Index: TODO
===================================================================
--- TODO	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ TODO	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -1,5 +1,4 @@
 gpm
 svn server
-sendmail
 iptables
 wpa_supplicant
Index: postlfs/security/firewalling-systemd.xml
===================================================================
--- postlfs/security/firewalling-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
+++ postlfs/security/firewalling-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -0,0 +1,587 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+]>
+
+<sect1 id="fw-firewall" xreflabel="Firewalling">
+  <?dbhtml filename="firewall.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Setting Up a Network Firewall</title>
+
+  <para>Before you read this part of the chapter, you should have
+  already installed iptables as described in the previous section.</para>
+
+  <sect2 id="fw-intro" xreflabel="Firewalling Introduction">
+    <title>Introduction to Firewall Creation</title>
+
+    <para>The general purpose of a firewall is to protect a computer or
+    a network against malicious access.</para>
+
+    <para>In a perfect world, every daemon or service on every machine
+    is perfectly configured and immune to flaws such as buffer overflows
+    or other problems regarding its security. Furthermore, you trust
+    every user accessing your services. In this world, you do not need
+    to have a firewall.</para>
+
+    <para>In the real world however, daemons may be misconfigured and
+    exploits against essential services are freely available. You may
+    wish to choose which services are accessible by certain machines or
+    you may wish to limit which machines or applications are allowed
+    external access. Alternatively, you may simply not trust some of
+    your applications or users. You are probably connected to the
+    Internet. In this world, a firewall is essential.</para>
+
+    <para>Don't assume however, that having a firewall makes careful
+    configuration redundant, or that it makes any negligent
+    misconfiguration harmless. It doesn't prevent anyone from exploiting
+    a service you intentionally offer but haven't recently updated or
+    patched after an exploit went public.  Despite having a firewall, you
+    need to keep applications and daemons on your system properly
+    configured and up to date.  A firewall is not a cure all, but should
+    be an essential part of your overall security strategy.</para>
+
+  </sect2>
+
+  <sect2>
+    <title>Meaning of the Word "Firewall"</title>
+
+    <para>The word firewall can have several different meanings.</para>
+
+    <sect3>
+      <title><xref linkend="fw-persFw"/></title>
+
+      <para>This is a hardware device or software program commercially sold (or
+      offered via freeware) by companies such as Symantec which claims that
+      it secures a home or desktop computer connected to the Internet. This
+      type of firewall is highly relevant for users who do not know how their
+      computers might be accessed via the Internet or how to disable
+      that access, especially if they are always online and connected
+      via broadband links.</para>
+
+    </sect3>
+
+    <sect3>
+      <title><xref linkend="fw-masqRouter"/></title>
+
+      <para>This is a system placed between the Internet and an intranet.
+      To minimize the risk of compromising the firewall itself, it should
+      generally have only one role&mdash;that of protecting the intranet.
+      Although not completely risk free, the tasks of doing the routing and
+      IP masquerading (rewriting IP headers of the packets it routes from
+      clients with private IP addresses onto the Internet so that they seem
+      to come from the firewall itself) are commonly considered relatively
+      secure.</para>
+
+    </sect3>
+
+    <sect3>
+      <title><xref linkend="fw-busybox"/></title>
+
+      <para>This is often an old computer you may have retired and nearly
+      forgotten, performing masquerading or routing functions, but offering
+      non-firewall services such as a web-cache or mail.  This may be used
+      for home networks, but is not to be considered as secure as a firewall
+      only machine because the combination of server and router/firewall on
+      one machine raises the complexity of the setup.</para>
+
+    </sect3>
+
+    <sect3>
+      <title>Firewall with a Demilitarized Zone [Not Further
+      Described Here]</title>
+
+      <para>This box performs masquerading or routing, but grants public
+      access to some branch of your network which, because of public IPs
+      and a physically separated structure, is essentially a separate
+      network with direct Internet access. The servers on this network are
+      those which must be easily accessible from both the Internet and
+      intranet. The firewall protects both networks. This type of firewall
+      has a minimum of three network interfaces.</para>
+
+    </sect3>
+
+    <sect3>
+      <title>Packetfilter</title>
+
+      <para>This type of firewall does routing or masquerading, but does
+      not maintain a state table of ongoing communication streams. It is
+      fast, but quite limited in its ability to block undesired packets
+      without blocking desired packets.</para>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 id="fw-writing" xreflabel="writing the firewalling-setup-scripts">
+    <title>Now You Can Start to Build your Firewall</title>
+
+    <caution>
+      <para>This introduction on how to setup a firewall is not a
+      complete guide to securing systems. Firewalling is a complex
+      issue that requires careful configuration. The scripts quoted
+      here are simply intended to give examples of how a firewall
+      works. They are not intended to fit into any particular
+      configuration and may not provide complete protection from
+      an attack.</para>
+
+      <para>Customization of these scripts for your specific situation
+      will be necessary for an optimal configuration, but you should
+      make a serious study of the iptables documentation and creating
+      firewalls in general before hacking away. Have a look at the
+      list of <xref linkend="fw-library"/> at the end of this section for
+      more details. There you will find a list of URLs that contain quite
+      comprehensive information about building your own firewall.</para>
+    </caution>
+
+    <para>The main startup firewall is located in the file
+    <filename>/etc/systemd/scripts/iptables</filename>. The sections below provide
+    three different approaches that can be used for a system.</para>
+
+    <note>
+      <para>You should always run your firewall rules from a script.
+      This ensures consistency and a record of what was done. It also
+      allows retention of comments that are essential for understanding
+      the rules long after they were written.</para>
+    </note>
+
+    <sect3 id="fw-persFw" xreflabel="Personal Firewall">
+      <title>Personal Firewall</title>
+
+      <para>A Personal Firewall is designed to let you access all the
+      services offered on the Internet, but keep your box secure and
+      your data private.</para>
+
+      <para>Below is a slightly modified version of Rusty Russell's
+      recommendation from the <ulink
+      url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
+      Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
+      to the Linux 2.6 kernels.</para>
+
+<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+# Insert connection-tracking modules
+# (not needed if built into the kernel)
+modprobe nf_conntrack
+modprobe xt_LOG
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
+
+# Do not send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface, where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
+
+# be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# disable Explicit Congestion Notification
+# too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local-only connections
+iptables -A INPUT  -i lo -j ACCEPT
+
+# Free output on any interface to any ip for any service
+# (equal to -P ACCEPT)
+iptables -A OUTPUT -j ACCEPT
+
+# Permit answers on already established connections
+# and permit new connections related to established ones
+# (e.g. port mode ftp)
+iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Log everything else. What's Windows' latest exploitable vulnerability?
+iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
+
+      <para>This script is quite simple, it drops all traffic coming
+      into your computer that wasn't initiated from your computer, but
+      as long as you are simply surfing the Internet you are unlikely
+      to exceed its limits.</para>
+
+      <para>If you frequently encounter certain delays at accessing
+      FTP servers, take a look at <xref linkend="fw-BB-4"/>.</para>
+
+      <para>Even if you have daemons or services running on your system,
+      these will be inaccessible everywhere but from your computer itself.
+      If you want to allow access to services on your machine, such as
+      <command>ssh</command> or <command>ping</command>, take a look at
+      <xref linkend="fw-busybox"/>.</para>
+
+    </sect3>
+
+    <sect3 id="fw-masqRouter" xreflabel="Masquerading Router">
+      <title>Masquerading Router</title>
+
+      <para>A true Firewall has two interfaces, one connected to an
+      intranet, in this example <emphasis role="strong">eth0</emphasis>,
+      and one connected to the Internet, here <emphasis
+      role="strong">ppp0</emphasis>. To provide the maximum security
+      for the firewall itself, make sure that there are no unnecessary
+      servers running on it such as <application>X11</application> et
+      al. As a general principle, the firewall itself should not access
+      any untrusted service (think of a remote server giving answers that
+      makes a daemon on your system crash, or even worse, that implements
+      a worm via a buffer-overflow).</para>
+
+<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+echo
+echo "You're using the example configuration for a setup of a firewall"
+echo "from Beyond Linux From Scratch."
+echo "This example is far from being complete, it is only meant"
+echo "to be a reference."
+echo "Firewall security is a complex issue, that exceeds the scope"
+echo "of the configuration rules below."
+echo "You can find additional information"
+echo "about firewalls in Chapter 4 of the BLFS book."
+echo "http://www.&lfs-domainname;/blfs"
+echo
+
+# Insert iptables modules (not needed if built into the kernel).
+
+modprobe nf_conntrack
+modprobe nf_conntrack_ftp
+modprobe xt_conntrack
+modprobe xt_LOG
+modprobe xt_state
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
+
+# Don't send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+
+# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# Disable Explicit Congestion Notification
+# Too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local connections
+iptables -A INPUT  -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+
+# Allow forwarding if the initiated on the intranet
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD  -i ! ppp+ -m conntrack --ctstate NEW      -j ACCEPT
+
+# Do masquerading
+# (not needed if intranet is not using private ip-addresses)
+iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
+
+# Log everything for debugging
+# (last of all rules, but before policy rules)
+iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
+iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
+iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
+
+# Enable IP Forwarding
+echo 1 &gt; /proc/sys/net/ipv4/ip_forward
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
+
+      <para>With this script your intranet should be reasonably secure
+      against external attacks. No one should be able to setup a new
+      connection to any internal service and, if it's masqueraded,
+      makes your intranet invisible to the Internet. Furthermore, your
+      firewall should be relatively safe because there are no services
+      running that a cracker could attack.</para>
+
+      <note>
+        <para>If the interface you're connecting to the Internet
+        doesn't connect via PPP, you will need to change
+        <replaceable>&lt;ppp+&gt;</replaceable> to the name of the interface
+        (e.g., <emphasis role="strong">eth1</emphasis>) which you are
+        using.</para>
+      </note>
+
+    </sect3>
+
+    <sect3 id="fw-busybox" xreflabel="BusyBox">
+      <title>BusyBox</title>
+
+      <para>This scenario isn't too different from the <xref
+      linkend="fw-masqRouter"/>, but additionally offers some
+      services to your intranet. Examples of this can be when
+      you want to administer your firewall from another host on
+      your intranet or use it as a proxy or a name server.</para>
+
+      <note>
+        <para>Outlining a true concept of how to protect a server that
+        offers services on the Internet goes far beyond the scope of
+        this document. See the references at the end of this section
+        for more information.</para>
+      </note>
+
+      <para>Be cautious. Every service you have enabled makes your
+      setup more complex and your firewall less secure. You are
+      exposed to the risks of misconfigured services or running
+      a service with an exploitable bug. A firewall should generally
+      not run any extra services.  See the introduction to the
+      <xref linkend="fw-masqRouter"/> for some more details.</para>
+
+      <para>If you want to add services such as internal Samba or
+      name servers that do not need to access the Internet themselves,
+      the additional statements are quite simple and should still be
+      acceptable from a security standpoint. Just add the following lines
+      into the script <emphasis>before</emphasis> the logging rules.</para>
+
+<screen><literal>iptables -A INPUT  -i ! ppp+  -j ACCEPT
+iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
+
+      <para>If daemons, such as squid, have to access the Internet
+      themselves, you could open OUTPUT generally and restrict
+      INPUT.</para>
+
+<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A OUTPUT -j ACCEPT</literal></screen>
+
+      <para>However, it is generally not advisable to leave OUTPUT
+      unrestricted. You lose any control over trojans who would like
+      to "call home", and a bit of redundancy in case you've
+      (mis-)configured a service so that it broadcasts its existence
+      to the world.</para>
+
+      <para>To accomplish this, you should restrict INPUT and OUTPUT
+      on all ports except those that it's absolutely necessary to have
+      open. Which ports you have to open depends on your needs: mostly
+      you will find them by looking for failed accesses in your log
+      files.</para>
+
+      <itemizedlist spacing="compact" role='iptables'>
+        <title>Have a Look at the Following Examples:</title>
+        <listitem>
+          <para>Squid is caching the web:</para>
+
+<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
+  -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>Your caching name server (e.g., named) does its
+          lookups via UDP:</para>
+
+<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>You want to be able to ping your computer to
+          ensure it's still alive:</para>
+
+<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
+iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para id='fw-BB-4' xreflabel="BusyBox example number 4">If
+          you are frequently accessing FTP servers or enjoy chatting, you might
+          notice certain delays because some implementations of these daemons
+          have the feature of querying an identd on your system to obtain
+          usernames. Although there's really little harm in this, having an
+          identd running is not recommended because many security experts feel
+          the service gives out too much additional information.</para>
+
+          <para>To avoid these delays you could reject the requests
+          with a 'tcp-reset':</para>
+
+<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>To log and drop invalid packets (packets
+          that came in after netfilter's timeout or some types of
+          network scans) insert these rules at the top of the chain:</para>
+
+<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
+  -j LOG --log-prefix "FIREWALL:INVALID "
+iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>Anything coming from the outside should not have a
+          private address, this is a common attack called IP-spoofing:</para>
+
+<screen><literal>iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
+iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
+iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
+
+          <para>There are other addresses that you may also want to
+          drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
+          experimental), 169.254.0.0/16 (Link Local Networks), and
+          192.0.2.0/24 (IANA defined test network).</para>
+        </listitem>
+        <listitem>
+          <para>If your firewall is a DHCP client, you need to allow
+          those packets:</para>
+
+<screen><literal>iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
+   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
+
+        </listitem>
+        <listitem>
+          <para>To simplify debugging and be fair to anyone who'd like
+          to access a service you have disabled, purposely or by mistake,
+          you could REJECT those packets that are dropped.</para>
+
+          <para>Obviously this must be done directly after logging as the very
+          last lines before the packets are dropped by policy:</para>
+
+<screen><literal>iptables -A INPUT -j REJECT</literal></screen>
+
+        </listitem>
+      </itemizedlist>
+
+      <para>These are only examples to show you some of the capabilities
+      of the firewall code in Linux. Have a look at the man page of iptables.
+      There you will find much more information. The port numbers needed for
+      this can be found in <filename>/etc/services</filename>, in case you
+      didn't find them by trial and error in your log file.</para>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 id="fw-finale" xreflabel="Conclusion">
+    <title>Conclusion</title>
+
+    <para>Finally, there is one fact you must not forget: The effort spent
+    attacking a system corresponds to the value the cracker expects to gain
+    from it. If you are responsible for valuable information, you need to
+    spend the time to protect it properly.</para>
+
+  </sect2>
+
+  <sect2 id="postlfs-security-fw-extra" xreflabel="Extra Information">
+    <title>Extra Information</title>
+
+    <sect3 id="fw-library" xreflabel="links for further reading">
+      <title>Where to Start with Further Reading on Firewalls</title>
+
+      <blockquote>
+        <literallayout>
+<ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables project</ulink>
+<ulink url="http://www.netfilter.org/documentation/FAQ/netfilter-faq.html">Netfilter related FAQ</ulink>
+<ulink url="http://www.netfilter.org/documentation/index.html#HOWTO">Netfilter related HOWTO's</ulink>
+<ulink url="http://en.tldp.org/LDP/nag2/x-087-2-firewall.html">en.tldp.org/LDP/nag2/x-087-2-firewall.html</ulink>
+<ulink url="http://en.tldp.org/HOWTO/Security-HOWTO.html">en.tldp.org/HOWTO/Security-HOWTO.html</ulink>
+<ulink url="http://en.tldp.org/HOWTO/Firewall-HOWTO.html">en.tldp.org/HOWTO/Firewall-HOWTO.html</ulink>
+<ulink url="http://www.linuxsecurity.com/docs/">www.linuxsecurity.com/docs/</ulink>
+<ulink url="http://www.little-idiot.de/firewall">www.little-idiot.de/firewall (German &amp; outdated, but very comprehensive)</ulink>
+<ulink url="http://linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html">linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html</ulink>
+<ulink url="http://staff.washington.edu/dittrich/misc/ddos">staff.washington.edu/dittrich/misc/ddos</ulink>
+<ulink url="http://www.e-infomax.com/ipmasq">www.e-infomax.com/ipmasq</ulink>
+<ulink url="http://www.circlemud.org/~jelson/writings/security/index.htm">www.circlemud.org/~jelson/writings/security/index.htm</ulink>
+<ulink url="http://www.securityfocus.com">www.securityfocus.com</ulink>
+<ulink url="http://www.cert.org/tech_tips/">www.cert.org - tech_tips</ulink>
+<ulink url="http://security.ittoolbox.com/">security.ittoolbox.com</ulink>
+<ulink url="http://www.insecure.org/reading.html">www.insecure.org/reading.html</ulink>
+        </literallayout>
+      </blockquote>
+
+      <!-- The following are all dead links from the section above. They are
+           moved out of the section so the literallayout won't produce blank
+           lines in the rendered text
+
+<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire.html">www.ibm.com/developerworks/security/library/s-fire.html</ulink>
+<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire2.html">www.ibm.com/developerworks/security/library/s-fire2.html</ulink>
+<ulink url="http://www.interhack.net/pubs/fw-faq/">www.interhack.net/pubs/fw-faq/</ulink>
+<ulink url="http://www.linuxgazette.com/issue65/stumpel.html">www.linuxgazette.com/issue65/stumpel.html</ulink>
+<ulink url="http://www.linux-firewall-tools.com/linux/">www.linux-firewall-tools.com/linux/</ulink>
+<ulink url="http://logi.cc/linux/athome-firewall.php3">logi.cc/linux/athome-firewall.php3</ulink>
+<ulink url="http://www.robertgraham.com/pubs/firewall-seen.html">www.robertgraham.com/pubs/firewall-seen.html</ulink>
+
+      -->
+
+    </sect3>
+
+  </sect2>
+
+</sect1>
Index: stlfs/security/firewalling.xml
===================================================================
--- postlfs/security/firewalling.xml	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,594 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-]>
-
-<sect1 id="fw-firewall" xreflabel="Firewalling">
-  <?dbhtml filename="firewall.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Setting Up a Network Firewall</title>
-
-  <para>Before you read this part of the chapter, you should have
-  already installed iptables as described in the previous section.</para>
-
-  <sect2 id="fw-intro" xreflabel="Firewalling Introduction">
-    <title>Introduction to Firewall Creation</title>
-
-    <para>The general purpose of a firewall is to protect a computer or
-    a network against malicious access.</para>
-
-    <para>In a perfect world, every daemon or service on every machine
-    is perfectly configured and immune to flaws such as buffer overflows
-    or other problems regarding its security. Furthermore, you trust
-    every user accessing your services. In this world, you do not need
-    to have a firewall.</para>
-
-    <para>In the real world however, daemons may be misconfigured and
-    exploits against essential services are freely available. You may
-    wish to choose which services are accessible by certain machines or
-    you may wish to limit which machines or applications are allowed
-    external access. Alternatively, you may simply not trust some of
-    your applications or users. You are probably connected to the
-    Internet. In this world, a firewall is essential.</para>
-
-    <para>Don't assume however, that having a firewall makes careful
-    configuration redundant, or that it makes any negligent
-    misconfiguration harmless. It doesn't prevent anyone from exploiting
-    a service you intentionally offer but haven't recently updated or
-    patched after an exploit went public.  Despite having a firewall, you
-    need to keep applications and daemons on your system properly
-    configured and up to date.  A firewall is not a cure all, but should
-    be an essential part of your overall security strategy.</para>
-
-  </sect2>
-
-  <sect2>
-    <title>Meaning of the Word "Firewall"</title>
-
-    <para>The word firewall can have several different meanings.</para>
-
-    <sect3>
-      <title><xref linkend="fw-persFw"/></title>
-
-      <para>This is a hardware device or software program commercially sold (or
-      offered via freeware) by companies such as Symantec which claims that
-      it secures a home or desktop computer connected to the Internet. This
-      type of firewall is highly relevant for users who do not know how their
-      computers might be accessed via the Internet or how to disable
-      that access, especially if they are always online and connected
-      via broadband links.</para>
-
-    </sect3>
-
-    <sect3>
-      <title><xref linkend="fw-masqRouter"/></title>
-
-      <para>This is a system placed between the Internet and an intranet.
-      To minimize the risk of compromising the firewall itself, it should
-      generally have only one role&mdash;that of protecting the intranet.
-      Although not completely risk free, the tasks of doing the routing and
-      IP masquerading (rewriting IP headers of the packets it routes from
-      clients with private IP addresses onto the Internet so that they seem
-      to come from the firewall itself) are commonly considered relatively
-      secure.</para>
-
-    </sect3>
-
-    <sect3>
-      <title><xref linkend="fw-busybox"/></title>
-
-      <para>This is often an old computer you may have retired and nearly
-      forgotten, performing masquerading or routing functions, but offering
-      non-firewall services such as a web-cache or mail.  This may be used
-      for home networks, but is not to be considered as secure as a firewall
-      only machine because the combination of server and router/firewall on
-      one machine raises the complexity of the setup.</para>
-
-    </sect3>
-
-    <sect3>
-      <title>Firewall with a Demilitarized Zone [Not Further
-      Described Here]</title>
-
-      <para>This box performs masquerading or routing, but grants public
-      access to some branch of your network which, because of public IPs
-      and a physically separated structure, is essentially a separate
-      network with direct Internet access. The servers on this network are
-      those which must be easily accessible from both the Internet and
-      intranet. The firewall protects both networks. This type of firewall
-      has a minimum of three network interfaces.</para>
-
-    </sect3>
-
-    <sect3>
-      <title>Packetfilter</title>
-
-      <para>This type of firewall does routing or masquerading, but does
-      not maintain a state table of ongoing communication streams. It is
-      fast, but quite limited in its ability to block undesired packets
-      without blocking desired packets.</para>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 id="fw-writing" xreflabel="writing the firewalling-setup-scripts">
-    <title>Now You Can Start to Build your Firewall</title>
-
-    <caution>
-      <para>This introduction on how to setup a firewall is not a
-      complete guide to securing systems. Firewalling is a complex
-      issue that requires careful configuration. The scripts quoted
-      here are simply intended to give examples of how a firewall
-      works. They are not intended to fit into any particular
-      configuration and may not provide complete protection from
-      an attack.</para>
-
-      <para>Customization of these scripts for your specific situation
-      will be necessary for an optimal configuration, but you should
-      make a serious study of the iptables documentation and creating
-      firewalls in general before hacking away. Have a look at the
-      list of <xref linkend="fw-library"/> at the end of this section for
-      more details. There you will find a list of URLs that contain quite
-      comprehensive information about building your own firewall.</para>
-    </caution>
-
-    <para>The firewall configuration script installed in the iptables section
-    differs from the standard configuration script. It only has two of
-    the standard targets: start and status. The other targets are clear
-    and lock. For instance if you issue:</para>
-
-<screen role="root"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
-
-    <para>the firewall will be restarted just as it is upon system startup.
-    The status target will present a list of all currently implemented
-    rules. The clear target turns off all firewall rules and the lock
-    target will block all packets in and out of the computer with the
-    exception of the loopback interface.</para>
-
-    <para>The main startup firewall is located in the file
-    <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
-    three different approaches that can be used for a system.</para>
-
-    <note>
-      <para>You should always run your firewall rules from a script.
-      This ensures consistency and a record of what was done. It also
-      allows retention of comments that are essential for understanding
-      the rules long after they were written.</para>
-    </note>
-
-    <sect3 id="fw-persFw" xreflabel="Personal Firewall">
-      <title>Personal Firewall</title>
-
-      <para>A Personal Firewall is designed to let you access all the
-      services offered on the Internet, but keep your box secure and
-      your data private.</para>
-
-      <para>Below is a slightly modified version of Rusty Russell's
-      recommendation from the <ulink
-      url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
-      Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
-      to the Linux 2.6 kernels.</para>
-
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
-<literal>#!/bin/sh
-
-# Begin rc.iptables
-
-# Insert connection-tracking modules
-# (not needed if built into the kernel)
-modprobe nf_conntrack
-modprobe xt_LOG
-
-# Enable broadcast echo Protection
-echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
-
-# Disable Source Routed Packets
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
-
-# Enable TCP SYN Cookie Protection
-echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
-
-# Disable ICMP Redirect Acceptance
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
-
-# Do not send Redirect Messages
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
-
-# Drop Spoofed Packets coming in on an interface, where responses
-# would result in the reply going out a different interface.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
-
-# Log packets with impossible addresses.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
-
-# be verbose on dynamic ip-addresses  (not needed in case of static IP)
-echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
-
-# disable Explicit Congestion Notification
-# too many routers are still ignorant
-echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
-
-# Set a known state
-iptables -P INPUT   DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT  DROP
-
-# These lines are here in case rules are already in place and the
-# script is ever rerun on the fly. We want to remove all rules and
-# pre-existing user defined chains before we implement new rules.
-iptables -F
-iptables -X
-iptables -Z
-
-iptables -t nat -F
-
-# Allow local-only connections
-iptables -A INPUT  -i lo -j ACCEPT
-
-# Free output on any interface to any ip for any service
-# (equal to -P ACCEPT)
-iptables -A OUTPUT -j ACCEPT
-
-# Permit answers on already established connections
-# and permit new connections related to established ones
-# (e.g. port mode ftp)
-iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-
-# Log everything else. What's Windows' latest exploitable vulnerability?
-iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
-
-# End $rc_base/rc.iptables</literal>
-EOF
-chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
-
-      <para>This script is quite simple, it drops all traffic coming
-      into your computer that wasn't initiated from your computer, but
-      as long as you are simply surfing the Internet you are unlikely
-      to exceed its limits.</para>
-
-      <para>If you frequently encounter certain delays at accessing
-      FTP servers, take a look at <xref linkend="fw-BB-4"/>.</para>
-
-      <para>Even if you have daemons or services running on your system,
-      these will be inaccessible everywhere but from your computer itself.
-      If you want to allow access to services on your machine, such as
-      <command>ssh</command> or <command>ping</command>, take a look at
-      <xref linkend="fw-busybox"/>.</para>
-
-    </sect3>
-
-    <sect3 id="fw-masqRouter" xreflabel="Masquerading Router">
-      <title>Masquerading Router</title>
-
-      <para>A true Firewall has two interfaces, one connected to an
-      intranet, in this example <emphasis role="strong">eth0</emphasis>,
-      and one connected to the Internet, here <emphasis
-      role="strong">ppp0</emphasis>. To provide the maximum security
-      for the firewall itself, make sure that there are no unnecessary
-      servers running on it such as <application>X11</application> et
-      al. As a general principle, the firewall itself should not access
-      any untrusted service (think of a remote server giving answers that
-      makes a daemon on your system crash, or even worse, that implements
-      a worm via a buffer-overflow).</para>
-
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
-<literal>#!/bin/sh
-
-# Begin rc.iptables
-
-echo
-echo "You're using the example configuration for a setup of a firewall"
-echo "from Beyond Linux From Scratch."
-echo "This example is far from being complete, it is only meant"
-echo "to be a reference."
-echo "Firewall security is a complex issue, that exceeds the scope"
-echo "of the configuration rules below."
-echo "You can find additional information"
-echo "about firewalls in Chapter 4 of the BLFS book."
-echo "http://www.&lfs-domainname;/blfs"
-echo
-
-# Insert iptables modules (not needed if built into the kernel).
-
-modprobe nf_conntrack
-modprobe nf_conntrack_ftp
-modprobe xt_conntrack
-modprobe xt_LOG
-modprobe xt_state
-
-# Enable broadcast echo Protection
-echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
-
-# Disable Source Routed Packets
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
-
-# Enable TCP SYN Cookie Protection
-echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
-
-# Disable ICMP Redirect Acceptance
-echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
-
-# Don't send Redirect Messages
-echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
-
-# Drop Spoofed Packets coming in on an interface where responses
-# would result in the reply going out a different interface.
-echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
-
-# Log packets with impossible addresses.
-echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
-
-# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
-echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
-
-# Disable Explicit Congestion Notification
-# Too many routers are still ignorant
-echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
-
-# Set a known state
-iptables -P INPUT   DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT  DROP
-
-# These lines are here in case rules are already in place and the
-# script is ever rerun on the fly. We want to remove all rules and
-# pre-existing user defined chains before we implement new rules.
-iptables -F
-iptables -X
-iptables -Z
-
-iptables -t nat -F
-
-# Allow local connections
-iptables -A INPUT  -i lo -j ACCEPT
-iptables -A OUTPUT -o lo -j ACCEPT
-
-# Allow forwarding if the initiated on the intranet
-iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A FORWARD  -i ! ppp+ -m conntrack --ctstate NEW      -j ACCEPT
-
-# Do masquerading
-# (not needed if intranet is not using private ip-addresses)
-iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
-
-# Log everything for debugging
-# (last of all rules, but before policy rules)
-iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
-iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
-iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
-
-# Enable IP Forwarding
-echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
-EOF
-chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
-
-      <para>With this script your intranet should be reasonably secure
-      against external attacks. No one should be able to setup a new
-      connection to any internal service and, if it's masqueraded,
-      makes your intranet invisible to the Internet. Furthermore, your
-      firewall should be relatively safe because there are no services
-      running that a cracker could attack.</para>
-
-      <note>
-        <para>If the interface you're connecting to the Internet
-        doesn't connect via PPP, you will need to change
-        <replaceable>&lt;ppp+&gt;</replaceable> to the name of the interface
-        (e.g., <emphasis role="strong">eth1</emphasis>) which you are
-        using.</para>
-      </note>
-
-    </sect3>
-
-    <sect3 id="fw-busybox" xreflabel="BusyBox">
-      <title>BusyBox</title>
-
-      <para>This scenario isn't too different from the <xref
-      linkend="fw-masqRouter"/>, but additionally offers some
-      services to your intranet. Examples of this can be when
-      you want to administer your firewall from another host on
-      your intranet or use it as a proxy or a name server.</para>
-
-      <note>
-        <para>Outlining a true concept of how to protect a server that
-        offers services on the Internet goes far beyond the scope of
-        this document. See the references at the end of this section
-        for more information.</para>
-      </note>
-
-      <para>Be cautious. Every service you have enabled makes your
-      setup more complex and your firewall less secure. You are
-      exposed to the risks of misconfigured services or running
-      a service with an exploitable bug. A firewall should generally
-      not run any extra services.  See the introduction to the
-      <xref linkend="fw-masqRouter"/> for some more details.</para>
-
-      <para>If you want to add services such as internal Samba or
-      name servers that do not need to access the Internet themselves,
-      the additional statements are quite simple and should still be
-      acceptable from a security standpoint. Just add the following lines
-      into the script <emphasis>before</emphasis> the logging rules.</para>
-
-<screen><literal>iptables -A INPUT  -i ! ppp+  -j ACCEPT
-iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
-
-      <para>If daemons, such as squid, have to access the Internet
-      themselves, you could open OUTPUT generally and restrict
-      INPUT.</para>
-
-<screen><literal>iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-iptables -A OUTPUT -j ACCEPT</literal></screen>
-
-      <para>However, it is generally not advisable to leave OUTPUT
-      unrestricted. You lose any control over trojans who would like
-      to "call home", and a bit of redundancy in case you've
-      (mis-)configured a service so that it broadcasts its existence
-      to the world.</para>
-
-      <para>To accomplish this, you should restrict INPUT and OUTPUT
-      on all ports except those that it's absolutely necessary to have
-      open. Which ports you have to open depends on your needs: mostly
-      you will find them by looking for failed accesses in your log
-      files.</para>
-
-      <itemizedlist spacing="compact" role='iptables'>
-        <title>Have a Look at the Following Examples:</title>
-        <listitem>
-          <para>Squid is caching the web:</para>
-
-<screen><literal>iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
-iptables -A INPUT  -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED \
-  -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>Your caching name server (e.g., named) does its
-          lookups via UDP:</para>
-
-<screen><literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>You want to be able to ping your computer to
-          ensure it's still alive:</para>
-
-<screen><literal>iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
-iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para id='fw-BB-4' xreflabel="BusyBox example number 4">If
-          you are frequently accessing FTP servers or enjoy chatting, you might
-          notice certain delays because some implementations of these daemons
-          have the feature of querying an identd on your system to obtain
-          usernames. Although there's really little harm in this, having an
-          identd running is not recommended because many security experts feel
-          the service gives out too much additional information.</para>
-
-          <para>To avoid these delays you could reject the requests
-          with a 'tcp-reset':</para>
-
-<screen><literal>iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>To log and drop invalid packets (packets
-          that came in after netfilter's timeout or some types of
-          network scans) insert these rules at the top of the chain:</para>
-
-<screen><literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
-  -j LOG --log-prefix "FIREWALL:INVALID "
-iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>Anything coming from the outside should not have a
-          private address, this is a common attack called IP-spoofing:</para>
-
-<screen><literal>iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
-iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
-iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
-
-          <para>There are other addresses that you may also want to
-          drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
-          experimental), 169.254.0.0/16 (Link Local Networks), and
-          192.0.2.0/24 (IANA defined test network).</para>
-        </listitem>
-        <listitem>
-          <para>If your firewall is a DHCP client, you need to allow
-          those packets:</para>
-
-<screen><literal>iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
-   -d 255.255.255.255 --dport 68 -j ACCEPT</literal></screen>
-
-        </listitem>
-        <listitem>
-          <para>To simplify debugging and be fair to anyone who'd like
-          to access a service you have disabled, purposely or by mistake,
-          you could REJECT those packets that are dropped.</para>
-
-          <para>Obviously this must be done directly after logging as the very
-          last lines before the packets are dropped by policy:</para>
-
-<screen><literal>iptables -A INPUT -j REJECT</literal></screen>
-
-        </listitem>
-      </itemizedlist>
-
-      <para>These are only examples to show you some of the capabilities
-      of the firewall code in Linux. Have a look at the man page of iptables.
-      There you will find much more information. The port numbers needed for
-      this can be found in <filename>/etc/services</filename>, in case you
-      didn't find them by trial and error in your log file.</para>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 id="fw-finale" xreflabel="Conclusion">
-    <title>Conclusion</title>
-
-    <para>Finally, there is one fact you must not forget: The effort spent
-    attacking a system corresponds to the value the cracker expects to gain
-    from it. If you are responsible for valuable information, you need to
-    spend the time to protect it properly.</para>
-
-  </sect2>
-
-  <sect2 id="postlfs-security-fw-extra" xreflabel="Extra Information">
-    <title>Extra Information</title>
-
-    <sect3 id="fw-library" xreflabel="links for further reading">
-      <title>Where to Start with Further Reading on Firewalls</title>
-
-      <blockquote>
-        <literallayout>
-<ulink url="http://www.netfilter.org/">www.netfilter.org - Homepage of the netfilter/iptables project</ulink>
-<ulink url="http://www.netfilter.org/documentation/FAQ/netfilter-faq.html">Netfilter related FAQ</ulink>
-<ulink url="http://www.netfilter.org/documentation/index.html#HOWTO">Netfilter related HOWTO's</ulink>
-<ulink url="http://en.tldp.org/LDP/nag2/x-087-2-firewall.html">en.tldp.org/LDP/nag2/x-087-2-firewall.html</ulink>
-<ulink url="http://en.tldp.org/HOWTO/Security-HOWTO.html">en.tldp.org/HOWTO/Security-HOWTO.html</ulink>
-<ulink url="http://en.tldp.org/HOWTO/Firewall-HOWTO.html">en.tldp.org/HOWTO/Firewall-HOWTO.html</ulink>
-<ulink url="http://www.linuxsecurity.com/docs/">www.linuxsecurity.com/docs/</ulink>
-<ulink url="http://www.little-idiot.de/firewall">www.little-idiot.de/firewall (German &amp; outdated, but very comprehensive)</ulink>
-<ulink url="http://linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html">linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html</ulink>
-<ulink url="http://staff.washington.edu/dittrich/misc/ddos">staff.washington.edu/dittrich/misc/ddos</ulink>
-<ulink url="http://www.e-infomax.com/ipmasq">www.e-infomax.com/ipmasq</ulink>
-<ulink url="http://www.circlemud.org/~jelson/writings/security/index.htm">www.circlemud.org/~jelson/writings/security/index.htm</ulink>
-<ulink url="http://www.securityfocus.com">www.securityfocus.com</ulink>
-<ulink url="http://www.cert.org/tech_tips/">www.cert.org - tech_tips</ulink>
-<ulink url="http://security.ittoolbox.com/">security.ittoolbox.com</ulink>
-<ulink url="http://www.insecure.org/reading.html">www.insecure.org/reading.html</ulink>
-        </literallayout>
-      </blockquote>
-
-      <!-- The following are all dead links from the section above. They are
-           moved out of the section so the literallayout won't produce blank
-           lines in the rendered text
-
-<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire.html">www.ibm.com/developerworks/security/library/s-fire.html</ulink>
-<ulink url="http://www-106.ibm.com/developerworks/security/library/s-fire2.html">www.ibm.com/developerworks/security/library/s-fire2.html</ulink>
-<ulink url="http://www.interhack.net/pubs/fw-faq/">www.interhack.net/pubs/fw-faq/</ulink>
-<ulink url="http://www.linuxgazette.com/issue65/stumpel.html">www.linuxgazette.com/issue65/stumpel.html</ulink>
-<ulink url="http://www.linux-firewall-tools.com/linux/">www.linux-firewall-tools.com/linux/</ulink>
-<ulink url="http://logi.cc/linux/athome-firewall.php3">logi.cc/linux/athome-firewall.php3</ulink>
-<ulink url="http://www.robertgraham.com/pubs/firewall-seen.html">www.robertgraham.com/pubs/firewall-seen.html</ulink>
-
-      -->
-
-    </sect3>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/haveged-systemd.xml
===================================================================
--- postlfs/security/haveged-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
+++ postlfs/security/haveged-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY haveged-download-http "http://www.issihosts.com/haveged/haveged-&haveged-version;.tar.gz">
+  <!ENTITY haveged-download-ftp  " ">
+  <!ENTITY haveged-md5sum        "015ff58cd10607db0e0de60aeca2f5f8">
+  <!ENTITY haveged-size          "468 KB">
+  <!ENTITY haveged-buildsize     "4.8 MB">
+  <!ENTITY haveged-time          "0.2 SBU">
+]>
+
+<sect1 id="haveged" xreflabel="Haveged-&haveged-version;">
+  <?dbhtml filename="haveged.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Haveged-&haveged-version;</title>
+
+  <indexterm zone="haveged">
+    <primary sortas="a-Haveged">Haveged</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to Haveged</title>
+
+    <para>
+      The <application>Haveged</application> package contains a daemon
+      that generates an unpredictable stream of random numbers
+      and feeds the /dev/random device.
+    </para>
+
+    &lfs75_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&haveged-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&haveged-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &haveged-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &haveged-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &haveged-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &haveged-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/haveged"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of Haveged</title>
+
+    <para>Install <application>Haveged</application> by running the following
+    commands:</para>
+
+<screen><userinput>./configure --prefix=/usr &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      To test the results, issue: <command>make check</command>.
+    </para>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+mkdir -pv    /usr/share/doc/haveged-&haveged-version; &amp;&amp;
+cp -v README /usr/share/doc/haveged-&haveged-version;</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring haveged</title>
+
+    <sect3  id="haveged-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To start the <command>haveged</command> daemon at boot,
+        install the systemd unit from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="haveged haveged-init">
+        <primary sortas="f-haveged">haveged</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-haveged</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directory</segtitle>
+
+      <seglistitem>
+        <seg>
+          haveged
+        </seg>
+        <seg>
+          libhavege.so
+        </seg>
+        <seg>
+          /usr/include/haveged
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="haveged-prog">
+        <term><command>haveged</command></term>
+        <listitem>
+          <para>
+            is a daemon that generates an unpredictable stream of random 
+            numbers harvested from the indirect effects of hardware events 
+            based on hidden processor states (caches, branch  predictors, memory
+            translation tables, etc).
+          </para>
+          <indexterm zone="haveged haveged-prog">
+            <primary sortas="b-haveged-prog">haveged</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: stlfs/security/haveged.xml
===================================================================
--- postlfs/security/haveged.xml	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,170 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY haveged-download-http "http://www.issihosts.com/haveged/haveged-&haveged-version;.tar.gz">
-  <!ENTITY haveged-download-ftp  " ">
-  <!ENTITY haveged-md5sum        "015ff58cd10607db0e0de60aeca2f5f8">
-  <!ENTITY haveged-size          "468 KB">
-  <!ENTITY haveged-buildsize     "4.8 MB">
-  <!ENTITY haveged-time          "0.2 SBU">
-]>
-
-<sect1 id="haveged" xreflabel="Haveged-&haveged-version;">
-  <?dbhtml filename="haveged.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Haveged-&haveged-version;</title>
-
-  <indexterm zone="haveged">
-    <primary sortas="a-Haveged">Haveged</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to Haveged</title>
-
-    <para>
-      The <application>Haveged</application> package contains a daemon
-      that generates an unpredictable stream of random numbers
-      and feeds the /dev/random device.
-    </para>
-
-    &lfs75_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&haveged-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&haveged-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &haveged-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &haveged-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &haveged-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &haveged-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/haveged"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of Haveged</title>
-
-    <para>Install <application>Haveged</application> by running the following
-    commands:</para>
-
-<screen><userinput>./configure --prefix=/usr &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      To test the results, issue: <command>make check</command>.
-    </para>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install &amp;&amp;
-mkdir -pv    /usr/share/doc/haveged-&haveged-version; &amp;&amp;
-cp -v README /usr/share/doc/haveged-&haveged-version;</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring haveged</title>
-
-    <sect3  id="haveged-init">
-      <title>Boot Script</title>
-
-      <para>
-        If you want the <application>Haveged</application> daemon to
-        start automatically when the system is booted, install the
-        <filename>/etc/rc.d/init.d/haveged</filename> init script included
-        in the <xref linkend="bootscripts"/> package.
-      </para>
-
-      <indexterm zone="haveged haveged-init">
-        <primary sortas="f-haveged">haveged</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-haveged</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directory</segtitle>
-
-      <seglistitem>
-        <seg>
-          haveged
-        </seg>
-        <seg>
-          libhavege.so
-        </seg>
-        <seg>
-          /usr/include/haveged
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="haveged-prog">
-        <term><command>haveged</command></term>
-        <listitem>
-          <para>
-            is a daemon that generates an unpredictable stream of random 
-            numbers harvested from the indirect effects of hardware events 
-            based on hidden processor states (caches, branch  predictors, memory
-            translation tables, etc).
-          </para>
-          <indexterm zone="haveged haveged-prog">
-            <primary sortas="b-haveged-prog">haveged</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: postlfs/security/iptables-systemd.xml
===================================================================
--- postlfs/security/iptables-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
+++ postlfs/security/iptables-systemd.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -0,0 +1,316 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
+  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
+  <!ENTITY iptables-md5sum        "536d048c8e8eeebcd9757d0863ebb0c0">
+  <!ENTITY iptables-size          "536 KB">
+  <!ENTITY iptables-buildsize     "15 MB">
+  <!ENTITY iptables-time          "0.2 SBU">
+]>
+
+<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
+  <?dbhtml filename="iptables.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>Iptables-&iptables-version;</title>
+
+  <indexterm zone="iptables">
+    <primary sortas="a-Iptables">Iptables</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to Iptables</title>
+
+    <para>
+      The next part of this chapter deals with firewalls. The principal
+      firewall tool for Linux is <application>Iptables</application>. You will
+      need to install <application>Iptables</application> if you intend on using
+      any form of a firewall.
+    </para>
+
+    &lfs75_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&iptables-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&iptables-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &iptables-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &iptables-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &iptables-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &iptables-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/iptables"/>
+    </para>
+  </sect2>
+
+  <sect2 role="kernel" id="iptables-kernel">
+    <title>Kernel Configuration</title>
+
+    <para>
+      A firewall in Linux is accomplished through a portion of the
+      kernel called netfilter. The interface to netfilter is
+      <application>Iptables</application>. To use it, the appropriate
+      kernel configuration parameters are found in Networking Support &rArr;
+      Networking Options &rArr; Network Packet Filtering Framework.
+    </para>
+
+    <indexterm zone="iptables iptables-kernel">
+      <primary sortas="d-iptables">Iptables</primary>
+    </indexterm>
+
+  </sect2>
+
+    <sect2 role="installation">
+      <title>Installation of Iptables</title>
+
+    <note>
+      <para>
+        The installation below does not include building some specialized
+        extension libraries which require the raw headers in the
+        <application>Linux</application> source code. If you wish to build the
+        additional extensions (if you aren't sure, then you probably don't), you
+        can look at the <filename>INSTALL</filename> file to see an example of
+        how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
+        at the <application>Linux</application> source code. Note that if you
+        upgrade the kernel version, you may also need to recompile
+        <application>Iptables</application> and that the BLFS team has not tested
+        using the raw kernel headers.
+      </para>
+
+      <para>
+        For some non-x86 architectures, the raw kernel headers may be
+        required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
+        parameter to point at the <application>Linux</application> source
+        code.
+      </para>
+    </note>
+
+    <para>
+      Install <application>Iptables</application> by running the following
+      commands:
+    </para>
+
+<screen><userinput>./configure --prefix=/usr                \
+            --sbindir=/sbin              \
+            --with-xtlibdir=/lib/xtables \
+            --enable-libipq &amp;&amp;
+make</userinput></screen>
+
+    <para>This package does not come with a test suite.</para>
+
+    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root"><userinput>make install &amp;&amp;
+ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
+for file in ip4tc ip6tc ipq iptc xtables
+do
+  mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
+  ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
+done</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
+      <application>Iptables</application> modules are installed in the
+      <filename class="directory">/lib/xtables</filename> directory.
+    </para>
+
+    <para>
+      <option>--enable-libipq</option>: This switch enables building
+      of <filename class="libraryfile">libipq.so</filename> which
+      can be used by some packages outside of BLFS.
+    </para>
+
+    <para>
+      <option>--enable-nfsynproxy</option>: This switch enables installation
+      of <application>nfsynproxy</application> SYNPROXY configuration tool.
+    </para>
+
+    <para>
+      <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
+      Ensure the symbolic link for <command>iptables-xml</command> is relative.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring Iptables</title>
+
+    <para>
+      Introductory instructions for configuring your firewall are
+      presented in the next section: <xref linkend="fw-firewall"/>
+    </para>
+
+    <sect3  id="iptables-init">
+      <title>Systemd Units</title>
+
+      <para>
+        To set up the <application>Iptables</application> firewall at boot,
+        install the systemd unit from the <xref linkend="bootscripts"/>
+        package by running the following command as the
+        <systemitem class="username">root</systemitem> user:
+      </para>
+
+      <indexterm zone="iptables iptables-init">
+        <primary sortas="f-iptables">iptables</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-iptables</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
+          iptables-save, iptables-xml, and xtables-multi
+        </seg>
+        <seg>
+          libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
+        </seg>
+        <seg>
+          /lib/xtables and /usr/include/libiptc
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="iptables-prog">
+        <term><command>iptables</command></term>
+        <listitem>
+          <para>
+            is used to set up, maintain, and inspect the tables of
+            IP packet filter rules in the Linux kernel.
+          </para>
+          <indexterm zone="iptables iptables-prog">
+            <primary sortas="b-iptables">iptables</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-restore">
+        <term><command>iptables-restore</command></term>
+        <listitem>
+          <para>
+            is used to restore IP Tables from data specified on
+            STDIN. Use I/O redirection provided by your
+            shell to read from a file.
+          </para>
+          <indexterm zone="iptables iptables-restore">
+            <primary sortas="b-iptables-restore">iptables-restore</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-save">
+        <term><command>iptables-save</command></term>
+        <listitem>
+          <para>
+            is used to dump the contents of an IP Table in easily
+            parseable format to STDOUT. Use I/O-redirection
+            provided by your shell to write to a file.
+          </para>
+          <indexterm zone="iptables iptables-save">
+            <primary sortas="b-iptables-save">iptables-save</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="iptables-xml">
+        <term><command>iptables-xml</command></term>
+        <listitem>
+          <para>
+            is used to convert the output of
+            <command>iptables-save</command> to an XML format. Using the
+            <filename>iptables.xslt</filename> stylesheet converts the XML
+            back to the format of <command>iptables-restore</command>.
+          </para>
+          <indexterm zone="iptables iptables-xml">
+            <primary sortas="b-iptables-xml">iptables-xml</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="ip6tables">
+        <term><command>ip6tables*</command></term>
+        <listitem>
+          <para>
+            are a set of commands for IPV6 that parallel the iptables
+            commands above.
+          </para>
+          <indexterm zone="iptables ip6tables">
+            <primary sortas="b-ip6tables">ip6tables</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="nfsynproxy">
+        <term><command>nfsynproxy</command></term>
+        <listitem>
+          <para>
+            (optional) configuration tool. SYNPROXY target makes handling of
+            large SYN floods possible without the large performance penalties
+            imposed by the connection tracking in such cases.
+          </para>
+          <indexterm zone="iptables nfsynproxy">
+            <primary sortas="b-nfsynproxy">nfsynproxy</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: postlfs/security/security.xml
===================================================================
--- postlfs/security/security.xml	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ postlfs/security/security.xml	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -48,7 +48,7 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gnutls.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gpgme.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables.xml"/>
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged-systemd.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables-systemd.xml"/>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling-systemd.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libcap.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="linux-pam.xml"/>
Index: systemd-units/Makefile
===================================================================
--- systemd-units/Makefile	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ systemd-units/Makefile	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -58,4 +58,8 @@
 	systemctl enable gpm.service
 
+install-haveged: create-dirs
+	install -m ${CONFMODE} blfs/units/haveged.service ${UNITSDIR}/
+	systemctl enable haveged.service
+
 install-httpd: create-dirs
 	install -m ${CONFMODE} blfs/tmpfiles/httpd.conf ${TMPFILESDIR}/
@@ -63,4 +67,8 @@
 	systemd-tmpfiles --create httpd.conf
 	systemctl enable httpd.service
+
+install-iptables: create-dirs
+	install -m ${CONFMODE} blfs/units/iptables.service ${UNITSDIR}/
+	systemctl enable iptables.service
 
 install-kdm: create-dirs
@@ -217,8 +225,17 @@
 	rm -f ${UNITSDIR}/gpm.service
 
+uninstall-haveged:
+	systemctl stop haveged.service
+	systemctl disable haveged.service
+	rm -f ${UNITSDIR}/haveged.service
+
 uninstall-httpd:
 	systemctl stop httpd.service
 	systemctl disable httpd.service
 	rm -f ${TMPFILESDIR}/httpd.conf ${UNITSDIR}/httpd.service
+
+uninstall-iptables:
+	systemctl disable iptables.service
+	rm -f ${UNITSDIR}/iptables.service
 
 uninstall-kdm:
@@ -363,4 +380,5 @@
 	install-gpm \
 	install-httpd \
+	install-iptables \
 	install-kdm \
 	install-krb5 \
@@ -391,4 +409,5 @@
 	uninstall-gpm \
 	uninstall-httpd \
+	uninstall-iptables \
 	uninstall-kdm \
 	uninstall-krb5 \
Index: stemd-units/blfs/services/bridge
===================================================================
--- systemd-units/blfs/services/bridge	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,76 +1,0 @@
-#!/bin/sh
-########################################################################
-# Begin /lib/services/bridge
-#
-# Description : Bridge Boot Script
-#
-# Authors     : Nathan Coulson - nathan@linuxfromscratch.org
-#               Bruce Dubbs - bdubbs@linuxfromscratch.org
-#
-# Version     : LFS-7.2
-#
-########################################################################
-
-. /lib/lsb/init-functions
-. ${IFCONFIG}
-
-# Make compatible with older versions of init-functions
-unset is_true
-
-is_true()
-{
-   [ "$1" = "1" ] || [ "$1" = "yes" ] || [ "$1" = "true" ] ||  
-   [ "$1" = "y" ] || [ "$1" = "t"   ]
-}
-
-if [ -z "${INTERFACE_COMPONENTS}" ]; then
-   log_failure_msg "INTERFACE_COMPONENTS variable missing from ${IFCONFIG}"
-   exit 1
-fi
-
-case "${2}" in
-   up)
-      log_info_msg2 "\n"
-      log_info_msg "Creating the ${1} interface..."
-      brctl addbr ${1}
-      evaluate_retval
-
-      for I in ${INTERFACE_COMPONENTS}; do
-         log_info_msg "Adding ${I} to ${1}..."
-         brctl addif ${1} ${I}
-         evaluate_retval
-      done
-
-      if is_true ${STP}; then
-        brctl stp ${1} on
-        log_success_msg "Setting spanning tree protocol"
-      fi
-
-      if is_true ${IP_FORWARD}; then
-        sysctl -w net.ipv4.ip_forward=1 > /dev/null
-        log_success_msg "Setting net.ipv4.ip_forward = 1"
-      fi
-   ;;
-   
-   down)
-      for I in ${INTERFACE_COMPONENTS}; do
-         log_info_msg "Removing ${I} from ${1}..."
-         ip link set ${I} down &&
-         brctl delif ${1} ${I}
-         evaluate_retval
-      done
-
-      log_info_msg "Bringing down the ${1} interface..."
-      ip link set ${1} down
-      brctl delbr ${1}
-      evaluate_retval
-   ;;
-   
-   *)
-      echo "Usage: ${0} [interface] {up|down}"
-      exit 1
-   ;;
-esac
-
-# End /lib/services/bridge
-
Index: stemd-units/blfs/services/dhclient
===================================================================
--- systemd-units/blfs/services/dhclient	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,117 +1,0 @@
-#!/bin/sh
-# Begin services/dhclient
-
-# Origianlly based upon lfs-bootscripts-1.12 $NETWORK_DEVICES/if{down,up}
-# Rewritten by Nathan Coulson <nathan@linuxfromscratch.org>
-# Adapted for dhclient by DJ Lucas <dj@linuxfromscratch.org>
-# Update for LFS 7.0 by Ken Moffat <ken@linuxfromscratch.org>
-
-# Call with: IFCONFIG=<filename> /lib/services/dhclient <IFACE> <up | down>
-
-#$LastChangedBy: krejzi $
-#$Date: 2013-02-11 17:22:35 +0100 (Mon, 11 Feb 2013) $
-
-. /lib/lsb/init-functions
-. $IFCONFIG
-
-PIDFILE=/run/dhclient-$1.pid
-LFILE=/var/lib/dhclient/dhclient-$1.leases
-
-getipstats()
-{
-   # Print the last 16 lines of dhclient.leases
-   sed -e :a -e '$q;N;17,$D;ba' ${LFILE}
-}
-
-# Make compatible with older versions of init-functions
-unset is_true
-
-is_true()
-{
-   [ "$1" = "1" ] || [ "$1" = "yes" ] || [ "$1" = "true" ] ||
-   [ "$1" = "y" ] || [ "$1" = "t" ]
-}
-
-case "$2" in
-   up)
-
-     if [ -e ${PIDFILE} ]; then
-        ps $(cat ${PIDFILE}) | grep dhclient >/dev/null
-        if [ "$?" = "0" ]; then
-           log_warning_msg "\n dhclient appears to be running on $1"
-           exit 0
-        else
-           rm ${PIDFILE}
-        fi
-     fi
-
-      log_info_msg "\n Starting dhclient on the $1 interface..."
-
-      /sbin/dhclient -lf ${LFILE} -pf ${PIDFILE} $DHCP_START $1
-
-      if [ "$?" != "0" ]; then
-        log_failure_msg2
-        exit 1
-      fi
-
-      # Print the assigned settings if requested
-      if  is_true "$PRINTIP"  -o  is_true "$PRINTALL"; then
-        # Get info from dhclient.leases file
-
-        IPADDR=`getipstats | grep "fixed-address" | \
-          sed 's/ fixed-address //' | \
-          sed 's/\;//'`
-
-        NETMASK=`getipstats | grep "subnet-mask" | \
-          sed 's/ option subnet-mask //' | \
-          sed 's/\;//'`
-
-        GATEWAY=`getipstats | grep "routers" | \
-          sed 's/ option routers //' | \
-          sed 's/\;//'`
-
-        DNS=`getipstats | grep "domain-name-servers" | \
-          sed 's/ option domain-name-servers //' | \
-          sed 's/\;//' | sed 's/,/ and /'`
-
-        if [ "$PRINTALL" = "yes" ]; then
-           # This is messy, the messages are on one very long
-           # line on the screen and in the log
-           log_info_msg "           DHCP Assigned Settings for $1:"
-           log_info_msg "           IP Address:      $IPADDR"
-           log_info_msg "           Subnet Mask:     $NETMASK"
-           log_info_msg "           Default Gateway: $GATEWAY"
-           log_info_msg "           DNS Server:      $DNS"
-        else
-           log_info_msg " IP Addresss:""$IPADDR"
-        fi
-      fi
-
-      log_success_msg2
-   ;;
-
-   down)
-      if [ ! -e ${PIDFILE} ]; then
-         log_warning_msg "\n dhclient doesn't appear to be running on $1"
-         exit 0
-      fi
-
-      log_info_msg "\n Stopping dhclient on the $1 interface..."
-
-      /sbin/dhclient -r -lf ${LFILE} -pf ${PIDFILE} $DHCP_STOP $1
-
-      ps $(cat ${PIDFILE}) | grep dhclient >/dev/null
-      if [ "$?" != "0" ]; then
-         rm -f ${PIDFILE}
-      fi
-
-      evaluate_retval
-   ;;
-
-   *)
-      echo "Usage: $0 [interface] {up|down}"
-      exit 1
-   ;;
-esac
-
-# End services/dhclient
Index: stemd-units/blfs/services/dhcpcd
===================================================================
--- systemd-units/blfs/services/dhcpcd	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,69 +1,0 @@
-#!/bin/bash
-# Begin services/dhcpcd
-
-# Origianlly dased upon lfs-bootscripts-1.12 $NETWORK_DEVICES/if{down,up}
-# Rewritten by Nathan Coulson <nathan@linuxfromscratch.org>
-# Adapted for dhcpcd by DJ Lucas <dj@linuxfromscratch.org>
-# Update for LFS 7.0 by Bruce Dubbs <bdubbs@linuxfromscratch,org>
-
-# Call with: IFCONFIG=<filename> /lib/services/dhcpcd <IFACE> <up | down>
-
-#$LastChangedBy: bdubbs $
-#$Date: 2012-04-09 21:48:51 +0200 (Mon, 09 Apr 2012) $
-
-. /lib/lsb/init-functions
-. $IFCONFIG
-
-pidfile="/var/run/dhcpcd-$1.pid"
-
-case "$2" in
-    up)
-       # Cosmetic output not needed for multiple services
-       if ! $(echo ${SERVICE} | grep -q " "); then
-         log_info_msg2 "\n" # Terminate the previous message
-       fi
-    
-       log_info_msg "Starting dhcpcd on the $1 interface..."
-
-       # Test to see if there is a stale pid file
-       if [ -f "$pidfile" ]; then
-          ps `cat "$pidfile"` | grep dhcpcd > /dev/null
-
-          if [ $? != 0 ]; then
-             rm -f /var/run/dhcpcd-$1.pid > /dev/null
-          
-          else
-             log_warning_msg "dhcpcd is already running!"
-             exit 2
-          fi
-       fi
-
-       /sbin/dhcpcd $1 $DHCP_START
-       evaluate_retval
-       ;;
-
-     down)
-       log_info_msg "Stopping dhcpcd on the $1 interface..."
-
-       if [ -z "$DHCP_STOP" ]; then
-          killproc -p "${pidfile}" /sbin/dhcpcd
-
-       else
-          /sbin/dhcpcd $1 $DHCP_STOP &> /dev/null
-
-          if [ "$?" -eq 1 ]; then
-             log_warning_msg "dhcpcd not running!"
-             exit 2
-          fi
-       fi
-
-       evaluate_retval
-       ;;
-
-     *)
-       echo "Usage: $0 [interface] {up|down}"
-       exit 1
-       ;;
-esac
-
-# End services/dhcpcd
Index: stemd-units/blfs/services/wpa
===================================================================
--- systemd-units/blfs/services/wpa	(revision 4321c68f70f731fa63ef7d6e913a46fffc2bd6f0)
+++ 	(revision )
@@ -1,89 +1,0 @@
-#!/bin/bash
-# Begin services/wpa
-
-# Origianlly based upon lfs-bootscripts-1.12 $NETWORK_DEVICES/if{down,up}
-# Written by Armin K. <krejzi at email dot com>
-
-# Call with: IFCONFIG=<filename> /lib/services/wpa <IFACE> <up | down>
-
-#$LastChangedBy: krejzi $
-#$Date: 2013-03-24 16:39:14 +0100 (Sun, 24 Mar 2013) $
-
-. /lib/lsb/init-functions
-. $IFCONFIG
-
-CFGFILE=/etc/sysconfig/wpa_supplicant-${IFCONFIG##*.}.conf
-PIDFILE=/run/wpa_supplicant/$1.pid
-CONTROL_IFACE=/run/wpa_supplicant/$1
-
-case "$2" in
-   up)
-
-      if [ -e ${PIDFILE} ]; then
-         ps $(cat ${PIDFILE}) | grep wpa_supplicant >/dev/null
-         if [ "$?" = "0" ]; then
-            log_warning_msg "\n wpa_supplicant already running on $1."
-            exit 0
-         else
-            rm ${PIDFILE}
-         fi
-      fi
-
-      if [ ! -e ${CFGFILE} ]; then
-        log_info_msg "\n wpa_supplicant configuration file ${CFGFILE} not present"
-        log_failure_msg2
-        exit 1
-      fi
-
-      log_info_msg "\n Starting wpa_supplicant on the $1 interface..."
-
-      mkdir -p /run/wpa_supplicant
-
-      /sbin/wpa_supplicant -q -B -Dnl80211,wext -P${PIDFILE} -C/run/wpa_supplicant -c${CFGFILE} -i$1 ${WPA_ARGS}
-
-      if [ "$?" != "0" ]; then
-        log_failure_msg2
-        exit 1
-      fi
-
-      log_success_msg2
-
-      if [ -n "${WPA_SERVICE}" ]; then
-         if [ ! -e /lib/services/${WPA_SERVICE} -a ! -x /lib/services/${WPA_SERVICE} ]; then
-            log_info_msg "\n Cannot start ${WPA_SERVICE} on $1"
-            log_failure_msg2
-            exit 1
-         fi
-
-         IFCONFIG=${IFCONFIG} /lib/services/${WPA_SERVICE} $1 up
-      fi
-   ;;
-
-   down)
-      if [ -n "${WPA_SERVICE}" ]; then
-         if [ ! -e /lib/services/${WPA_SERVICE} -a ! -x /lib/services/${WPA_SERVICE} ]; then
-            log_warning_msg "\n Cannot stop ${WPA_SERVICE} on $1"
-         else
-            IFCONFIG=${IFCONFIG} /lib/services/${WPA_SERVICE} $1 down
-         fi
-      fi
-
-      log_info_msg "\n Stopping wpa_supplicant on the $1 interface..."
-
-      if [ -e ${PIDFILE} ]; then
-         kill -9 $(cat ${PIDFILE})
-         rm -f ${PIDFILE} ${CONTROL_IFACE}
-         evaluate_retval
-      else
-         log_warning_msg "\n wpa_supplicant already stopped on $1"
-         exit 0
-      fi
-   ;;
-
-   *)
-      echo "Usage: $0 [interface] {up|down}"
-      exit 1
-   ;;
-esac
-
-# End services/wpa
Index: systemd-units/blfs/units/haveged.service
===================================================================
--- systemd-units/blfs/units/haveged.service	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
+++ systemd-units/blfs/units/haveged.service	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -0,0 +1,11 @@
+[Unit]
+Description=Entropy Harvesting Daemon
+Documentation=man:haveged(8)
+
+[Service]
+Type=forking
+ExecStart=/usr/sbin/haveged -w 1024 -v 1
+PIDFile=/run/haveged.pid
+
+[Install]
+WantedBy=multi-user.target
Index: systemd-units/blfs/units/iptables.service
===================================================================
--- systemd-units/blfs/units/iptables.service	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
+++ systemd-units/blfs/units/iptables.service	(revision af8e1cb5467a5211ac31883aa406bc7d04ddd58c)
@@ -0,0 +1,13 @@
+[Unit]
+Description=Load Iptables Rules
+ConditionFileIsExecutable=/etc/systemd/scripts/iptables
+After=network.target
+
+[Service]
+Type=forking
+ExecStart=/etc/systemd/scripts/iptables
+TimeoutSec=0
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
