diff --git a/src/etc/Makefile b/src/etc/Makefile
index b10eaf37..d0d18d90 100644
--- a/src/etc/Makefile
+++ b/src/etc/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.226 2005/05/26 23:06:06 mcbride Exp $
+#	$OpenBSD: Makefile,v 1.227 2005/08/15 00:40:17 millert Exp $
 
 TZDIR=		/usr/share/zoneinfo
 LOCALTIME=	Canada/Mountain
@@ -19,7 +19,7 @@ BIN1=	changelist ccd.conf csh.cshrc csh.login csh.logout daily dhcpd.conf \
 	protocols rbootd.conf rc rc.conf rc.local rc.securelevel rc.shutdown \
 	remote rpc security services shells spamd.conf syslog.conf weekly \
 	etc.${MACHINE}/disktab dhclient.conf mailer.conf ntpd.conf \
-	login.conf moduli pf.os sensorsd.conf ifstated.conf
+	moduli pf.os sensorsd.conf ifstated.conf
 
 .if ${MACHINE} == "alpha" || ${MACHINE} == "amd64" || \
     ${MACHINE} == "cats" || ${MACHINE} == "hp300" || \
@@ -72,6 +72,10 @@ distribution-etc-root-var: distrib-dirs
 	    chown ${BINOWN} ${DESTDIR}/etc/fbtab && \
 	    chgrp ${BINGRP} ${DESTDIR}/etc/fbtab && \
 	    chmod 644 ${DESTDIR}/etc/fbtab
+	awk -f ${.CURDIR}/mklogin.conf `test -f etc.${MACHINE}/login.conf.overrides && echo etc.${MACHINE}/login.conf.overrides` < ${.CURDIR}/login.conf.in > \
+	    ${DESTDIR}/etc/login.conf && \
+	    chown ${BINOWN}:${BINGRP} ${DESTDIR}/etc/login.conf && \
+	    chmod 644 ${DESTDIR}/etc/login.conf 
 	${INSTALL} -c -o ${BINOWN} -g ${BINGRP} -m 664 ${BIN2} ${DESTDIR}/etc
 	${INSTALL} -c -o root -g wheel -m 600 hosts.equiv ${DESTDIR}/etc
 	${INSTALL} -c -o root -g wheel -m 600 crontab ${DESTDIR}/var/cron/tabs/root
@@ -376,7 +380,7 @@ distrib:
 DHSIZE=1024 1536 2048 3072 4096
 update-moduli:
 	( \
-		echo '#    $$OpenBSD: Makefile,v 1.226 2005/05/26 23:06:06 mcbride Exp $$'; \
+		echo '#    $$OpenBSD: Makefile,v 1.227 2005/08/15 00:40:17 millert Exp $$'; \
 		echo '# Time Type Tests Tries Size Generator Modulus'; \
 		( for i in ${DHSIZE}; do \
 			ssh-keygen -b $$i -G /dev/stdout; \
diff --git a/src/etc/login.conf b/src/etc/login.conf.in
similarity index 82%
rename from src/etc/login.conf
rename to src/etc/login.conf.in
index dc1f7dc6..37842285 100644
--- a/src/etc/login.conf
+++ b/src/etc/login.conf.in
@@ -1,4 +1,4 @@
-# $OpenBSD: login.conf,v 1.22 2005/08/12 18:48:20 millert Exp $
+# $OpenBSD: login.conf.in,v 1.1 2005/08/15 00:40:17 millert Exp $
 
 #
 # Sample login.conf file.  See login.conf(5) for details.
@@ -40,11 +40,11 @@ auth-ftp-defaults:auth-ftp=passwd:
 default:\
 	:path=/usr/bin /bin /usr/sbin /sbin /usr/X11R6/bin /usr/local/bin:\
 	:umask=022:\
-	:datasize-max=512M:\
-	:datasize-cur=512M:\
-	:maxproc-max=128:\
-	:maxproc-cur=64:\
-	:openfiles-cur=64:\
+	:datasize-max=@DEF_DATASIZE_MAX@:\
+	:datasize-cur=@DEF_DATASIZE_CUR@:\
+	:maxproc-max=@DEF_MAXPROC_MAX@:\
+	:maxproc-cur=@DEF_MAXPROC_CUR@:\
+	:openfiles-cur=@DEF_OPENFILES_CUR@:\
 	:stacksize-cur=4M:\
 	:localcipher=blowfish,6:\
 	:ypcipher=old:\
@@ -69,10 +69,10 @@ daemon:\
 # Staff have fewer restrictions and can login even when nologins are set.
 #
 staff:\
-	:datasize-cur=512M:\
-	:datasize-max=infinity:\
-	:maxproc-max=256:\
-	:maxproc-cur=128:\
+	:datasize-cur=@STAFF_DATASIZE_CUR@:\
+	:datasize-max=@STAFF_DATASIZE_MAX@:\
+	:maxproc-max=@STAFF_MAXPROC_MAX@:\
+	:maxproc-cur=@STAFF_MAXPROC_CUR@:\
 	:ignorenologin:\
 	:requirehome@:\
 	:tc=default:
diff --git a/src/etc/mklogin.conf b/src/etc/mklogin.conf
new file mode 100644
index 00000000..4c7b938e
--- /dev/null
+++ b/src/etc/mklogin.conf
@@ -0,0 +1,38 @@
+#!/usr/bin/awk
+#
+# Generates a login.conf file from login.conf.in and an optional
+# file containing overrides.
+#
+# Usage: mklogin.conf [overrides_file] < login.conf.in > login.conf.out
+#
+# $OpenBSD: mklogin.conf,v 1.1 2005/08/15 00:40:17 millert Exp $
+
+BEGIN {
+	# Default substitutions
+	values["DEF_DATASIZE_MAX"]="512M"
+	values["DEF_DATASIZE_CUR"]="512M"
+	values["DEF_MAXPROC_MAX"]="128"
+	values["DEF_MAXPROC_CUR"]="64"
+	values["DEF_OPENFILES_CUR"]="64"
+	values["STAFF_DATASIZE_MAX"]="infinity"
+	values["STAFF_DATASIZE_CUR"]="512M"
+	values["STAFF_MAXPROC_MAX"]="256"
+	values["STAFF_MAXPROC_CUR"]="128"
+	values["STAFF_OPENFILES_CUR"]="128"
+
+	# Optional overrides
+	if (ARGC > 1) {
+		while (getline override < ARGV[1]) {
+			split(override, ov)
+			values[ov[0] ""]=ov[1] ""
+		}
+		ARGC--
+	}
+}
+
+# Read in login.conf template, do substitutions and output the result
+{
+	for (key in values)
+		gsub("@" key "@", values[key], $0)
+	print $0
+}