Index: postlfs/security/cyrus-sasl-systemd.xml
===================================================================
--- postlfs/security/cyrus-sasl-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/cyrus-sasl-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,407 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY cyrus-sasl-download-http " ">
+  <!ENTITY cyrus-sasl-download-ftp  "ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-&cyrus-sasl-version;.tar.gz">
+  <!ENTITY cyrus-sasl-md5sum        "a7f4e5e559a0e37b3ffc438c9456e425">
+  <!ENTITY cyrus-sasl-size          "5.0 MB">
+  <!ENTITY cyrus-sasl-buildsize     "30 MB">
+  <!ENTITY cyrus-sasl-time          "0.5 SBU">
+]>
+
+<sect1 id="cyrus-sasl" xreflabel="Cyrus SASL-&cyrus-sasl-version;">
+  <?dbhtml filename="cyrus-sasl.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Cyrus SASL-&cyrus-sasl-version;</title>
+
+  <indexterm zone="cyrus-sasl">
+    <primary sortas="a-Cyrus-SASL">Cyrus SASL</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to Cyrus SASL</title>
+
+    <para>
+      The <application>Cyrus SASL</application> package contains a Simple
+      Authentication and Security Layer, a method for adding authentication
+      support to connection-based protocols. To use SASL, a protocol includes
+      a command for identifying and authenticating a user to a server and for
+      optionally negotiating protection of subsequent protocol interactions.
+      If its use is negotiated, a security layer is inserted between the
+      protocol and the connection.
+    </para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&cyrus-sasl-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&cyrus-sasl-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &cyrus-sasl-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &cyrus-sasl-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &cyrus-sasl-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &cyrus-sasl-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/cyrus-sasl-&cyrus-sasl-version;-fixes-3.patch"/>
+       </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">Cyrus SASL Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Required</bridgehead>
+    <para role="required">
+      <xref linkend="openssl"/>
+    </para>
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended">
+      <xref linkend="db"/>
+    </para>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <xref linkend="linux-pam"/>,
+      <xref linkend="mitkrb"/>,
+      <xref linkend="mariadb"/>,
+      <xref linkend="openjdk"/>,
+      <xref linkend="openldap"/>,
+      <xref linkend="postgresql"/>,
+      <xref linkend="sqlite"/>,
+      <ulink url="ftp://ftp.pdc.kth.se/pub/krb/src/">krb4</ulink> and
+      <ulink url="http://dmalloc.com/">Dmalloc</ulink>
+    </para>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/cyrus-sasl"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of Cyrus SASL</title>
+
+    <para>
+      Install <application>Cyrus SASL</application> by
+      running the following commands:
+    </para>
+
+<screen><userinput>patch -Np1 -i ../cyrus-sasl-&cyrus-sasl-version;-fixes-3.patch &amp;&amp;
+autoreconf -fi &amp;&amp;
+./configure --prefix=/usr        \
+            --sysconfdir=/etc    \
+            --enable-auth-sasldb \
+            --with-dbpath=/var/lib/sasl/sasldb2 \
+            --with-saslauthd=/var/run/saslauthd &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      This package does not come with a test suite. If you are planning
+      on using the GSSAPI authentication mechanism, it is recommended to test
+      it after installing the package using the sample server and client
+      programs which were built in the preceding step. Instructions for
+      performing the tests can be found at
+      <ulink url="&hints-root;/downloads/files/cyrus-sasl.txt"/>.
+    </para>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+install -v -dm755 /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; &amp;&amp;
+install -v -m644  doc/{*.{html,txt,fig},ONEWS,TODO} \
+    saslauthd/LDAP_SASLAUTHD /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; &amp;&amp;
+install -v -dm700 /var/lib/sasl</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <parameter>--with-dbpath=/var/lib/sasl/sasldb2</parameter>: This
+      switch forces the <command>sasldb</command> database to be created
+      in <filename class="directory">/var/lib/sasl</filename> instead of
+      <filename class="directory">/etc</filename>.
+    </para>
+
+    <para>
+      <parameter>--with-saslauthd=/var/run/saslauthd</parameter>: This
+      switch forces <command>saslauthd</command> to use the FHS compliant
+      directory <filename class="directory">/var/run/saslauthd</filename>
+      for variable run-time data.
+    </para>
+
+    <para>
+      <parameter>--enable-auth-sasldb</parameter>: This switch enables
+      SASLDB authentication backend.
+    </para>
+
+    <para>
+      <parameter>--with-dblib=gdbm</parameter>: This switch forces
+      <application>GDBM</application> to be used instead of
+      <application>Berkeley DB</application>.
+    </para>
+
+    <para>
+      <option>--with-ldap</option>: This switch enables the
+      <application>OpenLDAP</application> support.
+    </para>
+
+    <para>
+      <option>--enable-ldapdb</option>: This switch enables the
+      LDAPDB authentication backend. There is a circular dependency with this
+      parameter. See <ulink url="&blfs-wiki;/cyrus-sasl"/> for a solution to
+      this problem.
+    </para>
+
+    <para>
+      <option>--enable-java</option>: This switch enables compiling of the
+      <application>Java</application> support libraries.
+    </para>
+
+    <para>
+      <option>--enable-login</option>: This option enables unsupported
+      LOGIN authentication.
+    </para>
+
+    <para>
+      <option>--enable-ntlm</option>: This option enables unsupported
+      NTLM authentication.
+    </para>
+
+    <para>
+      <command>install -v -m644 ...</command>: These commands
+      install documentation which is not installed by the
+      <command>make install</command> command.
+    </para>
+
+    <para>
+      <command>install -v -m700 -d /var/lib/sasl</command>: This directory
+      must exist when starting <command>saslauthd</command> or using the
+      sasldb plugin. If you're not going to be running the daemon or
+      using the plugins, you may omit the creation of this directory.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring Cyrus SASL</title>
+
+    <sect3 id="cyrus-sasl-config">
+      <title>Config Files</title>
+
+      <para>
+        <filename>/etc/saslauthd.conf</filename>
+        (for <command>saslauthd</command> LDAP configuration) and
+        <filename>/etc/sasl2/Appname.conf</filename>
+        (where "Appname" is the application defined name of the application)
+      </para>
+
+      <indexterm zone="cyrus-sasl cyrus-sasl-config">
+        <primary sortas="e-etc-saslauthd.conf">/etc/saslauthd.conf</primary>
+      </indexterm>
+
+    </sect3>
+
+    <sect3>
+      <title>Configuration Information</title>
+
+      <para>
+        See
+        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/sysadmin.html"/>
+        for information on what to include in the application configuration files.
+      </para>
+
+      <para>
+        See
+        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/LDAP_SASLAUTHD"/>
+        for configuring <command>saslauthd</command> with
+        <application>OpenLDAP</application>.
+      </para>
+
+      <para>
+        See
+        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/gssapi.html"/>
+        for configuring <command>saslauthd</command> with <application>Kerberos</application>.
+      </para>
+
+    </sect3>
+
+    <sect3 id="cyrus-sasl-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the <command>saslauthd</command> daemon at boot,
+        install the systemd unit from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="cyrus-sasl cyrus-sasl-init">
+        <primary sortas="f-saslauthd">saslauthd</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-saslauthd</userinput></screen>
+
+      <note>
+        <para>
+          The default authentication method is "shadow". The
+          <filename>/etc/default/saslauthd</filename> 
+          file needs to be modified for anything else.
+        </para>
+      </note>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Library</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          pluginviewer, saslauthd, sasldblistusers2, saslpasswd2 and
+          testsaslauthd
+        </seg>
+        <seg>
+          libsasl2.so
+        </seg>
+        <seg>
+          /usr/include/sasl,
+          /usr/lib/sasl2,
+          /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; and
+          /var/lib/sasl
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="pluginviewer">
+        <term><command>pluginviewer</command></term>
+        <listitem>
+          <para>
+            is used to list loadable SASL plugins and their properties.
+          </para>
+          <indexterm zone="cyrus-sasl pluginviewer">
+            <primary sortas="b-pluginviewer">pluginviewer</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="saslauthd">
+        <term><command>saslauthd</command></term>
+        <listitem>
+          <para>
+            is the SASL authentication server.
+          </para>
+          <indexterm zone="cyrus-sasl saslauthd">
+            <primary sortas="b-saslauthd">saslauthd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sasldblistusers2">
+        <term><command>sasldblistusers2</command></term>
+        <listitem>
+          <para>
+            is used to list the users in the SASL password database
+            <filename>sasldb2</filename>.
+          </para>
+          <indexterm zone="cyrus-sasl sasldblistusers2">
+            <primary sortas="b-sasldblistusers2">sasldblistusers2</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="saslpasswd2">
+        <term><command>saslpasswd2</command></term>
+        <listitem>
+          <para>
+            is used to set and delete a user's SASL password and
+            mechanism specific secrets in the SASL password
+            database <filename>sasldb2</filename>.
+          </para>
+          <indexterm zone="cyrus-sasl saslpasswd2">
+            <primary sortas="b-saslpasswd2">saslpasswd2</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="testsaslauthd">
+        <term><command>testsaslauthd</command></term>
+        <listitem>
+          <para>
+            is a test utility for the SASL authentication server.
+          </para>
+          <indexterm zone="cyrus-sasl testsaslauthd">
+            <primary sortas="b-testsaslauthd">testsaslauthd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libsasl2">
+        <term><filename class="libraryfile">libsasl2.so</filename></term>
+        <listitem>
+          <para>
+            is a general purpose authentication library for server
+            and client applications.
+          </para>
+          <indexterm zone="cyrus-sasl libsasl2">
+            <primary sortas="c-libsasl2">libsasl2.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/cyrus-sasl.xml
===================================================================
--- postlfs/security/cyrus-sasl.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,407 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY cyrus-sasl-download-http " ">
-  <!ENTITY cyrus-sasl-download-ftp  "ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-&cyrus-sasl-version;.tar.gz">
-  <!ENTITY cyrus-sasl-md5sum        "a7f4e5e559a0e37b3ffc438c9456e425">
-  <!ENTITY cyrus-sasl-size          "5.0 MB">
-  <!ENTITY cyrus-sasl-buildsize     "30 MB">
-  <!ENTITY cyrus-sasl-time          "0.5 SBU">
-]>
-
-<sect1 id="cyrus-sasl" xreflabel="Cyrus SASL-&cyrus-sasl-version;">
-  <?dbhtml filename="cyrus-sasl.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Cyrus SASL-&cyrus-sasl-version;</title>
-
-  <indexterm zone="cyrus-sasl">
-    <primary sortas="a-Cyrus-SASL">Cyrus SASL</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to Cyrus SASL</title>
-
-    <para>
-      The <application>Cyrus SASL</application> package contains a Simple
-      Authentication and Security Layer, a method for adding authentication
-      support to connection-based protocols. To use SASL, a protocol includes
-      a command for identifying and authenticating a user to a server and for
-      optionally negotiating protection of subsequent protocol interactions.
-      If its use is negotiated, a security layer is inserted between the
-      protocol and the connection.
-    </para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&cyrus-sasl-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&cyrus-sasl-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &cyrus-sasl-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &cyrus-sasl-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &cyrus-sasl-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &cyrus-sasl-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Required patch:
-          <ulink url="&patch-root;/cyrus-sasl-&cyrus-sasl-version;-fixes-3.patch"/>
-       </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">Cyrus SASL Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="openssl"/>
-    </para>
-
-    <bridgehead renderas="sect4">Recommended</bridgehead>
-    <para role="recommended">
-      <xref linkend="db"/>
-    </para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="linux-pam"/>,
-      <xref linkend="mitkrb"/>,
-      <xref linkend="mariadb"/> or <ulink url="http://www.mysql.com/">MySQL</ulink>,
-      <xref linkend="openjdk"/>,
-      <xref linkend="openldap"/>,
-      <xref linkend="postgresql"/>,
-      <xref linkend="sqlite"/>,
-      <ulink url="ftp://ftp.pdc.kth.se/pub/krb/src/">krb4</ulink> and
-      <ulink url="http://dmalloc.com/">Dmalloc</ulink>
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/cyrus-sasl"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of Cyrus SASL</title>
-
-    <para>
-      Install <application>Cyrus SASL</application> by
-      running the following commands:
-    </para>
-
-<screen><userinput>patch -Np1 -i ../cyrus-sasl-&cyrus-sasl-version;-fixes-3.patch &amp;&amp;
-autoreconf -fi &amp;&amp;
-./configure --prefix=/usr        \
-            --sysconfdir=/etc    \
-            --enable-auth-sasldb \
-            --with-dbpath=/var/lib/sasl/sasldb2 \
-            --with-saslauthd=/var/run/saslauthd &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      This package does not come with a test suite. If you are planning
-      on using the GSSAPI authentication mechanism, it is recommended to test
-      it after installing the package using the sample server and client
-      programs which were built in the preceding step. Instructions for
-      performing the tests can be found at
-      <ulink url="&hints-root;/downloads/files/cyrus-sasl.txt"/>.
-    </para>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install &amp;&amp;
-install -v -dm755 /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; &amp;&amp;
-install -v -m644  doc/{*.{html,txt,fig},ONEWS,TODO} \
-    saslauthd/LDAP_SASLAUTHD /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; &amp;&amp;
-install -v -dm700 /var/lib/sasl</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <parameter>--with-dbpath=/var/lib/sasl/sasldb2</parameter>: This
-      switch forces the <command>sasldb</command> database to be created
-      in <filename class="directory">/var/lib/sasl</filename> instead of
-      <filename class="directory">/etc</filename>.
-    </para>
-
-    <para>
-      <parameter>--with-saslauthd=/var/run/saslauthd</parameter>: This
-      switch forces <command>saslauthd</command> to use the FHS compliant
-      directory <filename class="directory">/var/run/saslauthd</filename>
-      for variable run-time data.
-    </para>
-
-    <para>
-      <parameter>--enable-auth-sasldb</parameter>: This switch enables
-      SASLDB authentication backend.
-    </para>
-
-    <para>
-      <option>--with-dblib=gdbm</option>: This switch forces
-      <application>GDBM</application> to be used instead of
-      <application>Berkeley DB</application>.
-    </para>
-
-    <para>
-      <option>--with-ldap</option>: This switch enables the
-      <application>OpenLDAP</application> support.
-    </para>
-
-    <para>
-      <option>--enable-ldapdb</option>: This switch enables the
-      LDAPDB authentication backend. There is a circular dependency with this
-      parameter. See <ulink url="&blfs-wiki;/cyrus-sasl"/> for a solution to
-      this problem.
-    </para>
-
-    <para>
-      <option>--enable-java</option>: This switch enables compiling of the
-      <application>Java</application> support libraries.
-    </para>
-
-    <para>
-      <option>--enable-login</option>: This option enables unsupported
-      LOGIN authentication.
-    </para>
-
-    <para>
-      <option>--enable-ntlm</option>: This option enables unsupported
-      NTLM authentication.
-    </para>
-
-    <para>
-      <command>install -v -m644 ...</command>: These commands
-      install documentation which is not installed by the
-      <command>make install</command> command.
-    </para>
-
-    <para>
-      <command>install -v -m700 -d /var/lib/sasl</command>: This directory
-      must exist when starting <command>saslauthd</command> or using the
-      sasldb plugin. If you're not going to be running the daemon or
-      using the plugins, you may omit the creation of this directory.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring Cyrus SASL</title>
-
-    <sect3 id="cyrus-sasl-config">
-      <title>Config Files</title>
-
-      <para>
-        <filename>/etc/saslauthd.conf</filename>
-        (for <command>saslauthd</command> LDAP configuration) and
-        <filename>/etc/sasl2/Appname.conf</filename>
-        (where "Appname" is the application defined name of the application)
-      </para>
-
-      <indexterm zone="cyrus-sasl cyrus-sasl-config">
-        <primary sortas="e-etc-saslauthd.conf">/etc/saslauthd.conf</primary>
-      </indexterm>
-
-    </sect3>
-
-    <sect3>
-      <title>Configuration Information</title>
-
-      <para>
-        See
-        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/sysadmin.html"/>
-        for information on what to include in the application configuration files.
-      </para>
-
-      <para>
-        See
-        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/LDAP_SASLAUTHD"/>
-        for configuring <command>saslauthd</command> with
-        <application>OpenLDAP</application>.
-      </para>
-
-      <para>
-        See
-        <ulink url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/gssapi.html"/>
-        for configuring <command>saslauthd</command> with <application>Kerberos</application>.
-      </para>
-
-    </sect3>
-
-    <sect3 id="cyrus-sasl-init">
-      <title>Init Script</title>
-
-      <para>
-        If you need to run the <command>saslauthd</command> daemon at system
-        startup, install the <filename>/etc/rc.d/init.d/saslauthd</filename>
-        init script included in the <xref linkend="bootscripts"/>
-        package using the following command:
-      </para>
-
-      <indexterm zone="cyrus-sasl cyrus-sasl-init">
-        <primary sortas="f-saslauthd">saslauthd</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-saslauthd</userinput></screen>
-
-      <note>
-        <para>
-          You'll need to modify /etc/sysconfig/saslauthd and replace the
-          <option><replaceable>AUTHMECH</replaceable></option> parameter
-          with your desired authentication mechanism.
-        </para>
-      </note>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Library</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          pluginviewer, saslauthd, sasldblistusers2, saslpasswd2 and
-          testsaslauthd
-        </seg>
-        <seg>
-          libsasl2.so
-        </seg>
-        <seg>
-          /usr/include/sasl,
-          /usr/lib/sasl2,
-          /usr/share/doc/cyrus-sasl-&cyrus-sasl-version; and
-          /var/lib/sasl
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="pluginviewer">
-        <term><command>pluginviewer</command></term>
-        <listitem>
-          <para>
-            is used to list loadable SASL plugins and their properties.
-          </para>
-          <indexterm zone="cyrus-sasl pluginviewer">
-            <primary sortas="b-pluginviewer">pluginviewer</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="saslauthd">
-        <term><command>saslauthd</command></term>
-        <listitem>
-          <para>
-            is the SASL authentication server.
-          </para>
-          <indexterm zone="cyrus-sasl saslauthd">
-            <primary sortas="b-saslauthd">saslauthd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sasldblistusers2">
-        <term><command>sasldblistusers2</command></term>
-        <listitem>
-          <para>
-            is used to list the users in the SASL password database
-            <filename>sasldb2</filename>.
-          </para>
-          <indexterm zone="cyrus-sasl sasldblistusers2">
-            <primary sortas="b-sasldblistusers2">sasldblistusers2</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="saslpasswd2">
-        <term><command>saslpasswd2</command></term>
-        <listitem>
-          <para>
-            is used to set and delete a user's SASL password and
-            mechanism specific secrets in the SASL password
-            database <filename>sasldb2</filename>.
-          </para>
-          <indexterm zone="cyrus-sasl saslpasswd2">
-            <primary sortas="b-saslpasswd2">saslpasswd2</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="testsaslauthd">
-        <term><command>testsaslauthd</command></term>
-        <listitem>
-          <para>
-            is a test utility for the SASL authentication server.
-          </para>
-          <indexterm zone="cyrus-sasl testsaslauthd">
-            <primary sortas="b-testsaslauthd">testsaslauthd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libsasl2">
-        <term><filename class="libraryfile">libsasl2.so</filename></term>
-        <listitem>
-          <para>
-            is a general purpose authentication library for server
-            and client applications.
-          </para>
-          <indexterm zone="cyrus-sasl libsasl2">
-            <primary sortas="c-libsasl2">libsasl2.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/firewalling-systemd.xml
===================================================================
--- postlfs/security/firewalling-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/firewalling-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,587 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+]>
+
+<sect1 id="fw-firewall" xreflabel="Firewalling">
+  <?dbhtml filename="firewall.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Setting Up a Network Firewall</title>
+
+  <para>Before you read this part of the chapter, you should have
+  already installed iptables as described in the previous section.</para>
+
+  <sect2 id="fw-intro" xreflabel="Firewalling Introduction">
+    <title>Introduction to Firewall Creation</title>
+
+    <para>The general purpose of a firewall is to protect a computer or
+    a network against malicious access.</para>
+
+    <para>In a perfect world, every daemon or service on every machine
+    is perfectly configured and immune to flaws such as buffer overflows
+    or other problems regarding its security. Furthermore, you trust
+    every user accessing your services. In this world, you do not need
+    to have a firewall.</para>
+
+    <para>In the real world however, daemons may be misconfigured and
+    exploits against essential services are freely available. You may
+    wish to choose which services are accessible by certain machines or
+    you may wish to limit which machines or applications are allowed
+    external access. Alternatively, you may simply not trust some of
+    your applications or users. You are probably connected to the
+    Internet. In this world, a firewall is essential.</para>
+
+    <para>Don't assume however, that having a firewall makes careful
+    configuration redundant, or that it makes any negligent
+    misconfiguration harmless. It doesn't prevent anyone from exploiting
+    a service you intentionally offer but haven't recently updated or
+    patched after an exploit went public.  Despite having a firewall, you
+    need to keep applications and daemons on your system properly
+    configured and up to date.  A firewall is not a cure all, but should
+    be an essential part of your overall security strategy.</para>
+
+  </sect2>
+
+  <sect2>
+    <title>Meaning of the Word "Firewall"</title>
+
+    <para>The word firewall can have several different meanings.</para>
+
+    <sect3>
+      <title><xref linkend="fw-persFw"/></title>
+
+      <para>This is a hardware device or software program commercially sold (or
+      offered via freeware) by companies such as Symantec which claims that
+      it secures a home or desktop computer connected to the Internet. This
+      type of firewall is highly relevant for users who do not know how their
+      computers might be accessed via the Internet or how to disable
+      that access, especially if they are always online and connected
+      via broadband links.</para>
+
+    </sect3>
+
+    <sect3>
+      <title><xref linkend="fw-masqRouter"/></title>
+
+      <para>This is a system placed between the Internet and an intranet.
+      To minimize the risk of compromising the firewall itself, it should
+      generally have only one role&mdash;that of protecting the intranet.
+      Although not completely risk free, the tasks of doing the routing and
+      IP masquerading (rewriting IP headers of the packets it routes from
+      clients with private IP addresses onto the Internet so that they seem
+      to come from the firewall itself) are commonly considered relatively
+      secure.</para>
+
+    </sect3>
+
+    <sect3>
+      <title><xref linkend="fw-busybox"/></title>
+
+      <para>This is often an old computer you may have retired and nearly
+      forgotten, performing masquerading or routing functions, but offering
+      non-firewall services such as a web-cache or mail.  This may be used
+      for home networks, but is not to be considered as secure as a firewall
+      only machine because the combination of server and router/firewall on
+      one machine raises the complexity of the setup.</para>
+
+    </sect3>
+
+    <sect3>
+      <title>Firewall with a Demilitarized Zone [Not Further
+      Described Here]</title>
+
+      <para>This box performs masquerading or routing, but grants public
+      access to some branch of your network which, because of public IPs
+      and a physically separated structure, is essentially a separate
+      network with direct Internet access. The servers on this network are
+      those which must be easily accessible from both the Internet and
+      intranet. The firewall protects both networks. This type of firewall
+      has a minimum of three network interfaces.</para>
+
+    </sect3>
+
+    <sect3>
+      <title>Packetfilter</title>
+
+      <para>This type of firewall does routing or masquerading, but does
+      not maintain a state table of ongoing communication streams. It is
+      fast, but quite limited in its ability to block undesired packets
+      without blocking desired packets.</para>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 id="fw-writing" xreflabel="writing the firewalling-setup-scripts">
+    <title>Now You Can Start to Build your Firewall</title>
+
+    <caution>
+      <para>This introduction on how to setup a firewall is not a
+      complete guide to securing systems. Firewalling is a complex
+      issue that requires careful configuration. The scripts quoted
+      here are simply intended to give examples of how a firewall
+      works. They are not intended to fit into any particular
+      configuration and may not provide complete protection from
+      an attack.</para>
+
+      <para>Customization of these scripts for your specific situation
+      will be necessary for an optimal configuration, but you should
+      make a serious study of the iptables documentation and creating
+      firewalls in general before hacking away. Have a look at the
+      list of <xref linkend="fw-library"/> at the end of this section for
+      more details. There you will find a list of URLs that contain quite
+      comprehensive information about building your own firewall.</para>
+    </caution>
+
+    <para>The main startup firewall is located in the file
+    <filename>/etc/systemd/scripts/iptables</filename>. The sections below provide
+    three different approaches that can be used for a system.</para>
+
+    <note>
+      <para>You should always run your firewall rules from a script.
+      This ensures consistency and a record of what was done. It also
+      allows retention of comments that are essential for understanding
+      the rules long after they were written.</para>
+    </note>
+
+    <sect3 id="fw-persFw" xreflabel="Personal Firewall">
+      <title>Personal Firewall</title>
+
+      <para>A Personal Firewall is designed to let you access all the
+      services offered on the Internet, but keep your box secure and
+      your data private.</para>
+
+      <para>Below is a slightly modified version of Rusty Russell's
+      recommendation from the <ulink
+      url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
+      Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
+      to the Linux 2.6 kernels.</para>
+
+<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+# Insert connection-tracking modules
+# (not needed if built into the kernel)
+modprobe nf_conntrack
+modprobe xt_LOG
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
+
+# Do not send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface, where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
+
+# be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# disable Explicit Congestion Notification
+# too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local-only connections
+iptables -A INPUT  -i lo -j ACCEPT
+
+# Free output on any interface to any ip for any service
+# (equal to -P ACCEPT)
+iptables -A OUTPUT -j ACCEPT
+
+# Permit answers on already established connections
+# and permit new connections related to established ones
+# (e.g. port mode ftp)
+iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Log everything else. What's Windows' latest exploitable vulnerability?
+iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
+
+      <para>This script is quite simple, it drops all traffic coming
+      into your computer that wasn't initiated from your computer, but
+      as long as you are simply surfing the Internet you are unlikely
+      to exceed its limits.</para>
+
+      <para>If you frequently encounter certain delays at accessing
+      FTP servers, take a look at <xref linkend="fw-BB-4"/>.</para>
+
+      <para>Even if you have daemons or services running on your system,
+      these will be inaccessible everywhere but from your computer itself.
+      If you want to allow access to services on your machine, such as
+      <command>ssh</command> or <command>ping</command>, take a look at
+      <xref linkend="fw-busybox"/>.</para>
+
+    </sect3>
+
+    <sect3 id="fw-masqRouter" xreflabel="Masquerading Router">
+      <title>Masquerading Router</title>
+
+      <para>A true Firewall has two interfaces, one connected to an
+      intranet, in this example <emphasis role="strong">eth0</emphasis>,
+      and one connected to the Internet, here <emphasis
+      role="strong">ppp0</emphasis>. To provide the maximum security
+      for the firewall itself, make sure that there are no unnecessary
+      servers running on it such as <application>X11</application> et
+      al. As a general principle, the firewall itself should not access
+      any untrusted service (think of a remote server giving answers that
+      makes a daemon on your system crash, or even worse, that implements
+      a worm via a buffer-overflow).</para>
+
+<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+echo
+echo "You're using the example configuration for a setup of a firewall"
+echo "from Beyond Linux From Scratch."
+echo "This example is far from being complete, it is only meant"
+echo "to be a reference."
+echo "Firewall security is a complex issue, that exceeds the scope"
+echo "of the configuration rules below."
+echo "You can find additional information"
+echo "about firewalls in Chapter 4 of the BLFS book."
+echo "http://www.&lfs-domainname;/blfs"
+echo
+
+# Insert iptables modules (not needed if built into the kernel).
+
+modprobe nf_conntrack
+modprobe nf_conntrack_ftp
+modprobe xt_conntrack
+modprobe xt_LOG
+modprobe xt_state
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
+
+# Don't send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+
+# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# Disable Explicit Congestion Notification
+# Too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local connections
+iptables -A INPUT  -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+
+# Allow forwarding if the initiated on the intranet
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD ! -i ppp+ -m conntrack --ctstate NEW       -j ACCEPT
+
+# Do masquerading
+# (not needed if intranet is not using private ip-addresses)
+iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
+
+# Log everything for debugging
+# (last of all rules, but before policy rules)
+iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
+iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
+iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
+
+# Enable IP Forwarding
+echo 1 &gt; /proc/sys/net/ipv4/ip_forward
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
+
+      <para>With this script your intranet should be reasonably secure
+      against external attacks. No one should be able to setup a new
+      connection to any internal service and, if it's masqueraded,
+      makes your intranet invisible to the Internet. Furthermore, your
+      firewall should be relatively safe because there are no services
+      running that a cracker could attack.</para>
+
+      <note>
+        <para>If the interface you're connecting to the Internet
+        doesn't connect via PPP, you will need to change
+        <replaceable>&lt;ppp+&gt;</replaceable> to the name of the interface
+        (e.g., <emphasis role="strong">eth1</emphasis>) which you are
+        using.</para>
+      </note>
+
+    </sect3>
+
+    <sect3 id="fw-busybox" xreflabel="BusyBox">
+      <title>BusyBox</title>
+
+      <para>This scenario isn't too different from the <xref
+      linkend="fw-masqRouter"/>, but additionally offers some
+      services to your intranet. Examples of this can be when
+      you want to administer your firewall from another host on
+      your intranet or use it as a proxy or a name server.</para>
+
+      <note>
+        <para>Outlining a true concept of how to protect a server that
+        offers services on the Internet goes far beyond the scope of
+        this document. See the references at the end of this section
+        for more information.</para>
+      </note>
+
+      <para>Be cautious. Every service you have enabled makes your
+      setup more complex and your firewall less secure. You are
+      exposed to the risks of misconfigured services or running
+      a service with an exploitable bug. A firewall should generally
+      not run any extra services.  See the introduction to the
+      <xref linkend="fw-masqRouter"/> for some more details.</para>
+
+      <para>If you want to add services such as internal Samba or
+      name servers that do not need to access the Internet themselves,
+      the additional statements are quite simple and should still be
+      acceptable from a security standpoint. Just add the following lines
+      into the script <emphasis>before</emphasis> the logging rules.</para>
+
+<screen><literal>iptables -A INPUT  -i ! ppp+  -j ACCEPT
+iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
+
+      <para>If daemons, such as squid, have to access the Internet
+      themselves, you could open OUTPUT generally and restrict
+      INPUT.</para>
+
+<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A OUTPUT -j ACCEPT</literal></screen>
+
+      <para>However, it is generally not advisable to leave OUTPUT
+      unrestricted. You lose any control over trojans who would like
+      to "call home", and a bit of redundancy in case you've
+      (mis-)configured a service so that it broadcasts its existence
+      to the world.</para>
+
+      <para>To accomplish this, you should restrict INPUT and OUTPUT
+      on all ports except those that it's absolutely necessary to have
+      open. Which ports you have to open depends on your needs: mostly
+      you will find them by looking for failed accesses in your log
+      files.</para>
+
+      <itemizedlist spacing="compact" role='iptables'>
+        <title>Have a Look at the Following Examples:</title>
+        <listitem>
+          <para>Squid is caching the web:</para>
+
+<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
+  -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>Your caching name server (e.g., named) does its
+          lookups via UDP:</para>
+
+<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>You want to be able to ping your computer to
+          ensure it's still alive:</para>
+
+<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
+iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para id='fw-BB-4' xreflabel="BusyBox example number 4">If
+          you are frequently accessing FTP servers or enjoy chatting, you might
+          notice certain delays because some implementations of these daemons
+          have the feature of querying an identd on your system to obtain
+          usernames. Although there's really little harm in this, having an
+          identd running is not recommended because many security experts feel
+          the service gives out too much additional information.</para>
+
+          <para>To avoid these delays you could reject the requests
+          with a 'tcp-reset':</para>
+
+<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>To log and drop invalid packets (packets
+          that came in after netfilter's timeout or some types of
+          network scans) insert these rules at the top of the chain:</para>
+
+<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
+  -j LOG --log-prefix "FIREWALL:INVALID "
+iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>Anything coming from the outside should not have a
+          private address, this is a common attack called IP-spoofing:</para>
+
+<screen><literal>iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
+iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
+iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
+
+          <para>There are other addresses that you may also want to
+          drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
+          experimental), 169.254.0.0/16 (Link Local Networks), and
+          192.0.2.0/24 (IANA defined test network).</para>
+        </listitem>
+        <listitem>
+          <para>If your firewall is a DHCP client, you need to allow
+          those packets:</para>
+
+<screen><literal>iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
+   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>To simplify debugging and be fair to anyone who'd like
+          to access a service you have disabled, purposely or by mistake,
+          you could REJECT those packets that are dropped.</para>
+
+          <para>Obviously this must be done directly after logging as the very
+          last lines before the packets are dropped by policy:</para>
+
+<screen><literal>iptables -A INPUT -j REJECT</literal></screen>
+
+        </listitem>
+      </itemizedlist>
+
+      <para>These are only examples to show you some of the capabilities
+      of the firewall code in Linux. Have a look at the man page of iptables.
+      There you will find much more information. The port numbers needed for
+      this can be found in <filename>/etc/services</filename>, in case you
+      didn't find them by trial and error in your log file.</para>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 id="fw-finale" xreflabel="Conclusion">
+    <title>Conclusion</title>
+
+    <para>Finally, there is one fact you must not forget: The effort spent
+    attacking a system corresponds to the value the cracker expects to gain
+    from it. If you are responsible for valuable information, you need to
+    spend the time to protect it properly.</para>
+
+  </sect2>
+
+  <sect2 id="postlfs-security-fw-extra" xreflabel="Extra Information">
+    <title>Extra Information</title>
+
+    <sect3 id="fw-library" xreflabel="links for further reading">
+      <title>Where to Start with Further Reading on Firewalls</title>
+
+      <blockquote>
+        <literallayout>
+<ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables project</ulink>
+<ulink url="http://www.netfilter.org/documentation/FAQ/netfilter-faq.html">Netfilter related FAQ</ulink>
+<ulink url="http://www.netfilter.org/documentation/index.html#HOWTO">Netfilter related HOWTO's</ulink>
+<ulink url="http://en.tldp.org/LDP/nag2/x-087-2-firewall.html">en.tldp.org/LDP/nag2/x-087-2-firewall.html</ulink>
+<ulink url="http://en.tldp.org/HOWTO/Security-HOWTO.html">en.tldp.org/HOWTO/Security-HOWTO.html</ulink>
+<ulink url="http://en.tldp.org/HOWTO/Firewall-HOWTO.html">en.tldp.org/HOWTO/Firewall-HOWTO.html</ulink>
+<ulink url="http://www.linuxsecurity.com/docs/">www.linuxsecurity.com/docs/</ulink>
+<ulink url="http://www.little-idiot.de/firewall">www.little-idiot.de/firewall (German &amp; outdated, but very comprehensive)</ulink>
+<ulink url="http://linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html">linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html</ulink>
+<ulink url="http://staff.washington.edu/dittrich/misc/ddos">staff.washington.edu/dittrich/misc/ddos</ulink>
+<ulink url="http://www.e-infomax.com/ipmasq">www.e-infomax.com/ipmasq</ulink>
+<ulink url="http://www.circlemud.org/~jelson/writings/security/index.htm">www.circlemud.org/~jelson/writings/security/index.htm</ulink>
+<ulink url="http://www.securityfocus.com">www.securityfocus.com</ulink>
+<ulink url="http://www.cert.org/tech_tips/">www.cert.org - tech_tips</ulink>
+<ulink url="http://security.ittoolbox.com/">security.ittoolbox.com</ulink>
+<ulink url="http://www.insecure.org/reading.html">www.insecure.org/reading.html</ulink>
+        </literallayout>
+      </blockquote>
+
+      <!-- The following are all dead links from the section above. They are
+           moved out of the section so the literallayout won't produce blank
+           lines in the rendered text
+
+<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire.html">www.ibm.com/developerworks/security/library/s-fire.html</ulink>
+<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire2.html">www.ibm.com/developerworks/security/library/s-fire2.html</ulink>
+<ulink url="http://www.interhack.net/pubs/fw-faq/">www.interhack.net/pubs/fw-faq/</ulink>
+<ulink url="http://www.linuxgazette.com/issue65/stumpel.html">www.linuxgazette.com/issue65/stumpel.html</ulink>
+<ulink url="http://www.linux-firewall-tools.com/linux/">www.linux-firewall-tools.com/linux/</ulink>
+<ulink url="http://logi.cc/linux/athome-firewall.php3">logi.cc/linux/athome-firewall.php3</ulink>
+<ulink url="http://www.robertgraham.com/pubs/firewall-seen.html">www.robertgraham.com/pubs/firewall-seen.html</ulink>
+
+      -->
+
+    </sect3>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/firewalling.xml
===================================================================
--- postlfs/security/firewalling.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,594 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-]>
-
-<sect1 id="fw-firewall" xreflabel="Firewalling">
-  <?dbhtml filename="firewall.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Setting Up a Network Firewall</title>
-
-  <para>Before you read this part of the chapter, you should have
-  already installed iptables as described in the previous section.</para>
-
-  <sect2 id="fw-intro" xreflabel="Firewalling Introduction">
-    <title>Introduction to Firewall Creation</title>
-
-    <para>The general purpose of a firewall is to protect a computer or
-    a network against malicious access.</para>
-
-    <para>In a perfect world, every daemon or service on every machine
-    is perfectly configured and immune to flaws such as buffer overflows
-    or other problems regarding its security. Furthermore, you trust
-    every user accessing your services. In this world, you do not need
-    to have a firewall.</para>
-
-    <para>In the real world however, daemons may be misconfigured and
-    exploits against essential services are freely available. You may
-    wish to choose which services are accessible by certain machines or
-    you may wish to limit which machines or applications are allowed
-    external access. Alternatively, you may simply not trust some of
-    your applications or users. You are probably connected to the
-    Internet. In this world, a firewall is essential.</para>
-
-    <para>Don't assume however, that having a firewall makes careful
-    configuration redundant, or that it makes any negligent
-    misconfiguration harmless. It doesn't prevent anyone from exploiting
-    a service you intentionally offer but haven't recently updated or
-    patched after an exploit went public.  Despite having a firewall, you
-    need to keep applications and daemons on your system properly
-    configured and up to date.  A firewall is not a cure all, but should
-    be an essential part of your overall security strategy.</para>
-
-  </sect2>
-
-  <sect2>
-    <title>Meaning of the Word "Firewall"</title>
-
-    <para>The word firewall can have several different meanings.</para>
-
-    <sect3>
-      <title><xref linkend="fw-persFw"/></title>
-
-      <para>This is a hardware device or software program commercially sold (or
-      offered via freeware) by companies such as Symantec which claims that
-      it secures a home or desktop computer connected to the Internet. This
-      type of firewall is highly relevant for users who do not know how their
-      computers might be accessed via the Internet or how to disable
-      that access, especially if they are always online and connected
-      via broadband links.</para>
-
-    </sect3>
-
-    <sect3>
-      <title><xref linkend="fw-masqRouter"/></title>
-
-      <para>This is a system placed between the Internet and an intranet.
-      To minimize the risk of compromising the firewall itself, it should
-      generally have only one role&mdash;that of protecting the intranet.
-      Although not completely risk free, the tasks of doing the routing and
-      IP masquerading (rewriting IP headers of the packets it routes from
-      clients with private IP addresses onto the Internet so that they seem
-      to come from the firewall itself) are commonly considered relatively
-      secure.</para>
-
-    </sect3>
-
-    <sect3>
-      <title><xref linkend="fw-busybox"/></title>
-
-      <para>This is often an old computer you may have retired and nearly
-      forgotten, performing masquerading or routing functions, but offering
-      non-firewall services such as a web-cache or mail.  This may be used
-      for home networks, but is not to be considered as secure as a firewall
-      only machine because the combination of server and router/firewall on
-      one machine raises the complexity of the setup.</para>
-
-    </sect3>
-
-    <sect3>
-      <title>Firewall with a Demilitarized Zone [Not Further
-      Described Here]</title>
-
-      <para>This box performs masquerading or routing, but grants public
-      access to some branch of your network which, because of public IPs
-      and a physically separated structure, is essentially a separate
-      network with direct Internet access. The servers on this network are
-      those which must be easily accessible from both the Internet and
-      intranet. The firewall protects both networks. This type of firewall
-      has a minimum of three network interfaces.</para>
-
-    </sect3>
-
-    <sect3>
-      <title>Packetfilter</title>
-
-      <para>This type of firewall does routing or masquerading, but does
-      not maintain a state table of ongoing communication streams. It is
-      fast, but quite limited in its ability to block undesired packets
-      without blocking desired packets.</para>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 id="fw-writing" xreflabel="writing the firewalling-setup-scripts">
-    <title>Now You Can Start to Build your Firewall</title>
-
-    <caution>
-      <para>This introduction on how to setup a firewall is not a
-      complete guide to securing systems. Firewalling is a complex
-      issue that requires careful configuration. The scripts quoted
-      here are simply intended to give examples of how a firewall
-      works. They are not intended to fit into any particular
-      configuration and may not provide complete protection from
-      an attack.</para>
-
-      <para>Customization of these scripts for your specific situation
-      will be necessary for an optimal configuration, but you should
-      make a serious study of the iptables documentation and creating
-      firewalls in general before hacking away. Have a look at the
-      list of <xref linkend="fw-library"/> at the end of this section for
-      more details. There you will find a list of URLs that contain quite
-      comprehensive information about building your own firewall.</para>
-    </caution>
-
-    <para>The firewall configuration script installed in the iptables section
-    differs from the standard configuration script. It only has two of
-    the standard targets: start and status. The other targets are clear
-    and lock. For instance if you issue:</para>
-
-<screen role="root"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
-
-    <para>the firewall will be restarted just as it is upon system startup.
-    The status target will present a list of all currently implemented
-    rules. The clear target turns off all firewall rules and the lock
-    target will block all packets in and out of the computer with the
-    exception of the loopback interface.</para>
-
-    <para>The main startup firewall is located in the file
-    <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
-    three different approaches that can be used for a system.</para>
-
-    <note>
-      <para>You should always run your firewall rules from a script.
-      This ensures consistency and a record of what was done. It also
-      allows retention of comments that are essential for understanding
-      the rules long after they were written.</para>
-    </note>
-
-    <sect3 id="fw-persFw" xreflabel="Personal Firewall">
-      <title>Personal Firewall</title>
-
-      <para>A Personal Firewall is designed to let you access all the
-      services offered on the Internet, but keep your box secure and
-      your data private.</para>
-
-      <para>Below is a slightly modified version of Rusty Russell's
-      recommendation from the <ulink
-      url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
-      Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
-      to the Linux 2.6 kernels.</para>
-
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
-<literal>#!/bin/sh
-
-# Begin rc.iptables
-
-# Insert connection-tracking modules
-# (not needed if built into the kernel)
-modprobe nf_conntrack
-modprobe xt_LOG
-
-# Enable broadcast echo Protection
-echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
-
-# Disable Source Routed Packets
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
-
-# Enable TCP SYN Cookie Protection
-echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
-
-# Disable ICMP Redirect Acceptance
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
-
-# Do not send Redirect Messages
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
-
-# Drop Spoofed Packets coming in on an interface, where responses
-# would result in the reply going out a different interface.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
-
-# Log packets with impossible addresses.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
-
-# be verbose on dynamic ip-addresses  (not needed in case of static IP)
-echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
-
-# disable Explicit Congestion Notification
-# too many routers are still ignorant
-echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
-
-# Set a known state
-iptables -P INPUT   DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT  DROP
-
-# These lines are here in case rules are already in place and the
-# script is ever rerun on the fly. We want to remove all rules and
-# pre-existing user defined chains before we implement new rules.
-iptables -F
-iptables -X
-iptables -Z
-
-iptables -t nat -F
-
-# Allow local-only connections
-iptables -A INPUT  -i lo -j ACCEPT
-
-# Free output on any interface to any ip for any service
-# (equal to -P ACCEPT)
-iptables -A OUTPUT -j ACCEPT
-
-# Permit answers on already established connections
-# and permit new connections related to established ones
-# (e.g. port mode ftp)
-iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-
-# Log everything else. What's Windows' latest exploitable vulnerability?
-iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
-
-# End $rc_base/rc.iptables</literal>
-EOF
-chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
-
-      <para>This script is quite simple, it drops all traffic coming
-      into your computer that wasn't initiated from your computer, but
-      as long as you are simply surfing the Internet you are unlikely
-      to exceed its limits.</para>
-
-      <para>If you frequently encounter certain delays at accessing
-      FTP servers, take a look at <xref linkend="fw-BB-4"/>.</para>
-
-      <para>Even if you have daemons or services running on your system,
-      these will be inaccessible everywhere but from your computer itself.
-      If you want to allow access to services on your machine, such as
-      <command>ssh</command> or <command>ping</command>, take a look at
-      <xref linkend="fw-busybox"/>.</para>
-
-    </sect3>
-
-    <sect3 id="fw-masqRouter" xreflabel="Masquerading Router">
-      <title>Masquerading Router</title>
-
-      <para>A true Firewall has two interfaces, one connected to an
-      intranet, in this example <emphasis role="strong">eth0</emphasis>,
-      and one connected to the Internet, here <emphasis
-      role="strong">ppp0</emphasis>. To provide the maximum security
-      for the firewall itself, make sure that there are no unnecessary
-      servers running on it such as <application>X11</application> et
-      al. As a general principle, the firewall itself should not access
-      any untrusted service (think of a remote server giving answers that
-      makes a daemon on your system crash, or even worse, that implements
-      a worm via a buffer-overflow).</para>
-
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
-<literal>#!/bin/sh
-
-# Begin rc.iptables
-
-echo
-echo "You're using the example configuration for a setup of a firewall"
-echo "from Beyond Linux From Scratch."
-echo "This example is far from being complete, it is only meant"
-echo "to be a reference."
-echo "Firewall security is a complex issue, that exceeds the scope"
-echo "of the configuration rules below."
-echo "You can find additional information"
-echo "about firewalls in Chapter 4 of the BLFS book."
-echo "http://www.&lfs-domainname;/blfs"
-echo
-
-# Insert iptables modules (not needed if built into the kernel).
-
-modprobe nf_conntrack
-modprobe nf_conntrack_ftp
-modprobe xt_conntrack
-modprobe xt_LOG
-modprobe xt_state
-
-# Enable broadcast echo Protection
-echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
-
-# Disable Source Routed Packets
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
-
-# Enable TCP SYN Cookie Protection
-echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
-
-# Disable ICMP Redirect Acceptance
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
-
-# Don't send Redirect Messages
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
-
-# Drop Spoofed Packets coming in on an interface where responses
-# would result in the reply going out a different interface.
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
-
-# Log packets with impossible addresses.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
-
-# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
-echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
-
-# Disable Explicit Congestion Notification
-# Too many routers are still ignorant
-echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
-
-# Set a known state
-iptables -P INPUT   DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT  DROP
-
-# These lines are here in case rules are already in place and the
-# script is ever rerun on the fly. We want to remove all rules and
-# pre-existing user defined chains before we implement new rules.
-iptables -F
-iptables -X
-iptables -Z
-
-iptables -t nat -F
-
-# Allow local connections
-iptables -A INPUT  -i lo -j ACCEPT
-iptables -A OUTPUT -o lo -j ACCEPT
-
-# Allow forwarding if the initiated on the intranet
-iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A FORWARD ! -i ppp+ -m conntrack --ctstate NEW       -j ACCEPT
-
-# Do masquerading
-# (not needed if intranet is not using private ip-addresses)
-iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
-
-# Log everything for debugging
-# (last of all rules, but before policy rules)
-iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
-iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
-iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
-
-# Enable IP Forwarding
-echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
-EOF
-chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
-
-      <para>With this script your intranet should be reasonably secure
-      against external attacks. No one should be able to setup a new
-      connection to any internal service and, if it's masqueraded,
-      makes your intranet invisible to the Internet. Furthermore, your
-      firewall should be relatively safe because there are no services
-      running that a cracker could attack.</para>
-
-      <note>
-        <para>If the interface you're connecting to the Internet
-        doesn't connect via PPP, you will need to change
-        <replaceable>&lt;ppp+&gt;</replaceable> to the name of the interface
-        (e.g., <emphasis role="strong">eth1</emphasis>) which you are
-        using.</para>
-      </note>
-
-    </sect3>
-
-    <sect3 id="fw-busybox" xreflabel="BusyBox">
-      <title>BusyBox</title>
-
-      <para>This scenario isn't too different from the <xref
-      linkend="fw-masqRouter"/>, but additionally offers some
-      services to your intranet. Examples of this can be when
-      you want to administer your firewall from another host on
-      your intranet or use it as a proxy or a name server.</para>
-
-      <note>
-        <para>Outlining a true concept of how to protect a server that
-        offers services on the Internet goes far beyond the scope of
-        this document. See the references at the end of this section
-        for more information.</para>
-      </note>
-
-      <para>Be cautious. Every service you have enabled makes your
-      setup more complex and your firewall less secure. You are
-      exposed to the risks of misconfigured services or running
-      a service with an exploitable bug. A firewall should generally
-      not run any extra services.  See the introduction to the
-      <xref linkend="fw-masqRouter"/> for some more details.</para>
-
-      <para>If you want to add services such as internal Samba or
-      name servers that do not need to access the Internet themselves,
-      the additional statements are quite simple and should still be
-      acceptable from a security standpoint. Just add the following lines
-      into the script <emphasis>before</emphasis> the logging rules.</para>
-
-<screen><literal>iptables -A INPUT  -i ! ppp+  -j ACCEPT
-iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
-
-      <para>If daemons, such as squid, have to access the Internet
-      themselves, you could open OUTPUT generally and restrict
-      INPUT.</para>
-
-<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A OUTPUT -j ACCEPT</literal></screen>
-
-      <para>However, it is generally not advisable to leave OUTPUT
-      unrestricted. You lose any control over trojans who would like
-      to "call home", and a bit of redundancy in case you've
-      (mis-)configured a service so that it broadcasts its existence
-      to the world.</para>
-
-      <para>To accomplish this, you should restrict INPUT and OUTPUT
-      on all ports except those that it's absolutely necessary to have
-      open. Which ports you have to open depends on your needs: mostly
-      you will find them by looking for failed accesses in your log
-      files.</para>
-
-      <itemizedlist spacing="compact" role='iptables'>
-        <title>Have a Look at the Following Examples:</title>
-        <listitem>
-          <para>Squid is caching the web:</para>
-
-<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
-iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
-  -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>Your caching name server (e.g., named) does its
-          lookups via UDP:</para>
-
-<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>You want to be able to ping your computer to
-          ensure it's still alive:</para>
-
-<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para id='fw-BB-4' xreflabel="BusyBox example number 4">If
-          you are frequently accessing FTP servers or enjoy chatting, you might
-          notice certain delays because some implementations of these daemons
-          have the feature of querying an identd on your system to obtain
-          usernames. Although there's really little harm in this, having an
-          identd running is not recommended because many security experts feel
-          the service gives out too much additional information.</para>
-
-          <para>To avoid these delays you could reject the requests
-          with a 'tcp-reset':</para>
-
-<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>To log and drop invalid packets (packets
-          that came in after netfilter's timeout or some types of
-          network scans) insert these rules at the top of the chain:</para>
-
-<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
-  -j LOG --log-prefix "FIREWALL:INVALID "
-iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>Anything coming from the outside should not have a
-          private address, this is a common attack called IP-spoofing:</para>
-
-<screen><literal>iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
-iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
-iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
-
-          <para>There are other addresses that you may also want to
-          drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
-          experimental), 169.254.0.0/16 (Link Local Networks), and
-          192.0.2.0/24 (IANA defined test network).</para>
-        </listitem>
-        <listitem>
-          <para>If your firewall is a DHCP client, you need to allow
-          those packets:</para>
-
-<screen><literal>iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
-   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>To simplify debugging and be fair to anyone who'd like
-          to access a service you have disabled, purposely or by mistake,
-          you could REJECT those packets that are dropped.</para>
-
-          <para>Obviously this must be done directly after logging as the very
-          last lines before the packets are dropped by policy:</para>
-
-<screen><literal>iptables -A INPUT -j REJECT</literal></screen>
-
-        </listitem>
-      </itemizedlist>
-
-      <para>These are only examples to show you some of the capabilities
-      of the firewall code in Linux. Have a look at the man page of iptables.
-      There you will find much more information. The port numbers needed for
-      this can be found in <filename>/etc/services</filename>, in case you
-      didn't find them by trial and error in your log file.</para>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 id="fw-finale" xreflabel="Conclusion">
-    <title>Conclusion</title>
-
-    <para>Finally, there is one fact you must not forget: The effort spent
-    attacking a system corresponds to the value the cracker expects to gain
-    from it. If you are responsible for valuable information, you need to
-    spend the time to protect it properly.</para>
-
-  </sect2>
-
-  <sect2 id="postlfs-security-fw-extra" xreflabel="Extra Information">
-    <title>Extra Information</title>
-
-    <sect3 id="fw-library" xreflabel="links for further reading">
-      <title>Where to Start with Further Reading on Firewalls</title>
-
-      <blockquote>
-        <literallayout>
-<ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables project</ulink>
-<ulink url="http://www.netfilter.org/documentation/FAQ/netfilter-faq.html">Netfilter related FAQ</ulink>
-<ulink url="http://www.netfilter.org/documentation/index.html#HOWTO">Netfilter related HOWTO's</ulink>
-<ulink url="http://en.tldp.org/LDP/nag2/x-087-2-firewall.html">en.tldp.org/LDP/nag2/x-087-2-firewall.html</ulink>
-<ulink url="http://en.tldp.org/HOWTO/Security-HOWTO.html">en.tldp.org/HOWTO/Security-HOWTO.html</ulink>
-<ulink url="http://en.tldp.org/HOWTO/Firewall-HOWTO.html">en.tldp.org/HOWTO/Firewall-HOWTO.html</ulink>
-<ulink url="http://www.linuxsecurity.com/docs/">www.linuxsecurity.com/docs/</ulink>
-<ulink url="http://www.little-idiot.de/firewall">www.little-idiot.de/firewall (German &amp; outdated, but very comprehensive)</ulink>
-<ulink url="http://linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html">linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html</ulink>
-<ulink url="http://staff.washington.edu/dittrich/misc/ddos">staff.washington.edu/dittrich/misc/ddos</ulink>
-<ulink url="http://www.e-infomax.com/ipmasq">www.e-infomax.com/ipmasq</ulink>
-<ulink url="http://www.circlemud.org/~jelson/writings/security/index.htm">www.circlemud.org/~jelson/writings/security/index.htm</ulink>
-<ulink url="http://www.securityfocus.com">www.securityfocus.com</ulink>
-<ulink url="http://www.cert.org/tech_tips/">www.cert.org - tech_tips</ulink>
-<ulink url="http://security.ittoolbox.com/">security.ittoolbox.com</ulink>
-<ulink url="http://www.insecure.org/reading.html">www.insecure.org/reading.html</ulink>
-        </literallayout>
-      </blockquote>
-
-      <!-- The following are all dead links from the section above. They are
-           moved out of the section so the literallayout won't produce blank
-           lines in the rendered text
-
-<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire.html">www.ibm.com/developerworks/security/library/s-fire.html</ulink>
-<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire2.html">www.ibm.com/developerworks/security/library/s-fire2.html</ulink>
-<ulink url="http://www.interhack.net/pubs/fw-faq/">www.interhack.net/pubs/fw-faq/</ulink>
-<ulink url="http://www.linuxgazette.com/issue65/stumpel.html">www.linuxgazette.com/issue65/stumpel.html</ulink>
-<ulink url="http://www.linux-firewall-tools.com/linux/">www.linux-firewall-tools.com/linux/</ulink>
-<ulink url="http://logi.cc/linux/athome-firewall.php3">logi.cc/linux/athome-firewall.php3</ulink>
-<ulink url="http://www.robertgraham.com/pubs/firewall-seen.html">www.robertgraham.com/pubs/firewall-seen.html</ulink>
-
-      -->
-
-    </sect3>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/gnutls.xml
===================================================================
--- postlfs/security/gnutls.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ postlfs/security/gnutls.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -111,5 +111,5 @@
       <xref linkend="unbound"/> (to build the DANE library), 
       <xref linkend="valgrind"/> (used during the test suite),
-      <ulink url="http://ftp.gnu.org/gnu/autogen/">autogen</ulink>, and
+      <ulink url="http://ftp.gnu.org/gnu/autogen/">Autogen</ulink>, and
       <ulink url="http://sourceforge.net/projects/trousers/files/trousers/">Trousers</ulink> (Trusted Platform Module support)
     </para>
@@ -134,6 +134,5 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr \
-            --with-default-trust-store-file=/etc/ssl/ca-bundle.crt &amp;&amp;
+<screen><userinput>./configure --prefix=/usr &amp;&amp;
 make</userinput></screen>
 
@@ -163,10 +162,4 @@
   <sect2 role="commands">
     <title>Command Explanations</title>
-
-    <para>
-      <parameter>--with-default-trust-store-file=/etc/ssl/ca-bundle.crt</parameter>:
-      This switch tells <command>configure</command> where to find the
-      CA Certificates.
-    </para>
 
     <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
@@ -191,5 +184,5 @@
           libgnutls.so, libgnutls-dane.so,
           libgnutls-openssl.so, libgnutlsxx.so, and
-          /usr/lib/guile/2.0/guile-gnutls-v-2.so
+          guile-gnutls-v-2.so (<application>Guile</application> Module
         </seg>
         <seg>
Index: postlfs/security/haveged-systemd.xml
===================================================================
--- postlfs/security/haveged-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/haveged-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY haveged-download-http "http://www.issihosts.com/haveged/haveged-&haveged-version;.tar.gz">
+  <!ENTITY haveged-download-ftp  " ">
+  <!ENTITY haveged-md5sum        "015ff58cd10607db0e0de60aeca2f5f8">
+  <!ENTITY haveged-size          "468 KB">
+  <!ENTITY haveged-buildsize     "4.8 MB">
+  <!ENTITY haveged-time          "0.2 SBU">
+]>
+
+<sect1 id="haveged" xreflabel="Haveged-&haveged-version;">
+  <?dbhtml filename="haveged.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Haveged-&haveged-version;</title>
+
+  <indexterm zone="haveged">
+    <primary sortas="a-Haveged">Haveged</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to Haveged</title>
+
+    <para>
+      The <application>Haveged</application> package contains a daemon
+      that generates an unpredictable stream of random numbers
+      and feeds the /dev/random device.
+    </para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&haveged-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&haveged-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &haveged-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &haveged-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &haveged-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &haveged-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/haveged"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of Haveged</title>
+
+    <para>Install <application>Haveged</application> by running the following
+    commands:</para>
+
+<screen><userinput>./configure --prefix=/usr &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      To test the results, issue: <command>make check</command>.
+    </para>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+mkdir -pv    /usr/share/doc/haveged-&haveged-version; &amp;&amp;
+cp -v README /usr/share/doc/haveged-&haveged-version;</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring haveged</title>
+
+    <sect3  id="haveged-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the <command>haveged</command> daemon at boot,
+        install the systemd unit from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="haveged haveged-init">
+        <primary sortas="f-haveged">haveged</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-haveged</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directory</segtitle>
+
+      <seglistitem>
+        <seg>
+          haveged
+        </seg>
+        <seg>
+          libhavege.so
+        </seg>
+        <seg>
+          /usr/include/haveged
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="haveged-prog">
+        <term><command>haveged</command></term>
+        <listitem>
+          <para>
+            is a daemon that generates an unpredictable stream of random 
+            numbers harvested from the indirect effects of hardware events 
+            based on hidden processor states (caches, branch  predictors, memory
+            translation tables, etc).
+          </para>
+          <indexterm zone="haveged haveged-prog">
+            <primary sortas="b-haveged-prog">haveged</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/haveged.xml
===================================================================
--- postlfs/security/haveged.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,170 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY haveged-download-http "http://www.issihosts.com/haveged/haveged-&haveged-version;.tar.gz">
-  <!ENTITY haveged-download-ftp  " ">
-  <!ENTITY haveged-md5sum        "015ff58cd10607db0e0de60aeca2f5f8">
-  <!ENTITY haveged-size          "468 KB">
-  <!ENTITY haveged-buildsize     "4.8 MB">
-  <!ENTITY haveged-time          "0.2 SBU">
-]>
-
-<sect1 id="haveged" xreflabel="Haveged-&haveged-version;">
-  <?dbhtml filename="haveged.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Haveged-&haveged-version;</title>
-
-  <indexterm zone="haveged">
-    <primary sortas="a-Haveged">Haveged</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to Haveged</title>
-
-    <para>
-      The <application>Haveged</application> package contains a daemon
-      that generates an unpredictable stream of random numbers
-      and feeds the /dev/random device.
-    </para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&haveged-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&haveged-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &haveged-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &haveged-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &haveged-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &haveged-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/haveged"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of Haveged</title>
-
-    <para>Install <application>Haveged</application> by running the following
-    commands:</para>
-
-<screen><userinput>./configure --prefix=/usr &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      To test the results, issue: <command>make check</command>.
-    </para>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install &amp;&amp;
-mkdir -pv    /usr/share/doc/haveged-&haveged-version; &amp;&amp;
-cp -v README /usr/share/doc/haveged-&haveged-version;</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring haveged</title>
-
-    <sect3  id="haveged-init">
-      <title>Boot Script</title>
-
-      <para>
-        If you want the <application>Haveged</application> daemon to
-        start automatically when the system is booted, install the
-        <filename>/etc/rc.d/init.d/haveged</filename> init script included
-        in the <xref linkend="bootscripts"/> package.
-      </para>
-
-      <indexterm zone="haveged haveged-init">
-        <primary sortas="f-haveged">haveged</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-haveged</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directory</segtitle>
-
-      <seglistitem>
-        <seg>
-          haveged
-        </seg>
-        <seg>
-          libhavege.so
-        </seg>
-        <seg>
-          /usr/include/haveged
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="haveged-prog">
-        <term><command>haveged</command></term>
-        <listitem>
-          <para>
-            is a daemon that generates an unpredictable stream of random 
-            numbers harvested from the indirect effects of hardware events 
-            based on hidden processor states (caches, branch  predictors, memory
-            translation tables, etc).
-          </para>
-          <indexterm zone="haveged haveged-prog">
-            <primary sortas="b-haveged-prog">haveged</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/iptables-systemd.xml
===================================================================
--- postlfs/security/iptables-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/iptables-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,316 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
+  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
+  <!ENTITY iptables-md5sum        "536d048c8e8eeebcd9757d0863ebb0c0">
+  <!ENTITY iptables-size          "536 KB">
+  <!ENTITY iptables-buildsize     "15 MB">
+  <!ENTITY iptables-time          "0.2 SBU">
+]>
+
+<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
+  <?dbhtml filename="iptables.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Iptables-&iptables-version;</title>
+
+  <indexterm zone="iptables">
+    <primary sortas="a-Iptables">Iptables</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to Iptables</title>
+
+    <para>
+      The next part of this chapter deals with firewalls. The principal
+      firewall tool for Linux is <application>Iptables</application>. You will
+      need to install <application>Iptables</application> if you intend on using
+      any form of a firewall.
+    </para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&iptables-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&iptables-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &iptables-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &iptables-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &iptables-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &iptables-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/iptables"/>
+    </para>
+  </sect2>
+
+  <sect2 role="kernel" id="iptables-kernel">
+    <title>Kernel Configuration</title>
+
+    <para>
+      A firewall in Linux is accomplished through a portion of the
+      kernel called netfilter. The interface to netfilter is
+      <application>Iptables</application>. To use it, the appropriate
+      kernel configuration parameters are found in Networking Support &rArr;
+      Networking Options &rArr; Network Packet Filtering Framework.
+    </para>
+
+    <indexterm zone="iptables iptables-kernel">
+      <primary sortas="d-iptables">Iptables</primary>
+    </indexterm>
+
+  </sect2>
+
+    <sect2 role="installation">
+      <title>Installation of Iptables</title>
+
+    <note>
+      <para>
+        The installation below does not include building some specialized
+        extension libraries which require the raw headers in the
+        <application>Linux</application> source code. If you wish to build the
+        additional extensions (if you aren't sure, then you probably don't), you
+        can look at the <filename>INSTALL</filename> file to see an example of
+        how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
+        at the <application>Linux</application> source code. Note that if you
+        upgrade the kernel version, you may also need to recompile
+        <application>Iptables</application> and that the BLFS team has not tested
+        using the raw kernel headers.
+      </para>
+
+      <para>
+        For some non-x86 architectures, the raw kernel headers may be
+        required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
+        parameter to point at the <application>Linux</application> source
+        code.
+      </para>
+    </note>
+
+    <para>
+      Install <application>Iptables</application> by running the following
+      commands:
+    </para>
+
+<screen><userinput>./configure --prefix=/usr                \
+            --sbindir=/sbin              \
+            --with-xtlibdir=/lib/xtables \
+            --enable-libipq &amp;&amp;
+make</userinput></screen>
+
+    <para>This package does not come with a test suite.</para>
+
+    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
+for file in ip4tc ip6tc ipq iptc xtables
+do
+  mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
+  ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
+done</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
+      <application>Iptables</application> modules are installed in the
+      <filename class="directory">/lib/xtables</filename> directory.
+    </para>
+
+    <para>
+      <option>--enable-libipq</option>: This switch enables building
+      of <filename class="libraryfile">libipq.so</filename> which
+      can be used by some packages outside of BLFS.
+    </para>
+
+    <para>
+      <option>--enable-nfsynproxy</option>: This switch enables installation
+      of <application>nfsynproxy</application> SYNPROXY configuration tool.
+    </para>
+
+    <para>
+      <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
+      Ensure the symbolic link for <command>iptables-xml</command> is relative.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring Iptables</title>
+
+    <para>
+      Introductory instructions for configuring your firewall are
+      presented in the next section: <xref linkend="fw-firewall"/>
+    </para>
+
+    <sect3  id="iptables-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To set up the <application>Iptables</application> firewall at boot,
+        install the systemd unit from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="iptables iptables-init">
+        <primary sortas="f-iptables">iptables</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-iptables</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
+          iptables-save, iptables-xml, and xtables-multi
+        </seg>
+        <seg>
+          libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
+        </seg>
+        <seg>
+          /lib/xtables and /usr/include/libiptc
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="iptables-prog">
+        <term><command>iptables</command></term>
+        <listitem>
+          <para>
+            is used to set up, maintain, and inspect the tables of
+            IP packet filter rules in the Linux kernel.
+          </para>
+          <indexterm zone="iptables iptables-prog">
+            <primary sortas="b-iptables">iptables</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-restore">
+        <term><command>iptables-restore</command></term>
+        <listitem>
+          <para>
+            is used to restore IP Tables from data specified on
+            STDIN. Use I/O redirection provided by your
+            shell to read from a file.
+          </para>
+          <indexterm zone="iptables iptables-restore">
+            <primary sortas="b-iptables-restore">iptables-restore</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-save">
+        <term><command>iptables-save</command></term>
+        <listitem>
+          <para>
+            is used to dump the contents of an IP Table in easily
+            parseable format to STDOUT. Use I/O-redirection
+            provided by your shell to write to a file.
+          </para>
+          <indexterm zone="iptables iptables-save">
+            <primary sortas="b-iptables-save">iptables-save</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-xml">
+        <term><command>iptables-xml</command></term>
+        <listitem>
+          <para>
+            is used to convert the output of
+            <command>iptables-save</command> to an XML format. Using the
+            <filename>iptables.xslt</filename> stylesheet converts the XML
+            back to the format of <command>iptables-restore</command>.
+          </para>
+          <indexterm zone="iptables iptables-xml">
+            <primary sortas="b-iptables-xml">iptables-xml</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ip6tables">
+        <term><command>ip6tables*</command></term>
+        <listitem>
+          <para>
+            are a set of commands for IPV6 that parallel the iptables
+            commands above.
+          </para>
+          <indexterm zone="iptables ip6tables">
+            <primary sortas="b-ip6tables">ip6tables</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="nfsynproxy">
+        <term><command>nfsynproxy</command></term>
+        <listitem>
+          <para>
+            (optional) configuration tool. SYNPROXY target makes handling of
+            large SYN floods possible without the large performance penalties
+            imposed by the connection tracking in such cases.
+          </para>
+          <indexterm zone="iptables nfsynproxy">
+            <primary sortas="b-nfsynproxy">nfsynproxy</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/iptables.xml
===================================================================
--- postlfs/security/iptables.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,315 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
-  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
-  <!ENTITY iptables-md5sum        "536d048c8e8eeebcd9757d0863ebb0c0">
-  <!ENTITY iptables-size          "536 KB">
-  <!ENTITY iptables-buildsize     "15 MB">
-  <!ENTITY iptables-time          "0.2 SBU">
-]>
-
-<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
-  <?dbhtml filename="iptables.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Iptables-&iptables-version;</title>
-
-  <indexterm zone="iptables">
-    <primary sortas="a-Iptables">Iptables</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to Iptables</title>
-
-    <para>
-      The next part of this chapter deals with firewalls. The principal
-      firewall tool for Linux is <application>Iptables</application>. You will
-      need to install <application>Iptables</application> if you intend on using
-      any form of a firewall.
-    </para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&iptables-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&iptables-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &iptables-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &iptables-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &iptables-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &iptables-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/iptables"/>
-    </para>
-  </sect2>
-
-  <sect2 role="kernel" id="iptables-kernel">
-    <title>Kernel Configuration</title>
-
-    <para>
-      A firewall in Linux is accomplished through a portion of the
-      kernel called netfilter. The interface to netfilter is
-      <application>Iptables</application>. To use it, the appropriate
-      kernel configuration parameters are found in Networking Support &rArr;
-      Networking Options &rArr; Network Packet Filtering Framework.
-    </para>
-
-    <indexterm zone="iptables iptables-kernel">
-      <primary sortas="d-iptables">Iptables</primary>
-    </indexterm>
-
-  </sect2>
-
-    <sect2 role="installation">
-      <title>Installation of Iptables</title>
-
-    <note>
-      <para>
-        The installation below does not include building some specialized
-        extension libraries which require the raw headers in the
-        <application>Linux</application> source code. If you wish to build the
-        additional extensions (if you aren't sure, then you probably don't), you
-        can look at the <filename>INSTALL</filename> file to see an example of
-        how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
-        at the <application>Linux</application> source code. Note that if you
-        upgrade the kernel version, you may also need to recompile
-        <application>Iptables</application> and that the BLFS team has not tested
-        using the raw kernel headers.
-      </para>
-
-      <para>
-        For some non-x86 architectures, the raw kernel headers may be
-        required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
-        parameter to point at the <application>Linux</application> source
-        code.
-      </para>
-    </note>
-
-    <para>
-      Install <application>Iptables</application> by running the following
-      commands:
-    </para>
-
-<screen><userinput>./configure --prefix=/usr                \
-            --sbindir=/sbin              \
-            --with-xtlibdir=/lib/xtables \
-            --enable-libipq &amp;&amp;
-make</userinput></screen>
-
-    <para>This package does not come with a test suite.</para>
-
-    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>make install &amp;&amp;
-ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
-for file in ip4tc ip6tc ipq iptc xtables
-do
-  mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
-  ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
-done</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
-      <application>Iptables</application> modules are installed in the
-      <filename class="directory">/lib/xtables</filename> directory.
-    </para>
-
-    <para>
-      <option>--enable-libipq</option>: This switch enables building
-      of <filename class="libraryfile">libipq.so</filename> which
-      can be used by some packages outside of BLFS.
-    </para>
-
-    <para>
-      <option>--enable-nfsynproxy</option>: This switch enables installation
-      of <application>nfsynproxy</application> SYNPROXY configuration tool.
-    </para>
-
-    <para>
-      <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
-      Ensure the symbolic link for <command>iptables-xml</command> is relative.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring Iptables</title>
-
-    <para>
-      Introductory instructions for configuring your firewall are
-      presented in the next section: <xref linkend="fw-firewall"/>
-    </para>
-
-    <sect3  id="iptables-init">
-      <title>Boot Script</title>
-
-      <para>
-        To set up the iptables firewall at boot, install the
-        <filename>/etc/rc.d/init.d/iptables</filename> init script included
-        in the <xref linkend="bootscripts"/> package.
-      </para>
-
-      <indexterm zone="iptables iptables-init">
-        <primary sortas="f-iptables">iptables</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-iptables</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
-          iptables-save, iptables-xml, and xtables-multi
-        </seg>
-        <seg>
-          libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
-        </seg>
-        <seg>
-          /lib/xtables and /usr/include/libiptc
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="iptables-prog">
-        <term><command>iptables</command></term>
-        <listitem>
-          <para>
-            is used to set up, maintain, and inspect the tables of
-            IP packet filter rules in the Linux kernel.
-          </para>
-          <indexterm zone="iptables iptables-prog">
-            <primary sortas="b-iptables">iptables</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="iptables-restore">
-        <term><command>iptables-restore</command></term>
-        <listitem>
-          <para>
-            is used to restore IP Tables from data specified on
-            STDIN. Use I/O redirection provided by your
-            shell to read from a file.
-          </para>
-          <indexterm zone="iptables iptables-restore">
-            <primary sortas="b-iptables-restore">iptables-restore</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="iptables-save">
-        <term><command>iptables-save</command></term>
-        <listitem>
-          <para>
-            is used to dump the contents of an IP Table in easily
-            parseable format to STDOUT. Use I/O-redirection
-            provided by your shell to write to a file.
-          </para>
-          <indexterm zone="iptables iptables-save">
-            <primary sortas="b-iptables-save">iptables-save</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="iptables-xml">
-        <term><command>iptables-xml</command></term>
-        <listitem>
-          <para>
-            is used to convert the output of
-            <command>iptables-save</command> to an XML format. Using the
-            <filename>iptables.xslt</filename> stylesheet converts the XML
-            back to the format of <command>iptables-restore</command>.
-          </para>
-          <indexterm zone="iptables iptables-xml">
-            <primary sortas="b-iptables-xml">iptables-xml</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ip6tables">
-        <term><command>ip6tables*</command></term>
-        <listitem>
-          <para>
-            are a set of commands for IPV6 that parallel the iptables
-            commands above.
-          </para>
-          <indexterm zone="iptables ip6tables">
-            <primary sortas="b-ip6tables">ip6tables</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="nfsynproxy">
-        <term><command>nfsynproxy</command></term>
-        <listitem>
-          <para>
-            (optional) configuration tool. SYNPROXY target makes handling of
-            large SYN floods possible without the large performance penalties
-            imposed by the connection tracking in such cases.
-          </para>
-          <indexterm zone="iptables nfsynproxy">
-            <primary sortas="b-nfsynproxy">nfsynproxy</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/mitkrb-systemd.xml
===================================================================
--- postlfs/security/mitkrb-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/mitkrb-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,835 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY mitkrb-download-http "http://web.mit.edu/kerberos/www/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;-signed.tar">
+  <!ENTITY mitkrb-download-ftp  " ">
+  <!ENTITY mitkrb-md5sum        "fa5d4dcd7b79e2165d0ec4affa0956ea">
+  <!ENTITY mitkrb-size          "12 MB">
+  <!ENTITY mitkrb-buildsize     "121 MB (Additional 22 MB if running the testsuite)">
+  <!ENTITY mitkrb-time          "1.0 SBU (additional 2.5 SBU if running the testsuite)">
+]>
+
+<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
+  <?dbhtml filename="mitkrb.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>MIT Kerberos V5-&mitkrb-version;</title>
+
+  <indexterm zone="mitkrb">
+    <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
+  </indexterm>
+
+    <sect2 role="package">
+      <title>Introduction to MIT Kerberos V5</title>
+
+    <para>
+      <application>MIT Kerberos V5</application> is a free implementation
+      of Kerberos 5. Kerberos is a network authentication protocol. It
+      centralizes the authentication database and uses kerberized
+      applications to work with servers or services that support Kerberos
+      allowing single logins and encrypted communication over internal
+      networks or the Internet.
+    </para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&mitkrb-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &mitkrb-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &mitkrb-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &mitkrb-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &mitkrb-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <xref linkend="dejagnu"/> (for full test coverage),
+      <xref linkend="gnupg2"/> (to authenticate the package),
+      <xref linkend="keyutils"/>,
+      <xref linkend="openldap"/>,
+      <xref linkend="python2"/> (used during the testsuite) and
+      <xref linkend="rpcbind"/> (used during the testsuite)
+    </para>
+
+    <note>
+      <para>
+        Some sort of time synchronization facility on your system (like
+        <xref linkend="ntp"/>) is required since Kerberos won't authenticate
+        if there is a time difference between a kerberized client and the
+        KDC server.
+      </para>
+    </note>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/mitkrb"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of MIT Kerberos V5</title>
+
+    <para>
+      <application>MIT Kerberos V5</application> is distributed in a
+      TAR file containing a compressed TAR package and a detached PGP
+      <filename class="extension">ASC</filename> file. You'll need to unpack
+      the distribution tar file, then unpack the compressed tar file before
+      starting the build.
+    </para>
+
+    <para>
+      After unpacking the distribution tarball and if you have
+      <xref linkend="gnupg2"/> installed, you can
+      authenticate the package.  First, check the contents of the file
+      <filename>krb5-&mitkrb-version;.tar.gz.asc</filename>.
+    </para>
+
+<screen><userinput>gpg2 --verify krb5-&mitkrb-version;.tar.gz.asc krb5-&mitkrb-version;.tar.gz</userinput></screen>
+
+    <para>You will probably see output similar to:</para>
+
+<screen><literal>gpg: Signature made Thu 16 Oct 2014 02:02:43 AM CEST using RSA key ID 749D7889
+gpg: Can't check signature: No public key</literal></screen>
+
+    <para>
+      You can import the public key with:
+    </para>
+
+<screen><userinput>gpg2 --pgp2 --keyserver pgp.mit.edu --recv-keys 0x749D7889</userinput></screen>
+
+    <para>
+      Now re-verify the package with the first command above.  You should  get a
+      indication of a good signature, but the key will still not be certified
+      with a trusted signature.  Trusting the downloaded key is a separate
+      operation but it is up to you to determine the level of trust.
+    </para>
+
+    <para>
+      Build <application>MIT Kerberos V5</application> by running the
+      following commands:
+    </para>
+
+<screen><userinput>cd src &amp;&amp;
+sed -e "s@python2.5/Python.h@&amp; python2.7/Python.h@g" \
+    -e "s@-lpython2.5]@&amp;,\n  AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
+    -i configure.in &amp;&amp;
+autoconf &amp;&amp;
+./configure --prefix=/usr            \
+            --sysconfdir=/etc        \
+            --localstatedir=/var/lib \
+            --with-system-et         \
+            --with-system-ss         \
+            --without-system-verto   \
+            --enable-dns-for-realm   &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      To test the build, issue: <command>make check</command>. You need at
+      least <xref linkend="tcl"/>, which is used to drive the testsuite.
+      Furthermore, <xref linkend="dejagnu"/> must be available for some
+      of the tests to run. If you have a former version of MIT Kerberos V5
+      installed, it may happen that the test suite pick up the installed
+      versions of the libraries, rather than the newly built ones. If so,
+      it is better to run the tests after the installation.
+    </para>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+
+for LIBRARY in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
+               kdb5 kdb_ldap krad krb5 krb5support verto ; do
+    [ -e  /usr/lib/lib$LIBRARY.so ] &amp;&amp; chmod -v 755 /usr/lib/lib$LIBRARY.so
+done &amp;&amp;
+unset LIBRARY &amp;&amp;
+
+mv -v /usr/lib/libkrb5.so.*        /lib &amp;&amp;
+mv -v /usr/lib/libk5crypto.so.*    /lib &amp;&amp;
+mv -v /usr/lib/libkrb5support.so.* /lib &amp;&amp;
+
+ln -sfv ../../lib/$(readlink /usr/lib/libkrb5.so)        /usr/lib/libkrb5.so        &amp;&amp;
+ln -sfv ../../lib/$(readlink /usr/lib/libk5crypto.so)    /usr/lib/libk5crypto.so    &amp;&amp;
+ln -sfv ../../lib/$(readlink /usr/lib/libkrb5support.so) /usr/lib/libkrb5support.so &amp;&amp;
+
+mv -v /usr/bin/ksu /bin &amp;&amp;
+chmod -v 755 /bin/ksu   &amp;&amp;
+
+install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
+cp -rfv ../doc/*  /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
+
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <command>sed -e ...</command>: The first <command>sed</command> fixes
+      <application>Python</application> detection.<!-- The second one increases
+      the width of the virtual terminal used for some tests, to prevent
+      some spurious characters to be echoed, which is taken as a failure. -->
+    </para>
+
+    <para>
+      <parameter>--localstatedir=/var/lib</parameter>: This switch is
+      used so that the Kerberos variable run-time data is located in
+      <filename class="directory">/var/lib</filename> instead of
+      <filename class="directory">/usr/var</filename>.
+    </para>
+
+    <para>
+      <parameter>--with-system-et</parameter>: This switch causes the build
+      to use the system-installed versions of the error-table support
+      software.
+    </para>
+
+    <para>
+      <parameter>--with-system-ss</parameter>: This switch causes the build
+      to use the system-installed versions of the subsystem command-line
+      interface software.
+    </para>
+
+    <para>
+      <parameter>--without-system-verto</parameter>: This switch causes
+      the build to use the internal version of <filename
+      class="libraryfile">libverto</filename> library in case older one
+      is present from previous <application>Kerberos</application>
+      installation.
+    </para>
+
+    <para>
+      <parameter>--enable-dns-for-realm</parameter>: This switch allows
+      realms to be resolved using the DNS server.
+    </para>
+
+    <para>
+      <command>mv -v /usr/bin/ksu /bin</command>: Moves the
+      <command>ksu</command> program to the
+      <filename class="directory">/bin</filename> directory so that it is
+      available when the <filename class="directory">/usr</filename>
+      filesystem is not mounted.
+    </para>
+
+    <para>
+      <option>--with-ldap</option>: Use this switch if you want to compile
+      <application>OpenLDAP</application> database backend module.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring MIT Kerberos V5</title>
+
+    <sect3 id="krb5-config">
+      <title>Config Files</title>
+
+      <para>
+        <filename>/etc/krb5.conf</filename> and
+        <filename>/var/lib/krb5kdc/kdc.conf</filename>
+      </para>
+
+      <indexterm zone="mitkrb krb5-config">
+        <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
+      </indexterm>
+
+      <indexterm zone="mitkrb krb5-config">
+        <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
+      </indexterm>
+
+    </sect3>
+
+    <sect3>
+      <title>Configuration Information</title>
+
+      <sect4>
+        <title>Kerberos Configuration</title>
+
+        <tip>
+          <para>
+            You should consider installing some sort of password checking
+            dictionary so that you can configure the installation to only
+            accept strong passwords. A suitable dictionary to use is shown in
+            the <xref linkend="cracklib"/> instructions. Note that only one
+            file can be used, but you can concatenate many files into one. The
+            configuration file shown below assumes you have installed a
+            dictionary to <filename>/usr/share/dict/words</filename>.
+          </para>
+        </tip>
+
+        <para>
+          Create the Kerberos configuration file with the following
+          commands issued by the <systemitem class="username">root</systemitem>
+          user:
+        </para>
+
+<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
+<literal># Begin /etc/krb5.conf
+
+[libdefaults]
+    default_realm = <replaceable>&lt;LFS.ORG&gt;</replaceable>
+    encrypt = true
+
+[realms]
+    <replaceable>&lt;LFS.ORG&gt;</replaceable> = {
+        kdc = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
+        admin_server = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
+        dict_file = /usr/share/dict/words
+    }
+
+[domain_realm]
+    .<replaceable>&lt;lfs.org&gt;</replaceable> = <replaceable>&lt;LFS.ORG&gt;</replaceable>
+
+[logging]
+    kdc = SYSLOG[:INFO[:AUTH]]
+    admin_server = SYSLOG[INFO[:AUTH]]
+    default = SYSLOG[[:SYS]]
+
+# End /etc/krb5.conf</literal>
+EOF</userinput></screen>
+
+        <para>
+          You will need to substitute your domain and proper hostname for the
+          occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
+          <replaceable>&lt;lfs.org&gt;</replaceable> names.
+        </para>
+
+        <para>
+          <option>default_realm</option> should be the name of your
+          domain changed to ALL CAPS. This isn't required, but both
+          <application>Heimdal</application> and MIT recommend it.
+        </para>
+
+        <para>
+          <option>encrypt = true</option> provides encryption of all traffic
+          between kerberized clients and servers. It's not necessary and can
+          be left off. If you leave it off, you can encrypt all traffic from
+          the client to the server using a switch on the client program
+          instead.
+        </para>
+
+        <para>
+          The <option>[realms]</option> parameters tell the client programs
+          where to look for the KDC authentication services.
+        </para>
+
+        <para>
+          The <option>[domain_realm]</option> section maps a domain to a realm.
+        </para>
+
+        <para>
+          Create the KDC database:
+       </para>
+
+<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;LFS.ORG&gt;</replaceable> -s</userinput></screen>
+
+        <para>
+          Now you should populate the database with principals
+          (users). For now, just use your regular login name or
+          <systemitem class="username">root</systemitem>.
+        </para>
+
+<screen role="root"><userinput>kadmin.local
+<prompt>kadmin.local:</prompt> add_policy dict-only
+<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
+
+        <para>
+          The KDC server and any machine running kerberized
+          server daemons must have a host key installed:
+        </para>
+
+<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
+
+        <para>
+          After choosing the defaults when prompted, you will have to
+          export the data to a keytab file:
+        </para>
+
+<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
+
+        <para>
+          This should have created a file in
+          <filename class="directory">/etc</filename> named
+          <filename>krb5.keytab</filename> (Kerberos 5). This file should
+          have 600 (<systemitem class="username">root</systemitem> rw only)
+          permissions. Keeping the keytab files from public access is crucial
+          to the overall security of the Kerberos installation.
+        </para>
+
+        <para>
+          Exit the <command>kadmin</command> program (use
+          <command>quit</command> or <command>exit</command>) and return
+          back to the shell prompt. Start the KDC daemon manually, just to
+          test out the installation:
+        </para>
+
+<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
+
+        <para>
+          Attempt to get a ticket with the following command:
+        </para>
+
+<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
+
+        <para>
+          You will be prompted for the password you created. After you
+          get your ticket, you can list it with the following command:
+        </para>
+
+<screen><userinput>klist</userinput></screen>
+
+        <para>
+          Information about the ticket should be displayed on the
+          screen.
+        </para>
+
+        <para>
+          To test the functionality of the keytab file, issue the
+          following command:
+        </para>
+
+<screen><userinput>ktutil
+<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
+<prompt>ktutil:</prompt> l</userinput></screen>
+
+        <para>
+          This should dump a list of the host principal, along with
+          the encryption methods used to access the principal.
+        </para>
+
+        <para>
+          At this point, if everything has been successful so far, you
+          can feel fairly confident in the installation and configuration of
+          the package.
+        </para>
+
+      </sect4>
+
+      <sect4>
+        <title>Additional Information</title>
+
+        <para>
+          For additional information consult the <ulink
+          url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
+          documentation for krb5-&mitkrb-version;</ulink> on which the above
+          instructions are based.
+        </para>
+
+      </sect4>
+
+    </sect3>
+
+    <sect3 id="mitkrb-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the Kerberos services at boot,
+        install the systemd units from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="mitkrb mitkrb-init">
+        <primary sortas="f-krb5">krb5</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-krb5</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+
+    <title>Contents</title>
+    <para></para>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
+          kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
+          kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
+          ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
+          sserver, uuclient and uuserver
+        </seg>
+        <seg>
+          libgssapi_krb5.so, libgssrpc.so, libk5crypto.so,
+          libkadm5clnt.so, libkadm5srv.so, libkdb5.so, libkdb_ldap.so
+          (optional), libkrad.so, libkrb5.so, libkrb5support.so, and
+          libverto.so
+        </seg>
+        <seg>
+          /usr/include/gssapi,
+          /usr/include/gssrpc,
+          /usr/include/kadm5,
+          /usr/include/krb5,
+          /usr/lib/krb5,
+          /usr/share/doc/krb5-&mitkrb-version;,
+          /usr/share/examples/krb5 and
+          /var/lib/krb5kdc
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="k5srvutil">
+        <term><command>k5srvutil</command></term>
+        <listitem>
+          <para>
+            is a host keytable manipulation utility.
+          </para>
+          <indexterm zone="mitkrb k5srvutil">
+            <primary sortas="b-k5srvutil">k5srvutil</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kadmin">
+        <term><command>kadmin</command></term>
+        <listitem>
+          <para>
+            is an utility used to make modifications
+            to the Kerberos database.
+          </para>
+          <indexterm zone="mitkrb kadmin">
+            <primary sortas="b-kadmin">kadmin</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kadmind">
+        <term><command>kadmind</command></term>
+        <listitem>
+          <para>
+            is a server for administrative access
+            to a Kerberos database.
+          </para>
+          <indexterm zone="mitkrb kadmind">
+            <primary sortas="b-kadmind">kadmind</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kdb5_util">
+        <term><command>kdb5_util</command></term>
+        <listitem>
+          <para>
+            is the KDC database utility.
+          </para>
+          <indexterm zone="mitkrb kdb5_util">
+            <primary sortas="b-kdb5_util">kdb5_util</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kdestroy">
+        <term><command>kdestroy</command></term>
+        <listitem>
+          <para>
+            removes the current set of tickets.
+          </para>
+          <indexterm zone="mitkrb kdestroy">
+            <primary sortas="b-kdestroy">kdestroy</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kinit">
+        <term><command>kinit</command></term>
+        <listitem>
+          <para>
+            is used to authenticate to the Kerberos server as a
+            principal and acquire a ticket granting ticket that can
+            later be used to obtain tickets for other services.
+          </para>
+          <indexterm zone="mitkrb kinit">
+            <primary sortas="b-kinit">kinit</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="klist">
+        <term><command>klist</command></term>
+        <listitem>
+          <para>
+            reads and displays the current tickets in
+            the credential cache.
+          </para>
+          <indexterm zone="mitkrb klist">
+            <primary sortas="b-klist">klist</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kpasswd">
+        <term><command>kpasswd</command></term>
+        <listitem>
+          <para>
+            is a program for changing Kerberos 5 passwords.
+          </para>
+          <indexterm zone="mitkrb kpasswd">
+            <primary sortas="b-kpasswd">kpasswd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kprop">
+        <term><command>kprop</command></term>
+        <listitem>
+          <para>
+            takes a principal database in a specified format and
+            converts it into a stream of database records.
+          </para>
+          <indexterm zone="mitkrb kprop">
+            <primary sortas="b-kprop">kprop</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kpropd">
+        <term><command>kpropd</command></term>
+        <listitem>
+          <para>
+            receives a database sent by <command>kprop</command>
+            and writes it as a local database.
+          </para>
+          <indexterm zone="mitkrb kpropd">
+            <primary sortas="b-kpropd">kpropd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="krb5-config-prog2">
+        <term><command>krb5-config</command></term>
+        <listitem>
+          <para>
+            gives information on how to link programs against
+            libraries.
+          </para>
+          <indexterm zone="mitkrb krb5-config-prog2">
+            <primary sortas="b-krb5-config">krb5-config</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="krb5kdc">
+        <term><command>krb5kdc</command></term>
+        <listitem>
+          <para>
+            is the <application>Kerberos 5</application> server.
+          </para>
+          <indexterm zone="mitkrb krb5kdc">
+            <primary sortas="b-krb5kdc">krb5kdc</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ksu">
+        <term><command>ksu</command></term>
+        <listitem>
+          <para>
+            is the super user program using Kerberos protocol.
+            Requires a properly configured
+            <filename>/etc/shells</filename> and
+            <filename>~/.k5login</filename> containing principals
+            authorized to become super users.
+          </para>
+          <indexterm zone="mitkrb ksu">
+            <primary sortas="b-ksu">ksu</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kswitch">
+        <term><command>kswitch</command></term>
+        <listitem>
+          <para>
+            makes the specified credential cache the
+            primary cache for the collection, if a cache
+            collection is available.
+          </para>
+          <indexterm zone="mitkrb kswitch">
+            <primary sortas="b-kswitch">kswitch</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ktutil">
+        <term><command>ktutil</command></term>
+        <listitem>
+          <para>
+            is a program for managing Kerberos keytabs.
+          </para>
+          <indexterm zone="mitkrb ktutil">
+            <primary sortas="b-ktutil">ktutil</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="kvno">
+        <term><command>kvno</command></term>
+        <listitem>
+          <para>
+            prints keyversion numbers of Kerberos principals.
+          </para>
+          <indexterm zone="mitkrb kvno">
+            <primary sortas="b-kvno">kvno</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sclient">
+        <term><command>sclient</command></term>
+        <listitem>
+          <para>
+            used to contact a sample server and authenticate to it
+            using Kerberos 5 tickets, then display the server's
+            response.
+          </para>
+          <indexterm zone="mitkrb sclient">
+            <primary sortas="b-sclient">sclient</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sserver">
+        <term><command>sserver</command></term>
+        <listitem>
+          <para>
+            is the sample Kerberos 5 server.
+          </para>
+          <indexterm zone="mitkrb sserver">
+            <primary sortas="b-sserver">sserver</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libgssapi_krb5">
+        <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
+        <listitem>
+          <para>
+            contain the Generic Security Service Application Programming
+            Interface (GSSAPI) functions which provides security services
+            to callers in a generic fashion, supportable with a range of
+            underlying mechanisms and technologies and hence allowing
+            source-level portability of applications to different
+            environments.
+          </para>
+          <indexterm zone="mitkrb libgssapi_krb5">
+            <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libkadm5clnt">
+        <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
+        <listitem>
+          <para>
+            contains the administrative authentication and password checking
+            functions required by Kerberos 5 client-side programs.
+          </para>
+          <indexterm zone="mitkrb libkadm5clnt">
+            <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libkadm5srv">
+        <term><filename class="libraryfile">libkadm5srv.so</filename></term>
+        <listitem>
+          <para>
+            contain the administrative authentication and password
+            checking functions required by Kerberos 5 servers.
+          </para>
+          <indexterm zone="mitkrb libkadm5srv">
+            <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libkdb5">
+        <term><filename class="libraryfile">libkdb5.so</filename></term>
+        <listitem>
+          <para>
+            is a Kerberos 5 authentication/authorization database
+            access library.
+          </para>
+          <indexterm zone="mitkrb libkdb5">
+            <primary sortas="c-libkdb5">libkdb5.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libkrad">
+        <term><filename class="libraryfile">libkrad.so</filename></term>
+        <listitem>
+          <para>
+            contains the internal support library for RADIUS functionality.
+          </para>
+          <indexterm zone="mitkrb libkrad">
+            <primary sortas="c-libkrad">libkrad.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libkrb5">
+        <term><filename class="libraryfile">libkrb5.so</filename></term>
+        <listitem>
+          <para>
+            is an all-purpose <application>Kerberos 5</application> library.
+          </para>
+          <indexterm zone="mitkrb libkrb5">
+            <primary sortas="c-libkrb5">libkrb5.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/mitkrb.xml
===================================================================
--- postlfs/security/mitkrb.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,838 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY mitkrb-download-http "http://web.mit.edu/kerberos/www/dist/krb5/&mitkrb-major-version;/krb5-&mitkrb-version;-signed.tar">
-  <!ENTITY mitkrb-download-ftp  " ">
-  <!ENTITY mitkrb-md5sum        "fa5d4dcd7b79e2165d0ec4affa0956ea">
-  <!ENTITY mitkrb-size          "12 MB">
-  <!ENTITY mitkrb-buildsize     "121 MB (Additional 22 MB if running the testsuite)">
-  <!ENTITY mitkrb-time          "1.0 SBU (additional 2.5 SBU if running the testsuite)">
-]>
-
-<sect1 id="mitkrb" xreflabel="MIT Kerberos V5-&mitkrb-version;">
-  <?dbhtml filename="mitkrb.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>MIT Kerberos V5-&mitkrb-version;</title>
-
-  <indexterm zone="mitkrb">
-    <primary sortas="a-MIT-Kerberos">MIT Kerberos V5</primary>
-  </indexterm>
-
-    <sect2 role="package">
-      <title>Introduction to MIT Kerberos V5</title>
-
-    <para>
-      <application>MIT Kerberos V5</application> is a free implementation
-      of Kerberos 5. Kerberos is a network authentication protocol. It
-      centralizes the authentication database and uses kerberized
-      applications to work with servers or services that support Kerberos
-      allowing single logins and encrypted communication over internal
-      networks or the Internet.
-    </para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&mitkrb-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&mitkrb-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &mitkrb-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &mitkrb-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &mitkrb-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &mitkrb-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">MIT Kerberos V5 Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="dejagnu"/> (for full test coverage),
-      <xref linkend="gnupg2"/> (to authenticate the package),
-      <xref linkend="keyutils"/>,
-      <xref linkend="openldap"/>,
-      <xref linkend="python2"/> (used during the testsuite) and
-      <xref linkend="rpcbind"/> (used during the testsuite)
-    </para>
-
-    <note>
-      <para>
-        Some sort of time synchronization facility on your system (like
-        <xref linkend="ntp"/>) is required since Kerberos won't authenticate
-        if there is a time difference between a kerberized client and the
-        KDC server.
-      </para>
-    </note>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/mitkrb"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of MIT Kerberos V5</title>
-
-    <para>
-      <application>MIT Kerberos V5</application> is distributed in a
-      TAR file containing a compressed TAR package and a detached PGP
-      <filename class="extension">ASC</filename> file. You'll need to unpack
-      the distribution tar file, then unpack the compressed tar file before
-      starting the build.
-    </para>
-
-    <para>
-      After unpacking the distribution tarball and if you have
-      <xref linkend="gnupg2"/> installed, you can
-      authenticate the package.  First, check the contents of the file
-      <filename>krb5-&mitkrb-version;.tar.gz.asc</filename>.
-    </para>
-
-<screen><userinput>gpg2 --verify krb5-&mitkrb-version;.tar.gz.asc krb5-&mitkrb-version;.tar.gz</userinput></screen>
-
-    <para>You will probably see output similar to:</para>
-
-<screen><literal>gpg: Signature made Mon Aug 11 22:53:10 2014 GMT using RSA key ID 749D7889
-gpg: Can't check signature: No public key</literal></screen>
-
-    <para>
-      You can import the public key with:
-    </para>
-
-<screen><userinput>gpg2 --pgp2 --keyserver pgp.mit.edu --recv-keys 0x749D7889</userinput></screen>
-
-    <para>
-      Now re-verify the package with the first command above.  You should  get a
-      indication of a good signature, but the key will still not be certified
-      with a trusted signature.  Trusting the downloaded key is a separate
-      operation but it is up to you to determine the level of trust.
-    </para>
-
-    <para>
-      Build <application>MIT Kerberos V5</application> by running the
-      following commands:
-    </para>
-
-<screen><userinput>cd src &amp;&amp;
-sed -e "s@python2.5/Python.h@&amp; python2.7/Python.h@g" \
-    -e "s@-lpython2.5]@&amp;,\n  AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
-    -i configure.in &amp;&amp;
-sed -e 's@\^u}@^u cols 300}@' \
-    -i tests/dejagnu/config/default.exp &amp;&amp;
-autoconf &amp;&amp;
-./configure --prefix=/usr            \
-            --sysconfdir=/etc        \
-            --localstatedir=/var/lib \
-            --with-system-et         \
-            --with-system-ss         \
-            --with-system-verto=no   \
-            --enable-dns-for-realm &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      To test the build, issue: <command>make check</command>. You need at
-      least <xref linkend="tcl"/>, which is used to drive the testsuite.
-      Furthermore, <xref linkend="dejagnu"/> must be available for some
-      of the tests to run. If you have a former version of MIT Kerberos V5
-      installed, it may happen that the test suite pick up the installed
-      versions of the libraries, rather than the newly built ones. If so,
-      it is better to run the tests after the installation.
-    </para>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install &amp;&amp;
-
-for LIBRARY in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
-               kdb5 kdb_ldap krad krb5 krb5support verto ; do
-    chmod -v 755 /usr/lib/lib$LIBRARY.so
-done          &amp;&amp;
-unset LIBRARY &amp;&amp;
-
-mv -v /usr/lib/libkrb5.so.3*        /lib &amp;&amp;
-mv -v /usr/lib/libk5crypto.so.3*    /lib &amp;&amp;
-mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
-
-ln -v -sf ../../lib/libkrb5.so.3.3        /usr/lib/libkrb5.so        &amp;&amp;
-ln -v -sf ../../lib/libk5crypto.so.3.1    /usr/lib/libk5crypto.so    &amp;&amp;
-ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
-
-mv -v /usr/bin/ksu /bin &amp;&amp;
-chmod -v 755 /bin/ksu   &amp;&amp;
-
-install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
-cp -vfr ../doc/*  /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
-
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <command>sed -e ...</command>: The first <command>sed</command> fixes
-      <application>Python</application> detection. The second one increases
-      the width of the virtual terminal used for some tests, to prevent
-      some spurious characters to be echoed, which is taken as a failure.
-    </para>
-
-    <para>
-      <parameter>--localstatedir=/var/lib</parameter>: This parameter is
-      used so that the Kerberos variable run-time data is located in
-      <filename class="directory">/var/lib</filename> instead of
-      <filename class="directory">/usr/var</filename>.
-    </para>
-
-    <para>
-      <parameter>--with-system-et</parameter>: This switch causes the build
-      to use the system-installed versions of the error-table support
-      software.
-    </para>
-
-    <para>
-      <parameter>--with-system-ss</parameter>: This switch causes the build
-      to use the system-installed versions of the subsystem command-line
-      interface software.
-    </para>
-
-    <para>
-      <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
-      the package: it does not recognize its own verto library installed
-      previously. This is not a problem, if reinstalling the same version,
-      but if you are updating, the old library is used as system's one,
-      instead of installing the new version.
-    </para>
-
-    <para>
-      <parameter>--enable-dns-for-realm</parameter>: This switch allows
-      realms to be resolved using the DNS server.
-    </para>
-
-    <para>
-      <command>mv -v /usr/bin/ksu /bin</command>: Moves the
-      <command>ksu</command> program to the
-      <filename class="directory">/bin</filename> directory so that it is
-      available when the <filename class="directory">/usr</filename>
-      filesystem is not mounted.
-    </para>
-
-    <para>
-      <option>--with-ldap</option>: Use this switch if you want to compile
-      <application>OpenLDAP</application> database backend module.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring MIT Kerberos V5</title>
-
-    <sect3 id="krb5-config">
-      <title>Config Files</title>
-
-      <para>
-        <filename>/etc/krb5.conf</filename> and
-        <filename>/var/lib/krb5kdc/kdc.conf</filename>
-      </para>
-
-      <indexterm zone="mitkrb krb5-config">
-        <primary sortas="e-etc-krb5.conf">/etc/krb5.conf</primary>
-      </indexterm>
-
-      <indexterm zone="mitkrb krb5-config">
-        <primary sortas="e-var-lib-krb5kdc-kdc.conf">/var/lib/krb5kdc/kdc.conf</primary>
-      </indexterm>
-
-    </sect3>
-
-    <sect3>
-      <title>Configuration Information</title>
-
-      <sect4>
-        <title>Kerberos Configuration</title>
-
-        <tip>
-          <para>
-            You should consider installing some sort of password checking
-            dictionary so that you can configure the installation to only
-            accept strong passwords. A suitable dictionary to use is shown in
-            the <xref linkend="cracklib"/> instructions. Note that only one
-            file can be used, but you can concatenate many files into one. The
-            configuration file shown below assumes you have installed a
-            dictionary to <filename>/usr/share/dict/words</filename>.
-          </para>
-        </tip>
-
-        <para>
-          Create the Kerberos configuration file with the following
-          commands issued by the <systemitem class="username">root</systemitem>
-          user:
-        </para>
-
-<screen role="root"><userinput>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"
-<literal># Begin /etc/krb5.conf
-
-[libdefaults]
-    default_realm = <replaceable>&lt;LFS.ORG&gt;</replaceable>
-    encrypt = true
-
-[realms]
-    <replaceable>&lt;LFS.ORG&gt;</replaceable> = {
-        kdc = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
-        admin_server = <replaceable>&lt;belgarath.lfs.org&gt;</replaceable>
-        dict_file = /usr/share/dict/words
-    }
-
-[domain_realm]
-    .<replaceable>&lt;lfs.org&gt;</replaceable> = <replaceable>&lt;LFS.ORG&gt;</replaceable>
-
-[logging]
-    kdc = SYSLOG[:INFO[:AUTH]]
-    admin_server = SYSLOG[INFO[:AUTH]]
-    default = SYSLOG[[:SYS]]
-
-# End /etc/krb5.conf</literal>
-EOF</userinput></screen>
-
-        <para>
-          You will need to substitute your domain and proper hostname for the
-          occurrences of the <replaceable>&lt;belgarath&gt;</replaceable> and
-          <replaceable>&lt;lfs.org&gt;</replaceable> names.
-        </para>
-
-        <para>
-          <option>default_realm</option> should be the name of your
-          domain changed to ALL CAPS. This isn't required, but both
-          <application>Heimdal</application> and MIT recommend it.
-        </para>
-
-        <para>
-          <option>encrypt = true</option> provides encryption of all traffic
-          between kerberized clients and servers. It's not necessary and can
-          be left off. If you leave it off, you can encrypt all traffic from
-          the client to the server using a switch on the client program
-          instead.
-        </para>
-
-        <para>
-          The <option>[realms]</option> parameters tell the client programs
-          where to look for the KDC authentication services.
-        </para>
-
-        <para>
-          The <option>[domain_realm]</option> section maps a domain to a realm.
-        </para>
-
-        <para>
-          Create the KDC database:
-       </para>
-
-<screen role="root"><userinput>kdb5_util create -r <replaceable>&lt;LFS.ORG&gt;</replaceable> -s</userinput></screen>
-
-        <para>
-          Now you should populate the database with principals
-          (users). For now, just use your regular login name or
-          <systemitem class="username">root</systemitem>.
-        </para>
-
-<screen role="root"><userinput>kadmin.local
-<prompt>kadmin.local:</prompt> add_policy dict-only
-<prompt>kadmin.local:</prompt> addprinc -policy dict-only <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
-
-        <para>
-          The KDC server and any machine running kerberized
-          server daemons must have a host key installed:
-        </para>
-
-<screen role="root"><userinput><prompt>kadmin.local:</prompt> addprinc -randkey host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
-
-        <para>
-          After choosing the defaults when prompted, you will have to
-          export the data to a keytab file:
-        </para>
-
-<screen role="root"><userinput><prompt>kadmin.local:</prompt> ktadd host/<replaceable>&lt;belgarath.lfs.org&gt;</replaceable></userinput></screen>
-
-        <para>
-          This should have created a file in
-          <filename class="directory">/etc</filename> named
-          <filename>krb5.keytab</filename> (Kerberos 5). This file should
-          have 600 (<systemitem class="username">root</systemitem> rw only)
-          permissions. Keeping the keytab files from public access is crucial
-          to the overall security of the Kerberos installation.
-        </para>
-
-        <para>
-          Exit the <command>kadmin</command> program (use
-          <command>quit</command> or <command>exit</command>) and return
-          back to the shell prompt. Start the KDC daemon manually, just to
-          test out the installation:
-        </para>
-
-<screen role="root"><userinput>/usr/sbin/krb5kdc</userinput></screen>
-
-        <para>
-          Attempt to get a ticket with the following command:
-        </para>
-
-<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
-
-        <para>
-          You will be prompted for the password you created. After you
-          get your ticket, you can list it with the following command:
-        </para>
-
-<screen><userinput>klist</userinput></screen>
-
-        <para>
-          Information about the ticket should be displayed on the
-          screen.
-        </para>
-
-        <para>
-          To test the functionality of the keytab file, issue the
-          following command:
-        </para>
-
-<screen><userinput>ktutil
-<prompt>ktutil:</prompt> rkt /etc/krb5.keytab
-<prompt>ktutil:</prompt> l</userinput></screen>
-
-        <para>
-          This should dump a list of the host principal, along with
-          the encryption methods used to access the principal.
-        </para>
-
-        <para>
-          At this point, if everything has been successful so far, you
-          can feel fairly confident in the installation and configuration of
-          the package.
-        </para>
-
-      </sect4>
-
-      <sect4>
-        <title>Additional Information</title>
-
-        <para>
-          For additional information consult the <ulink
-          url="http://web.mit.edu/kerberos/www/krb5-&mitkrb-major-version;/#documentation">
-          documentation for krb5-&mitkrb-version;</ulink> on which the above
-          instructions are based.
-        </para>
-
-      </sect4>
-
-    </sect3>
-
-    <sect3 id="mitkrb-init">
-      <title>Init Script</title>
-
-      <para>
-        If you want to start <application>Kerberos</application> services
-        at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
-        script included in the <xref linkend="bootscripts"/> package using
-        the following command:
-      </para>
-
-      <indexterm zone="mitkrb mitkrb-init">
-        <primary sortas="f-krb5">krb5</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-krb5</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-
-    <title>Contents</title>
-    <para></para>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          gss-client, gss-server, k5srvutil, kadmin, kadmin.local,
-          kadmind, kdb5_ldap_util (optional), kdb5_util, kdestroy, kinit, klist,
-          kpasswd, kprop, kpropd, kproplog, krb5-config, krb5kdc, krb5-send-pr,
-          ksu, kswitch, ktutil, kvno, sclient, sim_client, sim_server,
-          sserver, uuclient and uuserver
-        </seg>
-        <seg>
-          libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
-          libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
-          (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
-          libverto.so, and some plugins under the /usr/lib/krb5 tree
-        </seg>
-        <seg>
-          /usr/include/gssapi,
-          /usr/include/gssrpc,
-          /usr/include/kadm5,
-          /usr/include/krb5,
-          /usr/lib/krb5,
-          /usr/share/doc/krb5-&mitkrb-version;,
-          /usr/share/examples/krb5,
-          /usr/share/gnats/, and
-          /var/lib/krb5kdc
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="k5srvutil">
-        <term><command>k5srvutil</command></term>
-        <listitem>
-          <para>
-            is a host keytable manipulation utility.
-          </para>
-          <indexterm zone="mitkrb k5srvutil">
-            <primary sortas="b-k5srvutil">k5srvutil</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kadmin">
-        <term><command>kadmin</command></term>
-        <listitem>
-          <para>
-            is an utility used to make modifications
-            to the Kerberos database.
-          </para>
-          <indexterm zone="mitkrb kadmin">
-            <primary sortas="b-kadmin">kadmin</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kadmind">
-        <term><command>kadmind</command></term>
-        <listitem>
-          <para>
-            is a server for administrative access
-            to a Kerberos database.
-          </para>
-          <indexterm zone="mitkrb kadmind">
-            <primary sortas="b-kadmind">kadmind</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kdb5_util">
-        <term><command>kdb5_util</command></term>
-        <listitem>
-          <para>
-            is the KDC database utility.
-          </para>
-          <indexterm zone="mitkrb kdb5_util">
-            <primary sortas="b-kdb5_util">kdb5_util</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kdestroy">
-        <term><command>kdestroy</command></term>
-        <listitem>
-          <para>
-            removes the current set of tickets.
-          </para>
-          <indexterm zone="mitkrb kdestroy">
-            <primary sortas="b-kdestroy">kdestroy</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kinit">
-        <term><command>kinit</command></term>
-        <listitem>
-          <para>
-            is used to authenticate to the Kerberos server as a
-            principal and acquire a ticket granting ticket that can
-            later be used to obtain tickets for other services.
-          </para>
-          <indexterm zone="mitkrb kinit">
-            <primary sortas="b-kinit">kinit</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="klist">
-        <term><command>klist</command></term>
-        <listitem>
-          <para>
-            reads and displays the current tickets in
-            the credential cache.
-          </para>
-          <indexterm zone="mitkrb klist">
-            <primary sortas="b-klist">klist</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kpasswd">
-        <term><command>kpasswd</command></term>
-        <listitem>
-          <para>
-            is a program for changing Kerberos 5 passwords.
-          </para>
-          <indexterm zone="mitkrb kpasswd">
-            <primary sortas="b-kpasswd">kpasswd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kprop">
-        <term><command>kprop</command></term>
-        <listitem>
-          <para>
-            takes a principal database in a specified format and
-            converts it into a stream of database records.
-          </para>
-          <indexterm zone="mitkrb kprop">
-            <primary sortas="b-kprop">kprop</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kpropd">
-        <term><command>kpropd</command></term>
-        <listitem>
-          <para>
-            receives a database sent by <command>kprop</command>
-            and writes it as a local database.
-          </para>
-          <indexterm zone="mitkrb kpropd">
-            <primary sortas="b-kpropd">kpropd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="krb5-config-prog2">
-        <term><command>krb5-config</command></term>
-        <listitem>
-          <para>
-            gives information on how to link programs against
-            libraries.
-          </para>
-          <indexterm zone="mitkrb krb5-config-prog2">
-            <primary sortas="b-krb5-config">krb5-config</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="krb5kdc">
-        <term><command>krb5kdc</command></term>
-        <listitem>
-          <para>
-            is the <application>Kerberos 5</application> server.
-          </para>
-          <indexterm zone="mitkrb krb5kdc">
-            <primary sortas="b-krb5kdc">krb5kdc</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ksu">
-        <term><command>ksu</command></term>
-        <listitem>
-          <para>
-            is the super user program using Kerberos protocol.
-            Requires a properly configured
-            <filename>/etc/shells</filename> and
-            <filename>~/.k5login</filename> containing principals
-            authorized to become super users.
-          </para>
-          <indexterm zone="mitkrb ksu">
-            <primary sortas="b-ksu">ksu</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kswitch">
-        <term><command>kswitch</command></term>
-        <listitem>
-          <para>
-            makes the specified credential cache the
-            primary cache for the collection, if a cache
-            collection is available.
-          </para>
-          <indexterm zone="mitkrb kswitch">
-            <primary sortas="b-kswitch">kswitch</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ktutil">
-        <term><command>ktutil</command></term>
-        <listitem>
-          <para>
-            is a program for managing Kerberos keytabs.
-          </para>
-          <indexterm zone="mitkrb ktutil">
-            <primary sortas="b-ktutil">ktutil</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="kvno">
-        <term><command>kvno</command></term>
-        <listitem>
-          <para>
-            prints keyversion numbers of Kerberos principals.
-          </para>
-          <indexterm zone="mitkrb kvno">
-            <primary sortas="b-kvno">kvno</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sclient">
-        <term><command>sclient</command></term>
-        <listitem>
-          <para>
-            used to contact a sample server and authenticate to it
-            using Kerberos 5 tickets, then display the server's
-            response.
-          </para>
-          <indexterm zone="mitkrb sclient">
-            <primary sortas="b-sclient">sclient</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sserver">
-        <term><command>sserver</command></term>
-        <listitem>
-          <para>
-            is the sample Kerberos 5 server.
-          </para>
-          <indexterm zone="mitkrb sserver">
-            <primary sortas="b-sserver">sserver</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libgssapi_krb5">
-        <term><filename class="libraryfile">libgssapi_krb5.so</filename></term>
-        <listitem>
-          <para>
-            contain the Generic Security Service Application Programming
-            Interface (GSSAPI) functions which provides security services
-            to callers in a generic fashion, supportable with a range of
-            underlying mechanisms and technologies and hence allowing
-            source-level portability of applications to different
-            environments.
-          </para>
-          <indexterm zone="mitkrb libgssapi_krb5">
-            <primary sortas="c-libgssapi_krb5">libgssapi_krb5.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libkadm5clnt">
-        <term><filename class="libraryfile">libkadm5clnt.so</filename></term>
-        <listitem>
-          <para>
-            contains the administrative authentication and password checking
-            functions required by Kerberos 5 client-side programs.
-          </para>
-          <indexterm zone="mitkrb libkadm5clnt">
-            <primary sortas="c-libkadm5clnt">libkadm5clnt.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libkadm5srv">
-        <term><filename class="libraryfile">libkadm5srv.so</filename></term>
-        <listitem>
-          <para>
-            contain the administrative authentication and password
-            checking functions required by Kerberos 5 servers.
-          </para>
-          <indexterm zone="mitkrb libkadm5srv">
-            <primary sortas="c-libkadm5srv">libkadm5srv.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libkdb5">
-        <term><filename class="libraryfile">libkdb5.so</filename></term>
-        <listitem>
-          <para>
-            is a Kerberos 5 authentication/authorization database
-            access library.
-          </para>
-          <indexterm zone="mitkrb libkdb5">
-            <primary sortas="c-libkdb5">libkdb5.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libkrad">
-        <term><filename class="libraryfile">libkrad.so</filename></term>
-        <listitem>
-          <para>
-            contains the internal support library for RADIUS functionality.
-          </para>
-          <indexterm zone="mitkrb libkrad">
-            <primary sortas="c-libkrad">libkrad.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libkrb5">
-        <term><filename class="libraryfile">libkrb5.so</filename></term>
-        <listitem>
-          <para>
-            is an all-purpose <application>Kerberos 5</application> library.
-          </para>
-          <indexterm zone="mitkrb libkrb5">
-            <primary sortas="c-libkrb5">libkrb5.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/openssh-systemd.xml
===================================================================
--- postlfs/security/openssh-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/openssh-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,537 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY openssh-download-http
+           "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
+  <!ENTITY openssh-download-ftp
+           "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
+  <!ENTITY openssh-md5sum        "3246aa79317b1d23cae783a3bf8275d6">
+  <!ENTITY openssh-size          "1.3 MB">
+  <!ENTITY openssh-buildsize     "32 MB (additional 3 MB if running the tests)">
+  <!ENTITY openssh-time          "0.5 SBU (running the tests takes at least 10
+                                  minutes, irrespective of processor speed)">
+]>
+
+<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
+  <?dbhtml filename="openssh.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>OpenSSH-&openssh-version;</title>
+
+  <indexterm zone="openssh">
+    <primary sortas="a-OpenSSH">OpenSSH</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to OpenSSH</title>
+
+    <para>
+      The <application>OpenSSH</application> package contains
+      <command>ssh</command> clients and the <command>sshd</command> daemon. This
+      is useful for encrypting authentication and subsequent traffic over a
+      network. The <command>ssh</command> and <command>scp</command> commands are
+      secure implementions of <command>telnet</command> and <command>rcp</command>
+      respectively.
+    </para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&openssh-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&openssh-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &openssh-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &openssh-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &openssh-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &openssh-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Required</bridgehead>
+    <para role="required">
+      <xref linkend="openssl"/> or
+      <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>
+    </para>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <xref linkend="linux-pam"/>,
+      <xref linkend="x-window-system"/>,
+      <xref linkend="mitkrb"/>,
+      <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
+      <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
+      <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
+    </para>
+
+    <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
+    <para role="optional">
+      <xref linkend="openjdk"/>,
+      <xref linkend="net-tools"/>, and
+      <xref linkend="sysstat"/>
+    </para>
+
+    <para condition="html" role="usernotes">
+        User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of OpenSSH</title>
+
+    <para>
+      <application>OpenSSH</application> runs as two processes when connecting
+      to other computers. The first process is a privileged process and controls
+      the issuance of privileges as necessary. The second process communicates
+      with the network. Additional installation steps are necessary to set up
+      the proper environment, which are performed by issuing the following
+      commands as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
+chown   -v root:sys /var/lib/sshd &amp;&amp;
+
+groupadd -g 50 sshd &amp;&amp;
+useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
+
+    <para>
+      Install <application>OpenSSH</application> by running the following
+      commands:
+    </para>
+
+<screen><userinput>./configure --prefix=/usr                     \
+            --sysconfdir=/etc/ssh             \
+            --with-md5-passwords              \
+            --with-privsep-path=/var/lib/sshd &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      The testsuite requires an installed copy of <command>scp</command> to
+      complete the multiplexing tests. To run the test suite, first copy the
+      <command>scp</command> program to
+      <filename class="directory">/usr/bin</filename>, making sure that you
+      back up any existing copy first.
+    </para>
+
+    <para>
+      To test the results, issue: <command>make tests</command>.
+    </para>
+
+<!-- commenting this, I get "all tests passed" [ ken ]
+ NB tests should be run as _user_ but the role in the comment is root
+
+ commenting [ bruce ]:  There are a couple of tests that want root.
+ The log mentions that SUDO is not set.  These skipped tests are 
+ ignored and the end says 'all tests passed' even when not root
+
+    <para>
+      To run the test suite, issue the following commands:
+    </para>
+
+<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
+grep FATAL check.log</userinput></screen>
+
+    <para>
+      If the above command produces no 'FATAL' errors, then proceed with the
+      installation, as the <systemitem class="username">root</systemitem> user:
+    </para>-->
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install                                  &amp;&amp;
+install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
+install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
+install -v -m755 -d /usr/share/doc/openssh-&openssh-version;           &amp;&amp;
+install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
+      configuration files from being installed in
+      <filename class="directory">/usr/etc</filename>.
+    </para>
+
+    <para>
+      <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
+      passwords.
+    </para>
+
+    <para>
+      <parameter>--with-pam</parameter>: This parameter enables
+      <application>Linux-PAM</application> support in the build.
+    </para>
+
+    <para>
+      <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
+      location for the <command>xauth</command> binary for X authentication.
+      Change the location if <command>xauth</command> will be installed to a
+      different path. This can also be controlled from
+      <filename>sshd_config</filename> with the XAuthLocation keyword. You can
+      omit this switch if <application>Xorg</application> is already installed.
+    </para>
+
+    <para>
+      <parameter>--with-kerberos5=/usr</parameter>: This option is used to
+      include Kerberos 5 support in the build.
+    </para>
+
+    <para>
+      <parameter>--with-libedit</parameter>: This option enables line editing
+      and history features for <command>sftp</command>.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring OpenSSH</title>
+
+    <sect3 id="openssh-config">
+      <title>Config Files</title>
+
+      <para>
+        <filename>~/.ssh/*</filename>,
+      <filename>/etc/ssh/ssh_config</filename>, and
+      <filename>/etc/ssh/sshd_config</filename>
+        </para>
+
+      <indexterm zone="openssh openssh-config">
+        <primary sortas="e-AA.ssh">~/.ssh/*</primary>
+      </indexterm>
+
+      <indexterm zone="openssh openssh-config">
+        <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
+      </indexterm>
+
+      <indexterm zone="openssh openssh-config">
+        <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
+      </indexterm>
+
+      <para>
+        There are no required changes to any of these files. However,
+        you may wish to view the
+        <filename class='directory'>/etc/ssh/</filename> files and make any
+        changes appropriate for the security of your system. One recommended
+        change is that you disable
+        <systemitem class='username'>root</systemitem> login via
+        <command>ssh</command>. Execute the following command as the
+        <systemitem class='username'>root</systemitem> user to disable
+        <systemitem class='username'>root</systemitem> login via
+        <command>ssh</command>:
+      </para>
+
+<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
+
+      <para>
+        If you want to be able to log in without typing in your password, first
+        create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
+        <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
+        ~/.ssh/authorized_keys on the remote computer that you want to log into.
+        You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
+        computer and you'll also need to enter your password for the ssh-copy-id command
+        to succeed:
+      </para>
+
+<screen><userinput>ssh-keygen &amp;&amp;
+ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
+
+      <para>
+        Once you've got passwordless logins working it's actually more secure
+        than logging in with a password (as the private key is much longer than
+        most people's passwords). If you would like to now disable password
+        logins, as the <systemitem class="username">root</systemitem> user:
+      </para>
+
+
+<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
+echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
+
+      <para>
+        If you added <application>LinuxPAM</application> support and you want
+        ssh to use it then you will need to add a configuration file for
+        <application>sshd</application> and enable use of
+        <application>LinuxPAM</application>. Note, ssh only uses PAM to check
+        passwords, if you've disabled password logins these commands are not
+        needed. If you want to use PAM issue the following commands as the
+        <systemitem class='username'>root</systemitem> user:
+      </para>
+
+<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
+chmod 644 /etc/pam.d/sshd &amp;&amp;
+echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
+
+      <para>
+        Additional configuration information can be found in the man
+        pages for <command>sshd</command>, <command>ssh</command> and
+        <command>ssh-agent</command>.
+      </para>
+    </sect3>
+
+    <sect3  id="openssh-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the <command>sshd</command> daemon at boot,
+        install the systemd units from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="openssh openssh-init">
+        <primary sortas="f-sshd">sshd</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-sshd</userinput></screen>
+
+      <note>
+        <para>
+          This package comes with two types of units: A service file and a socket file. 
+          The service file will start sshd daemon once at boot and it will keep running until the 
+          system shuts down. The socket file will make systemd listen on sshd port (Default 22, needs 
+          to be edited for anything else) and will start sshd daemon when something tries to connect 
+          to that port and stop the daemon when the connection is terminated. This is 
+          called socket activation.
+
+          By default, the first method is used - sshd daemon is started at boot and stopped at shutdown. 
+          If the socket method is desired, you need to run as the
+          <systemitem class="username">root</systemitem> user:
+
+<screen role="root"><userinput>systemctl stop sshd &amp;&amp; 
+systemctl disable sshd &amp;&amp;
+systemctl enable sshd.socket &amp;&amp;
+systemctl start sshd.socket</userinput></screen>
+        </para>
+      </note>
+
+    </sect3>
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
+          ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
+        </seg>
+        <seg>
+          None
+        </seg>
+        <seg>
+          /etc/ssh,
+          /usr/libexec/openssh,
+          /usr/share/doc/openssh-&openssh-version;, and
+          /var/lib/sshd
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="scp">
+        <term><command>scp</command></term>
+        <listitem>
+          <para>
+            is a file copy program that acts like <command>rcp</command> except
+            it uses an encrypted protocol.
+          </para>
+          <indexterm zone="openssh scp">
+            <primary sortas="b-scp">scp</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sftp">
+        <term><command>sftp</command></term>
+        <listitem>
+          <para>
+            is an FTP-like program that works over the SSH1 and SSH2 protocols.
+          </para>
+          <indexterm zone="openssh sftp">
+            <primary sortas="b-sftp">sftp</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sftp-server">
+        <term><command>sftp-server</command></term>
+        <listitem>
+          <para>
+            is an SFTP server subsystem. This program is not normally called
+            directly by the user.
+          </para>
+          <indexterm zone="openssh sftp-server">
+            <primary sortas="b-sftp-server">sftp-server</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="slogin">
+        <term><command>slogin</command></term>
+        <listitem>
+          <para>
+            is a symlink to <command>ssh</command>.
+          </para>
+          <indexterm zone="openssh slogin">
+            <primary sortas="b-slogin">slogin</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh">
+        <term><command>ssh</command></term>
+        <listitem>
+          <para>
+            is an <command>rlogin</command>/<command>rsh</command>-like client
+            program except it uses an encrypted protocol.
+          </para>
+          <indexterm zone="openssh ssh">
+            <primary sortas="b-ssh">ssh</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="sshd">
+        <term><command>sshd</command></term>
+        <listitem>
+          <para>
+            is a daemon that listens for <command>ssh</command> login requests.
+          </para>
+          <indexterm zone="openssh sshd">
+            <primary sortas="b-sshd">sshd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-add">
+        <term><command>ssh-add</command></term>
+        <listitem>
+          <para>
+            is a tool which adds keys to the <command>ssh-agent</command>.
+          </para>
+          <indexterm zone="openssh ssh-add">
+            <primary sortas="b-ssh-add">ssh-add</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-agent">
+        <term><command>ssh-agent</command></term>
+        <listitem>
+          <para>
+            is an authentication agent that can store private keys.
+          </para>
+          <indexterm zone="openssh ssh-agent">
+            <primary sortas="b-ssh-agent">ssh-agent</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-copy-id">
+        <term><command>ssh-copy-id</command></term>
+        <listitem>
+          <para>
+            is a script that enables logins on remote machine using local keys.
+          </para>
+          <indexterm zone="openssh ssh-copy-id">
+            <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-keygen">
+        <term><command>ssh-keygen</command></term>
+        <listitem>
+          <para>
+            is a key generation tool.
+          </para>
+          <indexterm zone="openssh ssh-keygen">
+            <primary sortas="b-ssh-keygen">ssh-keygen</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-keyscan">
+        <term><command>ssh-keyscan</command></term>
+        <listitem>
+          <para>
+            is a utility for gathering public host keys from a number of hosts.
+          </para>
+          <indexterm zone="openssh ssh-keyscan">
+            <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-keysign">
+        <term><command>ssh-keysign</command></term>
+        <listitem>
+          <para>
+            is used by <command>ssh</command> to access the local host keys and
+            generate the digital signature required during hostbased
+            authentication with SSH protocol version 2. This program is not
+            normally called directly by the user.
+          </para>
+          <indexterm zone="openssh ssh-keysign">
+            <primary sortas="b-ssh-keysign">ssh-keysign</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ssh-pkcs11-helper">
+        <term><command>ssh-pkcs11-helper</command></term>
+        <listitem>
+          <para>
+            is a <command>ssh-agent</command> helper program for PKCS#11 support.
+          </para>
+          <indexterm zone="openssh ssh-pkcs11-helper">
+            <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+  </sect2>
+</sect1>
Index: postlfs/security/openssh.xml
===================================================================
--- postlfs/security/openssh.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,513 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY openssh-download-http
-           "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
-  <!ENTITY openssh-download-ftp
-           "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-&openssh-version;.tar.gz">
-  <!ENTITY openssh-md5sum        "3246aa79317b1d23cae783a3bf8275d6">
-  <!ENTITY openssh-size          "1.3 MB">
-  <!ENTITY openssh-buildsize     "32 MB (additional 3 MB if running the tests)">
-  <!ENTITY openssh-time          "0.5 SBU (running the tests takes at least 10
-                                  minutes, irrespective of processor speed)">
-]>
-
-<sect1 id="openssh" xreflabel="OpenSSH-&openssh-version;">
-  <?dbhtml filename="openssh.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>OpenSSH-&openssh-version;</title>
-
-  <indexterm zone="openssh">
-    <primary sortas="a-OpenSSH">OpenSSH</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to OpenSSH</title>
-
-    <para>
-      The <application>OpenSSH</application> package contains
-      <command>ssh</command> clients and the <command>sshd</command> daemon. This
-      is useful for encrypting authentication and subsequent traffic over a
-      network. The <command>ssh</command> and <command>scp</command> commands are
-      secure implementions of <command>telnet</command> and <command>rcp</command>
-      respectively.
-    </para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&openssh-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&openssh-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &openssh-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &openssh-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &openssh-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &openssh-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">OpenSSH Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="openssl"/> or
-      <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink></para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="linux-pam"/>,
-      <xref linkend="x-window-system"/>,
-      <xref linkend="mitkrb"/>,
-      <ulink url="http://www.thrysoee.dk/editline/">libedit</ulink>,
-      <ulink url="http://www.opensc-project.org/">OpenSC</ulink>, and
-      <ulink url="http://www.citi.umich.edu/projects/smartcard/sectok.html">libsectok</ulink>
-    </para>
-
-    <bridgehead renderas="sect4">Optional Runtime (Used only to gather entropy)</bridgehead>
-    <para role="optional">
-      <xref linkend="openjdk"/>,
-      <xref linkend="net-tools"/>, and
-      <xref linkend="sysstat"/>
-    </para>
-
-    <para condition="html" role="usernotes">
-        User Notes: <ulink url="&blfs-wiki;/OpenSSH"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of OpenSSH</title>
-
-    <para>
-      <application>OpenSSH</application> runs as two processes when connecting
-      to other computers. The first process is a privileged process and controls
-      the issuance of privileges as necessary. The second process communicates
-      with the network. Additional installation steps are necessary to set up
-      the proper environment, which are performed by issuing the following
-      commands as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>install -v -m700 -d /var/lib/sshd &amp;&amp;
-chown   -v root:sys /var/lib/sshd &amp;&amp;
-
-groupadd -g 50 sshd &amp;&amp;
-useradd -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd</userinput></screen>
-
-    <para>
-      Install <application>OpenSSH</application> by running the following
-      commands:
-    </para>
-
-<screen><userinput>./configure --prefix=/usr                     \
-            --sysconfdir=/etc/ssh             \
-            --with-md5-passwords              \
-            --with-privsep-path=/var/lib/sshd &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      The testsuite requires an installed copy of <command>scp</command> to
-      complete the multiplexing tests. To run the test suite, first copy the
-      <command>scp</command> program to
-      <filename class="directory">/usr/bin</filename>, making sure that you
-      back up any existing copy first.
-    </para>
-
-    <para>
-      To test the results, issue: <command>make tests</command>.
-    </para>
-
-<!-- commenting this, I get "all tests passed" [ ken ]
- NB tests should be run as _user_ but the role in the comment is root
-
- commenting [ bruce ]:  There are a couple of tests that want root.
- The log mentions that SUDO is not set.  These skipped tests are 
- ignored and the end says 'all tests passed' even when not root
-
-    <para>
-      To run the test suite, issue the following commands:
-    </para>
-
-<screen role="root"><userinput>make tests 2&gt;&amp;1 | tee check.log
-grep FATAL check.log</userinput></screen>
-
-    <para>
-      If the above command produces no 'FATAL' errors, then proceed with the
-      installation, as the <systemitem class="username">root</systemitem> user:
-    </para>-->
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install                                  &amp;&amp;
-install -v -m755 contrib/ssh-copy-id /usr/bin &amp;&amp;
-install -v -m644 contrib/ssh-copy-id.1 /usr/share/man/man1 &amp;&amp;
-install -v -m755 -d /usr/share/doc/openssh-&openssh-version;           &amp;&amp;
-install -v -m644 INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-&openssh-version;</userinput></screen>
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <parameter>--sysconfdir=/etc/ssh</parameter>: This prevents the
-      configuration files from being installed in
-      <filename class="directory">/usr/etc</filename>.
-    </para>
-
-    <para>
-      <parameter>--with-md5-passwords</parameter>: This enables the use of MD5
-      passwords.
-    </para>
-
-    <para>
-      <parameter>--with-pam</parameter>: This parameter enables
-      <application>Linux-PAM</application> support in the build.
-    </para>
-
-    <para>
-      <parameter>--with-xauth=/usr/bin/xauth</parameter>: Set the default
-      location for the <command>xauth</command> binary for X authentication.
-      Change the location if <command>xauth</command> will be installed to a
-      different path. This can also be controlled from
-      <filename>sshd_config</filename> with the XAuthLocation keyword. You can
-      omit this switch if <application>Xorg</application> is already installed.
-    </para>
-
-    <para>
-      <parameter>--with-kerberos5=/usr</parameter>: This option is used to
-      include Kerberos 5 support in the build.
-    </para>
-
-    <para>
-      <parameter>--with-libedit</parameter>: This option enables line editing
-      and history features for <command>sftp</command>.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring OpenSSH</title>
-
-    <sect3 id="openssh-config">
-      <title>Config Files</title>
-
-      <para>
-        <filename>~/.ssh/*</filename>,
-      <filename>/etc/ssh/ssh_config</filename>, and
-      <filename>/etc/ssh/sshd_config</filename>
-        </para>
-
-      <indexterm zone="openssh openssh-config">
-        <primary sortas="e-AA.ssh">~/.ssh/*</primary>
-      </indexterm>
-
-      <indexterm zone="openssh openssh-config">
-        <primary sortas="e-etc-ssh-ssh_config">/etc/ssh/ssh_config</primary>
-      </indexterm>
-
-      <indexterm zone="openssh openssh-config">
-        <primary sortas="e-etc-ssh-sshd_config">/etc/ssh/sshd_config</primary>
-      </indexterm>
-
-      <para>
-        There are no required changes to any of these files. However,
-        you may wish to view the
-        <filename class='directory'>/etc/ssh/</filename> files and make any
-        changes appropriate for the security of your system. One recommended
-        change is that you disable
-        <systemitem class='username'>root</systemitem> login via
-        <command>ssh</command>. Execute the following command as the
-        <systemitem class='username'>root</systemitem> user to disable
-        <systemitem class='username'>root</systemitem> login via
-        <command>ssh</command>:
-      </para>
-
-<screen role="root"><userinput>echo "PermitRootLogin no" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
-
-      <para>
-        If you want to be able to log in without typing in your password, first
-        create ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub with
-        <command>ssh-keygen</command> and then copy ~/.ssh/id_rsa.pub to
-        ~/.ssh/authorized_keys on the remote computer that you want to log into.
-        You'll need to change REMOTE_USERNAME and REMOTE_HOSTNAME for the username and hostname of the remote
-        computer and you'll also need to enter your password for the ssh-copy-id command
-        to succeed:
-      </para>
-
-<screen><userinput>ssh-keygen &amp;&amp;
-ssh-copy-id -i ~/.ssh/id_rsa.pub <replaceable>REMOTE_USERNAME</replaceable>@<replaceable>REMOTE_HOSTNAME</replaceable></userinput></screen>
-
-      <para>
-        Once you've got passwordless logins working it's actually more secure
-        than logging in with a password (as the private key is much longer than
-        most people's passwords). If you would like to now disable password
-        logins, as the <systemitem class="username">root</systemitem> user:
-      </para>
-
-
-<screen role="root"><userinput>echo "PasswordAuthentication no" >> /etc/ssh/sshd_config &amp;&amp;
-echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config</userinput></screen>
-
-      <para>
-        If you added <application>LinuxPAM</application> support and you want
-        ssh to use it then you will need to add a configuration file for
-        <application>sshd</application> and enable use of
-        <application>LinuxPAM</application>. Note, ssh only uses PAM to check
-        passwords, if you've disabled password logins these commands are not
-        needed. If you want to use PAM issue the following commands as the
-        <systemitem class='username'>root</systemitem> user:
-      </para>
-
-<screen role="root"><userinput>sed 's@d/login@d/sshd@g' /etc/pam.d/login &gt; /etc/pam.d/sshd &amp;&amp;
-chmod 644 /etc/pam.d/sshd &amp;&amp;
-echo "UsePAM yes" &gt;&gt; /etc/ssh/sshd_config</userinput></screen>
-
-      <para>
-        Additional configuration information can be found in the man
-        pages for <command>sshd</command>, <command>ssh</command> and
-        <command>ssh-agent</command>.
-      </para>
-    </sect3>
-
-    <sect3  id="openssh-init">
-      <title>Boot Script</title>
-
-      <para>
-        To start the SSH server at system boot, install the
-      <filename>/etc/rc.d/init.d/sshd</filename> init script included
-      in the <xref linkend="bootscripts"/> package.
-        </para>
-
-      <indexterm zone="openssh openssh-init">
-        <primary sortas="f-sshd">sshd</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-sshd</userinput></screen>
-    </sect3>
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          scp, sftp, slogin (symlink to ssh), ssh, ssh-add, ssh-agent,
-          ssh-copy-id, ssh-keygen, ssh-keyscan, and sshd
-        </seg>
-        <seg>
-          None
-        </seg>
-        <seg>
-          /etc/ssh,
-          /usr/share/doc/openssh-&openssh-version;, and
-          /var/lib/sshd
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="scp">
-        <term><command>scp</command></term>
-        <listitem>
-          <para>
-            is a file copy program that acts like <command>rcp</command> except
-            it uses an encrypted protocol.
-          </para>
-          <indexterm zone="openssh scp">
-            <primary sortas="b-scp">scp</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sftp">
-        <term><command>sftp</command></term>
-        <listitem>
-          <para>
-            is an FTP-like program that works over the SSH1 and SSH2 protocols.
-          </para>
-          <indexterm zone="openssh sftp">
-            <primary sortas="b-sftp">sftp</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sftp-server">
-        <term><command>sftp-server</command></term>
-        <listitem>
-          <para>
-            is an SFTP server subsystem. This program is not normally called
-            directly by the user.
-          </para>
-          <indexterm zone="openssh sftp-server">
-            <primary sortas="b-sftp-server">sftp-server</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="slogin">
-        <term><command>slogin</command></term>
-        <listitem>
-          <para>
-            is a symlink to <command>ssh</command>.
-          </para>
-          <indexterm zone="openssh slogin">
-            <primary sortas="b-slogin">slogin</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh">
-        <term><command>ssh</command></term>
-        <listitem>
-          <para>
-            is an <command>rlogin</command>/<command>rsh</command>-like client
-            program except it uses an encrypted protocol.
-          </para>
-          <indexterm zone="openssh ssh">
-            <primary sortas="b-ssh">ssh</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="sshd">
-        <term><command>sshd</command></term>
-        <listitem>
-          <para>
-            is a daemon that listens for <command>ssh</command> login requests.
-          </para>
-          <indexterm zone="openssh sshd">
-            <primary sortas="b-sshd">sshd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-add">
-        <term><command>ssh-add</command></term>
-        <listitem>
-          <para>
-            is a tool which adds keys to the <command>ssh-agent</command>.
-          </para>
-          <indexterm zone="openssh ssh-add">
-            <primary sortas="b-ssh-add">ssh-add</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-agent">
-        <term><command>ssh-agent</command></term>
-        <listitem>
-          <para>
-            is an authentication agent that can store private keys.
-          </para>
-          <indexterm zone="openssh ssh-agent">
-            <primary sortas="b-ssh-agent">ssh-agent</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-copy-id">
-        <term><command>ssh-copy-id</command></term>
-        <listitem>
-          <para>
-            is a script that enables logins on remote machine using local keys.
-          </para>
-          <indexterm zone="openssh ssh-copy-id">
-            <primary sortas="b-ssh-copy-id">ssh-copy-id</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-keygen">
-        <term><command>ssh-keygen</command></term>
-        <listitem>
-          <para>
-            is a key generation tool.
-          </para>
-          <indexterm zone="openssh ssh-keygen">
-            <primary sortas="b-ssh-keygen">ssh-keygen</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-keyscan">
-        <term><command>ssh-keyscan</command></term>
-        <listitem>
-          <para>
-            is a utility for gathering public host keys from a number of hosts.
-          </para>
-          <indexterm zone="openssh ssh-keyscan">
-            <primary sortas="b-ssh-keyscan">ssh-keyscan</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-keysign">
-        <term><command>ssh-keysign</command></term>
-        <listitem>
-          <para>
-            is used by <command>ssh</command> to access the local host keys and
-            generate the digital signature required during hostbased
-            authentication with SSH protocol version 2. This program is not
-            normally called directly by the user.
-          </para>
-          <indexterm zone="openssh ssh-keysign">
-            <primary sortas="b-ssh-keysign">ssh-keysign</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="ssh-pkcs11-helper">
-        <term><command>ssh-pkcs11-helper</command></term>
-        <listitem>
-          <para>
-            is a <command>ssh-agent</command> helper program for PKCS#11 support.
-          </para>
-          <indexterm zone="openssh ssh-pkcs11-helper">
-            <primary sortas="b-ssh-pkcs11-helper">ssh-pkcs11-helper</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-  </sect2>
-</sect1>
Index: postlfs/security/security.xml
===================================================================
--- postlfs/security/security.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ postlfs/security/security.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -44,17 +44,17 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cacerts.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cracklib.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cyrus-sasl.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cyrus-sasl-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gnupg2-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gnutls.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gpgme.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged-systemd.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables-systemd.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libcap-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="linux-pam.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mitkrb.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mitkrb-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nettle.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nss.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssh.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssh-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssl.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="p11-kit.xml"/>
@@ -62,5 +62,5 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="shadow.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="ssh-askpass.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stunnel.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stunnel-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="sudo.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="tripwire.xml"/>
Index: postlfs/security/shadow.xml
===================================================================
--- postlfs/security/shadow.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ postlfs/security/shadow.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -631,5 +631,5 @@
     <para>
       A list of the installed files, along with their short descriptions can be
-      found at <ulink url="http://www.linuxfromscratch.org/lfs/view/&lfs-version;/chapter06/shadow.html#contents-shadow"/>.
+      found at <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.
     </para>
 
Index: postlfs/security/stunnel-systemd.xml
===================================================================
--- postlfs/security/stunnel-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
+++ postlfs/security/stunnel-systemd.xml	(revision 0e389d1320287a6a94b77935f5159779f4ca1be7)
@@ -0,0 +1,325 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY stunnel-download-http "http://mirrors.zerg.biz/stunnel/stunnel-&stunnel-version;.tar.gz">
+  <!ENTITY stunnel-download-ftp  "ftp://ftp.stunnel.org/stunnel/stunnel-&stunnel-version;.tar.gz">
+  <!ENTITY stunnel-md5sum        "827901cd4690796eadf17f792b658573">
+  <!ENTITY stunnel-size          "584 KB">
+  <!ENTITY stunnel-buildsize     "5.7 MB">
+  <!ENTITY stunnel-time          "0.1 SBU">
+]>
+
+<sect1 id="stunnel" xreflabel="stunnel-&stunnel-version;">
+  <?dbhtml filename="stunnel.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>stunnel-&stunnel-version;</title>
+
+  <indexterm zone="stunnel">
+    <primary sortas="a-stunnel">stunnel</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to stunnel</title>
+
+    <para>The <application>stunnel</application> package contains a program
+    that allows you to encrypt arbitrary TCP connections inside SSL (Secure
+    Sockets Layer) so you can easily communicate with clients over secure
+    channels. <application>stunnel</application> can be used to add SSL
+    functionality to commonly used <application>Inetd</application> daemons
+    like POP-2, POP-3, and IMAP servers, to standalone daemons like NNTP,
+    SMTP and HTTP, and in tunneling PPP over network sockets without changes
+    to the server package source code.</para>
+
+    &lfs76_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>Download (HTTP): <ulink url="&stunnel-download-http;"/></para>
+      </listitem>
+      <listitem>
+        <para>Download (FTP): <ulink url="&stunnel-download-ftp;"/></para>
+      </listitem>
+      <listitem>
+        <para>Download MD5 sum: &stunnel-md5sum;</para>
+      </listitem>
+      <listitem>
+        <para>Download size: &stunnel-size;</para>
+      </listitem>
+      <listitem>
+        <para>Estimated disk space required: &stunnel-buildsize;</para>
+      </listitem>
+      <listitem>
+        <para>Estimated build time: &stunnel-time;</para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">stunnel Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Required</bridgehead>
+    <para role="required">
+      <xref linkend="openssl"/>
+    </para>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <ulink url="ftp://ftp.porcupine.org/pub/security/">tcpwrappers</ulink>
+    </para>
+
+    <para condition="html" role="usernotes">User Notes:
+    <ulink url="&blfs-wiki;/stunnel"/></para>
+
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of stunnel</title>
+
+    <para>The <command>stunnel</command> daemon will be run in a
+    <command>chroot</command> jail by an unprivileged user. Create the
+    new user and group using the following commands as the
+    <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root"><userinput>groupadd -g 51 stunnel &amp;&amp;
+useradd -c "stunnel Daemon" -d /var/lib/stunnel \
+        -g stunnel -s /bin/false -u 51 stunnel</userinput></screen>
+
+    <note>
+      <para>A signed SSL Certificate and a Private Key is necessary to run the
+      <command>stunnel</command> daemon.  Further below, after
+      <command>make ... install</command>, we include instructions to generate
+      them. However, if you own, or have already created a signed SSL
+      Certificate you wish to use, copy it to
+      <filename>/etc/stunnel/stunnel.pem</filename> before starting the build
+      (ensure only <systemitem class="username">root</systemitem> has read and
+      write access).  The <filename class="extension">.pem</filename> file must
+      be formatted as shown below:</para>
+
+<screen><literal>-----BEGIN PRIVATE KEY-----
+<replaceable>&lt;many encrypted lines of private key&gt;</replaceable>
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+<replaceable>&lt;many encrypted lines of certificate&gt;</replaceable>
+-----END CERTIFICATE-----
+-----BEGIN DH PARAMETERS-----
+<replaceable>&lt;encrypted lines of dh parms&gt;</replaceable>
+-----END DH PARAMETERS-----</literal></screen>
+    </note>
+
+    <para>
+      Fix the bundled systemd unit so it does not use a deprecated dependency:
+    </para>
+
+<screen><userinput>sed -i /syslog.target/d tools/stunnel.service.in</userinput></screen>
+
+    <para>Install <application>stunnel</application> by running the following
+    commands:</para>
+
+<screen><userinput>./configure --prefix=/usr \
+            --sysconfdir=/etc \
+            --localstatedir=/var &amp;&amp;
+make</userinput></screen>
+
+    <para>This package does not come with a test suite.</para>
+
+    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root"><userinput>make docdir=/usr/share/doc/stunnel-&stunnel-version; install</userinput></screen>
+
+    <para>
+      Install the systemd unit by running the following command as the
+      <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>install -v -m644 tools/stunnel.service /lib/systemd/system/stunnel.service</userinput></screen>
+
+    <para>To create the <filename>stunnel.pem</filename> in the
+    <filename class="directory">/etc/stunnel</filename> directory, 
+    you need to create one.   The following command prompts you
+    for the necessary information. Ensure you reply to the</para>
+    
+<screen><prompt>Common Name (FQDN of your server) [localhost]:</prompt></screen>
+
+    <para>prompt with the name or IP address you will be using
+    to access the service(s).</para>
+
+    <para>To generate a certificate, as the 
+    <systemitem class="username">root</systemitem> user, run:</para>
+
+<screen role="root"><userinput>make cert</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para><command>make docdir=... install</command>: This command installs the
+    package, changes the documentation installation directory to standard
+    naming conventions.</para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring stunnel</title>
+
+    <sect3 id="stunnel-config">
+      <title>Config Files</title>
+
+      <para><filename>/etc/stunnel/stunnel.conf</filename></para>
+
+      <indexterm zone="stunnel stunnel-config">
+        <primary sortas="e-etc-stunnel-stunnel.conf">/etc/stunnel/stunnel.conf</primary>
+      </indexterm>
+
+    </sect3>
+
+    <sect3>
+      <title>Configuration Information</title>
+
+      <para>As the <systemitem class="username">root</systemitem> user,
+      create the directory used for the
+      <filename class="extension">.pid</filename> file that is created
+      when the <application>stunnel</application> daemon starts:</para>
+
+<screen role="root"><userinput>install -v -m750 -o stunnel -g stunnel -d /var/lib/stunnel/run &amp;&amp;
+chown stunnel:stunnel /var/lib/stunnel</userinput></screen>
+
+      <para>Next, create a basic <filename>/etc/stunnel/stunnel.conf</filename>
+      configuration file using the following commands as the
+      <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root"><userinput>cat &gt;/etc/stunnel/stunnel.conf &lt;&lt; "EOF" &amp;&amp;
+<literal>; File: /etc/stunnel/stunnel.conf
+
+; Note: The pid and output locations are relative to the chroot location.
+
+pid    = /run/stunnel.pid
+chroot = /var/lib/stunnel
+client = no
+setuid = stunnel
+setgid = stunnel
+cert   = /etc/stunnel/stunnel.pem
+
+;debug = 7
+;output = stunnel.log
+
+;[https]
+;accept  = 443
+;connect = 80
+;; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL
+;; Microsoft implementations do not use SSL close-notify alert and thus
+;; they are vulnerable to truncation attacks
+;TIMEOUTclose = 0</literal>
+
+EOF
+chmod -v 644 /etc/stunnel/stunnel.conf</userinput></screen>
+
+      <para>Finally, you need to add the service(s) you wish to encrypt to the
+      configuration file. The format is as follows:</para>
+
+<screen><literal>[<replaceable>&lt;service&gt;</replaceable>]
+accept  = <replaceable>&lt;hostname:portnumber&gt;</replaceable>
+connect = <replaceable>&lt;hostname:portnumber&gt;</replaceable></literal></screen>
+
+      <para>If you use <application>stunnel</application> to encrypt a daemon
+      started from <command>[x]inetd</command>, you may need to disable that
+      daemon in the <filename>/etc/[x]inetd.conf</filename> file and enable a
+      corresponding <replaceable>&lt;service&gt;</replaceable>_stunnel service. You
+      may have to add an appropriate entry in <filename>/etc/services</filename>
+      as well.</para>
+
+      <para>For a full explanation of the commands and syntax used in the
+      configuration file, run <command>man stunnel</command>.</para>
+
+    </sect3>
+
+    <sect3  id="stunnel-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the <command>stunnel</command> daemon at boot,
+        enable the previously installed systemd unit by
+        running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="stunnel stunnel-init">
+        <primary sortas="f-stunnel">stunnel</primary>
+      </indexterm>
+
+<screen role="root"><userinput>systemctl enable stunnel</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Library</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>stunnel and stunnel3</seg>
+        <seg>libstunnel.so</seg>
+        <seg>/etc/stunnel, 
+             /usr/lib/stunnel,
+             /usr/share/doc/stunnel-&stunnel-version;, and
+             /var/lib/stunnel</seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="stunnel-prog">
+        <term><command>stunnel</command></term>
+        <listitem>
+          <para> is a program designed to work as an SSL
+          encryption wrapper between remote clients and local
+          (<command>{x}inetd</command>-startable) or remote servers.</para>
+          <indexterm zone="stunnel stunnel-prog">
+            <primary sortas="b-stunnel">stunnel</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="stunnel3">
+        <term><command>stunnel3</command></term>
+        <listitem>
+          <para>is a <application>Perl</application> wrapper script to use
+          <command>stunnel</command> 3.x syntax with <command>stunnel</command>
+          >=4.05.</para>
+          <indexterm zone="stunnel stunnel3">
+            <primary sortas="b-stunnel3">stunnel3</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libstunnel">
+        <term><filename class='libraryfile'>libstunnel.so</filename></term>
+        <listitem>
+          <para> contains the API functions required by
+          <application>stunnel</application>.</para>
+          <indexterm zone="stunnel libstunnel">
+            <primary sortas="c-libstunnel">libstunnel.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/stunnel.xml
===================================================================
--- postlfs/security/stunnel.xml	(revision cb9c6940382641529d9a72b7e326ba3190239b74)
+++ 	(revision )
@@ -1,310 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY stunnel-download-http "http://mirrors.zerg.biz/stunnel/stunnel-&stunnel-version;.tar.gz">
-  <!ENTITY stunnel-download-ftp  "ftp://ftp.stunnel.org/stunnel/stunnel-&stunnel-version;.tar.gz">
-  <!ENTITY stunnel-md5sum        "827901cd4690796eadf17f792b658573">
-  <!ENTITY stunnel-size          "584 KB">
-  <!ENTITY stunnel-buildsize     "5.7 MB">
-  <!ENTITY stunnel-time          "0.1 SBU">
-]>
-
-<sect1 id="stunnel" xreflabel="stunnel-&stunnel-version;">
-  <?dbhtml filename="stunnel.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>stunnel-&stunnel-version;</title>
-
-  <indexterm zone="stunnel">
-    <primary sortas="a-stunnel">stunnel</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to stunnel</title>
-
-    <para>The <application>stunnel</application> package contains a program
-    that allows you to encrypt arbitrary TCP connections inside SSL (Secure
-    Sockets Layer) so you can easily communicate with clients over secure
-    channels. <application>stunnel</application> can be used to add SSL
-    functionality to commonly used <application>Inetd</application> daemons
-    like POP-2, POP-3, and IMAP servers, to standalone daemons like NNTP,
-    SMTP and HTTP, and in tunneling PPP over network sockets without changes
-    to the server package source code.</para>
-
-    &lfs76_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>Download (HTTP): <ulink url="&stunnel-download-http;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download (FTP): <ulink url="&stunnel-download-ftp;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download MD5 sum: &stunnel-md5sum;</para>
-      </listitem>
-      <listitem>
-        <para>Download size: &stunnel-size;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated disk space required: &stunnel-buildsize;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated build time: &stunnel-time;</para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">stunnel Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="openssl"/>
-    </para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <ulink url="ftp://ftp.porcupine.org/pub/security/">tcpwrappers</ulink>
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-    <ulink url="&blfs-wiki;/stunnel"/></para>
-
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of stunnel</title>
-
-    <para>The <command>stunnel</command> daemon will be run in a
-    <command>chroot</command> jail by an unprivileged user. Create the
-    new user and group using the following commands as the
-    <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>groupadd -g 51 stunnel &amp;&amp;
-useradd -c "stunnel Daemon" -d /var/lib/stunnel \
-        -g stunnel -s /bin/false -u 51 stunnel</userinput></screen>
-
-    <note>
-      <para>A signed SSL Certificate and a Private Key is necessary to run the
-      <command>stunnel</command> daemon.  Further below, after
-      <command>make ... install</command>, we include instructions to generate
-      them. However, if you own, or have already created a signed SSL
-      Certificate you wish to use, copy it to
-      <filename>/etc/stunnel/stunnel.pem</filename> before starting the build
-      (ensure only <systemitem class="username">root</systemitem> has read and
-      write access).  The <filename class="extension">.pem</filename> file must
-      be formatted as shown below:</para>
-
-<screen><literal>-----BEGIN PRIVATE KEY-----
-<replaceable>&lt;many encrypted lines of private key&gt;</replaceable>
------END PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-<replaceable>&lt;many encrypted lines of certificate&gt;</replaceable>
------END CERTIFICATE-----
------BEGIN DH PARAMETERS-----
-<replaceable>&lt;encrypted lines of dh parms&gt;</replaceable>
------END DH PARAMETERS-----</literal></screen>
-    </note>
-
-    <para>Install <application>stunnel</application> by running the following
-    commands:</para>
-
-<screen><userinput>./configure --prefix=/usr \
-            --sysconfdir=/etc \
-            --localstatedir=/var &amp;&amp;
-make</userinput></screen>
-
-    <para>This package does not come with a test suite.</para>
-
-    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>make docdir=/usr/share/doc/stunnel-&stunnel-version; install</userinput></screen>
-
-    <para>To create the <filename>stunnel.pem</filename> in the
-    <filename class="directory">/etc/stunnel</filename> directory, 
-    you need to create one.   The following command prompts you
-    for the necessary information. Ensure you reply to the</para>
-    
-<screen><prompt>Common Name (FQDN of your server) [localhost]:</prompt></screen>
-
-    <para>prompt with the name or IP address you will be using
-    to access the service(s).</para>
-
-    <para>To generate a certificate, as the 
-    <systemitem class="username">root</systemitem> user, run:</para>
-
-<screen role="root"><userinput>make cert</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para><command>make docdir=... install</command>: This command installs the
-    package, changes the documentation installation directory to standard
-    naming conventions.</para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring stunnel</title>
-
-    <sect3 id="stunnel-config">
-      <title>Config Files</title>
-
-      <para><filename>/etc/stunnel/stunnel.conf</filename></para>
-
-      <indexterm zone="stunnel stunnel-config">
-        <primary sortas="e-etc-stunnel-stunnel.conf">/etc/stunnel/stunnel.conf</primary>
-      </indexterm>
-
-    </sect3>
-
-    <sect3>
-      <title>Configuration Information</title>
-
-      <para>As the <systemitem class="username">root</systemitem> user,
-      create the directory used for the
-      <filename class="extension">.pid</filename> file that is created
-      when the <application>stunnel</application> daemon starts:</para>
-
-<screen role="root"><userinput>install -v -m750 -o stunnel -g stunnel -d /var/lib/stunnel/run &amp;&amp;
-chown stunnel:stunnel /var/lib/stunnel</userinput></screen>
-
-      <para>Next, create a basic <filename>/etc/stunnel/stunnel.conf</filename>
-      configuration file using the following commands as the
-      <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>cat &gt;/etc/stunnel/stunnel.conf &lt;&lt; "EOF" &amp;&amp;
-<literal>; File: /etc/stunnel/stunnel.conf
-
-; Note: The pid and output locations are relative to the chroot location.
-
-pid    = /run/stunnel.pid
-chroot = /var/lib/stunnel
-client = no
-setuid = stunnel
-setgid = stunnel
-cert   = /etc/stunnel/stunnel.pem
-
-;debug = 7
-;output = stunnel.log
-
-;[https]
-;accept  = 443
-;connect = 80
-;; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL
-;; Microsoft implementations do not use SSL close-notify alert and thus
-;; they are vulnerable to truncation attacks
-;TIMEOUTclose = 0</literal>
-
-EOF
-chmod -v 644 /etc/stunnel/stunnel.conf</userinput></screen>
-
-      <para>Finally, you need to add the service(s) you wish to encrypt to the
-      configuration file. The format is as follows:</para>
-
-<screen><literal>[<replaceable>&lt;service&gt;</replaceable>]
-accept  = <replaceable>&lt;hostname:portnumber&gt;</replaceable>
-connect = <replaceable>&lt;hostname:portnumber&gt;</replaceable></literal></screen>
-
-      <para>If you use <application>stunnel</application> to encrypt a daemon
-      started from <command>[x]inetd</command>, you may need to disable that
-      daemon in the <filename>/etc/[x]inetd.conf</filename> file and enable a
-      corresponding <replaceable>&lt;service&gt;</replaceable>_stunnel service. You
-      may have to add an appropriate entry in <filename>/etc/services</filename>
-      as well.</para>
-
-      <para>For a full explanation of the commands and syntax used in the
-      configuration file, run <command>man stunnel</command>.</para>
-
-    </sect3>
-
-    <sect3  id="stunnel-init">
-      <title>Boot Script</title>
-
-      <para>To automatically start the <command>stunnel</command> daemon
-      when the system is rebooted, install the
-      <filename>/etc/rc.d/init.d/stunnel</filename> bootscript from the
-      <xref linkend="bootscripts"/> package.</para>
-
-      <indexterm zone="stunnel stunnel-init">
-        <primary sortas="f-stunnel">stunnel</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-stunnel</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Library</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>stunnel and stunnel3</seg>
-        <seg>libstunnel.so</seg>
-        <seg>/etc/stunnel, 
-             /usr/lib/stunnel,
-             /usr/share/doc/stunnel-&stunnel-version;, and
-             /var/lib/stunnel</seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="stunnel-prog">
-        <term><command>stunnel</command></term>
-        <listitem>
-          <para> is a program designed to work as an SSL
-          encryption wrapper between remote clients and local
-          (<command>{x}inetd</command>-startable) or remote servers.</para>
-          <indexterm zone="stunnel stunnel-prog">
-            <primary sortas="b-stunnel">stunnel</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="stunnel3">
-        <term><command>stunnel3</command></term>
-        <listitem>
-          <para>is a <application>Perl</application> wrapper script to use
-          <command>stunnel</command> 3.x syntax with <command>stunnel</command>
-          >=4.05.</para>
-          <indexterm zone="stunnel stunnel3">
-            <primary sortas="b-stunnel3">stunnel3</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libstunnel">
-        <term><filename class='libraryfile'>libstunnel.so</filename></term>
-        <listitem>
-          <para> contains the API functions required by
-          <application>stunnel</application>.</para>
-          <indexterm zone="stunnel libstunnel">
-            <primary sortas="c-libstunnel">libstunnel.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
