diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 692643505e18..1e2d20c1edb5 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -8,11 +8,17 @@ stdenv.mkDerivation {
     sha256 = "015r3xdkjpqwcv4lvxavq0nybdpxhfjycqpzbx8agqd5sywkx3b0";
   };
 
-  buildInputs = [ flex cracklib ]
+  buildNativeInputs = [ flex ];
+  buildInputs = [ cracklib ]
     ++ stdenv.lib.optional
       (stdenv.system != "armv5tel-linux" && stdenv.system != "mips64-linux")
       libxcrypt;
 
+  crossAttrs = {
+    # Skip libxcrypt cross-building, as it fails for mips and armv5tel
+    propagatedBuildInputs = [ flex.hostDrv cracklib.hostDrv ];
+  };
+
   postInstall = ''
     mv -v $out/sbin/unix_chkpwd{,.orig}
     ln -sv /var/setuid-wrappers/unix_chkpwd $out/sbin/unix_chkpwd
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 8c98297bd56a..c77fe53a56bf 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -28,12 +28,16 @@ stdenv.mkDerivation rec {
     
   patches = [ ./locale_archive.patch ];
 
-  buildInputs = [ zlib openssl perl libedit pkgconfig pam ];
+  buildNativeInptus = [ perl ];
+  buildInputs = [ zlib openssl libedit pkgconfig pam ];
 
+  # I set --disable-strip because later we strip anyway. And it fails to strip
+  # properly when cross building.
   configureFlags =
     ''
       --with-mantype=man
       --with-libedit=yes
+      --disable-strip
       ${if pam != null then "--with-pam" else "--without-pam"}
       ${if etcDir != null then "--sysconfdir=${etcDir}" else ""}
     '';