Index: etc/Makefile
===================================================================
--- etc/Makefile
+++ etc/Makefile
@@ -127,7 +127,7 @@
 		${BIN1} ${DESTDIR}/etc; \
 	    cap_mkdb ${CAP_MKDB_ENDIAN} ${DESTDIR}/etc/login.conf; \
 	    ${INSTALL} -o ${BINOWN} -g ${BINGRP} -m 600 \
-		master.passwd nsmb.conf opieaccess ${DESTDIR}/etc;
+		nsmb.conf opieaccess ${DESTDIR}/etc;
 
 .if ${MK_SERVICESDB} != "no"
 	cd ${.CURDIR}; \
@@ -135,16 +135,9 @@
 		${DESTDIR}/etc/services;
 .endif
 
-.if ${MK_TCSH} == "no"
-	sed -i "" -e 's;/bin/csh;/bin/sh;' ${DESTDIR}/etc/master.passwd
-.endif
-	pwd_mkdb -i -p -d ${DESTDIR}/etc ${DESTDIR}/etc/master.passwd
 .if defined(NO_ROOT)
 	( \
 		echo "./etc/login.conf.db type=file mode=0644 uname=root gname=wheel"; \
-		echo "./etc/passwd type=file mode=0644 uname=root gname=wheel"; \
-		echo "./etc/pwd.db type=file mode=0644 uname=root gname=wheel"; \
-		echo "./etc/spwd.db type=file mode=0600 uname=root gname=wheel"; \
 		echo "./var/db/services.db type=file mode=0644 uname=root gname=wheel"; \
 	) | ${METALOG.add}
 .endif
Index: etc/master.passwd
===================================================================
--- etc/master.passwd
+++ etc/master.passwd
@@ -1,28 +0,0 @@
-# $FreeBSD$
-#
-root::0:0::0:0:Charlie &:/root:/bin/csh
-toor:*:0:0::0:0:Bourne-again Superuser:/root:
-daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin
-operator:*:2:5::0:0:System &:/:/usr/sbin/nologin
-bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin
-tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin
-kmem:*:5:65533::0:0:KMem Sandbox:/:/usr/sbin/nologin
-games:*:7:13::0:0:Games pseudo-user:/:/usr/sbin/nologin
-news:*:8:8::0:0:News Subsystem:/:/usr/sbin/nologin
-man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
-sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
-smmsp:*:25:25::0:0:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
-mailnull:*:26:26::0:0:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
-bind:*:53:53::0:0:Bind Sandbox:/:/usr/sbin/nologin
-unbound:*:59:59::0:0:Unbound DNS Resolver:/var/unbound:/usr/sbin/nologin
-proxy:*:62:62::0:0:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
-_pflogd:*:64:64::0:0:pflogd privsep user:/var/empty:/usr/sbin/nologin
-_dhcp:*:65:65::0:0:dhcp programs:/var/empty:/usr/sbin/nologin
-uucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico
-pop:*:68:6::0:0:Post Office Owner:/nonexistent:/usr/sbin/nologin
-auditdistd:*:78:77::0:0:Auditdistd unprivileged user:/var/empty:/usr/sbin/nologin
-www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
-ntpd:*:123:123::0:0:NTP Daemon:/var/db/ntp:/usr/sbin/nologin
-_ypldap:*:160:160::0:0:YP LDAP unprivileged user:/var/empty:/usr/sbin/nologin
-hast:*:845:845::0:0:HAST unprivileged user:/var/empty:/usr/sbin/nologin
-nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin
Index: lib/libc/gen/Makefile.inc
===================================================================
--- lib/libc/gen/Makefile.inc
+++ lib/libc/gen/Makefile.inc
@@ -4,7 +4,8 @@
 # machine-independent gen sources
 .PATH: ${LIBC_SRCTOP}/${LIBC_ARCH}/gen ${LIBC_SRCTOP}/gen
 
-CONFS=	shells
+CONFS=	master.passwd shells
+CONFSMODE_master.passwd=	600
 
 SRCS+=	__getosreldate.c \
 	__pthread_mutex_init_calloc_cb_stub.c \
@@ -537,3 +538,16 @@
 	vis.3 svis.3
 
 MLINKS+=wordexp.3 wordfree.3
+
+afterinstallconfig:
+.if ${MK_TCSH} == "no"
+	sed -i "" -e 's;/bin/csh;/bin/sh;' ${DESTDIR}/etc/master.passwd
+.endif
+	pwd_mkdb -i -p -d ${DESTDIR}/etc ${DESTDIR}/etc/master.passwd
+.if defined(NO_ROOT) && defined(METALOG)
+	( \
+		echo "./etc/pwd.db type=file mode=0644 uname=root gname=wheel"; \
+		echo "./etc/spwd.db type=file mode=0600 uname=root gname=wheel"; \
+		echo "./etc/passwd type=file mode=0644 uname=root gname=wheel"; \
+	) | cat -l >> ${METALOG}
+.endif