /* various tables */
- 
- static const uint32_t
-@@ -56,6 +53,9 @@ parity[] = {
- #include	"parity.h"
- };
- 
-+static ENCRYPT(DesSmallFipsEncrypt,TEMPSMALL, LOADFIPS,KEYMAPSMALL,SAVEFIPS)
-+static DECRYPT(DesSmallFipsDecrypt,TEMPSMALL, LOADFIPS,KEYMAPSMALL,SAVEFIPS)
-+
- void
- des_fix_parity(unsigned length, uint8_t *dst,
- 	       const uint8_t *src)
diff --git a/security/lsh/patches/patch-ag b/security/lsh/patches/patch-ag
deleted file mode 100644
index 2a42304e5078..000000000000
--- a/security/lsh/patches/patch-ag
+++ /dev/null
@@ -1,18 +0,0 @@
-$NetBSD: patch-ag,v 1.1 2007/02/22 17:38:34 drochner Exp $
-
---- src/sftp/sftp_c.c.orig	2007-02-09 13:58:41.000000000 +0100
-+++ src/sftp/sftp_c.c
-@@ -1097,8 +1097,11 @@ sftp_get_file_main(struct sftp_callback 
-   int write_needed = 0;
-   UINT32 i;
- 
--  /* FIXME: state is const */
--  state->mem.used = 0;
-+  /* FIXME: This is ugly. The me object needs to be moved a pointer
-+   * away, or redesigned so that we don't need to modify it here. (Or
-+   * the constification of sftp_callback could be undone
-+   * altogether). */
-+  ((struct sftp_callback *)state)->mem.used = 0;
- 
-   sftp_get_mem_main(next, msg, id, in, out, state );
- 
diff --git a/security/lsh/patches/patch-ah b/security/lsh/patches/patch-ah
deleted file mode 100644
index 14e180dc15b2..000000000000
--- a/security/lsh/patches/patch-ah
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-ah,v 1.1 2007/02/22 17:38:34 drochner Exp $
-
---- src/exception.h.orig	2007-02-09 14:08:16.000000000 +0100
-+++ src/exception.h
-@@ -70,7 +70,7 @@ void exception_raise(struct exception_ha
- { STATIC_HEADER, (r), (p), __FILE__ ":" STRING_LINE ": Static" }
- 
- 
--#define HANDLER_CONTEXT   (__FILE__ ":" STRING_LINE ": " FUNCTION_NAME)
-+#define HANDLER_CONTEXT   (__FILE__ ":" STRING_LINE)
- 
- 
- /* Exception types. */
diff --git a/security/lsh2/DESCR b/security/lsh2/DESCR
deleted file mode 100644
index e61eb08139b5..000000000000
--- a/security/lsh2/DESCR
+++ /dev/null
@@ -1,2 +0,0 @@
-lsh is an alternative (GNU licensed) SSH2 client/server.
-This is version 2 of lsh.
diff --git a/security/lsh2/Makefile b/security/lsh2/Makefile
deleted file mode 100644
index 826dce13182f..000000000000
--- a/security/lsh2/Makefile
+++ /dev/null
@@ -1,28 +0,0 @@
-# $NetBSD: Makefile,v 1.9 2006/04/07 15:28:49 jlam Exp $
-#
-
-DISTNAME=		lsh-2.0.2
-CATEGORIES=		security
-MASTER_SITES=		http://www.lysator.liu.se/~nisse/archive/
-
-MAINTAINER=		pkgsrc-users@NetBSD.org
-HOMEPAGE=		http://www.lysator.liu.se/~nisse/lsh/
-COMMENT=		SSH2 client/server
-
-GNU_CONFIGURE=		yes
-USE_TOOLS+=		gmake gm4
-CONFIGURE_ARGS+=	--disable-openssl --disable-pam
-INFO_FILES=		# PLIST
-
-# lcp test depends on /bin/bash and thus fails, others work
-TEST_TARGET=		check
-
-# man/man8/sftp-server.8
-CONFLICTS+=		openssh-[0-9]* openssh+gssapi-[0-9]*
-
-# src/nettle/examples/nettle-openssl.c needs des_key*
-USE_OLD_DES_API=	yes
-
-.include "../../devel/gmp/buildlink3.mk"
-.include "../../devel/liboop/buildlink3.mk"
-.include "../../mk/bsd.pkg.mk"
diff --git a/security/lsh2/PLIST b/security/lsh2/PLIST
deleted file mode 100644
index 283ae7e2db32..000000000000
--- a/security/lsh2/PLIST
+++ /dev/null
@@ -1,81 +0,0 @@
-@comment $NetBSD: PLIST,v 1.3 2006/04/07 15:28:49 jlam Exp $
-bin/lcp
-bin/lsftp
-bin/lsh
-bin/lsh-authorize
-bin/lsh-decode-key
-bin/lsh-decrypt-key
-bin/lsh-export-key
-bin/lsh-keygen
-bin/lsh-make-seed
-bin/lsh-upgrade
-bin/lsh-upgrade-key
-bin/lsh-writekey
-bin/lshg
-bin/nettle-lfib-stream
-bin/pkcs1-conv
-bin/sexp-conv
-bin/srp-gen
-bin/ssh-conv
-include/nettle/aes.h
-include/nettle/arcfour.h
-include/nettle/arctwo.h
-include/nettle/asn1.h
-include/nettle/base16.h
-include/nettle/base64.h
-include/nettle/bignum.h
-include/nettle/blowfish.h
-include/nettle/buffer.h
-include/nettle/cast128.h
-include/nettle/cbc.h
-include/nettle/ctr.h
-include/nettle/des-compat.h
-include/nettle/des.h
-include/nettle/dsa.h
-include/nettle/hmac.h
-include/nettle/knuth-lfib.h
-include/nettle/macros.h
-include/nettle/md2.h
-include/nettle/md4.h
-include/nettle/md5-compat.h
-include/nettle/md5.h
-include/nettle/memxor.h
-include/nettle/nettle-meta.h
-include/nettle/nettle-stdint.h
-include/nettle/nettle-types.h
-include/nettle/pgp.h
-include/nettle/pkcs1.h
-include/nettle/realloc.h
-include/nettle/rsa-compat.h
-include/nettle/rsa.h
-include/nettle/serpent.h
-include/nettle/sexp.h
-include/nettle/sha.h
-include/nettle/twofish.h
-include/nettle/yarrow.h
-info/lsh.info
-info/nettle.info
-lib/libnettle.a
-man/man1/lsftp.1
-man/man1/lsh-authorize.1
-man/man1/lsh-decode-key.1
-man/man1/lsh-decrypt-key.1
-man/man1/lsh-export-key.1
-man/man1/lsh-keygen.1
-man/man1/lsh-make-seed.1
-man/man1/lsh-upgrade-key.1
-man/man1/lsh-upgrade.1
-man/man1/lsh-writekey.1
-man/man1/lsh.1
-man/man1/lshg.1
-man/man1/ssh-conv.1
-man/man5/DSA.5
-man/man5/SHA.5
-man/man5/SPKI.5
-man/man5/secsh.5
-man/man8/lshd.8
-man/man8/sftp-server.8
-sbin/lsh-execuv
-sbin/lshd
-sbin/sftp-server
-@dirrm include/nettle
diff --git a/security/lsh2/distinfo b/security/lsh2/distinfo
deleted file mode 100644
index a6738f8008a7..000000000000
--- a/security/lsh2/distinfo
+++ /dev/null
@@ -1,7 +0,0 @@
-$NetBSD: distinfo,v 1.2 2006/03/14 19:30:12 drochner Exp $
-
-SHA1 (lsh-2.0.2.tar.gz) = baaf8de1368b0bd3b6c0e67e03f66284b910b54c
-RMD160 (lsh-2.0.2.tar.gz) = fa876113924a6045ecd302892dc0fbbec764dabe
-Size (lsh-2.0.2.tar.gz) = 2179353 bytes
-SHA1 (patch-aa) = 08cb6cf3f28ae2281d109e20dc9585111009ea50
-SHA1 (patch-ab) = 179647434ecf7a4b42e301f1ac1c794f217d69d0
diff --git a/security/lsh2/patches/patch-aa b/security/lsh2/patches/patch-aa
deleted file mode 100644
index 0c508d8b9fdd..000000000000
--- a/security/lsh2/patches/patch-aa
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-aa,v 1.1 2005/04/30 12:23:42 drochner Exp $
-
---- src/unix_interact.c.orig	2003-10-14 19:12:21.000000000 +0200
-+++ src/unix_interact.c	2003-10-14 19:12:36.000000000 +0200
-@@ -261,7 +261,7 @@ do_make_raw(struct terminal_attributes *
- 
-   /* Modify VMIN and VTIME, to save some bandwidth and make traffic
-    * analysis of interactive sessions a little harder. */
--  res->ios.c_cc[VMIN] = 4;
-+  res->ios.c_cc[VMIN] = 1;
-   /* Inter-character timer, in units of 0.1s */
-   res->ios.c_cc[VTIME] = 1;
-   
diff --git a/security/lsh2/patches/patch-ab b/security/lsh2/patches/patch-ab
deleted file mode 100644
index 13a8c704297b..000000000000
--- a/security/lsh2/patches/patch-ab
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-ab,v 1.1 2005/04/30 12:23:42 drochner Exp $
-
---- src/Makefile.in.orig	2003-10-14 20:17:54.000000000 +0200
-+++ src/Makefile.in	2003-10-14 20:18:14.000000000 +0200
-@@ -1110,10 +1110,6 @@
- 
- # This is GNU make specific
- 
--%.x: % $(srcdir)/scm/gaba.scm $(srcdir)/scm/compiler.scm
--	$(SCHEME) -e main -l $(srcdir)/scm/compiler.scm \
--		  -s $(srcdir)/scm/gaba.scm <$< >$@T
--	test -s $@T && mv -f $@T $@
- # Tell versions [3.59,3.63) of GNU make to not export all variables.
- # Otherwise a system limit (for SysV at least) may be exceeded.
- .NOEXPORT: