Index: head/security/duo/Makefile
===================================================================
--- head/security/duo/Makefile	(revision 516036)
+++ head/security/duo/Makefile	(revision 516037)
@@ -1,39 +1,41 @@
 # Created by: Ryan Steinmetz <zi@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	duo
 PORTVERSION=	1.11.3
 CATEGORIES=	security
 MASTER_SITES=	https://dl.duosecurity.com/ \
 		ZI
 DISTNAME=	${PORTNAME}_unix-${PORTVERSION}
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Duo unix integration package
 
 LICENSE=	GPLv2
 
 CONFIGURE_ARGS=	--with-pam=${PREFIX}/lib/security --sysconfdir=${PREFIX}/etc \
 		--docdir=${DOCSDIR} --includedir=${PREFIX}/include/${PORTNAME}
 
 GNU_CONFIGURE=	yes
 USES=		libtool pathfix ssl
 USE_LDCONFIG=	yes
 
 SUB_FILES=	pkg-message
 
-OPTIONS_DEFINE=	DOCS
+SUID_DESC=	Install login_duo with suid bit set
+OPTIONS_DEFINE=	DOCS SUID
+OPTIONS_SUB=	yes
 
 post-patch:
 	${REINPLACE_CMD} -e 's| /etc| ${PREFIX}/etc|g' \
 		${WRKSRC}/pam_duo/pam_duo.8 \
 		${WRKSRC}/login_duo/login_duo.8
 
 post-install:
 	@${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/security/pam_duo.so
 	${INSTALL_DATA} ${WRKSRC}/login_duo/login_duo.conf \
 		${STAGEDIR}${PREFIX}/etc/login_duo.conf.sample
 	${INSTALL_DATA} ${WRKSRC}/pam_duo/pam_duo.conf \
 		${STAGEDIR}${PREFIX}/etc/pam_duo.conf.sample
 
 .include <bsd.port.mk>
Index: head/security/duo/pkg-plist
===================================================================
--- head/security/duo/pkg-plist	(revision 516036)
+++ head/security/duo/pkg-plist	(revision 516037)
@@ -1,19 +1,21 @@
 @sample(sshd,,0600) etc/login_duo.conf.sample
 @sample(,,0600) etc/pam_duo.conf.sample
 include/duo/common_ini_test.h
 include/duo/duo.h
 include/duo/duo_private.h
 include/duo/unity.h
 include/duo/util.h
 include/duo/shell.h
 libdata/pkgconfig/libduo.pc
 lib/security/pam_duo.so
 man/man3/duo.3.gz
 man/man8/login_duo.8.gz
 man/man8/pam_duo.8.gz
 %%PORTDOCS%%%%DOCSDIR%%/CONTRIBUTING.md
 %%PORTDOCS%%%%DOCSDIR%%/README.md
 %%PORTDOCS%%%%DOCSDIR%%/AUTHORS
 %%PORTDOCS%%%%DOCSDIR%%/CHANGES
 %%PORTDOCS%%%%DOCSDIR%%/LICENSE
+%%SUID%%@mode 4555
 sbin/login_duo
+%%SUID%%@mode