PAM isn't optional in FreeBSD, so there is no need for USE_PAM.

PAM is not optional; S/KEY aka OPIE is only supported through PAM.

You should probably replace this with getpass() or even openpam_ttyconv() (you can either call it directly or use pam_prompt() if you have a PAM handle, which you can get even if you don't intend to use PAM to unlock).

As mentioned earlier, you can use getpass() or openpam_ttyconv() / pam_prompt() here instead of fgets().

It's a good idea, but IMHO it's orthogonal to adding PAM support. I'd prefer to do that in a separate patch, especially that it might change the behaviour slightly (getpass() reads from console, the code above reads from standard input; no idea if it could make a practical difference).

Please use an explicit comparison to 0 as strcmp() is not a predicate.

Erm, but that's existing code - I'm only removing the "else" clause.