diff --git a/utils/shadow/Makefile b/utils/shadow/Makefile
new file mode 100644
index 0000000000..dc665bf78b
--- /dev/null
+++ b/utils/shadow/Makefile
@@ -0,0 +1,112 @@
+#
+# Copyright (C) 2008-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=shadow
+PKG_VERSION:=4.1.5.1
+PKG_RELEASE:=4
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=http://pkg-shadow.alioth.debian.org/releases
+PKG_MD5SUM:=a00449aa439c69287b6d472191dc2247
+PKG_MAINTAINER:=Steven Barth <cyrus@openwrt.org>
+
+PKG_FIXUP:=autoreconf
+PKG_BUILD_PARALLEL:=1
+PKG_INSTALL:=1
+
+PKG_BUILD_DEPENDS:=libintl
+
+include $(INCLUDE_DIR)/package.mk
+
+SHADOW_APPLETS := \
+	chage groupadd groupdel groupmod groups passwd su \
+	useradd userdel usermod
+
+CONFIGURE_ARGS += \
+	--without-audit \
+	--without-libpam \
+	--without-selinux \
+	--without-acl \
+	--without-attr \
+	--without-tcb \
+	--without-nscd
+
+define Package/shadow/Default
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=The PLD Linux shadow utilities
+  URL:=http://pkg-shadow.alioth.debian.org/
+endef
+
+define Package/shadow
+  $(call Package/shadow/Default)
+  DEPENDS:=$(foreach u,$(SHADOW_APPLETS),+shadow-$(u))
+endef
+
+define Package/shadow/description
+  Full versions of standard shadow utilities. Normally, you would not
+  use this package, since the functionality in BusyBox is more than
+  sufficient and much smaller.
+endef
+
+define Package/shadow/install
+	true
+endef
+
+
+define Package/shadow-common
+  $(call Package/shadow/Default)
+  TITLE:=Shared definitions for the PLD Linux shadow utilities
+endef
+
+
+define GenPlugin
+  define Package/shadow-$(1)
+    $(call Package/shadow/Default)
+    TITLE:=Utility $(1) from the PLD Linux shadow utilities
+    DEPENDS:=+shadow-common
+  endef
+
+  define Package/shadow-$(1)/description
+    Full version of standard $(1) utility. Normally, you would not use this
+    package, since the functionality in BusyBox is more than sufficient.
+  endef
+endef
+
+$(foreach u,$(SHADOW_APPLETS),$(eval $(call GenPlugin,$(u))))
+
+
+define Package/shadow-common/conffiles
+/etc/login.defs
+endef
+
+define Package/shadow-common/install
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/login.defs $(1)/etc/
+endef
+
+
+define BuildPlugin
+  define Package/shadow-$(1)/install
+	[ -x "$(PKG_INSTALL_DIR)/usr/sbin/$(1)" ] && { \
+		$(INSTALL_DIR) $$(1)/usr/sbin; \
+		$(CP) $(PKG_INSTALL_DIR)/usr/sbin/$(1) $$(1)/usr/sbin/; \
+	} || { \
+		$(INSTALL_DIR) $$(1)/usr/bin; \
+		$(CP) $(PKG_INSTALL_DIR)/usr/bin/$(1) $$(1)/usr/bin/; \
+	}
+  endef
+
+  $$(eval $$(call BuildPackage,shadow-$(1)))
+endef
+
+$(foreach u,$(SHADOW_APPLETS),$(eval $(call BuildPlugin,$(u))))
+
+$(eval $(call BuildPackage,shadow))
+$(eval $(call BuildPackage,shadow-common))
diff --git a/utils/shadow/patches/001-busybox_ash.patch b/utils/shadow/patches/001-busybox_ash.patch
new file mode 100644
index 0000000000..f21eee1bf9
--- /dev/null
+++ b/utils/shadow/patches/001-busybox_ash.patch
@@ -0,0 +1,13 @@
+diff --git a/etc/login.defs b/etc/login.defs
+index 5b6fab3..79eeccf 100644
+--- a/etc/login.defs
++++ b/etc/login.defs
+@@ -111,7 +111,7 @@ NOLOGINS_FILE	/etc/nologin
+ # command is "-su".  If not defined, then "ps" would display the
+ # name of the shell actually being run, e.g. something like "-sh".
+ #
+-SU_NAME		su
++#SU_NAME		su
+ 
+ #
+ # *REQUIRED*
diff --git a/utils/shadow/patches/002-disable-ruser-lookup.patch b/utils/shadow/patches/002-disable-ruser-lookup.patch
new file mode 100644
index 0000000000..7a6f38e792
--- /dev/null
+++ b/utils/shadow/patches/002-disable-ruser-lookup.patch
@@ -0,0 +1,10 @@
+--- a/configure.in
++++ b/configure.in
+@@ -195,7 +195,6 @@ AC_DEFINE_UNQUOTED(PASSWD_PROGRAM, "$sha
+ dnl XXX - quick hack, should disappear before anyone notices :).
+ AC_DEFINE(USE_SYSLOG, 1, [Define to use syslog().])
+ AC_DEFINE(RLOGIN, 1, [Define if login should support the -r flag for rlogind.])
+-AC_DEFINE(RUSEROK, 0, [Define to the ruserok() "success" return value (0 or 1).])
+ 
+ AC_ARG_ENABLE(shadowgrp,
+ 	[AC_HELP_STRING([--enable-shadowgrp], [enable shadow group support @<:@default=yes@:>@])],