Index: postlfs/security/mitkrb/mitkrb-config.xml
===================================================================
--- postlfs/security/mitkrb/mitkrb-config.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb-config.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,267 @@
+<sect2>
+<title>Configuring Heimdal</title>
+
+<sect3><title>Config files</title>
+<para><filename>/etc/krb5.conf</filename> and
+<filename>/var/lib/krb5kdc/kdc.conf</filename></para>
+</sect3>
+
+<sect3><title>Configuration Information</title>
+
+<sect4><title>Kerberos Configuration</title>
+
+<para>
+Create the Kerberos configuration file with the following command:
+</para>
+
+<screen><userinput><command>cat &gt; /etc/krb5.conf &lt;&lt; "EOF"</command>
+# Begin /etc/heimdal/krb5.conf
+        
+[libdefaults]
+    default_realm = <replaceable>[LFS.ORG]</replaceable>
+    encrypt = true
+
+[realms]
+    <replaceable>[LFS.ORG]</replaceable> = {
+        kdc = <replaceable>[belgarath.lfs.org]</replaceable>
+        admin_server = <replaceable>[belgarath.lfs.org]</replaceable>
+    }
+
+[domain_realm]
+    .<replaceable>[lfs.org]</replaceable> = <replaceable>[LFS.ORG]</replaceable>
+
+[logging]
+    kdc = SYSLOG[:INFO[:AUTH]]
+    admin_server = SYSLOG[INFO[:AUTH]]
+    default = SYSLOG[[:SYS]]
+
+# End /etc/heimdal/krb5.conf
+<command>EOF</command></userinput></screen>
+
+<para>
+You will need to substitute your domain and proper hostname for the
+occurances of the belgarath and lfs.org names.
+</para>
+
+<para>
+<userinput>default_realm</userinput> should be the name of your domain changed to ALL CAPS.
+This isn't required, but both Heimdal and <acronym>MIT</acronym>
+recommend it.
+</para>
+
+<para>
+<userinput>encrypt = true</userinput> provides encryption of all traffic between kerberized
+clients and servers. It's not necessary and can be left off. If you
+leave it off, you can encrypt all traffic from the client to the server
+using a switch on the client program instead.
+</para>
+
+<para>
+The <userinput>[realms]</userinput> parameters tell the client programs where to look for the
+<acronym>KDC</acronym> authentication services.
+</para>
+
+<para>
+The <userinput>[domain_realm]</userinput> section maps a domain to a realm.
+</para>
+
+<para>
+Create the <acronym>KDC</acronym> database:
+</para>
+
+<screen><userinput><command>kdb5_util create -r <replaceable>[LFS.ORG]</replaceable> -s </command></userinput></screen>
+
+<para>
+Now we need to populate the database with principles (users). For now,
+just use your regular login name or root. 
+</para>
+
+<screen><userinput><command>kadmin.local</command></userinput>
+<prompt>kadmin:</prompt><userinput><command>addprinc <replaceable>[loginname]</replaceable></command></userinput></screen>
+
+<para>
+The <acronym>KDC</acronym> server and any machine running kerberized
+server daemons must have a host key installed:
+</para>
+
+<screen><prompt>kadmin:</prompt><userinput><command>addprinc --random-key host/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
+
+<para>
+After choosing the defaults when prompted, you will have to export the
+data to a keytab file:
+</para>
+
+<screen><prompt>kadmin:</prompt><userinput><command>ktadd host/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
+
+<para>
+This should have created a file in
+<filename class="directory">/etc</filename> named
+<filename>krb5.keytab</filename> (Kerberos 5). This file should have 600
+(root rw only) permissions. Keeping the keytab files from public access
+is crucial to the overall security of the Kerberos installation.
+</para>
+
+<para>
+Eventually, you'll want to add server daemon principles to the database
+and extract them to the keytab file. You do this in the same way you
+created the host principles. Below is an example:
+</para>
+
+<screen><prompt>kadmin:</prompt><userinput><command>add --random-key ftp/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput>
+<prompt>kadmin:</prompt><userinput><command>ktadd ftp/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
+
+<para>
+Exit the <command>kadmin</command> program (use <command>quit</command>
+or <command>exit</command>) and return back to the shell prompt. Start
+the <acronym>KDC</acronym> daemon manually, just to test out the 
+installation:
+</para>
+
+<screen><userinput><command>/usr/sbin/krb5kdc &amp;</command></userinput></screen>
+
+<para>
+Attempt to get a ticket with the following command:
+</para>
+
+<screen><userinput><command>kinit <replaceable>[loginname]</replaceable></command></userinput></screen>
+
+<para>
+You will be prompted for the password you created. After you get your
+ticket, you can list it with the following command:
+</para>
+
+<screen><userinput><command>klist</command></userinput></screen>
+
+<para>
+Information about the ticket should be displayed on the screen.
+</para>
+
+<para>
+To test the functionality of the keytab file, issue the following
+command:
+</para>
+
+<screen><userinput><command>ktutil</command></userinput>
+<prompt>ktutil:</prompt><userinput>rkt /etc/krb5.keytab</userinput>
+<prompt>ktutil:</prompt><userinput>l</userinput></screen>
+
+<para>
+This should dump a list of the host principal, along with the encryption
+methods used to access the principal.
+</para>
+
+<para>
+At this point, if everything has been successful so far, you can feel
+fairly confident in the installation and configuration of the package.
+</para>
+
+<!---
+<para>Install <filename>/etc/rc.d/init.d/kerberos</filename> init script
+included in the <xref linkend="intro-important-bootscripts"/>
+package.</para>
+
+<screen><userinput><command>make install-heimdal</command></userinput></screen>
+-->
+
+<para>
+To automate the running of Kerberos server, use the following command to create
+the init.d script:
+</para>
+
+<screen><userinput><command>cat &gt;etc/rc.d/init.d/kerberos &lt;&lt; "EOF"</command>
+#!/bin/sh
+# Begin $rc_base/init.d/kerberos
+
+# Based on sysklogd script from LFS-3.1 and earlier.
+# Rewritten by Gerard Beekmans  - gerard@linuxfromscratch.org
+
+. /etc/sysconfig/rc
+. $rc_functions
+
+case "$1" in
+        start)  
+                echo "Starting Kerberos Authentication..."
+                loadproc krb5kdc
+                echo "Starting Kerberos Admin Daemon..."
+                loadproc kadmind
+                ;;
+
+        stop)
+                echo "Stopping Kerberos Authentication..."
+                killproc krb5kdc
+                echo "Stopping Kerberos Admin Daemon..."
+                killproc kadmind
+                ;;
+
+        reload)
+                echo "Reloading Kerberos Authentication..."
+                reloadproc krb5kdc
+                echo "Reloading Kerberos Admin Daemon..."
+                reloadproc kadmind
+                ;;
+
+        restart)
+                $0 stop
+                sleep 1
+                $0 start
+                ;;
+
+        status)
+                statusproc
+                ;;
+
+        *)
+                echo "Usage: $0 {start|stop|reload|restart|status}"
+                exit 1
+                ;;
+esac
+
+# End $rc_base/init.d/kerberos
+<command>EOF
+chmod 754 /etc/rc.d/init.d/kerberos</command></userinput></screen>
+
+<para>
+Create the symbolic links to this file in the relevant <filename
+class="directory">rc.d</filename> directory with the following commands:
+</para>
+
+<screen><userinput><command>cd /etc/rc.d/init.d &amp;&amp;
+ln -sf ../init.d/kerberos ../rc0.d/K42kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc1.d/K42kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc2.d/K42kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc3.d/S28kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc4.d/S28kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc5.d/S28kerberos &amp;&amp;
+ln -sf ../init.d/kerberos ../rc6.d/K42kerberos</command></userinput></screen>
+
+</sect4>
+
+<sect4><title>Using Kerberized Client Programs</title>
+
+<para>
+To use the kerberized client programs (<command>telnet</command>,
+<command>ftp</command>, <command>rsh</command>,
+<command>rcp</command>, <command>rlogin</command>), you first must get
+an authentication ticket. Use the <command>kinit</command> program to
+get the ticket. After you've acquired the ticket, you can use the
+kerberized programs to connect to any kerberized server on the network.
+You will not be prompted for authentication until your ticket expires
+(default is one day), unless you specify a different user as a command
+line argument to the program.
+</para>
+
+<para>
+The kerberized programs will connect to non kerberized daemons, warning
+you that authentication is not encrypted.</para>
+
+<para>
+For additional information consult <ulink
+url="http://web.mit.edu/kerberos/www/krb5-1.3/#documentation">Documentation
+for krb-&mitkrb-version;</ulink> on which the above instructions are based.
+</para>
+
+</sect4>
+
+</sect3>
+
+</sect2>
Index: postlfs/security/mitkrb/mitkrb-desc.xml
===================================================================
--- postlfs/security/mitkrb/mitkrb-desc.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb-desc.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,139 @@
+<sect2>
+<title>Contents</title>
+
+<para>The <application>MIT krb5</application> package contains
+<command>compile-et</command>,
+<command>ftp</command>,
+<command>ftpd</command>,
+<command>gss-client</command>,
+<command>gss-server</command>,
+<command>k5srvutil</command>,
+<command>kadmin</command>,
+<command>kadmin.local</command>,
+<command>kadmind</command>,
+<command>kadmind4</command>,
+<command>kdb5_util</command>
+<command>kdestroy</command>,
+<command>kinit</command>,
+<command>klist</command>,
+<command>klogin</command>,
+<command>klogind</command>,
+<command>kpasswd</command>,
+<command>kpasswdd</command>,
+<command>kprop</command>,
+<command>kpropd</command>,
+<command>krb5-send-pr</command>,
+<command>krb5-config</command>,
+<command>krb524d</command>,
+<command>krb524init</command>,
+<command>krb5kdc</command>,
+<command>kshd</command>,
+<command>ksu</command>,
+<command>ktutil</command>,
+<command>kvno</command>,
+<command>login.krb5</command>,
+<command>rcp</command>,
+<command>rlogin</command>,
+<command>rsh</command>,
+<command>rshd</command>,
+<command>rxtelnet</command>,
+<command>rxterm</command>,
+<command>sclient</command>,
+<command>sim_client</command>,
+<command>sim_server</command>,
+<command>sserver</command>,
+<command>telnet</command>,
+<command>telnetd</command>,
+<command>uuclient</command>,
+<command>uuserver</command>,
+<command>v5passwd</command>,
+<command>v5passwdd</command>,
+<filename class="libraryfile">libcom_err</filename>,
+<filename class="libraryfile">libdes425</filename>,
+<filename class="libraryfile">libgssapi</filename>,
+<filename class="libraryfile">libgssrpc</filename>,
+<filename class="libraryfile">lib5crypto</filename>,
+<filename class="libraryfile">libkadm5clnt</filename>,
+<filename class="libraryfile">libkadm5srv</filename>,
+<filename class="libraryfile">libkdb5</filename>,
+<filename class="libraryfile">libkrb4</filename>,
+<filename class="libraryfile">libkrb5</filename>.</para>
+
+</sect2>
+
+<sect2><title>Description</title>
+
+<sect3><title>compile_et</title>
+<para><command>compile_et</command></para></sect3>
+
+<sect3><title>k5srvutil</title>
+<para><command>k5srvutil</command> </para></sect3>
+
+<sect3><title>kadmin</title>
+<para><command>kadmin</command> is an utility used to make modifications
+to the Kerberos database.</para></sect3>
+
+<sect3><title>kadmind</title>
+<para><command>kadmind</command> is a server for administrative access
+to Kerberos database.</para></sect3>
+
+<sect3><title>kinit</title>
+<para><command>kinit</command> is used to
+authenticate to the Kerberos server as principal and acquire a ticket
+granting ticket that can later be used to obtain tickets for other
+services.</para></sect3>
+
+<sect3><title>krb5kdc</title>
+<para><command>kdc</command> is a Kerberos 5 server.</para></sect3>
+
+<sect3><title>kdestroy</title>
+<para><command>kdestroy</command> removes the current set of
+tickets.</para></sect3>
+
+<sect3><title>kdb5_util</title>
+<para><command>kdb5_util</command> </para></sect3>
+
+<sect3><title>klist</title>
+<para><command>klist</command> reads and displays the current tickets in
+the credential cache.</para></sect3>
+
+<sect3><title>klogin</title>
+<para><command>klogin</command></para></sect3>
+
+<sect3><title>klogind</title>
+<para><command>klogind</command></para></sect3>
+
+<sect3><title>kpasswd</title>
+<para><command>kpasswd</command> is a program for changing Kerberos 5
+passwords.</para></sect3>
+
+<sect3><title>kpasswdd</title>
+<para><command>kpasswdd</command> is a Kerberos 5 password changing
+server.</para></sect3>
+
+<sect3><title>kprop</title>
+<para><command>kprop</command> takes a principal database in a specified
+format and converts it into a stream of Heimdal database
+records.</para></sect3>
+
+<sect3><title>kpropd</title>
+<para><command>kpropd</command> receives a database sent by
+<command>hprop</command> and writes it as a local
+database.</para></sect3>
+
+<sect3><title>krb5-config</title>
+<para><command>krb5-config</command> gives information on how to link
+programs against libraries.</para></sect3>
+
+<sect3><title>kshd</title>
+<para><command>kshd</command> </para></sect3>
+
+<sect3><title>ktutil</title>
+<para><command>ktutil</command> is a program for managing Kerberos
+keytabs.</para></sect3>
+
+<sect3><title>kvno</title>
+<para><command>kvno</command> </para></sect3>
+
+
+</sect2>
Index: postlfs/security/mitkrb/mitkrb-exp.xml
===================================================================
--- postlfs/security/mitkrb/mitkrb-exp.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb-exp.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,29 @@
+<sect2>
+<title>Command explanations</title>
+
+<para><parameter>--enable-dns</parameter>: This switch allows realms to
+be resolved using the <acronym>DNS</acronym> server.</para>
+
+<para><screen><command>mv /bin/login /bin/login.shadow
+mv /usr/sbin/login.krb5 /bin/login
+mv /usr/bin/ksu /bin</command></screen>
+Preserves <application>Shadow</application>'s <command>login</command>
+command, moves <command>ksu</command> and <command>login</command> to
+the <filename class="directory">/bin</filename> directory.</para>
+
+<para><screen><command>mv /usr/lib/libkrb5.so.3* /lib
+mv /usr/lib/libkrb4.so.2* /lib
+mv /usr/lib/libdes425.so.3* /lib
+mv /usr/lib/libk5crypto.so.3* /lib
+mv /usr/lib/libcom_err.so.3* /lib
+ln -sf ../../lib/libkrb5.so /usr/lib
+ln -sf ../../lib/libkrb4.so /usr/lib
+ln -sf ../../lib/libdes425.so /usr/lib
+ln -sf ../../lib/libk5crypto.so /usr/lib
+ln -sf ../../lib/libcom_err.so /usr/lib</command></screen>
+The <command>login</command> and <command>ksu</command> programs
+are linked against these libraries. We move these libraries to <filename
+class="directory">/lib</filename> to allow logins without mounting <filename
+class="directory">/usr</filename>.</para>
+
+</sect2>
Index: postlfs/security/mitkrb/mitkrb-inst.xml
===================================================================
--- postlfs/security/mitkrb/mitkrb-inst.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb-inst.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,25 @@
+<sect2>
+<title>Installation of <application>MIT krb5</application></title>
+
+<para>Install <application>MIT krb5</application> by running the following commands:</para>
+
+<screen><userinput><command>./configure --prefix=/usr --sysconfdir=/etc \
+    --localstatedir=/var/lib --enable-dns --enable-shared --mandir=/usr/share/man &amp;&amp;
+make &amp;&amp;
+make install &amp;&amp;
+mv /bin/login /bin/login.shadow &amp;&amp;
+mv /usr/sbin/login.krb5 /bin/login &amp;&amp;
+mv /usr/bin/ksu /bin &amp;&amp;
+mv /usr/lib/libkrb5.so.3* /lib &amp;&amp;
+mv /usr/lib/libkrb4.so.2* /lib &amp;&amp;
+mv /usr/lib/libdes425.so.3* /lib &amp;&amp;
+mv /usr/lib/libk5crypto.so.3* /lib &amp;&amp;
+mv /usr/lib/libcom_err.so.3* /lib &amp;&amp;
+ln -sf ../../lib/libkrb5.so /usr/lib &amp;&amp;
+ln -sf ../../lib/libkrb4.so /usr/lib &amp;&amp;
+ln -sf ../../lib/libdes425.so /usr/lib &amp;&amp;
+ln -sf ../../lib/libk5crypto.so /usr/lib &amp;&amp;
+ln -sf ../../lib/libcom_err.so /usr/lib &amp;&amp;
+ldconfig</command></userinput></screen>
+
+</sect2>
Index: postlfs/security/mitkrb/mitkrb-intro.xml
===================================================================
--- postlfs/security/mitkrb/mitkrb-intro.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb-intro.xml	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,37 @@
+<sect2>
+<title>Introduction to <application>MIT krb5</application></title>
+
+<para>
+<application>MIT krb5</application> is a free implementation of Kerberos
+5. Kerberos is a network authentication protocol. It centralizes the
+authentication database and uses kerberized applications to work with 
+servers or services that support Kerberos allowing single logins and
+encrypted communication over internal networks or the Internet.</para>
+
+<sect3><title>Package information</title>
+<itemizedlist spacing='compact'>
+<listitem><para>Download (HTTP): <ulink url="&mitkrb-download-http;"/></para></listitem>
+<listitem><para>Download (FTP): <ulink url="&mitkrb-download-ftp;"/></para></listitem>
+<listitem><para>Download size: &mitkrb-size;</para></listitem>
+<listitem><para>Estimated Disk space required: &mitkrb-buildsize;</para></listitem>
+<listitem><para>Estimated build time: &mitkrb-time;</para></listitem></itemizedlist>
+</sect3>
+
+<sect3><title><application>MIT krb5</application> dependencies</title>
+<sect4><title>Optional</title>
+<para>
+<xref linkend="Linux_PAM"/>,
+<xref linkend="openldap"/> and
+<ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink>
+</para>
+
+<note><para>
+Some sort of time synchronization facility on your system (like <xref
+linkend="ntp"/>) is required since Kerberos won't authenticate if there
+is a time difference between a kerberized client and the
+<acronym>KDC</acronym> server.</para></note> 
+</sect4>
+
+</sect3>
+
+</sect2>
Index: postlfs/security/mitkrb/mitkrb.ent
===================================================================
--- postlfs/security/mitkrb/mitkrb.ent	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
+++ postlfs/security/mitkrb/mitkrb.ent	(revision 1dce14330daac084f55169b47a2591b90aaae6f9)
@@ -0,0 +1,12 @@
+<!ENTITY mitkrb SYSTEM "../mitkrb.xml">
+<!ENTITY mitkrb-intro SYSTEM "mitkrb-intro.xml">
+<!ENTITY mitkrb-inst SYSTEM "mitkrb-inst.xml">
+<!ENTITY mitkrb-exp SYSTEM "mitkrb-exp.xml">
+<!ENTITY mitkrb-config SYSTEM "mitkrb-config.xml">
+<!ENTITY mitkrb-desc SYSTEM "mitkrb-desc.xml">
+<!ENTITY mitkrb-version "1.3.3">
+<!ENTITY mitkrb-download-http "http://web.mit.edu/kerberos/www/krb5/1.3/krb5-&mitkrb-version;.tar">
+<!ENTITY mitkrb-download-ftp "">
+<!ENTITY mitkrb-size "6.2 MB">
+<!ENTITY mitkrb-buildsize "137.4 MB">
+<!ENTITY mitkrb-time "2.55 SBU">
