Index: general.ent
===================================================================
--- general.ent	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ general.ent	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -1,5 +1,5 @@
 <!-- $LastChangedBy$ $Date$ -->
 
-<!ENTITY day          "04">                   <!-- Always 2 digits -->
+<!ENTITY day          "05">                   <!-- Always 2 digits -->
 <!ENTITY month        "06">                   <!-- Always 2 digits -->
 <!ENTITY year         "2016">
@@ -7,8 +7,9 @@
 <!ENTITY copyholder   "The BLFS Development Team">
 <!ENTITY version      "&year;-&month;-&day;">
-<!ENTITY releasedate  "June 4th &year;">
+<!ENTITY releasedate  "June 5th &year;">
 <!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
 <!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->
-<!ENTITY lfs-version  "development">          <!-- x.y|development] -->
+<!ENTITY lfs-version  "development">          <!-- x.y|development -->
+<!ENTITY lfs-versiond "systemd">              <!-- x.y-systemd|systemd -->
 <!ENTITY last-commit  "$Date$"> <!-- Automatic update -->
 <!ENTITY lfs-domainname       "linuxfromscratch.org">
@@ -35,4 +36,5 @@
 
 <!ENTITY lfs-root             "../../../../lfs/view/&lfs-version;">
+<!ENTITY lfs-rootd            "../../../../lfs/view/&lfs-versiond;">
 <!ENTITY lfs-dev              "../../../../lfs/view/development">
 <!ENTITY kernel               "http://www.kernel.org/pub/">
Index: general/genlib/genlib.xml
===================================================================
--- general/genlib/genlib.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ general/genlib/genlib.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -63,8 +63,4 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gmime.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gobject-introspection.xml"/>
-
-  <!-- systemd only -->
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="grantlee.xml"/>
-
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gsl.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="icu.xml"/>
Index: neral/genlib/grantlee.xml
===================================================================
--- general/genlib/grantlee.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ 	(revision )
@@ -1,123 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY grantlee-download-http
-           "http://downloads.grantlee.org/grantlee-&grantlee-version;.tar.gz">
-  <!ENTITY grantlee-download-ftp  " ">
-  <!ENTITY grantlee-md5sum        "775f22dac0953029b414ed3b7379098c">
-  <!ENTITY grantlee-size          "1.1 MB">
-  <!ENTITY grantlee-buildsize     "21 MB">
-  <!ENTITY grantlee-time          "0.8 SBU">
-]>
-
-<sect1 id="grantlee" xreflabel="grantlee-&grantlee-version;" revision="systemd">
-  <?dbhtml filename="grantlee.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Grantlee-&grantlee-version;</title>
-
-  <indexterm zone="grantlee">
-    <primary sortas="a-grantlee">grantlee</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to grantlee</title>
-
-    <para>
-       Grantlee is a set of free software libraries written using the Qt
-       framework. Currently two libraries are shipped with Grantlee: Grantlee
-       Templates and Grantlee TextDocument. The goal of Grantlee Templates is
-       to make it easier for application developers to separate the structure
-       of documents from the data they contain, opening the door for theming.
-    </para>
-
-    <!-- &lfs78_checked; -->
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>Download (HTTP): <ulink url="&grantlee-download-http;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download (FTP): <ulink url="&grantlee-download-ftp;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download MD5 sum: &grantlee-md5sum;</para>
-      </listitem>
-      <listitem>
-        <para>Download size: &grantlee-size;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated disk space required: &grantlee-buildsize;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated build time: &grantlee-time;</para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">Grantlee Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="cmake"/> and <xref linkend="qt4"/>
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-    <ulink url="&blfs-wiki;/grantlee"/></para>
-
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of Grantlee</title>
-
-    <para>Install <application>Grantlee</application> by
-    running the following commands:</para>
-
-<screen><userinput>mkdir build &amp;&amp;
-cd    build &amp;&amp;
-
-cmake -DCMAKE_INSTALL_PREFIX=/usr \
-      -DCMAKE_BUILD_TYPE=Release  \
-      .. &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      This package does not come with a test suite.
-    </para>
-
-    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>make install</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>none</seg>
-        <seg>
-           libgrantlee_core.so and
-           libgrantlee_gui.so
-        </seg>
-        <seg>
-           /usr/lib/cmake/grantlee,
-           /usr/lib/grantlee/0.4, and
-           /usr/include/grantlee</seg>
-      </seglistitem>
-    </segmentedlist>
-  </sect2>
-
-</sect1>
Index: general/sysutils/dbus.xml
===================================================================
--- general/sysutils/dbus.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ general/sysutils/dbus.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -668,5 +668,8 @@
         A list of the installed files, along with their short
         descriptions can be found at
-        <ulink url="&lfs-root;/chapter06/dbus.html#contents-dbus"/>.
+        <phrase revision="sysv">
+        <ulink url="&lfs-root;/chapter06/dbus.html#contents-dbus"/></phrase>
+        <phrase revision="systemd">
+        <ulink url="&lfs-rootd;/chapter06/dbus.html#contents-dbus"/></phrase>.
       </para>
 
Index: neral/sysutils/strigi.xml
===================================================================
--- general/sysutils/strigi.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ 	(revision )
@@ -1,249 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY strigi-download-http "http://www.vandenoever.info/software/strigi/strigi-&strigi-version;.tar.bz2">
-  <!ENTITY strigi-download-ftp  " ">
-  <!ENTITY strigi-md5sum        "d69443234f4286d71997db9de543331a">
-  <!ENTITY strigi-size          "811 KB">
-  <!ENTITY strigi-buildsize     "52 MB">
-  <!ENTITY strigi-time          "1.2 SBU">
-]>
-
-<sect1 id="strigi" xreflabel="strigi-&strigi-version;" revision="systemd">
-  <?dbhtml filename="strigi.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>Strigi-&strigi-version;</title>
-
-  <indexterm zone="strigi">
-    <primary sortas="a-strigi">strigi</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to Strigi</title>
-
-    <para><application>Strigi</application> is a program for fast indexing and
-    searching of personal data. It can gather and index information from
-    files in the filesystem even if they are hidden in emails or
-    archives.</para>
-
-    <!-- &lfs78_checked; -->
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>Download (HTTP): <ulink url="&strigi-download-http;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download (FTP): <ulink url="&strigi-download-ftp;"/></para>
-      </listitem>
-      <listitem>
-        <para>Download MD5 sum: &strigi-md5sum;</para>
-      </listitem>
-      <listitem>
-        <para>Download size: &strigi-size;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated disk space required: &strigi-buildsize;</para>
-      </listitem>
-      <listitem>
-        <para>Estimated build time: &strigi-time;</para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">Strigi Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="cmake"/>
-    </para>
-
-    <bridgehead renderas="sect4">Recommended</bridgehead>
-    <para role="recommended">
-      <xref linkend="dbus"/> and
-      <xref linkend="qt4"/>
-    </para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="ffmpeg"/>,
-      <xref linkend="exiv2"/>,
-      <xref linkend="libxml2"/>,
-      <ulink url="http://sourceforge.net/projects/clucene/files/clucene-core-stable/">
-         CLucene version 0.9x</ulink> , and
-      <ulink url="http://logging.apache.org/log4cxx/">log4cxx</ulink>
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-    <ulink url="&blfs-wiki;/strigi"/></para>
-
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of Strigi</title>
-
-    <para>Install <application>strigi</application> by running the following
-    commands:</para>
-
-<screen><userinput>sed -i "s/BufferedStream :/STREAMS_EXPORT &amp;/" libstreams/include/strigi/bufferedstream.h &amp;&amp;
-
-mkdir build &amp;&amp;
-cd    build &amp;&amp;
-
-cmake -DCMAKE_INSTALL_PREFIX=/usr \
-      -DCMAKE_INSTALL_LIBDIR=lib  \
-      -DCMAKE_BUILD_TYPE=Release  \
-      -DENABLE_CLUCENE=OFF        \
-      -DENABLE_CLUCENE_NG=OFF     \
-      .. &amp;&amp;
-make</userinput></screen>
-
-    <para>To test the results, issue <command>make test</command>.</para>
-
-    <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
-
-<screen role="root"><userinput>make install</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <command>sed -i "..."</command>: This command fixes the build with recent
-      <application>GCC</application> versions.
-    </para>
-
-    <para>
-      <parameter>-DCMAKE_INSTALL_LIBDIR=lib</parameter>: This switch is used so
-      the package doesn't write over the lib64 symlink on 64 bit systems.
-    </para>
-
-    <para>
-      <parameter>-DCMAKE_BUILD_TYPE=Release</parameter>: This switch is used to
-      apply higher level of the compiler optimizations.
-    </para>
-
-    <para>
-      <option>-DENABLE_QT4=OFF</option>: Use this <command>cmake</command>
-      variable if you don't have <application>Qt4</application> installed or if
-      you compiled <application>Qt4</application> without
-      <application>D-Bus</application> support.
-    </para>
-
-    <para>
-      <option>-DENABLE_CLUCENE*=OFF</option>: These statements disable the
-      package from trying to use <xref linkend="clucene"/> (current stable
-      version).
-    </para>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>deepfind, deepgrep, rdfindexer, strigiclient, strigicmd,
-        strigidaemon, and xmlindexer</seg>
-        <seg>libsearchclient.so, libstreamanalyzer.so, libstreams.so,
-        libstrigihtmlgui.so, libstrigiqtdbusclient.so, and several in
-        /usr/lib/strigi</seg>
-        <seg>/usr/include/strigi, /usr/lib/strigi, and /usr/share/strigi</seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="deepfind">
-        <term><command>deepfind</command></term>
-        <listitem>
-          <para>is a utility for searching for filenames in compressed
-          archives like tar, cpio, and zip</para>
-          <indexterm zone="strigi deepfind">
-            <primary sortas="b-deepfind">deepfind</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="deepgrep">
-        <term><command>deepgrep</command></term>
-        <listitem>
-          <para>is a utility for searching compressed archives like
-                    tar, cpio, and zip</para>
-          <indexterm zone="strigi deepgrep">
-            <primary sortas="b-deepgrep">deepgrep</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="rdfindexer">
-        <term><command>rdfindexer</command></term>
-        <listitem>
-          <para>manages and performs indexing of the RDF data for entities
-          present on your site</para>
-          <indexterm zone="strigi rdfindexer">
-            <primary sortas="b-rdfindexer">rdfindexer</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="strigiclient">
-        <term><command>strigiclient</command></term>
-        <listitem>
-          <para>is a Qt4 client (GUI) for the Strigi Desktop Search software</para>
-          <indexterm zone="strigi strigiclient">
-            <primary sortas="b-strigiclient">strigiclient</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="strigicmd">
-        <term><command>strigicmd</command></term>
-        <listitem>
-          <para>is a program for creating and querying indices</para>
-          <indexterm zone="strigi strigicmd">
-            <primary sortas="b-strigicmd">strigicmd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="strigidaemon">
-        <term><command>strigidaemon</command></term>
-        <listitem>
-          <para>is a daemon program for maintaining indices</para>
-          <indexterm zone="strigi strigidaemon">
-            <primary sortas="b-strigidaemon">strigidaemon</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="xmlindexer">
-        <term><command>xmlindexer</command></term>
-        <listitem>
-          <para>indexes XML documents</para>
-          <indexterm zone="strigi xmlindexer">
-            <primary sortas="b-xmlindexer">xmlindexer</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: general/sysutils/sysutils.xml
===================================================================
--- general/sysutils/sysutils.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ general/sysutils/sysutils.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -54,8 +54,4 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="redland.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="sg3_utils.xml"/>
-
-  <!-- systemd only -->  
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="strigi.xml"/>
-
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="sysstat.xml"/>
 
Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ introduction/welcome/changelog.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -44,4 +44,17 @@
 
 -->
+    <listitem>
+      <para>June 5th, 2016</para>
+      <itemizedlist>
+        <listitem revision="systemd">
+          <para>[dj] - Removed grantlee and strigi packages.</para>
+        </listitem>
+        <listitem revision="sysv">
+          <para>[dj] - Only install the Linux-PAM module when rebuilding
+          libcap for Linux-PAM.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
     <listitem>
       <para>June 4th, 2016</para>
Index: postlfs/security/cyrus-sasl.xml
===================================================================
--- postlfs/security/cyrus-sasl.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/cyrus-sasl.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -269,12 +269,19 @@
 
     <sect3 id="cyrus-sasl-init">
-      <title>Init Script</title>
-
-      <para>
+      <title><phrase revision="sysv">Init Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
         If you need to run the <command>saslauthd</command> daemon at system
         startup, install the <filename>/etc/rc.d/init.d/saslauthd</filename>
-        init script included in the <xref linkend="bootscripts" revision="sysv"/>
-        <xref linkend="systemd-units" revision="systemd"/>
-        package using the following command:
+        init script included in the
+        <xref linkend="bootscripts"/> package using the following command:
+      </para>
+
+      <para revision="systemd">
+        If you need to run the <command>saslauthd</command> daemon at system
+        startup, install the <filename>saslauthd.service</filename> unit
+        included in the <xref linkend="systemd-units"/> package using the
+        following command:
       </para>
 
@@ -287,7 +294,11 @@
       <note>
         <para>
-          You'll need to modify /etc/sysconfig/saslauthd and replace the
-          <option><replaceable>AUTHMECH</replaceable></option> parameter
-          with your desired authentication mechanism.
+          You'll need to modify
+          <filename revision="sysv">/etc/sysconfig/saslauthd</filename>
+          <filename revision="systemd">/etc/default/saslauthd</filename>
+          and modify the
+          <option revision="sysv">AUTHMECH</option>
+          <option revision="systemd">MECHANISM</option>
+          parameter with your desired authentication mechanism.
         </para>
       </note>
Index: postlfs/security/firewalling.xml
===================================================================
--- postlfs/security/firewalling.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/firewalling.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -141,20 +141,24 @@
     </caution>
 
-    <para>The firewall configuration script installed in the iptables section
-    differs from the standard configuration script. It only has two of
-    the standard targets: start and status. The other targets are clear
-    and lock. For instance if you issue:</para>
-
-<screen role="root"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
-
-    <para>the firewall will be restarted just as it is upon system startup.
-    The status target will present a list of all currently implemented
-    rules. The clear target turns off all firewall rules and the lock
-    target will block all packets in and out of the computer with the
+    <para revision="sysv">The firewall configuration script installed in the
+    iptables section differs from the standard configuration script. It only
+    has two of the standard targets: start and status. The other targets are
+    clear and lock. For instance if you issue:</para>
+
+<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
+
+    <para revision="sysv">the firewall will be restarted just as it is upon
+    system startup. The status target will present a list of all currently
+    implemented rules. The clear target turns off all firewall rules and the
+    lock target will block all packets in and out of the computer with the
     exception of the loopback interface.</para>
 
-    <para>The main startup firewall is located in the file
+    <para revision="sysv">The main startup firewall is located in the file
     <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
     three different approaches that can be used for a system.</para>
+
+    <para revision="systemd">The main startup firewall is located in the file
+    <filename>/etc/systemd/scripts/iptables</filename>. The sections below
+    provide three different approaches that can be used for a system.</para>
 
     <note>
@@ -178,5 +182,5 @@
       to the Linux 2.6 kernels.</para>
 
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
+<screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
 <literal>#!/bin/sh
 
@@ -253,4 +257,83 @@
 EOF
 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
+
+
+<screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+# Insert connection-tracking modules
+# (not needed if built into the kernel)
+modprobe nf_conntrack
+modprobe xt_LOG
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects
+
+# Do not send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface, where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians
+
+# be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# disable Explicit Congestion Notification
+# too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local-only connections
+iptables -A INPUT  -i lo -j ACCEPT
+
+# Free output on any interface to any ip for any service
+# (equal to -P ACCEPT)
+iptables -A OUTPUT -j ACCEPT
+
+# Permit answers on already established connections
+# and permit new connections related to established ones
+# (e.g. port mode ftp)
+iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Log everything else. What's Windows' latest exploitable vulnerability?
+iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
 
       <para>This script is quite simple, it drops all traffic coming
@@ -284,5 +367,5 @@
       a worm via a buffer-overflow).</para>
 
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
+<screen role="root" revision="sysv"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
 <literal>#!/bin/sh
 
@@ -374,4 +457,100 @@
 EOF
 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
+
+<screen role="root" revision="systemd"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
+
+cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
+<literal>#!/bin/sh
+
+# Begin /etc/systemd/scripts/iptables
+
+echo
+echo "You're using the example configuration for a setup of a firewall"
+echo "from Beyond Linux From Scratch."
+echo "This example is far from being complete, it is only meant"
+echo "to be a reference."
+echo "Firewall security is a complex issue, that exceeds the scope"
+echo "of the configuration rules below."
+
+echo "You can find additional information"
+echo "about firewalls in Chapter 4 of the BLFS book."
+echo "http://www.&lfs-domainname;/blfs"
+echo
+
+# Insert iptables modules (not needed if built into the kernel).
+
+modprobe nf_conntrack
+modprobe nf_conntrack_ftp
+modprobe xt_conntrack
+modprobe xt_LOG
+modprobe xt_state
+
+# Enable broadcast echo Protection
+echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+# Disable Source Routed Packets
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
+
+# Enable TCP SYN Cookie Protection
+echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies
+
+# Disable ICMP Redirect Acceptance
+echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects
+
+# Don't send Redirect Messages
+echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects
+
+# Drop Spoofed Packets coming in on an interface where responses
+# would result in the reply going out a different interface.
+echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter
+
+# Log packets with impossible addresses.
+echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
+
+# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
+echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
+
+# Disable Explicit Congestion Notification
+# Too many routers are still ignorant
+echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
+
+# Set a known state
+iptables -P INPUT   DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT  DROP
+
+# These lines are here in case rules are already in place and the
+# script is ever rerun on the fly. We want to remove all rules and
+# pre-existing user defined chains before we implement new rules.
+iptables -F
+iptables -X
+iptables -Z
+
+iptables -t nat -F
+
+# Allow local connections
+iptables -A INPUT  -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+
+# Allow forwarding if the initiated on the intranet
+iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A FORWARD ! -i ppp+ -m conntrack --ctstate NEW       -j ACCEPT
+
+# Do masquerading
+# (not needed if intranet is not using private ip-addresses)
+iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
+
+# Log everything for debugging
+# (last of all rules, but before policy rules)
+iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT "
+iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
+iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
+
+# Enable IP Forwarding
+echo 1 &gt; /proc/sys/net/ipv4/ip_forward
+
+# End /etc/systemd/scripts/iptables</literal>
+EOF
+chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
 
       <para>With this script your intranet should be reasonably secure
Index: postlfs/security/gnutls.xml
===================================================================
--- postlfs/security/gnutls.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/gnutls.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -147,5 +147,5 @@
       To test the results, issue: <command>make check</command>.  If a prior
       version of <application>GnuTLS</application> (or the same version but
-      without all the recommended dependencies) has been installed, some
+      without all of the recommended dependencies) has been installed, some
       tests may fail. If <filename>/usr/lib/libgnutls.so</filename> and the
       target of that symlink are moved or renamed so that they cannot be found,
Index: postlfs/security/haveged.xml
===================================================================
--- postlfs/security/haveged.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/haveged.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -105,12 +105,21 @@
 
     <sect3  id="haveged-init">
-      <title>Boot Script</title>
+      <title><phrase revision="sysv">Boot Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
 
-      <para>
+      <para revision="sysv">
         If you want the <application>Haveged</application> daemon to
         start automatically when the system is booted, install the
         <filename>/etc/rc.d/init.d/haveged</filename> init script included
-        in the <xref linkend="bootscripts" revision="sysv"/>
-        <xref linkend="systemd-units" revision="systemd"/> package.
+        in the <xref linkend="bootscripts"/> package (as the
+        <systemitem class="username">root</systemitem> user):
+      </para>
+
+      <para revision="systemd">
+        If you want the <application>Haveged</application> daemon to
+        start automatically when the system is booted, install the
+        <filename>haveged.service</filename> unit included in the
+        <xref linkend="systemd-units"/> package (as the
+        <systemitem class="username">root</systemitem> user):
       </para>
 
Index: postlfs/security/iptables.xml
===================================================================
--- postlfs/security/iptables.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/iptables.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -163,5 +163,5 @@
     <para>
       <parameter>--disable-nftables</parameter>: This switch disables building
-      nftables compat.
+      nftables compat. Omit this switch if you have installed nftables.
     </para>
 
@@ -199,11 +199,17 @@
 
     <sect3  id="iptables-init">
-      <title>Boot Script</title>
-
-      <para>
+      <title><phrase revision="sysv">Boot Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
         To set up the iptables firewall at boot, install the
         <filename>/etc/rc.d/init.d/iptables</filename> init script included
-        in the <xref linkend="bootscripts" revision="sysv"/>
-        <xref linkend="systemd-units" revision="systemd"/> package.
+        in the <xref linkend="bootscripts"/> package.
+      </para>
+
+      <para revision="systemd">
+        To set up the iptables firewall at boot, install the
+        <filename>iptables.service</filename> unit included in the
+        <xref linkend="systemd-units"/> package.
       </para>
 
Index: postlfs/security/libcap.xml
===================================================================
--- postlfs/security/libcap.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/libcap.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -30,7 +30,8 @@
     <title>Introduction to libcap with PAM</title>
 
-    <para>The <application>libcap</application> package was installed in
-    LFS, but if PAM support is desired, it needs to be reinstalled after
-    PAM is built.</para>
+    <para>The <application>libcap</application> package was installed in 
+    LFS, but if <application>Linux-PAM</application> support is desired,
+    the PAM module must be built (after installation of
+    <application>Linux-PAM</application>).</para>
 
     &lfs79_checked;&gcc6_checked;
@@ -61,5 +62,7 @@
 
     <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required"><xref linkend="linux-pam"/></para>
+    <para role="required">
+      <xref linkend="linux-pam"/>
+    </para>
 
     <para condition="html" role="usernotes">User Notes:
@@ -74,44 +77,12 @@
     commands:</para>
 
-<screen><userinput>sed -i 's:LIBDIR:PAM_&amp;:g' pam_cap/Makefile &amp;&amp;
-make</userinput></screen>
+<screen><userinput>make -C pam_cap</userinput></screen>
 
     <para>This package does not come with a test suite.</para>
 
-    <para>
-      If you want to disable installing the static library, use this sed:
-    </para>
-
-<screen><userinput>sed -i '/install.*STALIBNAME/ s/^/#/' libcap/Makefile</userinput></screen>
-
     <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
 
-<screen role="root"><userinput>make prefix=/usr \
-     SBINDIR=/sbin \
-     PAM_LIBDIR=/lib \
-     RAISE_SETFCAP=no install</userinput></screen>
-
-   <para>
-     Still as the <systemitem class="username">root</systemitem> user,
-     clean up some library locations and permissions:
-   </para>
-
-<screen role="root"><userinput>chmod -v 755 /usr/lib/libcap.so &amp;&amp;
-mv -v /usr/lib/libcap.so.* /lib &amp;&amp;
-ln -sfv ../../lib/libcap.so.2 /usr/lib/libcap.so</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <command>sed -i '...'</command>, <parameter>PAM_LIBDIR=/lib</parameter>:
-      These correct PAM module install location.
-    </para>
-
-    <para><parameter>RAISE_SETFCAP=no</parameter>: This parameter skips trying
-    to use <application>setcap</application> on itself.  This avoids an installation
-    error if the kernel or file system do not support extended capabilities.</para>
+<screen role="root"><userinput>install -v -m755 pam_cap/pam_cap.so /lib/security &amp;&amp;
+install -v -m644 pam_cap/capability.conf /etc/security</userinput></screen>
 
   </sect2>
@@ -122,71 +93,14 @@
     <segmentedlist>
       <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Library</segtitle>
       <segtitle>Installed Directories</segtitle>
 
       <seglistitem>
-        <seg>capsh, getcap, getpcaps, and setcap</seg>
-        <seg>libcap.{so,a} and pam_cap.so</seg>
+        <seg>None</seg>
+        <seg>pam_cap.so</seg>
         <seg>None</seg>
       </seglistitem>
     </segmentedlist>
 
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="capsh">
-        <term><command>capsh</command></term>
-        <listitem>
-          <para>is a shell wrapper to explore and constrain capability support.</para>
-          <indexterm zone="libcap-pam capsh">
-            <primary sortas="b-capsh">capsh</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="getcap">
-        <term><command>getcap</command></term>
-        <listitem>
-          <para>examines file capabilities.</para>
-          <indexterm zone="libcap-pam getcap">
-            <primary sortas="b-getcap">getcap</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="getpcaps">
-        <term><command>getpcaps</command></term>
-        <listitem>
-          <para>displays the capabilities on the queried process(es).</para>
-          <indexterm zone="libcap-pam getpcaps">
-            <primary sortas="b-getpcaps">getpcaps</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="setcap">
-        <term><command>setcap</command></term>
-        <listitem>
-          <para>sets file file capabilities.</para>
-          <indexterm zone="libcap-pam setcap">
-            <primary sortas="b-setcap">setcap</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libcap-lib">
-        <term><filename class='libraryfile'>libcap.{so,a}</filename></term>
-        <listitem>
-          <para>contains the <application>libcap</application> API functions.</para>
-          <indexterm zone="libcap-pam libcap-lib">
-            <primary sortas="c-libcap">libcap.{so,a}</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
   </sect2>
 
Index: postlfs/security/linux-pam.xml
===================================================================
--- postlfs/security/linux-pam.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/linux-pam.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -377,5 +377,7 @@
         <para>
           You should now reinstall the <xref linkend="shadow"/>
-          package.
+          <phrase revision="sysv">package.</phrase>
+          <phrase revision="systemd"> and <xref linkend="systemd"/>
+          packages.</phrase>
         </para>
       </important>
Index: postlfs/security/mitkrb.xml
===================================================================
--- postlfs/security/mitkrb.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/mitkrb.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -445,12 +445,18 @@
 
     <sect3 id="mitkrb-init">
-      <title>Init Script</title>
-
-      <para>
+      <title><phrase revision="sysv">Init Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
         If you want to start <application>Kerberos</application> services
         at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
-        script included in the <xref linkend="bootscripts" revision="sysv"/>
-        <xref linkend="systemd-units" revision="systemd"/> package using
+        script included in the <xref linkend="bootscripts"/> package using
         the following command:
+      </para>
+
+      <para revision="systemd">
+        If you want to start <application>Kerberos</application> services
+        at boot, install the <filename>krb5.service</filename> unit included in
+        the <xref linkend="systemd-units"/> package using the following command:
       </para>
 
Index: postlfs/security/openssh.xml
===================================================================
--- postlfs/security/openssh.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/openssh.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -111,4 +111,15 @@
     <title>Installation of OpenSSH</title>
 
+    <warning revision="systemd">
+    <para>
+      If reinstalling over an <application>SSH</application> connection to
+      enable <xref linkend="linux-pam"/> support, be certain to temporarily set
+      <option>PermitRootLogin</option> to <parameter>yes</parameter> in
+      <filename>/etc/ssh/sshd_config</filename> until you complete
+      reinstallation of <xref linkend="systemd"/>, or you may find that you are
+      unable to login to the system remotely.
+    </para>
+    </warning>
+
     <para>
       <application>OpenSSH</application> runs as two processes when connecting
@@ -289,10 +300,10 @@
 
       <para>
-        If you added <application>LinuxPAM</application> support and you want
+        If you added <application>Linux-PAM</application> support and you want
         ssh to use it then you will need to add a configuration file for
         <application>sshd</application> and enable use of
         <application>LinuxPAM</application>. Note, ssh only uses PAM to check
         passwords, if you've disabled password logins these commands are not
-        needed. If you want to use PAM issue the following commands as the
+        needed. If you want to use PAM, issue the following commands as the
         <systemitem class='username'>root</systemitem> user:
       </para>
@@ -310,11 +321,17 @@
 
     <sect3  id="openssh-init">
-      <title>Boot Script</title>
-
-      <para>
+      <title><phrase revision="sysv">Boot Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
         To start the SSH server at system boot, install the
         <filename>/etc/rc.d/init.d/sshd</filename> init script included
-        in the <xref linkend="bootscripts" revision="sysv"/>
-        <xref linkend="systemd-units" revision="systemd"/> package.
+        in the <xref linkend="bootscripts"/> package.
+      </para>
+
+      <para revision="systemd">
+        To start the SSH server at system boot, install the
+        <filename>sshd.service</filename> unit included in the
+        <xref linkend="systemd-units"/> package.
       </para>
 
Index: postlfs/security/openssl.xml
===================================================================
--- postlfs/security/openssl.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/openssl.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -207,5 +207,5 @@
         providing functions to other programs such as
         <application>OpenSSH</application> and web browsers do not need to worry
-        about additional configuration. This is an advanced topic and so those
+        about additional configuration. This is an advanced topic and those
         who do need it would normally be expected to either know how to properly
         update <filename>/etc/ssl/openssl.cnf</filename> or be able to find out
Index: postlfs/security/p11-kit.xml
===================================================================
--- postlfs/security/p11-kit.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/p11-kit.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -120,6 +120,6 @@
     <para>
       <option>--with-hash-impl=freebl</option>: Use this switch if you want to
-      use Freebl library from <application>NSS</application> for SHA1 and MD5
-      hashing.
+      use the Freebl library from <application>NSS</application> for SHA1 and
+      MD5 hashing.
     </para>
 
Index: postlfs/security/polkit.xml
===================================================================
--- postlfs/security/polkit.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/polkit.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -81,4 +81,19 @@
     </para>
 
+    <bridgehead renderas="sect4" revision="systemd">Recommended</bridgehead>
+    <para role="recommended" revision="systemd">
+      <xref linkend="linux-pam"/>
+    </para>
+
+    <note revision="systemd">
+      <para>
+        Since <command>systemd-logind</command> uses PAM to register user
+        sessions, it is a good idea to build <application>Polkit</application>
+        with PAM support so <command>systemd-logind</command> can track
+        <application>Polkit</application> sessions.
+      </para>
+    </note>
+
+
     <bridgehead renderas="sect4">Optional (Required if building GNOME)</bridgehead>
     <para role="optional">
@@ -90,16 +105,22 @@
       <xref linkend="DocBook"/>,
       <xref linkend="docbook-xsl"/>,
-      <xref linkend="gtk-doc"/>,
-      <xref linkend="libxslt"/> and
-      <xref linkend="linux-pam"/>
+      <xref linkend="gtk-doc"/>, <phrase revision="systemd">and </phrase>
+      <xref linkend="libxslt"/><phrase revision="sysv">, and
+      <xref linkend="linux-pam"/></phrase>
+    </para>
+
+    <bridgehead renderas="sect4" revision="systemd">Required Runtime Dependencies</bridgehead>
+    <para role="required" revision="systemd">
+      <xref linkend="systemd"/>
     </para>
 
     <note>
       <para>
-        If <xref linkend="libxslt"/> is installed, then <xref linkend="DocBook"/>
-        and <xref linkend="docbook-xsl"/> are required. If you have installed
-        <xref linkend="libxslt"/>, but you do not want to install any of the
-        DocBook packages mentioned, you will need to use
-        <option>--disable-man-pages</option> in the instructions below.
+        If <xref linkend="libxslt"/> is installed,
+        then <xref linkend="DocBook"/> and <xref linkend="docbook-xsl"/> are
+        required. If you have installed <xref linkend="libxslt"/>, but you do
+        not want to install any of the DocBook packages mentioned, you will
+        need to use <option>--disable-man-pages</option> in the instructions
+        below.
       </para>
     </note>
@@ -124,4 +145,19 @@
         -g polkitd -s /bin/false polkitd</userinput></screen>
 
+    <note revision="systemd">
+      <para>
+        When building <application>Polkit</application> with
+        <application>systemd</application> logind support, the
+        <command>configure</command> script explicitly checks if
+        system is booted using <application>systemd</application>.
+        This can cause problems if building the package in chroot,
+        where the <command>configure</command> would fail to
+        detect <application>systemd</application>. To workaround
+        the problem, simply run the following command:
+      </para>
+
+<screen><userinput>sed -i "s:/sys/fs/cgroup/systemd/:/sys:g" configure</userinput></screen>
+    </note>
+
     <para>
       Install <application>Polkit</application> by running the following
@@ -129,5 +165,5 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr                \
+<screen revision="sysv"><userinput>./configure --prefix=/usr                \
             --sysconfdir=/etc            \
             --localstatedir=/var         \
@@ -137,4 +173,10 @@
 make</userinput></screen>
 
+<screen revision="systemd"><userinput>./configure --prefix=/usr        \
+            --sysconfdir=/etc    \
+            --localstatedir=/var \
+            --disable-static     &amp;&amp;
+make</userinput></screen>
+
     <para>
       To test the results, issue: <command>make check</command>.
@@ -156,5 +198,5 @@
     <title>Command Explanations</title>
 
-    <para>
+    <para revision="sysv">
       <parameter>--enable-libsystemd-login=no</parameter>: This parameter fixes
       building without <application>systemd</application>, which is not part
@@ -163,9 +205,16 @@
     </para>
 
-    <para>
+    <para revision="sysv">
       <parameter>--with-authfw=shadow</parameter>: This parameter configures the
       package to use the <application>Shadow</application> rather than the
-      <application>Linux PAM</application> Authentication framework. Remove it
-      if you would like to use <application>Linux PAM</application>.
+      <application>Linux-PAM</application> Authentication framework. Remove it
+      if you would like to use <application>Linux-PAM</application>.
+    </para>
+
+    <para revision="systemd">
+      <option>--with-authfw=shadow</option>: This switch enables the
+      package to use the <application>Shadow</application> rather than the
+      <application>Linux PAM</application> Authentication framework. Use it
+      if you have not installed <application>Linux PAM</application>.
     </para>
 
Index: postlfs/security/shadow.xml
===================================================================
--- postlfs/security/shadow.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/shadow.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -459,4 +459,12 @@
 done</userinput></screen>
 
+        <para revision="systemd">Because the installation of
+        <application>systemd</application> is not yet complete, you will need
+        to remove the <filename>/run/nologin</filename> file before testing the
+        installation. Execute the following command as the
+        <systemitem class="username">root</systemitem> user:</para>
+
+<screen role="root" revision="systemd"><userinput>rm -f /run/nologin</userinput></screen>
+
         <warning>
           <para>
@@ -532,5 +540,9 @@
     <para>
       A list of the installed files, along with their short descriptions can be
-      found at <ulink url="http://www.linuxfromscratch.org/lfs/view/&lfs-version;/chapter06/shadow.html#contents-shadow"/>.
+      found at
+      <phrase revision="sysv">
+      <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/></phrase>
+      <phrase revision="systemd">
+      <ulink url="&lfs-rootd;/chapter06/shadow.html#contents-shadow"/></phrase>.
     </para>
 
Index: postlfs/security/stunnel.xml
===================================================================
--- postlfs/security/stunnel.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/stunnel.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -150,4 +150,11 @@
 <screen role="root"><userinput>make docdir=/usr/share/doc/stunnel-&stunnel-version; install</userinput></screen>
 
+    <para revision="systemd">
+      Install the included systemd unit by running the following command as the
+      <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root" revision="systemd"><userinput>install -v -m644 tools/stunnel.service /lib/systemd/system</userinput></screen>
+
     <para>If you do not already have a signed SSL Certificate and Private Key,
     create the <filename>stunnel.pem</filename> file in the
@@ -255,11 +262,16 @@
 
     <sect3  id="stunnel-init">
-      <title>Boot Script</title>
-
-      <para>To automatically start the <command>stunnel</command> daemon
-      when the system is booted, install the
+      <title><phrase revision="sysv">Boot Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">To automatically start the
+      <command>stunnel</command> daemon when the system is booted, install the
       <filename>/etc/rc.d/init.d/stunnel</filename> bootscript from the
-      <xref linkend="bootscripts" revision="sysv"/>
-      <xref linkend="systemd-units" revision="systemd"/> package.</para>
+      <xref linkend="bootscripts"/> package.</para>
+
+      <para revision="systemd">To start the <command>stunnel</command>
+      daemon at boot, enalbe the previously installed
+      <application>systemd</application> unit by running the following command
+     as the <systemitem class="username">root</systemitem> user:</para>
 
       <indexterm zone="stunnel stunnel-init">
@@ -267,5 +279,7 @@
       </indexterm>
 
-<screen role="root"><userinput>make install-stunnel</userinput></screen>
+<screen role="root" revision="sysv"><userinput>make install-stunnel</userinput></screen>
+
+<screen role="root" revision="systemd"><userinput>systemctl enable stunnel</userinput></screen>
 
     </sect3>
Index: postlfs/security/sudo.xml
===================================================================
--- postlfs/security/sudo.xml	(revision eb3dbe3bec771663ff1b76e72a4a3b3bb5bd45fe)
+++ postlfs/security/sudo.xml	(revision f586237a1c5b4a634bcc3da2cec5a62830a324a3)
@@ -159,6 +159,7 @@
 
     <para>
-      <option>--without-pam</option>: Avoids building <application>PAM</application>
-      support when <application>PAM</application> is installed on the system.
+      <option>--without-pam</option>: This switch avoids building
+      <application>Linux-PAM</application> support when
+      <application>Linux-PAM</application> is installed on the system.
     </para>
 
@@ -175,5 +176,5 @@
 
     <para>
-      <command>ln -sfv libsudo_util...</command>: works around a bug in the
+      <command>ln -sfv libsudo_util...</command>: Works around a bug in the
       installation process, which links to the previously installed
       version (if there is one) instead of the new one.
