Beyond Linux® From Scratch

Version 6.3

BLFS Development Team

Copyright © 2001-2008, BLFS Development Team

All rights reserved.

Descriptive text is licensed under a Creative Commons License.

Computer instructions are licensed under the Academic Free License v. 2.1.

Linux® is a registered trademark of Linus Torvalds.

2008-08-24

Revision History
Revision 6.3 2008-08-24 Seventh release
Revision 6.2.0 2007-02-14 Sixth release
Revision 6.1 2005-08-14 Fifth release
Revision 6.0 2005-04-02 Fourth release
Revision 5.1 2004-06-05 Third release
Revision 5.0 2003-11-06 Second release
Revision 1.0 2003-04-25 First release

Abstract

This book follows on from the Linux From Scratch book. It introduces and guides the reader through additions to the system including networking, graphical interfaces, sound support, and printer and scanner support.


Dedication

This book is dedicated to the LFS community

Table of Contents

Preface

Having helped out with Linux From Scratch for a short time, I noticed that we were getting many queries as to how to do things beyond the base LFS system. At the time, the only assistance specifically offered relating to LFS were the LFS hints (http://www.linuxfromscratch.org/hints). Most of the LFS hints are extremely good and well written but I (and others) could still see a need for more comprehensive help to go Beyond LFS - hence BLFS.

BLFS aims to be more than the LFS-hints converted to XML although much of our work is based around the hints and indeed some authors write both hints and the relevant BLFS sections. We hope that we can provide you with enough information to not only manage to build your system up to what you want, whether it be a web server or a multimedia desktop system, but also that you will learn a lot about system configuration as you go.

Thanks as ever go to everyone in the LFS/BLFS community; especially those who have contributed instructions, written text, answered questions and generally shouted when things were wrong!

Finally, we encourage you to become involved in the community; ask questions on the mailing list or news gateway and join in the fun on #lfs at irc.linuxfromscratch.org. You can find more details about all of these in the Introduction section of the book.

Enjoy using BLFS.

Mark Hymers
markh <at> linuxfromscratch.org
BLFS Editor (July 2001–March 2003)

I still remember how I found the BLFS project and started using the instructions that were completed at the time. I could not believe how wonderful it was to get an application up and running very quickly, with explanations as to why things were done a certain way. Unfortunately, for me, it wasn't long before I was opening applications that had nothing more than "To be done" on the page. I did what most would do, I waited for someone else to do it. It wasn't too long before I am looking through Bugzilla for something easy to do. As with any learning experience, the definition of what was easy kept changing.

We still encourage you to become involved as BLFS is never really finished. Contributing or just using, we hope you enjoy your BLFS experience.

Larry Lawrence
larry <at> linuxfromscratch.org
BLFS Editor (March 2003–June 2004)

The BLFS project is a natural progression of LFS. Together, these projects provide a unique resource for the Open Source Community. They take the mystery out of the process of building a complete, functional software system from the source code contributed by many talented individuals throughout the world. They truly allow users to implement the slogan "Your distro, your rules."

Our goal is to continue to provide the best resource available that shows you how to integrate many significant Open Source applications. Since these applications are constantly updated and new applications are developed, this book will never be complete. Additionally, there is always room for improvement in explaining the nuances of how to install the different packages. To make these improvements, we need your feedback. I encourage you to participate on the different mailing lists, news groups, and IRC channels to help meet these goals.

Bruce Dubbs
bdubbs <at> linuxfromscratch.org
BLFS Editor (June 2004–December 2006)

My introduction to the [B]LFS project was actually by accident. I was trying to build a GNOME environment using some how-tos and other information I found on the web. A couple of times I ran into some build issues and Googling pulled up some old BLFS mailing list messages. Out for curiosity, I visited the Linux From Scratch web site and shortly thereafter was hooked. I've not used any other Linux distribution for personal use since.

I can't promise anyone will feel the sense of satisfaction I felt after building my first few systems using [B]LFS instructions, but I sincerely hope that your BLFS experience is as rewarding for you as it has been for me.

The BLFS project has grown significantly the last couple of years. There are more package instructions and related dependencies than ever before. The project requires your input for continued success. If you discover that you enjoy building BLFS, please consider helping out in any way you can. BLFS requires hundreds of hours of maintenance to keep it even semi-current. If you feel confident enough in your editing skills, please consider joining the BLFS team. Simply contributing to the mailing list discussions with sound advice and/or providing patches to the book's XML will probably result in you receiving an invitation to join the team.

Randy McMurchy
randy <at> linuxfromscratch.org
BLFS Editor (December 2006–Present)

Foreword

BLFS version 6.3 is the complement to the LFS 6.3 book. It has been 18 months since the last release of BLFS and almost 12 months since LFS-6.3 was released. Though we would like to release BLFS versions as quickly as possible after an LFS release, this version lagged a bit due to Editor inactivity. However, early on in 2008 several new Editors were brought on board which helped stimulate a flurry of activity. Many new packages have been introduced in the 6.3 version, as well as many updates, refinements and additions to the existing packages.

The BLFS book now provides build and configuration instructions for almost 500 packages (many more than that if you want to count each individual package in the autotooled X Window instructions). Some of the new packages introduced in this version are: Dash, ksh, D-Bus bindings, Wireshark (formerly named Ethereal), rxvt-unicode, Gutenprint (formerly name Gimp-Print), Pidgin (formerly name Gaim), GnuTLS (and many of its dependencies), Qt version 4.x, GnuPG version 2.x, and Amarok. Major updates include GNOME-2.18.3 (with several new GNOME packages), KDE-3.5.9, Firefox-2.x, Thunderbird-2.x, and most (if not all) of the mainline server packages. As always, the list of packages that have been upgraded or added as well as configuration and build command changes are annotated in the Change Log.

As always, the main thrust of BLFS development will be to support the changes in the current LFS development book, but we're releasing this version of BLFS so that builders of the stable LFS book can continue on into BLFS with known good instructions that should be 100% compatible to provide a semi current and very stable Linux platform.

Enjoy!

Randy McMurchy
August 24th, 2008

Last updated on 2008-08-24 14:01:22 -0500

Who Would Want to Read this Book

This book is mainly aimed at those who have built a system based on the LFS book. It will also be useful for those who are using other distributions, but for one reason or another want to manually build software and are in need of some assistance. Note that the material contained in this book, in particular the dependency listings, is based upon the assumption that you are using a base LFS system with every package listed in the LFS book already installed and configured. BLFS can be used to create a range of diverse systems and so the target audience is probably nearly as wide as that of the LFS book. If you found LFS useful, you should also like this!

Since Release 5.0, the BLFS book version matches the LFS book version. This book may be incompatible with a previous or latter release of the LFS book.

Last updated on 2007-04-04 14:42:53 -0500

Organization

This book is divided into the following parts.

Part I - Introduction

This part contains information which is essential to the rest of the book.

Part II - Post LFS Configuration and Extra Software

Here we introduce basic configuration and security issues. We also discuss a range of editors, file systems, and shells which aren't covered in the main LFS book.

Part III - General Libraries and Utilities

In this section we cover libraries which are often needed by the rest of the book as well as system utilities. Information on Programming (including recompiling GCC to support its full range of languages) concludes this part.

Part IV - Connecting to a Network

Here we cover how to connect to a network when you aren't using the simple static IP setup given in the main LFS book.

Part V - Basic Networking

Networking libraries and command-line networking tools make up the bulk of this part.

Part VI - Major Servers

Here we deal with setting up mail and other servers (such as SSH, Apache, etc.).

Part VII - X + Window Managers

This part explains how to set up a basic X Window System installation along with some generic X libraries and Window managers.

Part VIII - KDE

For those who want to use the K Desktop Environment or some parts of it, this part covers it.

Part IX - GNOME

GNOME is the main alternative to KDE in the Desktop Environment arena and we cover GNOME-2.18 here.

Part X - X Software

Office programs and graphical web browsers are important to most people. They, along with some generic X software can be found in this part of the book.

Part XI - Multimedia

Here we cover setting multimedia libraries and drivers along with some audio, video and CD-writing programs.

Part XII - Printing, Scanning and Typesetting (PST)

The PST part of the book covers document handling with applications like Ghostscript, CUPS and DocBook to installing teTeX.

Appendices

The Appendices cover information which doesn't belong in the main book; they are mainly there as a reference.

Last updated on 2007-10-16 06:56:37 -0500

Errata

The software used to create BLFS applications is constantly being updated and enhanced. Security warnings and bug fixes may become available after the BLFS book has been released. To check whether the package versions or instructions in this release of BLFS need any modifications to accommodate security vulnerabilities or other bug fixes, please visit http://www.linuxfromscratch.org/blfs/errata/6.3/ before proceeding with your build. You should note any changes shown and apply them to the relevant section of the book as you progress with building the applications in BLFS.

Last updated on 2007-04-04 14:42:53 -0500

Part I. Introduction

Chapter 1. Welcome to BLFS

The Beyond Linux From Scratch book is designed to carry on from where the LFS book leaves off. But unlike the LFS book, it isn't designed to be followed straight through. Reading the Which sections of the book? part of this chapter should help guide you through the book.

Please read most of this part of the book carefully as it explains quite a few of the conventions used throughout the book.

Acknowledgments

We would like to thank the following people and organizations for their contributions toward the BLFS and LFS projects:

  • All those people listed on the Credits page for submitting patches, instructions and corrections to the book. The former editor would especially like to thank Bruce, Larry and Billy for their enormous inputs to the project.

  • Jeff Bauman (former co-editor of the book) for his assistance with getting BLFS off the ground.

  • Gerard Beekmans <gerard <at> linuxfromscratch.org> for starting and writing the vast majority of the LFS project.

  • Robert Briggs for donating the linuxfromscratch.org and linuxfromscratch.com domain names.

  • DREAMWVR.COM for their ongoing sponsorship by donating various resources to the LFS and related sub projects.

  • Bruce Dubbs for donating the anduin package server and his substantial contribution to the purchase of the new quantum server.

  • Garrett LeSage <garrett <at> linux.com> for creating the LFS banner.

  • Frank Skettino <bkenoah <at> oswd.org> at OSWD for coming up with the initial design of the LFS and BLFS websites.

  • Mark Stone <mstone <at> linux.com> for donating the original linuxfromscratch.org servers.

  • Jesse Tie-Ten-Quee <higho <at> linuxfromscratch.org> for answering many questions on IRC, having a great deal of patience and for not killing the former editor for the joke in the original BLFS announcement!

  • Countless other people on the various LFS and BLFS mailing lists who are making this book possible by giving their suggestions, testing the book and submitting bug reports.

Last updated on 2007-10-16 06:56:37 -0500

Credits

Many people have contributed both directly and indirectly to BLFS. This page lists all of those we can think of. We may well have left people out and if you feel this is the case, drop us a line. Many thanks to all of the LFS community for their assistance with this project. If you are in the list and wish to have your email address included, again please drop us a line to randy AT linuxfromscratch D0T org and we'll be happy to add it. We don't include email addresses by default so if you want it included, please state so when you contact us.

Editors

  • Editor: Randy McMurchy <randy AT linuxfromscratch D0T org>

  • Co-Editors: Robert Daniels, Richard Downing, Bruce Dubbs, Manuel Canales Esparcia, Ag Hatzimanikas, David Jensen, DJ Lucas, Ken Moffet, Dan Nicholson, Alexander Patrakov, Chris Staub, Tushar Teredesai, Thomas Trepl, and Christian Wurst

Text Authors

  • Chapter 01. Based on the LFS introductory text by Gerard Beekmans, modified by Mark Hymers for BLFS.

  • Chapter 02: The /usr versus /usr/local debate: Andrew McMurry.

  • Chapter 02: Going beyond BLFS: Tushar Teredesai.

  • Chapter 02: Package Management: Tushar Teredesai.

  • Chapter 02: Automated Building Procedures: Randy McMurchy.

  • Chapter 02: Locale Related Issues: Alexander Patrakov and Randy McMurchy.

  • Chapter 03: /etc/inputrc: Chris Lynn.

  • Chapter 03: Customizing your logon & vimrc: Mark Hymers.

  • Chapter 03: /etc/shells: Igor Zivkovic.

  • Chapter 03: Random number script Larry Lawrence.

  • Chapter 03: Creating a Custom Boot Device Bruce Dubbs.

  • Chapter 03: The Bash Shell Startup Files James Robertson revised by Bruce Dubbs.

  • Chapter 03: Compressed docs Olivier Peres.

  • Chapter 04: Firewalling: Henning Rohde with thanks to Jeff Bauman. Revised by Bruce Dubbs.

  • Chapter 11: Which Mark Hymers with many thanks to Seth Klein and Jesse Tie-Ten-Quee.

  • Chapter 25: X Window System Environment: Bruce Dubbs.

  • Chapter 27: Intro to Window Managers: Bruce Dubbs.

  • Chapters 28, 29, and 30: KDE: Bruce Dubbs.

  • Chapters 31 and 32: GNOME: Larry Lawrence.

Installation Instruction Authors

  • traceroute: Jeff Bauman

  • ProFTPD and rsync: Daniel Baumann

  • joe, nano, nmap, slang, w3m and whois: Timothy Bauscher

  • Fetchmail: Paul Campbell

  • CDParanoia, mpg123, SDL and XMMS: Jeroen Coumans

  • Amarok: Robert Daniels

  • UDFtools, Perl modules (initial version) and Bluefish: Richard Downing

  • sudo, wireless_tools: Bruce Dubbs

  • tripwire: Manfred Glombowski

  • Dash and rxvt-unicode: Ag Hatzimanikas

  • alsa, cvs, dhcpcd, gpm, hdparm, libjpeg, libmng, libpng, libtiff, giflib, links, lynx, openssl, tcsh, which and zsh: Mark Hymers

  • ALSA Firmware, ALSA OSS, inetutils, GLib, GTK+, libxml and vim: James Iwanek

  • db and lcms: Jeremy Jones and Mark Hymers

  • aalib, Alsa, ffmpeg, MPlayer, transcode, xvid and xsane: Alex Kloss

  • ntp: Eric Konopka

  • AbiWord, at-spi, ATK, audiofile, avifile, bc, bug-buddy, cdrdao, cdrtools, cpio, curl, dhcp, eog, esound, fcron, fluxbox, gail, galeon, gconf-editor, gdbm, gedit, gimp, GLib2, gmp, gnet, gnome-applets, gnome-desktop, gnome-games, gnome-icon-theme, gnome-libs, gnome-media, gnome-mime-data, gnome-panel, gnome-session, gnome-system-monitor, gnome-terminal, gnome-themes, gnome-utils, gnome-vfs, gnome-user-docs, gnumeric, GTK+2, gtk-doc, gtk-engines, eel, imlib, intltool, lame, libao, libart_lgpl, libbonobo, libbonoboui, libgail-gnome, libglade2, libgnome, libgnomecanvas, libgnomeprint, libgnomeprintui, libgnomeui, libgsf, libgtkhtml, libgtop, libIDL, libogg, librep, librsvg, libvorbis, libwnck, libxml2, libxslt, LPRng, Linux-PAM, metacity, MIT Kerberos 5, MPlayer, mutt, nautilus, OpenJade, OpenSP, OpenSSH, ORBit2, pan, Pango, pcre, pkgconfig, postfix, procmail, Python, QT, rep-gtk, ruby, sawfish, scrollkeeper, sgml-common, sgml-dtd, shadow, startup-notification, unzip, vorbis-tools, vte, wget, XFce, xine, xml-dtd, yelp and zip: Larry Lawrence

  • Archive::Zip, cracklib, JDK6, ksh, libdrm, libpcap, Mesa, netfs, OpenOffice-2, PPP (update), Samba-3, Subversion, Xorg-7 and xterm: DJ Lucas

  • ALSA Tools, Apache Ant, cairo, Cyrus-SASL, D-BUS, D-Bus Bindings, DejaGnu, desktop-file-utils, DocBook DSSSL Stylesheets, DocBook-utils, dvd+rw-tools, Evince, Evolution Data Server, Exim (many additions), Expect, FOP, FreeTTS, FriBidi, GC, GCC (rewrite), GMime, gnome-audio, gnome-backgrounds, gnome-menus, gnome-mount, gnome-screensaver, gnome-volume-manager, GNOME Doc Utils, GNOME Keyring Manager, GnuCash (version 2), GnuPG2, GnuTLS, GOffice, Graphviz, GStreamer Base Plug-ins, GStreamer Good Plug-ins, GStreamer Ugly Plug-ins, HAL, Heimdal, HTML Tidy, icon-naming-utils, ISO Codes, JadeTeX, Java Access Bridge, JUnit, K3b, Libassuan, LessTif (rewrite), libexif, libgail-gnome, libgcrypt, libgnomecups, libgnomekbd, libgpg-error, Libidn, Libksba, libmpeg2, libmusicbrainz, libquicktime, mcs, MIT Kerberos V5 (many updates and enhancements), MPlayer (extensive overhaul), NSS, Orca, Other Programming Tools, PDL, Perl Modules, pilot-link, PIN-Entry, Poppler, Pth, PyXML, Samba 3 (many additions), SANE (original instructions by Alex Kloss), Shadow (rewrite), SLIB, Sound Juicer, Stunnel, Subversion Client (many additions), Sysstat, system-tools-backends, Totem, unixODBC, Wireshark and usbutils: Randy McMurchy

  • aspell, balsa, bind, cvs server, emacs, evolution, exim, expat, GnuCash, gtkhtml, guile, g-wrap, leafnode, lesstif, libesmtp, pine, portmap, PostgreSQL, qpopper, reiserfs, sendmail, slrn, teTeX, tcp-wrappers, and xinetd: Billy O'Connor

  • Gutenprint (originally named Gimp-Print), libusb, FAAC, FAAD2 and TIN: Alexander E. Patrakov

  • Screen: Andreas Pedersen

  • nfs-utils: Reinhard

  • ESP Ghostscript: Matt Rogers

  • iptables: Henning Rohde

  • fontconfig, gcc, seamonkey, nas, openoffice, ispell, mailx (formerly named Nail), ImageMagick, hd2u, tcl, tk and bind-utils: Tushar Teredesai

  • MySQL: Jesse Tie-Ten-Quee

  • PHP: Jeremy Utley

  • Ekiga, Epiphany, FLAC, File Roller, GNOME Magnifier, GNOME Netstatus, GNOME Speech, GOK, Imlib2, LZO, MC, NASM, Nautilus CD Burner, Speex, XScreenSaver, Zenity, compface, freeglut, gcalctool, gucharmap, id3lib, kde-i18n, kdeaccessibility, kdebindings, kdesdk, kdevelop, kdewebdev, libFAME, liba52, libdv, libdvdcss, libdvdread, libmad, libmikmod and libmpeg3: Igor Zivkovic

General Acknowledgments

  • Fernando Arbeiza for doing great quality assurance on Shadow utilizing PAM. The machine access he saved may have been yours.

  • Archaic for trouble shooting the mozilla section by performing multiple builds and for providing a description of the various mozilla extensions.

  • Miguel Bazdresch for many suggestions and contributions to the Other Programming Tools section.

  • Gerard Beekmans for generally putting up with us and for running the whole LFS project.

  • Oliver Brakmann for developing the dhcpcd patch for FHS compliance.

  • Ian Chilton for writing the nfs hint.

  • Nathan Coulson for writing the new network bootscripts.

  • Nathan Coulson, DJ Lucas and Zack Winkles for reworking the bootscripts used throughout the book.

  • Jim Harris for writing the dig-nslookup-host.txt hint on which the bind-utils instructions are based.

  • Lee Harris for writing the gpm.txt hint on which our gpm instructions are based.

  • Marc Heerdink for creating patches for tcp_wrappers and portmap and for writing the gpm2.txt hint on which our gpm instruction are based.

  • Mark Hymers for initiating the BLFS project and writing many of the initial chapters of the book.

  • J_Man for submitting a gpm-1.19.3.diff file on which our gpm instructions are based.

  • Jeremy Jones (otherwise known as mca) for hacking Makefiles and general assistance.

  • Steffen Knollmann for revising the JadeTeX instructions to work with teTex-3.0.

  • Eric Konopka for writing the ntp.txt hint on which the ntp section is based.

  • Scot McPherson for writing the gnome-1.4.txt hint from which was gathered useful information and for warning us that GNOME Version 2.0 may not be ready to put in the book.

  • Billy O'Connor for building GNOME 2.0 so many times and being very helpful with his comments on that section.

  • Alexander E. Patrakov for patches and suggestions to improve the book content, assistance with alsa dev.d helpers, and increasing the l10n awareness.

  • Ted Riley for writing the Linux-PAM + CrackLib + Shadow hint on which reinstalling Shadow to use PAM is based.

  • Jeremy Byron and David Ciecierski for assisting with, modifying, and testing various OpenOffice-2.0-pre builds and patches.

Last updated on 2008-05-12 07:59:11 -0500

Which Sections of the Book Do I Want?

Unlike the Linux From Scratch book, BLFS isn't designed to be followed in a linear manner. This is because LFS provides instructions on how to create a base system which is capable of turning into anything from a web server to a multimedia desktop system. BLFS is where we try to guide you in the process of going from the base system to your intended destination. Choice is very much involved.

Everyone who reads the book will want to read certain sections. The Introduction part, which you are currently reading, contains generic information. Especially take note of the information in Chapter 2, Important Information, as this contains comments about how to unpack software, issues related to using different locales and various other aspects which apply throughout the book.

The part on Post LFS Configuration and Extra Software is where most people will want to turn next. This deals with not just configuration but also Security (Chapter 4, Security), File Systems (Chapter 5, File Systems), Editors (Chapter 6, Editors) and Shells (Chapter 7, Shells). Indeed, you may wish to reference certain parts of this chapter (especially the sections on Editors and File Systems) while building your LFS system.

Following these basic items, most people will want to at least browse through the General Libraries and Utilities part of the book. This part contains information on many items which are prerequisites for other sections of the book as well as some items (such as Chapter 12, Programming) which are useful in their own right. Note that you don't have to install all of these libraries and packages found in this part to start with as each BLFS installation procedure tells you which packages it depends upon so you can choose the program you want to install and see what it needs.

Likewise, most people will probably want to look at the Basic Networking part. It deals with connecting to the Internet or your LAN (Chapter 13, Connecting to a Network) using a variety of methods such as DHCP and PPP, and with items such as Networking Libraries (Chapter 14, Networking Libraries) and various basic networking programs and utilities.

Once you have dealt with these basics, you may wish to configure more advanced network services. These are dealt with in the Servers part of the book. Those wanting to build servers should find a good starting point there. Note that this section also contains information on various database packages.

The next parts of the book principally deal with desktop systems. This portion of the book starts with a part talking about X and Window Managers. This part also deals with some generic X-based libraries (Chapter 24, X Libraries). After this, KDE and GNOME are given their own parts which are followed by one on X Software.

The book then moves on to deal with Multimedia packages. Note that many people may want to use the ALSA-1.0.13 instructions from this chapter quite near the start of their BLFS journey; they are placed here simply because it is the most logical place for them.

The final part of the main BLFS book deals with Printing, Scanning and Typesetting. This is useful for most people with desktop systems and even those who are creating mainly server systems will find it useful.

We hope you enjoy using BLFS and find it useful.

Last updated on 2008-03-18 10:49:58 -0500

Conventions Used in this Book

To make things easy to follow, there are a number of conventions used throughout the book. Following are some examples:

./configure --prefix=/usr

This form of text is designed to be typed exactly as seen unless otherwise noted in the surrounding text. It is also used to identify references to specific commands.

install-info: unknown option
`--dir-file=/mnt/lfs/usr/info/dir'

This form of text (fixed width text) is showing screen output, probably a result from issuing a command. It is also used to show filenames such as /boot/grub/grub.conf

Emphasis

This form of text is used for several purposes in the book but mainly to emphasize important points or to give examples as to what to type.

http://www.linuxfromscratch.org/

This form of text is used for hypertext links external to the book such as HowTos, download locations, websites, etc.

SeaMonkey-1.1.9

This form of text is used for links internal to the book such as another section describing a different package.

cat > $LFS/etc/group << "EOF"
root:x:0:
bin:x:1:
......
EOF

This type of section is used mainly when creating configuration files. The first command (in bold) tells the system to create the file $LFS/etc/group from whatever is typed on the following lines until the sequence EOF is encountered. Therefore, this whole section is generally typed as seen.

<REPLACED TEXT>

This form of text is used to encapsulate text that should be modified and is not to be typed as seen, or copy and pasted. Note that the square brackets are not part of the text, but should be substituted for as well.

root

This form of text is used to show a specific system user or group reference in the instructions.

Last updated on 2007-04-04 14:42:53 -0500

Book Version

This is BLFS-BOOK version 6.3 dated August 24th, 2008. This version is intended as the complement to the LFS-6.3 book.

Last updated on 2008-05-12 07:59:11 -0500

Mirror Sites

The BLFS project has a number of mirrors set up world-wide to make it easier and more convenient for you to access the website. Please visit the http://www.linuxfromscratch.org/mirrors.html website for the list of current mirrors.

Last updated on 2007-04-04 14:42:53 -0500

Getting the Source Packages

Within the BLFS instructions, each package has two references for finding the source files for the package—an HTTP link and an FTP link (some packages may only list one of these links). Every effort has been made to ensure that these links are accurate. However, the World Wide Web is in continuous flux. Packages are sometimes moved or updated and the exact URL specified is not always available.

To overcome this problem, the BLFS Team, with the assistance of Server Beach, has made an HTTP/FTP site available at anduin.linuxfromscratch.org. This site has all the sources of the exact versions of the packages used in BLFS. If you can't find the BLFS package you need, get it there.

We would like to ask a favor, however. Although this is a public resource for you to use, we do not want to abuse it. We have already had one unthinking individual download over 3 GB of data, including multiple copies of the same files that are placed at different locations (via symlinks) to make finding the right package easier. This person clearly did not know what files he needed and downloaded everything. The best place to download files is the site or sites set up by the source code developer. Please try there first.

Last updated on 2007-04-04 14:42:53 -0500

Change Log

Please note that the Change Log only lists which editor was responsible for putting the changes into SVN; please read the Credits page in Chapter 1 for details on who wrote what.

Current release: 6.3 – August 24th, 2008

Changelog Entries:

  • August 24th, 2008

    • [randy] - Fixed a broken URL for the libpcap package.

    • [randy] - Fixed a broken URL for the Libassuan package.

    • [randy] - Fixed a broken URL for the GnuPG2 package.

    • [randy] - Fixed a broken URL for the GnuPG package.

    • [randy] - Fixed a broken URL for the libidn package.

  • August 17th, 2008

    • [randy] - Modified the sudo instructions so the Linux-PAM configuration file is correct. Thanks to Jeremy Henty for the report.

  • August 15th, 2008

    • [thomas] - Added a command to create a missing test data file in the CrackLib instructions so that 'make test' works.

  • August 11th, 2008

    • [randy] - Added some text to the AutoFS instructions pointing out that the wget package must be installed. Thanks to Leonhard Landrock for the report.

    • [randy] - Changed the location of the Stunnel patch due to upstream's removing it. Thanks to Brian Cade for the report.

    • [randy] - Added parameters to the Pin Entry instructions so the configuration process won't fail if the optional dependencies are not installed. Thanks to Brian Cade for the report.

    • [randy] - Fixed broken Thunderbird download URL.

    • [randy] - Fixed broken rsync download URL.

    • [randy] - Fixed broken Whois download URL.

  • August 10th, 2008

    • [randy] - Updated the PAR-Dist Perl module to 0.31.

    • [randy] - Updated the Text-CSV_XS Perl module to 0.52.

  • Aug 1st, 2008

    • [thomas] - Fix net-tools download location.

  • July 12th, 2008

    • [ken] - Updated security_fixes patch for poppler-0.5.4.

    • [ken] - Updated security_fixes patch for fetchmail-6.3.8.

    • [ken] - Updated firefox to 2.0.0.15 to fix another batch of vulnerabilities.

  • July 9th, 2008

    • [ken] - Updated freetype to 2.3.7 (bugfixes on top of the vulnerability fixes).

    • [ken] - Updated libpng to 1.2.29 (bugfixes on top of the vulnerability fixes).

    • [ken] - Added security patch to libvorbis.

  • July 8th, 2008

    • [ken] - Added security patch to pcre.

  • June 27th, 2008

    • [dj] - Corrected warning in shadow instructions to add the --without-pam switch instead of replace.

  • June 25th, 2008

    • [dj] - Removed Xorg-Data page and replaced with remaining xcursor-themes package.

  • June 19th, 2008

    • [dj] - Corrected text surrounding the sample commands Xorg installation.

    • [dj] - Added libXdmcp to Xorg Libraries required dependendcies.

    • [dj] - Accounted for additional path depth in Xorg Libraries patch commands. Reported by Philipp Christian Loewner.

  • June 9th, 2008

    • [alexander] - Fixed typos on the PPP page.

  • June 6th, 2008

    • [thomas] - Update to new Samba version 3.0.30.

  • May 24th, 2008

    • [dj] - Completed removal of xorg proxy packages.

    • [dj] - Fixed pam_xauth.so module name in /etc/pam.s/su. Reported by Guy Dalziel.

  • May 16th, 2008

    • [randy] - Modified the akode tarball download URL in the kdemultimedia instructions to a wget-friendly name.

    • [randy] - Added a download URL and a command to install the akode patch for experimental FFmpeg support in the kdemultimedia instructions.

  • May 15th, 2008

    • [dnicholson] - Fix the Linux-PAM tarball md5sum and size. Thanks to Toni for the report.

    • [rdaniels] - Added --without-ffmpeg to Akode instructions to prevent compilation errors from building Akode with FFmpeg support.

  • May 14th, 2008

    • [randy] - Added a patch to the rxvt-unicode instructions to fix a security vulnerability and changed the download URL to a more consistent location.

  • May 12th, 2008

    • [randy] - Released BLFS-6.3-rc1.

    • [dj] - Removed JDK source installation instructions because of unavailable security patches.

  • May 10th, 2008

    • [randy] - Fixed broken download URLs in various package instructions.

    • [randy] - Updated various Perl Modules: Business-ISBN-Data-1.17, DateManip-5.54, IO-Zlib-1.09, Text-CSV-1.05 (was Text-CSV_PP), Text-CSV_XS-0.45, version-0.74 and XML-Simple-2.18.

    • [randy] - Updated to ImageMagick-6.3.5-10.

  • May 9th, 2008

    • [dnicholson] - Fixed libXfont to work with newer versions of FreeType2.

    • [randy] - Updated to rsync-3.0.2.

    • [dj] - Updated to sudo-1.6.9p15.

    • [dj] - Correted incorrect variable in precompiled JDK instructions.

  • May 7th, 2008

    • [dj] - Completed cleanup for /etc/X11 changes and /usr/X11R6 removal.

    • [thomas] - Fix download location of shadow.

  • May 6th, 2008

    • [dj] - Removed (commented) more XFree86 related text.

    • [dj] - Changed jdk symlink to use precompiled version and other text cleanups in jdk page.

    • [thomas] - Updated to QT-3.3.8b.

  • May 4th, 2008

    • [ken] - Updated firefox to 2.0.0.14.

  • May 3rd, 2008

    • [dj] - Commented out remaining text related to XFree86.

  • May 1st, 2008

    • [dj] - Corrected location of Xorg config files for FHS compliance.

    • [dj] - Corrected commands for lesstif and xvt-unicode relating to the Xorg config files. Thanks to Alexander Patrakov for finding these.

  • April 30th, 2008

    • [randy] - Added missing patch commands to the Heimdal instructions.

  • April 26th, 2008

    • [randy] - Removed an unnecessary sed command from the Ed instructions.

  • April 25th, 2008

    • [dnicholson] - Update to xkeyboard-config-1.2.

  • April 23rd, 2008

    • [bdubbs] - Updated to mpg123-1.4.2.

    • [bdubbs] - Ensure /etc/X11/app-defaults exists in rxvt-unicode.

    • [bdubbs] - Updated to xine-lib-1.1.12.

  • April 22nd, 2008

    • [dnicholson] - Fix multiple security vulnerabilities in xorg-server, libXfont and xfs for Xorg-7.2.

  • April 21st, 2008

    • [bdubbs] - Update to seamonkey 1.1.9.

    • [dnicholson] - Bug fixes and automatic compression support from Lars Bamberger for the compressdoc script.

  • April 20th, 2008

    • [bdubbs] - Update to Tripwire-2.4.1.2.

  • April 14th, 2008

    • [bdubbs] - Add 2nd security patch to unzip. Also moved locale patch to BLFS repository.

    • [bdubbs] - Add optional dependencies to autofs.

  • April 13th, 2008

    • [ken] - Update the cups security_fixes patch.

  • April 11th, 2008

    • [bdubbs] - Updated to dhcp-3.0.6.

    • [randy] - Added a comment to the Tcsh page mentioning that one of the tests in the testsuite is known to fail.

    • [alexander] - Removed the obsolete libxml1 library.

  • April 10th, 2008

    • [randy] - Updated to Whois-4.7.26.

  • April 9th, 2008

    • [randy] - Updated to Tk-8.4.18.

    • [randy] - Updated to Tcl-8.4.18.

    • [dj] - Updated OpenOffice instructions with changes suggested by Randy McMurchy and Chris Staub.

    • [dj] - Corrected OpenOffice build failure when GMime is installed. Thanks to Alessandro Alocci for tracking down the cause of the build failure.

    • [randy] - Clarified the GMP documentation installation.

  • April 6th, 2008

    • [ag] - Updated to zsh-4.3.6.

  • April 5th, 2008

    • [ag] - Added a command to regenerate the tags file in vim when updating the runtime files.

    • [ag] - Added a sed to the ed instructions to replace with symbolic links the hard links to red and its man page.

  • April 4th, 2008

    • [richard] - updated to a2ps-4.14.

  • April 3rd, 2008

    • [cwurst] - Changed download location of gimp-help. Fixes #2503.

  • April 2nd, 2008

    • [randy] - Updated to Which-2.19.

  • April 1st, 2008

    • [ken] - Updated xine-lib to 1.1.11.1.

    • [thomas] - Updates on adding users to groups. Avoid destroying group assignments in usermod commands without -a option

    • [richard] - Added gperf-3.0.3 to General Utilities. Required for a2ps-4.14.

  • March 31st, 2008

    • [rdaniels] - Updated dependencies for all KDE packages.

    • [richard] - Commented Dillo-0.8.5 out of the book.

    • [ken] - Added patch for xpdf to fix vulnerabilities.

    • [ken] - Updated to gnumeric-1.8.2.

  • March 28th, 2008

    • [ken] - Updated to cups-1.2.12 with a patch for the vulnerabilities.

    • [ken] - Updated a patch to fix vulnerabilities in poppler-0.5.4.

  • March 27th, 2008

    • [ken] - Updated to firefox-2.0.0.13.

    • [rdaniels] - Added parameters to xine-lib and xine-ui instructions to place documentation in versioned directories.

    • [richard] - Updated to Bluefish-1.0.7.

  • March 26th, 2008

    • [bdubbs] - Expanded the discussion on autofs configuration.

    • [cwurst] - Added build instructions for UnRar. Fixes #2345.

    • [ag] - Added a sed to Tcl/Tk instructions. Fixes #2487.

    • [randy] - Updated to Stunnel-4.21.

    • [randy] - Added a parameter to the libgnome configure command to account for ESounD may not be installed.

  • March 25th, 2008

    • [randy] - Added a patch to the ESP Ghostscript instructions to fix a buffer overflow vulnerability. Thanks to Alexander for finding it.

    • [randy] - Modified a documentation installation command in the Python instructions so ownership of installed files is correct.

  • March 24th, 2008

    • [randy] - Added a note to the Berkeley DB instructions about the JDK-6 and GMime uudecode conflict.

    • [dj] - Added a caution to the xfs-progs page and pointed the download location to the anduin server.

  • March 23rd, 2008

    • [Chris] - Added kernel configuration information to CUPS page. Fixes ticket #2430.

    • [dj] - Updated to xfs-progs-2.9.7.

  • March 22nd, 2008

    • [dj] - Updated to Apache httpd-2.2.8.

    • [randy] - Updated to SeaMonkey-1.1.8.

    • [dj] - Added enable-tlsext option for SNI to the OpenSSL command explanations section.

    • [randy] - Added the libedit package as a dependency of OpenSSH which provides sftp command-line history.

    • [randy] - Updated to rsync-3.0.0.

    • [randy] - Updated to Heimdal-1.1. Removed the Heimdal-Cracklib patches from both packages as Heimdal has been converted to use Cracklib differently. Created a patch to change the names of some installed files so they don't conflict with the E2fsprogs package.

  • March 20th, 2008

    • [thomas] - Added page in chapter 16 about NFS client tools. Upgrade to nfs-utils-1.1.2 and change the download location.

  • March 18th, 2008

    • [alexander] - Removed WvDial, WvStreams and RP-PPPoE, as alternative instructions are available on the PPP page. Moved the remaining packages from the Connecting to a Network part to a chapter with the same name in the Basic Networking part.

  • March 17th, 2008

    • [randy] - Updated to Python-2.5.2.

    • [alexander] - Removed xfsprogs-2.9.6, as they are incompatible with the LFS-6.3 kernel.

    • [alexander] - Updated MCS to version 0.7.0.

    • [alexander] - Added Mowgli-0.6.1.

  • March 16th, 2008

    • [ken] - Corrected the download locations for goffice.

    • [ag] - Added header caching support in mutt. Added qdbm as optional dependency.

    • [alexander] - Fixed URL for Audacious third-party plugins.

    • [alexander] - Noted that mpeg4ip is a dead project.

  • March 15th, 2008

    • [randy] - Updated GNOME Games to reflect the GNOME-2.18.3 update. This completes all the current GNOME packages currently in the book.

    • [alexander] - Added PPPoE configuration instructions to the PPP page.

    • [randy] - Updated Ekiga to reflect the GNOME-2.18.3 update.

  • March 14th, 2008

    • [ken] - Updated to gnucash-2.2.4.

    • [randy] - Updated Epiphany to reflect the GNOME-2.18.3 update.

    • [randy] - Updated File Roller, gcalctool, GNOME Keyring Manager, GNOME Netstatus and GNOME System Monitor to reflect the GNOME-2.18.3 update.

  • March 13th, 2008

    • [randy] - Removed (commented out) the Galeon package as it requires an older version of a Gecko engine than what is in the book. Currently, it fails to build. Will add it back to the book when/if it supports modern Gecko.

    • [randy] - Updated to Vorbis Tools-1.2.0.

    • [rdaniels] - Updated to xine-ui-0.99.5. Fixed ftp link for xine-lib.

    • [rdaniels] - Updated to xine-lib-1.1.10.1. Removed obsolete note from xine-lib page regarding --with-xv-path.

  • March 12th, 2008

    • [dnicholson] - Add pidfile directive to ntp.conf.

    • [rdaniels] - Updated to gmp-4.2.2.

    • [randy] - Updated to libgtkhtml-2.11.1.

    • [randy] - Updated the Heimdal instructions to preserve the mk_cmds script from the e2fsprogs package. Thanks DJ.

    • [randy] - Updated to S-Lang-2.1.3.

    • [randy] - Updated the SLIB download URL.

    • [alexander] - Added dialup and GPRS configuration instructions to the PPP page.

    • [dj] - Updated to OpenLDAP-2.3.39.

    • [dj] - Updated to Postfix-2.5.1.

    • [rdaniels] - Updated to Nano-2.0.7.

  • March 11th, 2008

    • [alexander] - Updated to Tin-1.8.3.

    • [alexander] - Mentioned the locale issue with the built-in editor in Lynx, and made cookies persistent.

    • [alexander] - Changed Lynx download URL in order to avoid MD5 sum changes in the future.

    • [alexander] - Reworded explanations and verified dependencies on the Links page.

    • [randy] - Updated to paps-0.6.8.

    • [randy] - Removed an obsolete sed command from the GNOME Doc Utils instructions.

    • [rdaniels] - Updated to K3b-1.0.4.

    • [rdaniels] - Updated to KOffice-1.6.3. Changed dependency from PostgreSQL to libpqxx. Use kde-config to set --prefix.

  • March 10th, 2008

    • [randy] - Updated the Enigmail download URLs to proper locations in the Thunderbird and Seamonkey instructions.

    • [randy] - Updated to Thunderbird-2.0.0.12 with Enigmail-0.95.6.

    • [ken] - Add missing goffice dependency.

    • [randy] - Updated to libxslt-1.1.22.

    • [rdaniels] - Updated to KDE-3.5.9.

  • March 9th, 2008

    • [ken] - Updated to gnumeric-1.8.1, with goffice-0.6.1, libgsf-1.14.7, and warning that gnucash-2.2.0 needs an older version of goffice.

    • [dj] - Updated to gamin-0.1.9.

    • [ken] - Updated to firefox-2.0.0.12.

    • [ken] - Updated to cairo-1.4.14.

    • [dj] - Updated to ksh-2008-02-02.

    • [dj] - Added iproute2 patch for bind, corrected L.ROOT-SERVERS.NET IP address, and added -r /dev/urandom to rdnc-confgen command.

    • [randy] - Updated to libxml2-2.6.31.

    • [dj] - Updated to JDK-6u5 and added warning about trailing JRL releases and security vulnerabilities.

  • March 8th, 2008

    • [bdubbs] - Udated to autofs-5.0.3. Expanded explanation of the use of autofs and created a procedure to automatically download and apply all patches.

    • [ag] - Added a patch and a configuration item to fix the UTF-8 related issues in Links. Thanks to Alexander Patrakov for the suggestions.

    • [bdubbs] - Fixed problem with netfs bootscript boot procedure.

    • [randy] - Updated to Balsa-2.3.22.

    • [thomas] - Updated to portmap-6.0 and nfs-utils-1.1.1

  • March 7th, 2008

    • [ag] - Updated to pcre-7.6. Added the --enable-pcregrep-libbz2 and --enable-pcregrep-libz switches. Added in command explanations the --enable-unicode-properties switch. Added patch to fix ABI breakage.

    • [randy] - Added new package GnuPG-2.0.8.

    • [bdubbs] - Fixed autofs bootscript.

    • [rdaniels] - Added new package Amarok-1.4.8.

  • March 6th, 2008

    • [bdubbs] - Added Qt4.

  • March 5th, 2008

    • [ag] - Updated to zsh-4.3.5. Added libcap as an optional dependency and enabled the --bindir=/bin switch.

  • March 4th, 2008

    • [dj] - Updated broken cracklib-heimdal patch.

  • March 3rd, 2008

    • [ken] - Updated to libpng-1.2.24, thanks to Hendrik Hoeth.

  • March 2nd, 2008

    • [ag] - Fixed two broken links in MPlayer page. Reported by habiloid.

  • February 26th, 2008

    • [ag] - Updated to links-2.1pre33. Enables graphics support by default.

  • February 25th, 2008

    • [tushar] - Add a note about LDFLAGS for BBLFS section.

    • [ag] - Added a switch to the OpenSSH instructions to set the default path for xauth.

  • February 24th, 2008

    • [ag] - Updated vim with the latest upstream patches. Added a command to update the runtime files.

    • [dj] - Updated to Linux-PAM-0.99.10.0.

  • February 22nd, 2008

    • [dj] - Updated to cracklib-2.8.12.

  • February 21st, 2008

    • [dj] - Updated to xfsprogs-2.9.6.

  • February 19th, 2008

    • [dj] - Added note about OpenSSH testsuite failures.

  • February 13th, 2008

    • [dj] - Updated to openssh-4.7p1.

    • [dj] - Updated to whois-4.7.24 (Christian Wurst).

  • February 11th, 2008

    • [ag] - Updated to rxvt-unicode-9.02. Added libAfterImage as an optional dependency.

    • [dj] - Updated to openssl-0.9.8g.

  • February 6th, 2008

    • [dj] - Updated to sudo-1.6.9p12.

  • February 5th, 2008

    • [bdubbs] - Removed XFree86.

  • January 21st, 2008

    • [randy] - Updated to Libassuan-1.0.4.

  • January 20th, 2008

    • [alexander] - Configured the Backspace key in xterm, updated program descriptions, updated xterm to version 231.

  • January 19th, 2008

    • [alexander] - Added FAAC and FAAD2.

  • January 10th, 2008

    • [randy] - Corrected a chmod command in the BIND instructions.

  • December 29th, 2007

    • [dj] - Added --without-pam switch to OpenOffice installation instructions. Reported by Nathan Coulson.

  • December 28th, 2007

    • [ag] - Added a documentation link to the procmail page.

  • December 22nd, 2007

    • [ag] - Updated to Ruby-1.8.6-p111.

  • December 21st, 2007

    • [dnicholson] - Updated the bootscripts tarball to include fixes for dhcp, gdm, gpm, hal, ntp, dbus and samba.

    • [alexander] - Updated the text about default mount options on the HAL page.

  • December 19th, 2007

    • [dj] - Updated to OpenOffice-2.3.1.

  • December 17th, 2007

    • [alexander] - Dropped Imlib-1.9.15.

    • [dj] - Updated to JDK-6 Update 3.

  • December 16th, 2007

    • [alexander] - Moved the URI Perl module under a separate heading, to simplify cross-references.

  • December 15th, 2007

    • [ag] - Updated to XFS 2.9.4. Thanks to Christian Wurst for his patch.

  • December 14th, 2007

    • [ag] - Updated to Mutt-1.5.17. Added command to generate the manual in PDF format.

  • December 13th, 2007

    • [ag] - Fixed Ruby download link.

    • [ag] - Updated to Flac-1.2.1.

  • December 7th, 2007

    • [alexander] - Updated to Xfce-4.4.2 and commented it out.

  • November 22nd, 2007

    • [ag] - Fixed the download link to rxvt-unicode.

    • [ag] - Updated to Compface 2.5.2.

  • November 17th, 2007

    • [ag] - Fixed a broken link to the Python documentation. Reported by Moody.

    • [ag] - Added a switch in the 'Command Explanations' section of the Vorbis Tools page that allows ogg123 to be built without cURL. Reported by laxy. Fixes #2413.

  • November 5th, 2007

    • [dnicholson] - Really fix luit to find the locale.alias file. Caught by laxy. Fixes #2414.

  • November 4th, 2007

    • [ag] - Updated to rxvt-unicode-8.4.

    • [ag] - Updated to libvorbis-1.2.0.

  • November 2nd, 2007

    • [dnicholson] - Fix luit to find the locale.alias file. Fixes #2393.

    • [dnicholson] - Updated to Nano-2.0.6.

  • November 1st, 2007

    • [ag] - Updated to ed-0.8.

    • [ag] - Updated to Fcron-3.0.3.

  • October 16th, 2007

    • [randy] - Updated to Heimdal-0.8.1.

    • [randy] - Modified the 'Configuring for Adding Users' page to reflect that the /etc/default/useradd file is now created in LFS. Thanks to Chris Staub for the suggestion.

    • [randy] - Fixed numerous typos and ommisions, along with several corrections by applying patches from Chris Staub. Thanks, Chris.

    • [randy] - Updated the Evince instructions to reflect the GNOME-2.18.3 update.

  • September 22nd, 2007

    • [randy] - Fixed an incorrect installation command in the XSL Stylesheets instructions, thanks to Frank Ianella for pointing it out.

  • September 12th, 2007

    • [randy] - Updated the EOG instructions to reflect the GNOME-2.18.3 update.

  • September 11, 2007

    • [randy] - Added a note to the Totem instructions explaining that the GStreamer backend will not play DVDs properly, and you can use the Xine Libraries backend instead.

  • September 10th, 2007

    • [randy] - Added a more accurate explanation of the GConf dependency in the GStreamer Good Plugins instructions.

  • September 9th, 2007

    • [manuel] - Updated the internal XSL Stylesheets to 1.73.2.

  • September 7th, 2007

    • [randy] - Changed the chmod command in the OpenLDAP instructions to use the 'readlink' command to find out the names of the shared libraries.

  • September 6th, 2007

    • [randy] - Modified the Heimdal instructions which move the libraries into /lib to use the 'readlink' command to create the symlinks so that the instructions are not version specific.

  • September 5th, 2007

    • [randy] - Modified the Linux-PAM instructions to install the libraries into /lib and then use the 'readlink' command to create the symlinks so that the instructions are not version specific.

  • September 4th, 2007

    • [dnicholson] - Removed an unnecessary command in the Cyrus SASL instructions.

  • September 2nd, 2007

    • [dnicholson] - Updated to Cyrus SASL-2.1.22.

  • August 22nd, 2007

    • [dj] - Updated to dhcpcd-3.0.19.

  • August 21st, 2007

    • [djensen] - Removed a Makefile sed that disabled autoconf in XFS-2.9.3. It will be needed with some libtool versions.

  • August 20th , 2007

    • [djensen] - Updated to XFS-2.9.3.

    • [dj] - Added GCC-3.3.6 as a runtime dependency for the binary JDK.

  • August 19th, 2007

    • [randy] - Added new package PIN-Entry-0.7.3.

  • August 18th, 2007

    • [randy] - Updated to DocBook XSL Stylesheets-1.71.1.

    • [randy] - Added new package Libksba-1.0.2.

  • August 17th, 2007

    • [randy] - Updated to Transcode-1.0.3.

    • [randy] - Applied a patch contributed by Jeremy Henty that updated the book to Emacs-22.1. Thanks Jeremy!

    • [randy] - Updated to libquicktime-1.0.0.

    • [randy] - Updated to libmpeg3-1.7.

    • [dj] - Updated to OpenOffice-2.2.1

  • August 16th, 2007

    • [randy] - Added new package GnuTLS-1.6.3.

    • [manuel] - Added upstream asmrules_fix_20061231.diff patch to Mplayer-1.0rc1.

    • [randy] - Added new package Libgcrypt-1.2.4.

    • [randy] - Added new package Libgpg-error-1.5.

    • [randy] - Added new package Libassuan-1.0.2.

    • [randy] - Added new package Pth-2.0.7.

  • August 15th, 2007

    • [randy] - Updated Gaim to Pidgin-2.1.0.

    • [randy] - Removed an unneeded sed command from the RP-PPPoE instructions.

    • [randy] - Updated to Audacious-1.3.2.

  • August 14th, 2007

    • [randy] - Added new package mcs-0.4.1 to support recent versions of Audacious.

    • [randy] - Updated to Hdparm-7.7.

    • [randy] - Updated to Hd2u-1.0.1.

    • [randy] - Updated to Exim-4.67.

  • August 13th, 2007

    • [randy] - Updated to Cdrdao-1.2.2.

    • [randy] - Updated the Sound Juicer instructions to reflect the GNOME-2.18.3 update.

    • [randy] - Updated to libmusicbrainz-2.1.5.

  • August 12th, 2007

    • [dnicholson] - Added the Python Modules page with Gnome-Python and its dependencies.

    • [randy] - Added instructions to create an X11R6 symlink to the X Windows Components page.

    • [dj] - Updated to JDK-6 Update 2.

  • August 11th, 2007

    • [randy] - Updated the GConf Editor instructions to reflect the GNOME-2.18.3 update.

    • [randy] - Added a note to the FreeGlut instructions saying you don't need to install it if you installed the GLUT library during a MesaLib installation.

    • [randy] - Updated to MPlayer-1.0rc1.

    • [randy] - Updated to FFmpeg-svn_20070606 (svn checkout).

  • August 9th, 2007

    • [randy] - Replaced the obsolete Gimp-Print package with Gutenprint-5.0.1.

  • August 8th, 2007

    • [randy] - Updated to XChat-2.8.4.

    • [randy] - Updated all the GNOME Assistive Technology (Accessibility) packages to GNOME-2.18 versions, including updating Gnome Speech to 0.4.16.

    • [randy] - Added new package Orca-2.18.1 as a replacement for the obsolete Gnopernicus package.

    • [randy] - Replaced all instances of the Gtk+-2 library directory pathname with an entity.

    • [randy] - Replaced all instances of the Python library directory pathname with an entity.

    • [randy] - Simplified some commands using conditionals in various package instructions.

    • [randy] - Added a parameter to the configure command in the GNOME Session instructions so that the Assistive Technology (Accessibility) packages work properly.

  • August 7th, 2007

    • [randy] - Added notes to the AbiWord and Gnumeric instructions that the versions of libgda/libgnomedb will conflict with each other.

    • [randy] - Minor modifications to the Gnumeric build instructions.

    • [randy] - Updated to AbiWord-2.4.6.

  • August 6th, 2007

    • [randy] - Updated to FriBidi-0.10.8.

  • August 5th, 2007

    • [randy] - Updated to Finance::Quote-1.13.

    • [dnicholson] - Updated to Thunderbird-2.0.0.6 with Enigmail-0.95.3.

    • [dnicholson] - Updated to Firefox-2.0.0.6.

    • [randy] - Updated to GnuCash-2.2.0.

  • August 3rd, 2007

    • [ag] - Updated to Fetchmail-6.3.8.

    • [randy] - Updated to GOffice-0.4.2.

    • [randy] - Updated to SLIB-3a4.

    • [randy] - Updated to Guile-1.8.2. This breaks the GnuCash package instructions and since no other BLFS packages depend on the GNOME-1.4 libraries, the entire GNOME-1.4 section of the book has been commented out.

  • August 2nd, 2007

    • [ag] - Added the rxvt-unicode terminal emulator package.

    • [dnicholson] - Updated to NcFTP-3.2.1.

    • [randy] - Updated to gedit-2.18.2.

    • [dnicholson] - Updated to Iptables-1.3.8.

    • [dnicholson] - Updated the libusb udev rule for raw USB device ownership to work with Linux-2.6.22.

  • August 1st, 2007

    • [ag] - Updated to ReiserFS-3.6.20.

  • July 31st, 2007

    • [ag] - Removed obsolete text in the X Window System Components page.

    • [ag] - Updated to Dash-0.5.4. Fixes Trac ticket #2366.

  • July 30th, 2007

    • [ag] - Removed the extra-prompt.sh script and avoid exporting the PS1 variable. Thanks to David Jensen for the suggestions and to Craig Jackson for the report.

    • [ag] - Added a warning in the mutt instructions about linking mutt against GnuTLS.

    • [ag] - Added a consolidated patch to vim instructions, with fixes from upstream. Syncing with LFS.

  • July 27th, 2007

    • [randy] - Added the D-Bus GLib bindings as a required dependency of GNOME VFS and removed it from other packages where it became redundant.

    • [randy] - Updated to XSane-0.994.

    • [randy] - Updated to ksh-2007-06-28.

    • [randy] - Updated Perl Modules: Finance::QuoteHist-1.11, HTML::TableExtract-2.10.

    • [randy] - Added a patch to the Avifile instructions to correct a build problem when using GCC-4.1.x. Thanks to Robert Connolly for submitting the patch.

  • July 26th, 2007

    • [randy] - Updated to rsync-2.6.9.

    • [randy] - Updated some GNOME utility packages: GDM-2.18.3, GNOME Utilities-2.18.1, gnome-screensaver-2.18.2, zenity-2.18.2.

    • [randy] - Updated to XScreenSaver-5.03.

    • [randy] - Updated several package's broken download URLs.

    • [randy] - Updated to gnome-volume-manager-2.17.0.

  • July 25th, 2007

    • [randy] - Updated to Evolution-2.10.3.

    • [randy] - Updated to Xine Libraries-1.1.7.

    • [randy] - Updated some of the GNOME-2 additional packages ('Utilities') to GNOME-2.18.3: bug-buddy-2.18.1, GNOME Media-2.18.0, gnome-mount-0.6, gucharmap-1.10.0, Nautilus CD Burner-2.18.2, Totem-2.18.2. Other additional packages will be updated individually as soon as possible.

    • [randy] - Updated GNOME-2 additional packages ('Libraries') to GNOME-2.18.3.

    • [randy] - Updated core GNOME-2 to version 2.18.3. Separated the core packages into 'Platform' and 'Desktop' sections.

    • [randy] - Updated to ImageMagick-6.3.5-3.

    • [randy] - Updated Perl Modules: Archive-Tar-1.32, Archive-Zip1.20, Business-ISBN-Data-1.14, Compress-Raw-Zlib-2.005, Compress-Zlib-2.005, Crypt-SSLeay-0.56, Digest-SHA-5.45, ExtUtils-CBuilder-0.19, ExtUtils-ParseXS-2.18, IO-Compress-Base-2.005, Compress-Raw-Bzip2-2.005, IO-Compress-Bzip2-2.005, IO-Compress-Zlib-2.005, IO-Zlib-1.06, LWP5.806, Module-Build-0.2808, Module-Corelist-2.12, Module-Signature-0.55, PAR-Dist-0.24, Pod-Readme-0.09, Test-Base-0.54, Test-Prereq-1.033, version-0.7203, YAML-0.65.

  • July 24th, 2007

    • [bdubbs] - Updated to Bind-9.4.1-P1.

    • [randy] - Updated to SANE Backends-1.0.18.

    • [dj] - Added Java header path to CPPFLAGS for Graphviz.

  • July 22nd, 2007

    • [randy] - Updated to XviD-1.1.3.

    • [randy] - Updated to ISO Codes-1.2.

    • [randy] - Updated to Module::Info-0.31.

  • July 21st, 2007

    • [randy] - Updated to Metacity-2.18.5

    • [randy] - Added new package libgnomekbd-2.18.2 to the GNOME Core packages section.

    • [dnicholson] - Reworked Xorg download links and md5sum files. Added the continue parameter for the large wget downloads.

    • [randy] - Added a sed and a patch to allow Vorbis-Tools to link against cURL and FLAC respectively. Fixes Trac ticket #2240. Patch to update the book contributed by Ag Hatzimanikas.

    • [randy] - Updated to libxklavier-3.2.

    • [randy] - Updated to W3m-0.5.2.

  • July 20th, 2007

    • [randy] - Updated to GMime-2.2.10.

    • [randy] - Updated to libwnck-2.18.3.

    • [randy] - Updated to GIMP-2.2.17 and GIMP-Help-0.12. No changes have been made yet to support Gutenprint instead of the deprecated Gimp-Print. Those changes will follow after Gutenprint is in the book.

    • [randy] - Updated to libgsf-1.14.5.

    • [randy] - Updated to XML-SAX-0.16.

  • July 19th, 2007

    • [randy] - Updated to GStreamer Ugly Plug-ins-0.10.6.

    • [randy] - Updated to libmpeg2-0.4.1.

    • [randy] - Updated to libdvdread-0.9.7.

    • [randy] - Added a note to the libdvdcss instructions about an issue that may occur with the LaTeX installation.

    • [randy] - Updated to LAME-3.97.

    • [randy] - Updated to libao-0.8.8.

    • [randy] - Updated to FLAC-1.1.4.

    • [randy] - Updated to GStreamer Good Plug-ins-0.10.6.

    • [randy] - Updated to Imlib2-1.4.0.

    • [randy] - Updated to libdv-1.0.0.

  • July 18th, 2007

    • [randy] - Updated to GStreamer Base Plug-ins-0.10.13.

    • [randy] - Updated to desktop-file-utils-0.13.

    • [randy] - Updated to shared-mime-info-0.21.

    • [randy] - Updated to GStreamer-0.10.13.

    • [randy] - Added an additional sed to the LPRng instructions to correct some bad syntax.

    • [randy] - Updated to pilot-link-0.12.2.

    • [randy] - Updated to Nmap-4.20.

  • July 17th, 2007

    • [randy] - Updated to Poppler-0.5.4.

    • [randy] - Updated to Wireshark-0.99.6 (formerly named Ethereal).

    • [randy] - Updated to libpcap-0.9.6.

    • [randy] - Updated to Samba-3.0.25b.

    • [randy] - Updated to Subversion-1.4.4.

  • July 16th, 2007

    • [randy] - Clarified the Apache HTTPD dependencies and added a note how to build APR-util with Berkeley DB support.

    • [randy] - Updated to JUnit-4.3.1.

    • [randy] - Updated to dvd+rw-tools-7.0.

    • [randy] - Updated to Xpdf-3.02.

  • July 15th, 2007

    • [randy] - Updated to LessTif-0.95.0.

    • [randy] - Updated to NSS-3.11.7 (includes NSPR-4.6.7).

    • [randy] - Updated to Firefox-2.0.0.4.

    • [randy] - Updated to Thunderbird-2.0.0.4.

  • July 14th, 2007

    • [randy] - Updated to HAL-0.5.9.1 and HAL Hardware Info-20070618.

    • [randy] - Added the Qt3 bindings to the D-Bus Bindings page.

  • July 12th, 2007

    • [randy] - Updated to Tcsh-6.15.00.

  • July 11th, 2007

    • [randy] - Updated to cpio-2.9.

    • [randy] - Updated to Sendmail-8.14.1.

  • July 10th, 2007

    • [dnicholson] - Added information for running the D-Bus testsuite.

    • [randy] - Updated the K3b and KDE Base instructions to specify that the D-Bus Qt3 Bindings are required if HAL functionality is desired.

    • [dnicholson] - Added libxcb and its dependencies xcb-proto and libpthread-stubs to the book. Enabled it as a dependency for the Xorg-7 Libraries.

    • [randy] - Modified the D-Bus dependency in several packages to account for the new D-Bus core and bindings separation.

    • [randy] - Added the Python Bindings to the D-Bus Bindings page.

  • July 9th, 2007

    • [dnicholson] - Updated D-Bus Core to 1.0.2.

    • [randy] - Created a D-Bus Bindings page and added the GLib bindings. Other D-Bus bindings will be added to the same page as they are developed.

  • July 8th, 2007

    • [dnicholson] - Fix a bad commit breaking Xorg-7 libX11 in r6797.

    • [dnicholson] - Applied patchlevel updates for Xorg-7.2 packages.

    • [randy] - Updated to CUPS-1.2.11.

    • [randy] - Updated to PHP-5.2.3.

    • [randy] - Updated to libexif-0.6.16.

    • [randy] - Updated to libglade-2.6.1.

    • [randy] - Updated to cURL-7.16.3.

    • [randy] - Updated to Libidn-0.6.14.

  • July 7th, 2007

    • [manuel] - Updated book rendering framework to use the new LFS-XSL stylesheets.

  • July 6th, 2007

    • [randy] - Updated to PostgreSQL-8.2.4.

    • [randy] - Downgraded OpenLDAP to the stable 2.3.32 version as the download page now properly reflects the versions.

  • July 5th, 2007

    • [randy] - Updated to MySQL-5.0.41.

    • [randy] - Updated Tcl and Tk to 8.4.15.

  • July 4th, 2007

    • [randy] - Updated to libxslt-1.1.21.

    • [dj] - Modified Linux-PAM configuration to use cracklib defaults.

  • July 3rd, 2007

    • [randy] - Updated to libxml2-2.6.29.

    • [randy] - Updated to Python-2.5.1.

    • [randy] - Updated to Shadow-4.0.18.1, which is the version used in LFS. Also modified the /etc/pam.d/login file as suggested by Jonathan Oksman to strengthen the login security.

    • [dnicholson] - Fixed an incorrect path for the MesaLib drivers. Reported by Alexander Patrakov.

  • July 2nd, 2007

    • [randy] - Updated to Whois-4.7.21.

    • [randy] - Updated to Expat-2.0.1.

    • [randy] - Updated to S-Lang-2.1.1.

    • [randy] - Updated to PCRE-7.2.

    • [randy] - Updated to libpng-1.2.18.

    • [randy] - Updated to pkg-config-0.22.

  • July 1st, 2007

    • [randy] - Incremented the date of the bootscript entity so a new bootscript tarball will be created (to reflect the changes made to the bootscripts on 20070620).

  • June 30th, 2007

    • [randy] - Updated to GTK+-2.10.13.

    • [randy] - Updated to Pango-1.16.4.

    • [randy] - Updated to cairo-1.4.10.

    • [randy] - Updated Inetutils MD5sum as upstream released a new tarball.

    • [randy] - Updated to GLib-2.12.12.

  • June 20th, 2007

    • [dnicholson] - Fixed app-defaults references in xterm. Closes #2362. Reported by laxy.

    • [dnicholson] - Updated to dhcpcd-3.0.17.

  • June 15th, 2007

    • [dnicholson] - Mutt cleanups from Alexander Patrakov and Ag Hatzim.

    • [dnicholson] - Fixed Firefox and Thunderbird to ensure that libX11 and libXrender are found.

  • June 13th, 2007

    • [dj] - Added ksh-2007-03-28

  • June 12th, 2007

    • [dnicholson] - Updated to Mutt-1.5.16

  • June 7th, 2007

    • [dnicholson] - Changed the Qt /usr install with symlinks to the bin, include and lib directories in /usr/share/qt.

    • [dnicholson] - Updated to NTP-4.2.4p0.

    • [dnicholson] - Fixed a broken GLib URL. Reported by Ken Moffat.

    • [dnicholson] - Removed the optional ctypes dependency from libmusicbrainz since it's included in Python-2.5. Thanks to bambi for the report.

    • [dnicholson] - Fixed some errors on the X Window System Components page. Reported by Spinal.

  • May 31st, 2007

    • [dnicholson] - Changed the xkb output directory for Xorg-Server to match that from XKeyboardConfig. Reported by DJ Lucas.

    • [dnicholson] - Streamlined the commands for each Xorg section.

    • [dnicholson] - Commented out the sun video drivers and deprecated modules in the Xorg wget lists and changed the download commands to support the comments.

  • May 30th, 2007

    • [dnicholson] - Fixed a broken link on the XFree86 page. Reported by Roland Puntaier.

    • [dnicholson] - Added a missing expat dependency on the MesaLib page. Reported by DJ Lucas.

  • May 28th, 2007

    • [dnicholson] - Changed the XKeyboardConfig intltool dependency to optional and added a required XML::Parser dependency.

  • May 26th, 2007

    • [dnicholson] - Removed the /opt globbing from the Bash Shell Startup Files since entries in /opt are handled separately.

  • May 25th, 2007

    • [dnicholson] - Updated to libdrm-2.3.0.

    • [dnicholson] - Added the XKeyboardConfig package, which replaces xkbdata for Xorg-7.

    • [dnicholson] - Updated to MesaLib-6.5.2.

    • [dnicholson] - Updated to Xorg-7.2.

  • May 24th, 2007

    • [dnicholson] - Various changes were applied to the XFree86 page.

    • [dnicholson] - Added a version number to the Xorg md5sums file.

    • [dnicholson] - Revert a mistaken version update to the xf86-input-elographics driver.

    • [dnicholson] - Removed unnecessary commands for the imake and xorg-cf-files packages.

    • [dnicholson] - Removed an unnecessary parameter for the xorg-server package.

  • May 23rd, 2007

    • [dnicholson] - Removed the unneeded Glibc build fix for XFree86.

  • May 19th, 2007

    • [dnicholson] - Fix the installation of the mail extensions to go to the correct directory in Thunderbird.

  • May 18th, 2007

    • [dnicholson] - Updated to Thunderbird-2.0.0.0 with Enigmail-0.95.0.

  • May 13th, 2007

    • [dnicholson] - Updated to xterm-225 and corrected configure settings. Thanks to kratz00 and fix.

    • [bdubbs] - Updated to vim-7.1.

  • May 5th, 2007

    • [bdubbs] - Corrected md5sum for libdrm-2.0.1.

    • [bdubbs] - Updated to xine-lib-1.1.6.

    • [bdubbs] - Updated to Seamonkey-1.1.1.

  • April 29th, 2007

    • [dnicholson] - Updated to Fontconfig-2.4.2. Fixes ticket #2134.

  • April 27th, 2007

    • [dnicholson] - Updated to Firefox-2.0.0.3. Fixes ticket #2218.

    • [dnicholson] - Updated to HAL-0.5.9 with hal-info-20070425. Fixes ticket #2213.

    • [dnicholson] - Updated to FreeType-2.3.4. Fixes ticket #1988.

  • April 26th, 2007

    • [randy] - Updated to GnuPG-1.4.7.

  • April 25th, 2007

    • [bdubbs] - Added a security patch for Qt and updated description of MySql options for Qt.

    • [alexander] - Applied cpio-2.7 upstream fixes.

  • April 21st, 2007

    • [bdubbs] - Expanded note on building database support into qt.

  • April 20th, 2007

    • [randy] - Updated to Graphviz-2.12.

    • [randy] - Updated to Doxygen-1.5.2.

  • April 19th, 2007

    • [randy] - Updated to unixODBC-2.2.12.

    • [randy] - Updated to libsoup-2.2.100.

    • [randy] - Updated to startup-notification-0.9.

    • [randy] - Updated to GOffice-0.2.2.

    • [randy] - Updated to ESP Ghostscript-8.15.4.

  • April 18th, 2007

    • [randy] - Added additional files to the chmod command in the S-Lang instructions.

    • [randy] - Added a note to run some commands in the OpenSSH instructions as the root user. Thanks to ghylton for the report.

    • [randy] - Updated to libgsf-1.14.3.

  • April 17th, 2007

    • [randy] - Added new Perl Modules to support icon-naming-utils: Tie::IxHash, XML::LibXML, XML::NamespaceSupport, XML::SAX, XML::SAX::Expat and XML::Simple

    • [randy] - Added new package icon-naming-utils-0.8.2 (required by the GNOME Icon Theme package).

  • April 16th, 2007

    • [randy] - Updated to EsounD-0.2.37.

    • [randy] - Updated the PyGTK dependencies in the HAL instructions.

  • April 15th, 2007

    • [djensen] - Updated to librsvg-2.16.1.

    • [djensen] - Updated to shared-mime-info-0.20.

    • [randy] - Updated to Qt-3.3.8.

    • [randy] - Updated to NAS-1.9.

  • April 14th, 2007

    • [randy] - Updated to Samba-3.0.24.

  • April 13th, 2007

    • [randy] - Updated to Gamin-0.1.8.

    • [randy] - Updated to desktop-file-utils-0.12.

  • April 10th, 2007

    • [randy] - Updated to little cms-1.16.

    • [randy] - Added the Utah Raster Toolkit as an optional dependency of giflib.

  • April 9th, 2007

    • [randy] - Updated to Ruby-1.8.6.

    • [randy] - Updated to libart_lgpl-2.3.19.

  • April 4th, 2007

    • [randy] - Updated the XML and stylesheets to use the 4.5 version of DocBook XML DTD.

  • March 31st, 2007

    • [randy] - Updated to PHP-5.2.1.

    • [randy] - Removed the Ash package as it has been effectively replaced by the Dash package.

  • March 30th, 2007

    • [randy] - Updated to hicolor-icon-theme-0.10.

    • [randy] - Updated to libpcap-0.9.5.

    • [randy] - Updated to Apache HTTPD-2.2.4.

    • [randy] - Updated to GTK-Doc-1.8.

    • [randy] - Updated to Perl Module HTML::Parser-3.56.

    • [randy] - Updated to Perl modules: Algorithm::Diff-1.1902, Compress::Zlib-2.004, Crypt::SSLeay-0.53, Pod::Simple-3.05, Test::Pod-1.26, Test::Simple-0.70, version-0.71.

    • [randy] - Added new Perl modules: Compress::Raw::Zlib-2.004, IO::Compress::Base-2.004, IO::Compress::Bzip2-2.004, IO::Compress::Zlib-2.004.

  • March 28th, 2007

    • [randy] - Updated to ASpell-0.60.5.

  • March 27th, 2007

    • [randy] - Updated to HTML Tidy-cvs_20070326.

  • March 26th, 2007

    • [djensen] - Updated to libIDL-0.8.8.

    • [randy] - Updated to Heirloom Mailx-12.2.

    • [randy] - Updated to Sendmail-8.14.0.

    • [randy] - Updated to OpenLDAP-2.3.34.

  • March 25th, 2007

    • [djensen] - Updated to Intltool-0.35.5.

    • [djensen] - Updated to libwnck-2.18.0.

    • [djensen] - Updated to VTE-2.16.0.

    • [randy] - Updated to OpenSSH-4.6p1.

    • [randy] - Updated to OpenSSL-0.9.8e.

    • [randy] - Updated to cURL-7.16.1.

    • [randy] - Updated to Stunnel-4.20.

    • [randy] - Updated to Libidn-0.6.11.

  • March 24th, 2007

    • [randy] - Updated to FOP-0.93.

  • March 23rd, 2007

    • [dnicholson] - Removed the reference to tinker-term.sh in the Bash Shell Startup Files. Thanks to Jonathan Oksman for the report.

    • [dnicholson] - Added a patch with upstream fixes for Dash and an optional command for replacing /bin/sh.

    • [randy] - Updated to Apache Ant-1.7.0.

    • [randy] - Added new package JUnit-4.1.

  • March 21st, 2007

    • [randy] - Updated to MySQL-5.0.37.

    • [randy] - Modified the Heimdal instructions to rename the Heimdal libss headers and libraries and restore the orginal E2fsprogs files. Also added some documentation installation commands.

  • March 20th, 2007

    • [bdubbs] - Updated to cairo-1.4.2. Fixes a severe hang problem and some systems when running checks.

    • [randy] - Updated to Berkeley DB-4.5.20 to match the version used in LFS.

    • [randy] - Updated to JDK-1.5.0.11 (source and binary).

  • March 19th, 2007

    • [randy] - Updated to cpio-2.7.

  • March 18th, 2007

    • [randy] - Updated to NSS-3.11.5 (includes NSPR-4.6.5).

    • [randy] - Added a warning to the GNOME introduction section, and links to this warning in various GNOME package instructions telling to use the stable version of BLFS to build current GNOME.

    • [randy] - Updated to GTK+-2.10.11.

    • [randy] - Updated to ATK-1.18.0.

    • [randy] - Updated to Pango-1.16.1.

    • [randy] - Updated to cairo-1.4.0.

    • [randy] - Updated to GLib-2.12.11.

  • March 17th, 2007

    • [randy] - Updated to libxslt-1.1.20.

    • [randy] - Updated to Python-2.5.

  • March 16th, 2007

    • [randy] - Updated to GCC-4.1.2, which matches the version used in LFS.

  • March 15th, 2007

    • [randy] - Added the Dash package using a patch provided by Agathoklis Hatzimanikas.

  • March 13th, 2007

    • [randy] - Added a note to the Linux-PAM instructions to run the test suite after the package has been installed and minimally configured.

  • March 8th, 2007

    • [alexander] - Added Recode-3.6.

  • March 7th, 2007

    • [djensen] - Updated to ImageMagick-6.3.3-0, man page sed by alexander.

  • March 4th, 2007

    • [dnicholson] - Updated the Docbook SGML & XML DTD packages to version 4.5. Patch from Matthew Burgess.

  • March 3rd, 2007

    • [djensen] - Updated to PostgreSQL-8.2.3.

    • [alexander] - Removed the link to the (dead) libstk site from Xine Libraries page.

  • February 28th, 2007

    • [dnicholson] - Made the i18n-fonts commands more explicit on the a2ps page to guard against errors. Thanks to Nathan Coulson for the report.

  • February 24th, 2007

    • [dnicholson] - Fixed a dead ftp:// link for Nano. Reported by Daniel Rindt.

  • February 19th, 2007

    • [dnicholson] - Fixed the sed needed to run the libxml2 testsuite. Closes #2299. Report from kratz00.

  • February 16th, 2007

    • [randy] - Updated to GMP-4.2.1.

    • [randy] - Updated to libxml2-2.6.27.

    • [randy] - Fixed a broken documentation installation command in the libpng instructions, thanks to Nathan Coulson for the report.

    • [randy] - Updated to Inetutils-1.5.

  • February 15th, 2007

    • [randy] - Updated to Sysstat-7.0.4.

    • [randy] - Updated to Shadow-4.0.17.

    • [randy] - Updated to Linux-PAM-0.99.7.1.

    • [randy] - Updated to Tk-8.4.14.

    • [randy] - Updated to Tcl-8.4.14.

    • [randy] - Updated to S-Lang-2.0.7.

    • [randy] - Updated to PCRE-7.0.

    • [randy] - Updated to libpng-1.2.16.

    • [randy] - Updated to pkg-config-0.21.

  • February 14th, 2007

    • [randy] - Released BLFS Version 6.2.0.

  • February 6th, 2007

    • [randy] - Updated to CrackLib-2.8.10 (don't merge to the 6.2 branch until 6.2.0 has been released).

  • February 4th, 2007

    • [randy] - Removed the obsolete and unmaintained Xorg-6.9 package (do not merge to the 6.2 branch).

Last updated on 2008-08-24 12:50:26 -0500

Mailing Lists

The linuxfromscratch.org server is hosting a number of mailing lists that are used for the development of the BLFS book. These lists include, among others, the main development and support lists.

For more information regarding which lists are available, how to subscribe to them, archive locations, etc., visit http://www.linuxfromscratch.org/mail.html.

Last updated on 2007-04-04 14:42:53 -0500

BLFS Wiki

The BLFS Project has created a Wiki for users to comment on pages and instructions at http://wiki.linuxfromscratch.org/blfs/wiki. Comments are welcome from all users.

The following are the rules for posting:

  • Users must register and log in to edit a page.

  • Suggestions to change the book should be made by creating a new ticket, not by making comments in the Wiki.

  • Questions with your specific installation problems should be made by subscribing and mailing to the BLFS Support Mailing List at mailto:blfs-support AT linuxfromscratch D0T org.

  • Discussions of build instructions should be made by subscribing and mailing to the BLFS Development List at mailto:blfs-dev AT linuxfromscratch D0T org.

  • Inappropriate material will be removed.

Last updated on 2007-04-04 14:42:53 -0500

Asking for Help and the FAQ

If you encounter a problem while using this book, and your problem is not listed in the FAQ (http://www.linuxfromscratch.org/faq), you will find that most of the people on Internet Relay Chat (IRC) and on the mailing lists are willing to help you. An overview of the LFS mailing lists can be found in Mailing lists. To assist us in diagnosing and solving your problem, include as much relevant information as possible in your request for help.

Things to Check Prior to Asking

Before asking for help, you should review the following items:

  • Is the hardware support compiled into the kernel or available as a module to the kernel? If it is a module, is it configured properly in modprobe.conf and has it been loaded? You should use lsmod as the root user to see if it's loaded. Check the sys.log file or run modprobe <driver> to review any error message. If it loads properly, you may need to add the modprobe command to your boot scripts.

  • Are your permissions properly set, especially for devices? LFS uses groups to make these settings easier, but it also adds the step of adding users to groups to allow access. A simple moduser -G audio <user> may be all that's necessary for that user to have access to the sound system. Any question that starts out with “It works as root, but not as ...” requires a thorough review of permissions prior to asking.

  • BLFS liberally uses /opt/<package>. The main objection to this centers around the need to expand your environment variables for each package placed there (e.g., PATH=$PATH:/opt/kde/bin). In most cases, the package instructions will walk you through the changes, but some will not. The section called “Going Beyond BLFS” is available to help you check.

Things to Mention

Apart from a brief explanation of the problem you're having, the essential things to include in your request are:

  • the version of the book you are using (being 6.3),

  • the package or section giving you problems,

  • the exact error message or symptom you are receiving,

  • whether you have deviated from the book or LFS at all,

  • if you are installing a BLFS package on a non-LFS system.

(Note that saying that you've deviated from the book doesn't mean that we won't help you. It'll just help us to see other possible causes of your problem.)

Expect guidance instead of specific instructions. If you are instructed to read something, please do so. It generally implies that the answer was way too obvious and that the question would not have been asked if a little research was done prior to asking. The volunteers in the mailing list prefer not to be used as an alternative to doing reasonable research on your end. In addition, the quality of your experience with BLFS is also greatly enhanced by this research, and the quality of volunteers is enhanced because they don't feel that their time has been abused, so they are far more likely to participate.

An excellent article on asking for help on the Internet in general has been written by Eric S. Raymond. It is available online at http://www.catb.org/~esr/faqs/smart-questions.html. Read and follow the hints in that document and you are much more likely to get a response to start with and also to get the help you actually need.

Last updated on 2007-04-04 14:42:53 -0500

Contact Information

Please direct your emails to one of the BLFS mailing lists. See Mailing lists for more information on the available mailing lists.

The current BLFS maintainer is Randy McMurchy. If you need to reach Randy, send an email to randy AT linuxfromscratch D0T org.

Last updated on 2007-04-04 14:42:53 -0500

Chapter 2. Important Information

This chapter is used to explain some of the policies used throughout the book, to introduce important concepts and to explain some issues you may see with some of the included packages.

Notes on Building Software

Those people who have built an LFS system may be aware of the general principles of downloading and unpacking software. We will however repeat some of that information here for those new to building their own software.

Each set of installation instructions contains a URL from which you can download the package. We do however keep a selection of patches available via HTTP. These are referenced as needed in the installation instructions.

While you can keep the source files anywhere you like, we assume that you have unpacked the package and changed into the directory created by the unpacking process (the 'build' directory). We also assume you have uncompressed any required patches and they are in the directory immediately above the 'build' directory.

We can not emphasize strongly enough that you should start from a clean source tree each time. This means that if you have had an error during configuration or compilation, it's usually best to delete the source tree and re-unpack it before trying again. This obviously doesn't apply if you're an advanced user used to hacking Makefiles and C code, but if in doubt, start from a clean tree.

Building Software as an Unprivileged (non-root) User

The golden rule of Unix System Administration is to use your superpowers only when necessary. Hence, BLFS recommends that you build software as an unprivileged user and only become the root user when installing the software. This philosophy is followed in all the packages in this book. Unless otherwise specified, all instructions should be executed as an unprivileged user. The book will advise you on instructions that need root privileges.

Unpacking the Software

If a file is in .tar format and compressed, it is unpacked by running one of the following commands:

tar -xvf filename.tar.gz
tar -xvf filename.tgz
tar -xvf filename.tar.Z
tar -xvf filename.tar.bz2

Note

You may omit using the v parameter in the commands shown above and below if you wish to suppress the verbose listing of all the files in the archive as they are extracted. This can help speed up the extraction as well as make any errors produced during the extraction more obvious to you.

You can also use a slightly different method:

bzcat filename.tar.bz2 | tar -xv

Finally, you sometimes need to be able to unpack patches which are generally not in .tar format. The best way to do this is to copy the patch file to parent of the 'build' directory and then run one of the following commands depending on whether the file is a .gz or .bz2 file:

gunzip -v patchname.gz
bunzip2 -v patchname.bz2

Verifying File Integrity Using 'md5sum'

Generally, to verify that the downloaded file is genuine and complete, many package maintainers also distribute md5sums of the files. To verify the md5sum of the downloaded files, download both the file and the corresponding md5sum file to the same directory (preferably from different on-line locations), and (assuming file.md5sum is the md5sum file downloaded) run the following command:

md5sum -c file.md5sum

If there are any errors, they will be reported. Note that the BLFS book includes md5sums for all the source files also. To use the BLFS supplied md5sums, you can create a file.md5sum (place the md5sum data and the exact name of the downloaded file on the same line of a file, separated by white space) and run the command shown above. Alternately, simply run the command shown below and compare the output to the md5sum data shown in the BLFS book.

md5sum <name_of_downloaded_file>

Creating Log Files During Installation

For larger packages, it is convenient to create log files instead of staring at the screen hoping to catch a particular error or warning. Log files are also useful for debugging and keeping records. The following command allows you to create an installation log. Replace <command> with the command you intend to execute.

( <command> 2>&1 | tee compile.log && exit $PIPESTATUS )

2>&1 redirects error messages to the same location as standard output. The tee command allows viewing of the output while logging the results to a file. The parentheses around the command run the entire command in a subshell and finally the exit $PIPESTATUS command ensures the result of the <command> is returned as the result and not the result of the tee command.

Automated Building Procedures

There are times when automating the building of a package can come in handy. Everyone has their own reasons for wanting to automate building, and everyone goes about it in their own way. Creating Makefiles, Bash scripts, Perl scripts or simply a list of commands used to cut and paste are just some of the methods you can use to automate building BLFS packages. Detailing how and providing examples of the many ways you can automate the building of packages is beyond the scope of this section. This section will expose you to using file redirection and the yes command to help provide ideas on how to automate your builds.

File Redirection to Automate Input

You will find times throughout your BLFS journey when you will come across a package that has a command prompting you for information. This information might be configuration details, a directory path, or a response to a license agreement. This can present a challenge to automate the building of that package. Occasionally, you will be prompted for different information in a series of questions. One method to automate this type of scenario requires putting the desired responses in a file and using redirection so that the program uses the data in the file as the answers to the questions.

Building the CUPS package is a good example of how redirecting a file as input to prompts can help you automate the build. If you run the test suite, you are asked to respond to a series of questions regarding the type of test to run and if you have any auxiliary programs the test can use. You can create a file with your responses, one response per line, and use a command similar to the one shown below to automate running the test suite:

make check < ../cups-1.1.23-testsuite_parms

This effectively makes the test suite use the responses in the file as the input to the questions. Occasionally you may end up doing a bit of trial and error determining the exact format of your input file for some things, but once figured out and documented you can use this to automate building the package.

Using yes to Automate Input

Sometimes you will only need to provide one response, or provide the same response to many prompts. For these instances, the yes command works really well. The yes command can be used to provide a response (the same one) to one or more instances of questions. It can be used to simulate pressing just the Enter key, entering the Y key or entering a string of text. Perhaps the easiest way to show its use is in an example.

First, create a short Bash script by entering the following commands:

cat > blfs-yes-test1 << "EOF"
#!/bin/bash

echo -n -e "\n\nPlease type something (or nothing) and press Enter ---> "

read A_STRING

if test "$A_STRING" = ""; then A_STRING="Just the Enter key was pressed"
else A_STRING="You entered '$A_STRING'"
fi

echo -e "\n\n$A_STRING\n\n"
EOF
chmod 755 blfs-yes-test1

Now run the script by issuing ./blfs-yes-test1 from the command line. It will wait for a response, which can be anything (or nothing) followed by the Enter key. After entering something, the result will be echoed to the screen. Now use the yes command to automate the entering of a response:

yes | ./blfs-yes-test1

Notice that piping yes by itself to the script results in y being passed to the script. Now try it with a string of text:

yes 'This is some text' | ./blfs-yes-test1

The exact string was used as the response to the script. Finally, try it using an empty (null) string:

yes '' | ./blfs-yes-test1

Notice this results in passing just the press of the Enter key to the script. This is useful for times when the default answer to the prompt is sufficient. This syntax is used in the Net-tools instructions to accept all the defaults to the many prompts during the configuration step. You may now remove the test script, if desired.

File Redirection to Automate Output

In order to automate the building of some packages, especially those that require you to read a license agreement one page at a time, requires using a method that avoids having to press a key to display each page. Redirecting the output to a file can be used in these instances to assist with the automation. The previous section on this page touched on creating log files of the build output. The redirection method shown there used the tee command to redirect output to a file while also displaying the output to the screen. Here, the output will only be sent to a file.

Again, the easiest way to demonstrate the technique is to show an example. First, issue the command:

ls -l /usr/bin | more

Of course, you'll be required to view the output one page at a time because the more filter was used. Now try the same command, but this time redirect the output to a file. The special file /dev/null can be used instead of the filename shown, but you will have no log file to examine:

ls -l /usr/bin | more > redirect_test.log 2>&1

Notice that this time the command immediately returned to the shell prompt without having to page through the output. You may now remove the log file.

The last example will use the yes command in combination with output redirection to bypass having to page through the output and then provide a y to a prompt. This technique could be used in instances when otherwise you would have to page through the output of a file (such as a license agreement) and then answer the question of “do you accept the above?”. For this example, another short Bash script is required:

cat > blfs-yes-test2 << "EOF"
#!/bin/bash

ls -l /usr/bin | more

echo -n -e "\n\nDid you enjoy reading this? (y,n) "

read A_STRING

if test "$A_STRING" = "y"; then A_STRING="You entered the 'y' key"
else A_STRING="You did NOT enter the 'y' key"
fi

echo -e "\n\n$A_STRING\n\n"
EOF
chmod 755 blfs-yes-test2

This script can be used to simulate a program that requires you to read a license agreement, then respond appropriately to accept the agreement before the program will install anything. First, run the script without any automation techniques by issuing ./blfs-yes-test2.

Now issue the following command which uses two automation techniques, making it suitable for use in an automated build script:

yes | ./blfs-yes-test2 > blfs-yes-test2.log 2>&1

If desired, issue tail blfs-yes-test2.log to see the end of the paged output, and confirmation that y was passed through to the script. Once satisfied that it works as it should, you may remove the script and log file.

Finally, keep in mind that there are many ways to automate and/or script the build commands. There is not a single “correct” way to do it. Your imagination is the only limit.

Dependencies

For each package described, BLFS lists the known dependencies. These are listed under several headings, whose meaning is as follows:

  • Required means that the target package cannot be correctly built without the dependency having first been installed.

  • Recommended means that BLFS strongly suggests this package is installed first for a clean and trouble-free build, that won't have issues either during the build process, or at run-time.

  • Optional means that this package might be installed for added functionality. Often BLFS will describe the dependency to explain the added functionality that will result.

Last updated on 2007-04-04 14:42:53 -0500

The /usr Versus /usr/local Debate

Should I install XXX in /usr or /usr/local?

This is a question without an obvious answer for an LFS based system.

In traditional Unix systems, /usr usually contains files that come with the system distribution, and the /usr/local tree is free for the local administrator to manage. The only really hard and fast rule is that Unix distributions should not touch /usr/local, except perhaps to create the basic directories within it.

With Linux distributions like Red Hat, Debian, etc., a possible rule is that /usr is managed by the distribution's package system and /usr/local is not. This way the package manager's database knows about every file within /usr.

LFS users build their own system and so deciding where the system ends and local files begin is not straightforward. So the choice should be made in order to make things easier to administer. There are several reasons for dividing files between /usr and /usr/local.

  • On a network of several machines all running LFS, or mixed LFS and other Linux distributions, /usr/local could be used to hold packages that are common between all the computers in the network. It can be NFS mounted or mirrored from a single server. Here local indicates local to the site.

  • On a network of several computers all running an identical LFS system, /usr/local could hold packages that are different between the machines. In this case local refers to the individual computers.

  • Even on a single computer, /usr/local can be useful if you have several distributions installed simultaneously, and want a place to put packages that will be the same on all of them.

  • Or you might regularly rebuild your LFS, but want a place to put files that you don't want to rebuild each time. This way you can wipe the LFS file system and start from a clean partition every time without losing everything.

Some people ask why not use your own directory tree, e.g., /usr/site, rather than /usr/local?

There is nothing stopping you, many sites do make their own trees, however it makes installing new software more difficult. Automatic installers often look for dependencies in /usr and /usr/local, and if the file it is looking for is in /usr/site instead, the installer will probably fail unless you specifically tell it where to look.

What is the BLFS position on this?

All of the BLFS instructions install programs in /usr with optional instructions to install into /opt for some specific packages.

Last updated on 2007-04-04 14:42:53 -0500

Optional Patches

As you follow the various sections in the book, you will observe that the book occasionally includes patches that are required for a successful and secure installation of the packages. The general policy of the book is to include patches that fall in one of the following criteria:

  • Fixes a compilation problem.

  • Fixes a security problem.

  • Fixes a broken functionality.

In short, the book only includes patches that are either required or recommended. There is a Patches subproject which hosts various patches (including the patches referenced in the books) to enable you to configure your LFS the way you like it.

Last updated on 2007-04-04 14:42:53 -0500

BLFS Boot Scripts

The BLFS Bootscripts package contains the init scripts that are used throughout the book. It is assumed that you will be using the BLFS Bootscripts package in conjunction with a compatible LFS-Bootscripts package. Refer to ../../../../lfs/view/6.3/chapter07/bootscripts.html for more information on the LFS-Bootscripts package.

The BLFS Bootscripts package will be used throughout the BLFS book for startup scripts. Unlike LFS, each init script has a separate install target in the BLFS Bootscripts package. It is recommended you keep the package source directory around until completion of your BLFS system. When a script is requested from BLFS Bootscripts, simply change to the directory and as the root user, execute the given make install-<init-script> command. This command installs the init script to its proper location (along with any auxiliary configuration scripts) and also creates the appropriate symlinks to start and stop the service at the appropriate run-level.

Note

It is advisable to peruse each bootscript before installation to ascertain that it satisfies your need. Also verify that the start and stop symlinks it creates match your preferences.

Last updated on 2007-04-04 14:42:53 -0500

Locale Related Issues

This page contains information about locale related problems and issues. In the following paragraphs you'll find a generic overview of things that can come up when configuring your system for various locales. Many (but not all) existing locale related problems can be classified and fall under one of the headings below. The severity ratings below use the following criteria:

  • Critical: The program doesn't perform its main function. The fix would be very intrusive, it's better to search for a replacement.

  • High: Part of the functionality that the program provides is not usable. If that functionality is required, it's better to search for a replacement.

  • Low: The program works in all typical use cases, but lacks some functionality normally provided by its equivalents.

If there is a known workaround for a specific package, it will appear on that package's page. For the most recent information about locale related issues for individual packages, check the User Notes in the BLFS Wiki.

The Needed Encoding is Not a Valid Option in the Program

Severity: Critical

Some programs require the user to specify the character encoding for their input or output data and present only a limited choice of encodings. This is the case for the -X option in a2ps-4.14 and Enscript-1.6.4, the -input-charset option in unpatched Cdrtools-2.01, and the character sets offered for display in the menu of Links-2.1pre33. If the required encoding is not in the list, the program usually becomes completely unusable. For non-interactive programs, it may be possible to work around this by converting the document to a supported input character set before submitting to the program.

A solution to this type of problem is to implement the necessary support for the missing encoding as a patch to the original program (as done for Cdrtools-2.01 in this book), or to find a replacement.

The Program Assumes the Locale-Based Encoding of External Documents

Severity: High for non-text documents, low for text documents

Some programs, nano-2.0.7 or JOE-3.5 for example, assume that documents are always in the encoding implied by the current locale. While this assumption may be valid for the user-created documents, it is not safe for external ones. When this assumption fails, non-ASCII characters are displayed incorrectly, and the document may become unreadable.

If the external document is entirely text based, it can be converted to the current locale encoding using the iconv program.

For documents that are not text-based, this is not possible. In fact, the assumption made in the program may be completely invalid for documents where the Microsoft Windows operating system has set de facto standards. An example of this problem is ID3v1 tags in MP3 files (see the BLFS Wiki ID3v1Coding page for more details). For these cases, the only solution is to find a replacement program that doesn't have the issue (e.g., one that will allow you to specify the assumed document encoding).

Among BLFS packages, this problem applies to nano-2.0.7, JOE-3.5, and all media players except Audacious-1.3.2.

Another problem in this category is when someone cannot read the documents you've sent them because their operating system is set up to handle character encodings differently. This can happen often when the other person is using Microsoft Windows, which only provides one character encoding for a given country. For example, this causes problems with UTF-8 encoded TeX documents created in Linux. On Windows, most applications will assume that these documents have been created using the default Windows 8-bit encoding. See the teTeX Wiki page for more details.

In extreme cases, Windows encoding compatibility issues may be solved only by running Windows programs under Wine.

The Program Uses or Creates Filenames in the Wrong Encoding

Severity: Critical

The POSIX standard mandates that the filename encoding is the encoding implied by the current LC_CTYPE locale category. This information is well-hidden on the page which specifies the behavior of Tar and Cpio programs. Some programs get it wrong by default (or simply don't have enough information to get it right). The result is that they create filenames which are not subsequently shown correctly by ls, or they refuse to accept filenames that ls shows properly. For the GLib-2.12.12 library, the problem can be corrected by setting the G_FILENAME_ENCODING environment variable to the special "@locale" value. Glib2 based programs that don't respect that environment variable are buggy.

The Zip-2.32, UnZip-5.52, and Nautilus CD Burner-2.18.2 have this problem because they hard-code the expected filename encoding. UnZip contains a hard-coded conversion table between the CP850 (DOS) and ISO-8859-1 (UNIX) encodings and uses this table when extracting archives created under DOS or Microsoft Windows. However, this assumption only works for those in the US and not for anyone using a UTF-8 locale. Non-ASCII characters will be mangled in the extracted filenames.

On the other hand, Nautilus CD Burner checks names of files added to its window for UTF-8 validity. This is wrong for users of non-UTF-8 locales. Also, Nautilus CD Burner unconditionally calls mkisofs with the -input-charset UTF-8 parameter, which is only correct in UTF-8 locales.

The general rule for avoiding this class of problems is to avoid installing broken programs. If this is impossible, the convmv command-line tool can be used to fix filenames created by these broken programs, or intentionally mangle the existing filenames to meet the broken expectations of such programs.

In other cases, a similar problem is caused by importing filenames from a system using a different locale with a tool that is not locale-aware (e.g., NFS Utilities-1.1.2 or OpenSSH-4.7p1). In order to avoid mangling non-ASCII characters when transferring files to a system with a different locale, any of the following methods can be used:

  • Transfer anyway, fix the damage with convmv.

  • On the sending side, create a tar archive with the --format=posix switch passed to tar (this will be the default in a future version of tar).

  • Mail the files as attachments. Mail clients specify the encoding of attached filenames.

  • Write the files to a removable disk formatted with a FAT or FAT32 filesystem.

  • Transfer the files using Samba.

  • Transfer the files via FTP using RFC2640-aware server (this currently means only wu-ftpd, which has bad security history) and client (e.g., lftp).

The last four methods work because the filenames are automatically converted from the sender's locale to UNICODE and stored or sent in this form. They are then transparently converted from UNICODE to the recipient's locale encoding.

The Program Breaks Multibyte Characters or Doesn't Count Character Cells Correctly

Severity: High or critical

Many programs were written in an older era where multibyte locales were not common. Such programs assume that C "char" data type, which is one byte, can be used to store single characters. Further, they assume that any sequence of characters is a valid string and that every character occupies a single character cell. Such assumptions completely break in UTF-8 locales. The visible manifestation is that the program truncates strings prematurely (i.e., at 80 bytes instead of 80 characters). Terminal-based programs don't place the cursor correctly on the screen, don't react to the "Backspace" key by erasing one character, and leave junk characters around when updating the screen, usually turning the screen into a complete mess.

Fixing this kind of problems is a tedious task from a programmer's point of view, like all other cases of retrofitting new concepts into the old flawed design. In this case, one has to redesign all data structures in order to accommodate to the fact that a complete character may span a variable number of "char"s (or switch to wchar_t and convert as needed). Also, for every call to the "strlen" and similar functions, find out whether a number of bytes, a number of characters, or the width of the string was really meant. Sometimes it is faster to write a program with the same functionality from scratch.

Among BLFS packages, this problem applies to xine User Interface-0.99.5 and all the shells.

The Package Installs Manual Pages in Incorrect or Non-Displayable Encoding

Severity: Low

LFS expects that manual pages are in the language-specific (usually 8-bit) encoding, as specified on the LFS Man DB page. However, some packages install translated manual pages in UTF-8 encoding (e.g., Shadow, already dealt with), or manual pages in languages not in the table. Not all BLFS packages have been audited for conformance with the requirements put in LFS (the large majority have been checked, and fixes placed in the book for packages known to install non-conforming manual pages). If you find a manual page installed by any of BLFS packages that is obviously in the wrong encoding, please remove or convert it as needed, and report this to BLFS team as a bug.

You can easily check your system for any non-conforming manual pages by copying the following short shell script to some accessible location,

#!/bin/sh
# Begin checkman.sh
# Usage: find /usr/share/man -type f | xargs checkman.sh
for a in "$@"
do
    # echo "Checking $a..."
    # Pure-ASCII manual page (possibly except comments) is OK
    grep -v '.\\"' "$a" | iconv -f US-ASCII -t US-ASCII >/dev/null 2>&1 \
        && continue
    # Non-UTF-8 manual page is OK
    iconv -f UTF-8 -t UTF-8 "$a" >/dev/null 2>&1 || continue
    # If we got here, we found UTF-8 manual page, bad.
    echo "UTF-8 manual page: $a" >&2
done
# End checkman.sh

and then issuing the following command (modify the command below if the checkman.sh script is not in your PATH environment variable):

find /usr/share/man -type f | xargs checkman.sh

Note that if you have manual pages installed in any location other than /usr/share/man (e.g., /usr/local/share/man), you must modify the above command to include this additional location.

Last updated on 2007-11-01 18:23:19 -0500

Going Beyond BLFS

The packages that are installed in this book are only the tip of the iceberg. We hope that the experience you gained with the LFS book and the BLFS book will give you the background needed to compile, install and configure packages that are not included in this book.

When you want to install a package to a location other than /, or /usr, you are installing outside the default environment settings on most machines. The following examples should assist you in determining how to correct this situation. The examples cover the complete range of settings that may need updating, but they are not all needed in every situation.

  • Expand the PATH to include $PREFIX/bin.

  • Expand the PATH for root to include $PREFIX/sbin.

  • Add $PREFIX/lib to /etc/ld.so.conf or expand LD_LIBRARY_PATH to include it. Before using the latter option, check out http://xahlee.org/UnixResource_dir/_/ldpath.html. If you modify /etc/ld.so.conf, remember to update /etc/ld.so.cache by executing ldconfig as the root user.

  • Add $PREFIX/man to /etc/man_db.conf or expand MANPATH.

  • Add $PREFIX/info to INFOPATH.

  • Add $PREFIX/lib/pkgconfig to PKG_CONFIG_PATH. Some packages are now installing .pc files in $PREFIX/share/pkgconfig, so you may have to include this directory also.

  • Add $PREFIX/include to CPPFLAGS when compiling packages that depend on the package you installed.

  • Add $PREFIX/lib to LDFLAGS when compiling packages that depend on a library installed by the package.

If you are in search of a package that is not in the book, the following are different ways you can search for the desired package.

Some general hints on handling new packages:

  • Many of the newer packages follow the ./configure && make && make install process. Help on the options accepted by configure can be obtained via the command ./configure --help.

  • Most of the packages contain documentation on compiling and installing the package. Some of the documents are excellent, some not so excellent. Check out the homepage of the package for any additional and updated hints for compiling and configuring the package.

  • If you are having a problem compiling the package, try searching the LFS archives at http://www.linuxfromscratch.org/search.html for the error or if that fails, try searching Google. If everything else fails, try the blfs-support mailing-list.

Tip

If you have found a package that is only available in .deb or .rpm format, there are two small scripts, rpm2targz and deb2targz that are available at http://downloads.linuxfromscratch.org/deb2targz.tar.bz2 and http://downloads.linuxfromscratch.org/rpm2targz.tar.bz2 to convert the archives into a simple tar.gz format.

Last updated on 2008-02-25 11:58:32 -0600

Part II. Post LFS Configuration and Extra Software

Chapter 3. After LFS Configuration Issues

The intention of LFS is to provide a basic system which you can build upon. There are several things about tidying up the system which many people wonder about once they have done the base install. We hope to cover these issues in this chapter.

Most people coming from non-Unix like backgrounds to Linux find the concept of text-only configuration files slightly strange. In Linux, just about all configuration is done via the manipulation of text files. The majority of these files can be found in the /etc hierarchy. There are often graphical configuration programs available for different subsystems but most are simply pretty front ends to the process of editing a text file. The advantage of text-only configuration is that you can edit parameters using your favorite text editor, whether that be vim, emacs, or any other editor.

The first task is making a recovery boot device in Creating a Custom Boot Device because it's the most critical need. Then the system is configured to ease addition of new users, because this can affect the choices you make in the two subsequent topics—The Bash Shell Startup Files and The vimrc Files.

The remaining topics, Customizing your Logon with /etc/issue, The /etc/shells File, Random number generation, Compressing man and info pages, Autofs-5.0.3, and Configuring for Network Filesystems are then addressed, in that order. They don't have much interaction with the other topics in this chapter.

Creating a Custom Boot Device

Decent Rescue Boot Device Needs

This section is really about creating a rescue device. As the name rescue implies, the host system has a problem, often lost partition information or corrupted file systems, that prevents it from booting and/or operating normally. For this reason, you must not depend on resources from the host being "rescued". To presume that any given partition or hard drive will be available is a risky presumption.

In a modern system, there are many devices that can be used as a rescue device: floppy, cdrom, usb drive, or even a network card. Which one you use depends on your hardware and your BIOS. In the past, we usually thought of rescue device as a floppy disk. Today, many systems do not even have a floppy drive.

Building a complete rescue device is a challenging task. In many ways, it is equivalent to building an entire LFS system. In addition, it would be a repetition of information already available. For these reasons, the procedures for a rescue device image are not presented here.

Creating a Rescue Floppy

The software of today's systems has grown large. Linux 2.6 no longer supports booting directly from a floppy. In spite of this, there are solutions available using older versions of Linux. One of the best is Tom's Root/Boot Disk available at http://www.toms.net/rb/. This will provide a minimal Linux system on a single floppy disk and provides the ability to customize the contents of your disk if necessary.

Creating a Bootable CD-ROM

There are several sources that can be used for a rescue CD-ROM. Just about any commercial distribution's installation CD-ROMs or DVDs will work. These include RedHat, Mandrake, and SuSE. One very popular option is Knoppix.

Also, the LFS Community has developed its own LiveCD available at http://www.linuxfromscratch.org/livecd/. This LiveCD, in addition to having boot and rescue capabilities, is capable of building an entire LFS/BLFS system. A copy of this CD-ROM is available with the printed version of the Linux From Scratch book. If you download the ISO image, use cdrecord to copy the image to a CD-ROM.

Creating a Bootable USB Drive

A USB Pen drive, sometimes called a Thumb drive, is recognized by Linux as a SCSI device. Using one of these devices as a rescue device has the advantage that it is usually large enough to hold more than a minimal boot image. You can save critical data to the drive as well as use it to diagnose and recover a damaged system. Booting such a drive requires BIOS support, but building the system consists of formatting the drive, adding GRUB as well as the Linux kernel and supporting files.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/CreatingaCustomBootDevice

Last updated on 2008-03-12 11:05:41 -0500

Configuring for Adding Users

Together, the /usr/sbin/useradd command and /etc/skel directory (both are easy to set up and use) provide a way to assure new users are added to your LFS system with the same beginning settings for things such as the PATH, keyboard processing and other environmental variables. Using these two facilities makes it easier to assure this initial state for each new user added to the system.

The /etc/skel directory holds copies of various initialization and other files that may be copied to the new user's home directory when the /usr/sbin/useradd program adds the new user.

Useradd

The useradd program uses a collection of default values kept in /etc/default/useradd. This file is created in a base LFS installation by the Shadow package. If it has been removed or renamed, the useradd program uses some internal defaults. You can see the default values by running /usr/sbin/useradd -D.

To change these values, simply modify the /etc/default/useradd file as the root user. An alternative to directly modifying the file is to run useradd as the root user while supplying the desired modifications on the command line. Information on how to do this can be found in the useradd man page.

/etc/skel

To get started, create an /etc/skel directory and make sure it is writable only by the system administrator, usually root. Creating the directory as root is the best way to go.

The mode of any files from this part of the book that you put in /etc/skel should be writable only by the owner. Also, since there is no telling what kind of sensitive information a user may eventually place in their copy of these files, you should make them unreadable by "group" and "other".

You can also put other files in /etc/skel and different permissions may be needed for them.

Decide which initialization files should be provided in every (or most) new user's home directory. The decisions you make will affect what you do in the next two sections, The Bash Shell Startup Files and The vimrc Files. Some or all of those files will be useful for root, any already-existing users, and new users.

The files from those sections that you might want to place in /etc/skel include .inputrc, .bash_profile, .bashrc, .bash_logout, .dircolors, and .vimrc. If you are unsure which of these should be placed there, just continue to the following sections, read each section and any references provided, and then make your decision.

You will run a slightly modified set of commands for files which are placed in /etc/skel. Each section will remind you of this. In brief, the book's commands have been written for files not added to /etc/skel and instead just sends the results to the user's home directory. If the file is going to be in /etc/skel, change the book's command(s) to send output there instead and then just copy the file from /etc/skel to the appropriate directories, like /etc, ~ or the home directory of any other user already in the system.

When Adding a User

When adding a new user with useradd, use the -m parameter, which tells useradd to create the user's home directory and copy files from /etc/skel (can be overridden) to the new user's home directory. For example (perform as the root user):

useradd -m <newuser>

Last updated on 2007-10-16 08:49:09 -0500

About System Users and Groups

Throughout BLFS, many packages install programs that run as daemons or in some way should have a user or group name assigned. Generally these names are used to map a user ID (uid) or group ID (gid) for system use. Generally the specific uid or gid numbers used by these applications are not significant. The exception of course, is that root has a uid and gid of 0 (zero) that is indeed special. The uid values are stored in /etc/passwd and the gid values are found in /etc/group.

Customarily, Unix systems classify users and groups into two categories: system users and regular users. The system users and groups are given low numbers and regular users and groups have numeric values greater than all the system values. The cutoff for these numbers is found in two parameters in the /etc/login.defs configuration file. The default UID_MIN value is 1000 and the default GID_MIN value is 100. If a specific uid or gid value is not specified when creating a user with useradd or a group with groupadd the values assigned will always be above these cutoff values.

Additionally, the Linux Standard Base recommends that system uid and gid values should be below 100.

Below is a table of suggested uid/gid values used in BLFS beyond those defined in a base LFS installation. These can be changed as desired, but provide a suggested set of consistent values.

Table 3.1. UID/GID Suggested Values

Name uid gid
bin 1
lp 9
messagebus 18 18
haldaemon 19 19
named 20 20
gdm 21 21
fcron 22 22
apache 25 25
smmsp 26 26
exim 31 31
postfix 32 32
postdrop 33
sendmail 34
mail 34
vmailman 35 35
news 36 36
mysql 40 40
postgres 41 41
ftp 45 45
proftpd 46 46
vsftpd 47 47
rsyncd 48 48
sshd 50 50
stunnel 51 51
svn 56 56
svntest 57
games 60 60
anonymous 98
nobody 99
nogroup 99

One value that is missing is 65534. This value is customarily assigned to the user nobody and group nogroup and is unnecessary. The issue is explained in more detail in the first note in the NFS Utilities Installation section.

Last updated on 2008-03-12 11:05:41 -0500

About Devices

Although most devices needed by packages in BLFS and beyond are set up properly by udev using the default rules installed by LFS in /etc/udev/rules.d, there are cases where the rules must be modified or augmented.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/aboutdevices

Multiple Sound Cards

If there are multiple sound cards in a system, the "default" sound card becomes random. The method to establish sound card order depends on whether the drivers are modules or not. If the sound card drivers are compiled into the kernel, control is via kernel command line parameters in /boot/grub/menu.lst. For example, if a system has both an FM801 card and a SoundBlaster PCI card, the following can be appended to the command line:

snd-fm801.index=0 snd-ens1371.index=1

If the sound card drivers are built as modules, the order can be established in the /etc/modprobe.conf file with:

options snd-fm801 index=0
options snd-ens1371 index=1

Udev Device Attributes

Fine-tuning of device attributes such as group name and permissions is possible by creating extra udev rules, matching on something like this (on one line). The vendor and product can be found by searching the /sys/devices directory entries or using udevinfo after the device has been attached. See the documentation in the current udev directory of /usr/share/doc for details.

SUBSYSTEM=="usb_device", SYSFS{idVendor}=="05d8",
   SYSFS{idProduct}=="4002", GROUP:="scanner", MODE:="0640"

USB Device Issues

Some older applications, such as VMware, need the following deprecated entry in the /etc/fstab file. This is not normally needed.

usbfs  /proc/bus/usb  usbfs  devgid=14,devmode=0660  0  0

Devices for Servers

In some cases, it makes sense to disable udev completely and create static devices. Servers are one example of this situation. Does a server need the capability of handling dynamic devices? Only the system administrator can answer that question, but in many cases the answer will be no.

If dynamic devices are not desired, then static devices must be created on the system. In the default configuration, the /etc/rc.d/rcsysinit.d/S10udev boot script mounts a tmpfs partition over the /dev directory. This problem can be overcome by mounting the root partition temporarily:

Warning

If the instructions below are not followed carefully, your system could become unbootable.

mount --bind / /mnt
cp -a /dev/* /mnt/dev
rm /etc/rc.d/rcsysinit.d/{S10udev,S45udev_retry}
umount /mnt

At this point, the system will use static devices upon the next reboot. Create any desired additional devices using mknod.

If you want to restore the dynamic devices, recreate the /etc/rc.d/rcsysinit.d/{S10udev,S45udev_retry} symbolic links and reboot again. Static devices do not need to be removed (console and null are always needed) because they are covered by the tmpfs partition. Disk usage for devices is negligible (about 20–30 bytes per entry.)

Last updated on 2007-04-14 05:46:41 -0500

The Bash Shell Startup Files

The shell program /bin/bash (hereafter referred to as just "the shell") uses a collection of startup files to help create an environment. Each file has a specific use and may affect login and interactive environments differently. The files in the /etc directory generally provide global settings. If an equivalent file exists in your home directory it may override the global settings.

An interactive login shell is started after a successful login, using /bin/login, by reading the /etc/passwd file. This shell invocation normally reads /etc/profile and its private equivalent ~/.bash_profile upon startup.

An interactive non-login shell is normally started at the command-line using a shell program (e.g., [prompt]$/bin/bash) or by the /bin/su command. An interactive non-login shell is also started with a terminal program such as xterm or konsole from within a graphical environment. This type of shell invocation normally copies the parent environment and then reads the user's ~/.bashrc file for additional startup configuration instructions.

A non-interactive shell is usually present when a shell script is running. It is non-interactive because it is processing a script and not waiting for user input between commands. For these shell invocations, only the environment inherited from the parent shell is used.

The file ~/.bash_logout is not used for an invocation of the shell. It is read and executed when a user exits from an interactive login shell.

Many distributions use /etc/bashrc for system wide initialization of non-login shells. This file is usually called from the user's ~/.bashrc file and is not built directly into bash itself. This convention is followed in this section.

For more information see info bash -- Nodes: Bash Startup Files and Interactive Shells.

Note

Most of the instructions below are used to create files located in the /etc directory structure which requires you to execute the commands as the root user. If you elect to create the files in user's home directories instead, you should run the commands as an unprivileged user.

/etc/profile

Here is a base /etc/profile. This file starts by setting up some helper functions and some basic parameters. It specifies some bash history parameters and, for security purposes, disables keeping a permanent history file for the root user. It also sets a default user prompt. It then calls small, single purpose scripts in the /etc/profile.d directory to provide most of the initialization.

For more information on the escape sequences you can use for your prompt (i.e., the PS1 environment variable) see info bash -- Node: Printing a Prompt.

cat > /etc/profile << "EOF"
# Begin /etc/profile
# Written for Beyond Linux From Scratch
# by James Robertson <jameswrobertson@earthlink.net>
# modifications by Dagmar d'Surreal <rivyqntzne@pbzpnfg.arg>

# System wide environment variables and startup programs.

# System wide aliases and functions should go in /etc/bashrc.  Personal
# environment variables and startup programs should go into
# ~/.bash_profile.  Personal aliases and functions should go into
# ~/.bashrc.

# Functions to help us manage paths.  Second argument is the name of the
# path variable to be modified (default: PATH)
pathremove () {
        local IFS=':'
        local NEWPATH
        local DIR
        local PATHVARIABLE=${2:-PATH}
        for DIR in ${!PATHVARIABLE} ; do
                if [ "$DIR" != "$1" ] ; then
                  NEWPATH=${NEWPATH:+$NEWPATH:}$DIR
                fi
        done
        export $PATHVARIABLE="$NEWPATH"
}

pathprepend () {
        pathremove $1 $2
        local PATHVARIABLE=${2:-PATH}
        export $PATHVARIABLE="$1${!PATHVARIABLE:+:${!PATHVARIABLE}}"
}

pathappend () {
        pathremove $1 $2
        local PATHVARIABLE=${2:-PATH}
        export $PATHVARIABLE="${!PATHVARIABLE:+${!PATHVARIABLE}:}$1"
}


# Set the initial path
export PATH=/bin:/usr/bin

if [ $EUID -eq 0 ] ; then
        pathappend /sbin:/usr/sbin
        unset HISTFILE
fi

# Setup some environment variables.
export HISTSIZE=1000
export HISTIGNORE="&:[bf]g:exit"

# Setup a red prompt for root and a green one for users.
NORMAL="\[\e[0m\]"
RED="\[\e[1;31m\]"
GREEN="\[\e[1;32m\]"
if [[ $EUID == 0 ]] ; then
  PS1="$RED\u [ $NORMAL\w$RED ]# $NORMAL"
else
  PS1="$GREEN\u [ $NORMAL\w$GREEN ]\$ $NORMAL"
fi

for script in /etc/profile.d/*.sh ; do
        if [ -r $script ] ; then
                . $script
        fi
done

# Now to clean up
unset pathremove pathprepend pathappend

# End /etc/profile
EOF

The /etc/profile.d Directory

Now create the /etc/profile.d directory, where the individual initialization scripts are placed:

install --directory --mode=0755 --owner=root --group=root /etc/profile.d

/etc/profile.d/dircolors.sh

This script uses the ~/.dircolors and /etc/dircolors files to control the colors of file names in a directory listing. They control colorized output of things like ls --color. The explanation of how to initialize these files is at the end of this section.

cat > /etc/profile.d/dircolors.sh << "EOF"
# Setup for /bin/ls to support color, the alias is in /etc/bashrc.
if [ -f "/etc/dircolors" ] ; then
        eval $(dircolors -b /etc/dircolors)

        if [ -f "$HOME/.dircolors" ] ; then
                eval $(dircolors -b $HOME/.dircolors)
        fi
fi
alias ls='ls --color=auto'
EOF

/etc/profile.d/extrapaths.sh

This script adds several useful paths to the PATH and PKG_CONFIG_PATH environment variables. If you want, you can uncomment the last section to put a dot at the end of your path. This will allow executables in the current working directory to be executed without specifiying a ./, however you are warned that this is generally considered a security hazard.

cat > /etc/profile.d/extrapaths.sh << "EOF"
if [ -d /usr/local/lib/pkgconfig ] ; then
        pathappend /usr/local/lib/pkgconfig PKG_CONFIG_PATH
fi
if [ -d /usr/local/bin ]; then
        pathprepend /usr/local/bin
fi
if [ -d /usr/local/sbin -a $EUID -eq 0 ]; then
        pathprepend /usr/local/sbin
fi

if [ -d ~/bin ]; then
        pathprepend ~/bin
fi
#if [ $EUID -gt 99 ]; then
#        pathappend .
#fi
EOF

/etc/profile.d/readline.sh

This script sets up the default inputrc configuration file. If the user does not have individual settings, it uses the global file.

cat > /etc/profile.d/readline.sh << "EOF"
# Setup the INPUTRC environment variable.
if [ -z "$INPUTRC" -a ! -f "$HOME/.inputrc" ] ; then
        INPUTRC=/etc/inputrc
fi
export INPUTRC
EOF

/etc/profile.d/umask.sh

Setting the umask value is important for security. Here the default group write permissions are turned off for system users and when the user name and group name are not the same.

cat > /etc/profile.d/umask.sh << "EOF"
# By default we want the umask to get set.
if [ "$(id -gn)" = "$(id -un)" -a $EUID -gt 99 ] ; then
  umask 002
else
  umask 022
fi
EOF

/etc/profile.d/X.sh

If X is installed, the PATH and PKG_CONFIG_PATH variables are also updated.

cat > /etc/profile.d/X.sh << "EOF"
if [ -x /usr/X11R6/bin/X ]; then
        pathappend /usr/X11R6/bin
fi
if [ -d /usr/X11R6/lib/pkgconfig ] ; then
        pathappend /usr/X11R6/lib/pkgconfig PKG_CONFIG_PATH
fi
EOF

/etc/profile.d/i18n.sh

This script sets an environment variable necessary for native language support. A full discussion on determining this variable can be found on the LFS Bash Shell Startup Files page.

cat > /etc/profile.d/i18n.sh << "EOF"
# Set up i18n variables
export LANG=<ll>_<CC>.<charmap><@modifiers>
EOF

Other Initialization Values

Other initialization can easily be added to the profile by adding additional scripts to the /etc/profile.d directory.

/etc/bashrc

Here is a base /etc/bashrc. Comments in the file should explain everything you need.

cat > /etc/bashrc << "EOF"
# Begin /etc/bashrc
# Written for Beyond Linux From Scratch
# by James Robertson <jameswrobertson@earthlink.net>
# updated by Bruce Dubbs <bdubbs@linuxfromscratch.org>

# System wide aliases and functions.

# System wide environment variables and startup programs should go into
# /etc/profile.  Personal environment variables and startup programs
# should go into ~/.bash_profile.  Personal aliases and functions should
# go into ~/.bashrc

# Provides a colored /bin/ls command.  Used in conjunction with code in
# /etc/profile.

alias ls='ls --color=auto'

# Provides prompt for non-login shells, specifically shells started
# in the X environment. [Review the LFS archive thread titled
# PS1 Environment Variable for a great case study behind this script
# addendum.]

NORMAL="\[\e[0m\]"
RED="\[\e[1;31m\]"
GREEN="\[\e[1;32m\]"
if [[ $EUID == 0 ]] ; then
  PS1="$RED\u [ $NORMAL\w$RED ]# $NORMAL"
else
  PS1="$GREEN\u [ $NORMAL\w$GREEN ]\$ $NORMAL"
fi

# End /etc/bashrc
EOF

~/.bash_profile

Here is a base ~/.bash_profile. If you want each new user to have this file automatically, just change the output of the command to /etc/skel/.bash_profile and check the permissions after the command is run. You can then copy /etc/skel/.bash_profile to the home directories of already existing users, including root, and set the owner and group appropriately.

cat > ~/.bash_profile << "EOF"
# Begin ~/.bash_profile
# Written for Beyond Linux From Scratch
# by James Robertson <jameswrobertson@earthlink.net>
# updated by Bruce Dubbs <bdubbs@linuxfromscratch.org>

# Personal environment variables and startup programs.

# Personal aliases and functions should go in ~/.bashrc.  System wide
# environment variables and startup programs are in /etc/profile.
# System wide aliases and functions are in /etc/bashrc.

append () {
  # First remove the directory
  local IFS=':'
  local NEWPATH
  for DIR in $PATH; do
     if [ "$DIR" != "$1" ]; then
       NEWPATH=${NEWPATH:+$NEWPATH:}$DIR
     fi
  done

  # Then append the directory
  export PATH=$NEWPATH:$1
}

if [ -f "$HOME/.bashrc" ] ; then
  source $HOME/.bashrc
fi

if [ -d "$HOME/bin" ] ; then
  append $HOME/bin
fi

unset append

# End ~/.bash_profile
EOF

~/.bashrc

Here is a base ~/.bashrc. The comments and instructions for using /etc/skel for .bash_profile above also apply here. Only the target file names are different.

cat > ~/.bashrc << "EOF"
# Begin ~/.bashrc
# Written for Beyond Linux From Scratch
# by James Robertson <jameswrobertson@earthlink.net>

# Personal aliases and functions.

# Personal environment variables and startup programs should go in
# ~/.bash_profile.  System wide environment variables and startup
# programs are in /etc/profile.  System wide aliases and functions are
# in /etc/bashrc.

if [ -f "/etc/bashrc" ] ; then
  source /etc/bashrc
fi

# End ~/.bashrc
EOF

~/.bash_logout

This is an empty ~/.bash_logout that can be used as a template. You will notice that the base ~/.bash_logout does not include a clear command. This is because the clear is handled in the /etc/issue file.

cat > ~/.bash_logout << "EOF"
# Begin ~/.bash_logout
# Written for Beyond Linux From Scratch
# by James Robertson <jameswrobertson@earthlink.net>

# Personal items to perform on logout.

# End ~/.bash_logout
EOF

/etc/dircolors

If you want to use the dircolors capability, then run the following command. The /etc/skel setup steps shown above also can be used here to provide a ~/.dircolors file when a new user is set up. As before, just change the output file name on the following command and assure the permissions, owner, and group are correct on the files created and/or copied.

dircolors -p > /etc/dircolors

If you wish to customize the colors used for different file types, you can edit the /etc/dircolors file. The instructions for setting the colors are embedded in the file.

Finally, Ian Macdonald has written an excellent collection of tips and tricks to enhance your shell environment. You can read it online at http://www.caliban.org/bash/index.shtml.

Last updated on 2008-05-09 08:00:42 -0500

The /etc/vimrc and ~/.vimrc Files

The LFS book installs Vim as its text editor. At this point it should be noted that there are a lot of different editing applications out there including Emacs, nano, Joe and many more. Anyone who has been around the Internet (especially usenet) for a short time will certainly have observed at least one flame war, usually involving Vim and Emacs users!

The LFS book creates a basic vimrc file. In this section you'll find an attempt to enhance this file. At startup, vim reads the global configuration file (/etc/vimrc) as well as a user-specific file (~/.vimrc). Either or both can be tailored to suit the needs of your particular system.

Here is a slightly expanded .vimrc that you can put in ~/.vimrc to provide user specific effects. Of course, if you put it into /etc/skel/.vimrc instead, it will be made available to users you add to the system later. You can also copy the file from /etc/skel/.vimrc to the home directory of users already on the system, such as root. Be sure to set permissions, owner, and group if you do copy anything directly from /etc/skel.

" Begin .vimrc

set columns=80
set wrapmargin=8
set ruler

" End .vimrc

Note that the comment tags are " instead of the more usual # or //. This is correct, the syntax for vimrc is slightly unusual.

Below you'll find a quick explanation of what each of the options in this example file means here:

  • set columns=80: This simply sets the number of columns used on the screen.

  • set wrapmargin=8: This is the number of characters from the right window border where wrapping starts.

  • set ruler: This makes vim show the current row and column at the bottom right of the screen.

More information on the many vim options can be found by reading the help inside vim itself. Do this by typing :help in vim to get the general help, or by typing :help usr_toc.txt to view the User Manual Table of Contents.

Last updated on 2007-10-16 08:02:24 -0500

Customizing your Logon with /etc/issue

When you first boot up your new LFS system, the logon screen will be nice and plain (as it should be in a bare-bones system). Many people however, will want their system to display some information in the logon message. This can be accomplished using the file /etc/issue.

The /etc/issue file is a plain text file which will also accept certain escape sequences (see below) in order to insert information about the system. There is also the file issue.net which can be used when logging on remotely. ssh however, will only use it if you set the option in the configuration file and will not interpret the escape sequences shown below.

One of the most common things which people want to do is clear the screen at each logon. The easiest way of doing that is to put a "clear" escape sequence into /etc/issue. A simple way of doing this is to issue the command clear > /etc/issue. This will insert the relevant escape code into the start of the /etc/issue file. Note that if you do this, when you edit the file, you should leave the characters (normally '^[[H^[[2J') on the first line alone.

Note

Terminal escape sequences are special codes recognized by the terminal. The ^[ represents an ASCII ESC character. The sequence ESC [ H puts the cursor in the upper left hand corner of the screen and ESC 2 J erases the screen. For more information on terminal escape sequences see http://rtfm.etla.org/xterm/ctlseq.html

The following sequences are recognized by agetty (the program which usually parses /etc/issue). This information is from man agetty where you can find extra information about the logon process.

The issue file can contain certain character sequences to display various information. All issue sequences consist of a backslash (\) immediately followed by one of the letters explained below (so \d in /etc/issue would insert the current date).

b   Insert the baudrate of the current line.
d   Insert the current date.
s   Insert the system name, the name of the operating system.
l   Insert the name of the current tty line.
m   Insert the architecture identifier of the machine, e.g., i686.
n   Insert the nodename of the machine, also known as the hostname.
o   Insert the domainname of the machine.
r   Insert the release number of the kernel, e.g., 2.6.11.12.
t   Insert the current time.
u   Insert the number of current users logged in.
U   Insert the string "1 user" or "<n> users" where <n> is the
    number of current users logged in.
v   Insert the version of the OS, e.g., the build-date etc.

Last updated on 2007-04-04 14:42:53 -0500

The /etc/shells File

The shells file contains a list of login shells on the system. Applications use this file to determine whether a shell is valid. For each shell a single line should be present, consisting of the shell's path, relative to the root of the directory structure (/).

For example, this file is consulted by chsh to determine whether an unprivileged user may change the login shell for her own account. If the command name is not listed, the user will be denied of change.

It is a requirement for applications such as GDM which does not populate the face browser if it can't find /etc/shells, or FTP daemons which traditionally disallow access to users with shells not included in this file.

cat > /etc/shells << "EOF"
# Begin /etc/shells

/bin/sh
/bin/bash

# End /etc/shells
EOF

Last updated on 2007-04-04 14:42:53 -0500

Random Number Generation

The Linux kernel supplies a random number generator which is accessed through /dev/random and /dev/urandom. Programs that utilize the random and urandom devices, such as OpenSSH, will benefit from these instructions.

When a Linux system starts up without much operator interaction, the entropy pool (data used to compute a random number) may be in a fairly predictable state. This creates the real possibility that the number generated at startup may always be the same. In order to counteract this effect, you should carry the entropy pool information across your shut-downs and start-ups.

Install the /etc/rc.d/init.d/random init script included with the blfs-bootscripts-20080816 package.

make install-random

Last updated on 2007-04-04 14:42:53 -0500

Compressing Man and Info Pages

Man and info reader programs can transparently process files compressed with gzip or bzip2, a feature you can use to free some disk space while keeping your documentation available. However, things are not that simple; man directories tend to contain links—hard and symbolic—which defeat simple ideas like recursively calling gzip on them. A better way to go is to use the script below. If you would prefer to download the file instead of creating it by typing or cut-and-pasting, you can find it at http://anduin.linuxfromscratch.org/files/BLFS/6.3/compressdoc (the file should be installed in the /usr/sbin directory).

cat > /usr/sbin/compressdoc << "EOF"
#!/bin/bash
# VERSION: 20080421.1623
#
# Compress (with bzip2 or gzip) all man pages in a hierarchy and
# update symlinks - By Marc Heerdink <marc @ koelkast.net>
#
# Modified to be able to gzip or bzip2 files as an option and to deal
# with all symlinks properly by Mark Hymers <markh @ linuxfromscratch.org>
#
# Modified 20030930 by Yann E. Morin <yann.morin.1998 @ anciens.enib.fr>
# to accept compression/decompression, to correctly handle hard-links,
# to allow for changing hard-links into soft- ones, to specify the
# compression level, to parse the man.conf for all occurrences of MANPATH,
# to allow for a backup, to allow to keep the newest version of a page.
#
# Modified 20040330 by Tushar Teredesai to replace $0 by the name of the
# script.
#   (Note: It is assumed that the script is in the user's PATH)
#
# Modified 20050112 by Randy McMurchy to shorten line lengths and
# correct grammar errors.
#
# Modified 20060128 by Alexander E. Patrakov for compatibility with Man-DB.
#
# Modified 20060311 by Archaic to use Man-DB manpath utility which is a
# replacement for man --path from Man.
#
# Modified 20080421 by Dan Nicholson to properly execute the correct
# compressdoc when working recursively. This means the same compressdoc
# will be used whether a full path was given or it was resolved from PATH.
#
# Modified 20080421 by Dan Nicholson to be more robust with directories
# that don't exist or don't have sufficient permissions.
#
# Modified 20080421 by Lars Bamberger to (sort of) automatically choose
# a compression method based on the size of the manpage. A couple bug
# fixes were added by Dan Nicholson.
#
# Modified 20080421 by Dan Nicholson to suppress warnings from manpath
# since these are emitted when $MANPATH is set. Removed the TODO for
# using the $MANPATH variable since manpath(1) handles this already.
#
# TODO:
#     - choose a default compress method to be based on the available
#       tool : gzip or bzip2;
#     - offer an option to restore a previous backup;
#     - add other compression engines (compress, zip, etc?). Needed?

# Funny enough, this function prints some help.
function help ()
{
  if [ -n "$1" ]; then
    echo "Unknown option : $1"
  fi
  ( echo "Usage: $MY_NAME <comp_method> [options] [dirs]" && \
  cat << EOT
Where comp_method is one of :
  --gzip, --gz, -g
  --bzip2, --bz2, -b
                Compress using gzip or bzip2.
  --automatic
                Compress using either gzip or bzip2, depending on the
                size of the file to be compressed. Files larger than 5
                kB are bzipped, files larger than 1 kB are gzipped and
                files smaller than 1 kB are not compressed.

  --decompress, -d
                Decompress the man pages.

  --backup      Specify a .tar backup shall be done for all directories.
                In case a backup already exists, it is saved as .tar.old
                prior to making the new backup. If a .tar.old backup
                exists, it is removed prior to saving the backup.
                In backup mode, no other action is performed.

And where options are :
  -1 to -9, --fast, --best
                The compression level, as accepted by gzip and bzip2.
                When not specified, uses the default compression level
                for the given method (-6 for gzip, and -9 for bzip2).
                Not used when in backup or decompress modes.

  --force, -F   Force (re-)compression, even if the previous one was
                the same method. Useful when changing the compression
                ratio. By default, a page will not be re-compressed if
                it ends with the same suffix as the method adds
                (.bz2 for bzip2, .gz for gzip).

  --soft, -S    Change hard-links into soft-links. Use with _caution_
                as the first encountered file will be used as a
                reference. Not used when in backup mode.

  --hard, -H    Change soft-links into hard-links. Not used when in
                backup mode.

  --conf=dir, --conf dir
                Specify the location of man_db.conf. Defaults to /etc.

  --verbose, -v Verbose mode, print the name of the directory being
                processed. Double the flag to turn it even more verbose,
                and to print the name of the file being processed.

  --fake, -f    Fakes it. Print the actual parameters compressdoc will use.

  dirs          A list of space-separated _absolute_ pathnames to the
                man directories. When empty, and only then, use manpath
                to parse ${MAN_CONF}/man_db.conf for all valid occurrences
                of MANDATORY_MANPATH.

Note about compression:
  There has been a discussion on blfs-support about compression ratios of
  both gzip and bzip2 on man pages, taking into account the hosting fs,
  the architecture, etc... On the overall, the conclusion was that gzip
  was much more efficient on 'small' files, and bzip2 on 'big' files,
  small and big being very dependent on the content of the files.

  See the original post from Mickael A. Peters, titled
  "Bootable Utility CD", dated 20030409.1816(+0200), and subsequent posts:
  http://linuxfromscratch.org/pipermail/blfs-support/2003-April/038817.html

  On my system (x86, ext3), man pages were 35564KB before compression.
  gzip -9 compressed them down to 20372KB (57.28%), bzip2 -9 got down to
  19812KB (55.71%). That is a 1.57% gain in space. YMMV.

  What was not taken into consideration was the decompression speed. But
  does it make sense to? You gain fast access with uncompressed man
  pages, or you gain space at the expense of a slight overhead in time.
  Well, my P4-2.5GHz does not even let me notice this... :-)

EOT
) | less
}

# This function checks that the man page is unique amongst bzip2'd,
# gzip'd and uncompressed versions.
#  $1 the directory in which the file resides
#  $2 the file name for the man page
# Returns 0 (true) if the file is the latest and must be taken care of,
# and 1 (false) if the file is not the latest (and has therefore been
# deleted).
function check_unique ()
{
  # NB. When there are hard-links to this file, these are
  # _not_ deleted. In fact, if there are hard-links, they
  # all have the same date/time, thus making them ready
  # for deletion later on.

  # Build the list of all man pages with the same name
  DIR=$1
  BASENAME=`basename "${2}" .bz2`
  BASENAME=`basename "${BASENAME}" .gz`
  GZ_FILE="$BASENAME".gz
  BZ_FILE="$BASENAME".bz2

  # Look for, and keep, the most recent one
  LATEST=`(cd "$DIR"; ls -1rt "${BASENAME}" "${GZ_FILE}" "${BZ_FILE}" \
         2>/dev/null | tail -n 1)`
  for i in "${BASENAME}" "${GZ_FILE}" "${BZ_FILE}"; do
    [ "$LATEST" != "$i" ] && rm -f "$DIR"/"$i"
  done

  # In case the specified file was the latest, return 0
  [ "$LATEST" = "$2" ] && return 0
  # If the file was not the latest, return 1
  return 1
}

# Name of the script
MY_NAME=`basename $0`

# OK, parse the command-line for arguments, and initialize to some
# sensible state, that is: don't change links state, parse
# /etc/man_db.conf, be most silent, search man_db.conf in /etc, and don't
# force (re-)compression.
COMP_METHOD=
COMP_SUF=
COMP_LVL=
FORCE_OPT=
LN_OPT=
MAN_DIR=
VERBOSE_LVL=0
BACKUP=no
FAKE=no
MAN_CONF=/etc
while [ -n "$1" ]; do
  case $1 in
    --gzip|--gz|-g)
      COMP_SUF=.gz
      COMP_METHOD=$1
      shift
      ;;
    --bzip2|--bz2|-b)
      COMP_SUF=.bz2
      COMP_METHOD=$1
      shift
      ;;
    --automatic)
      COMP_SUF=TBD
      COMP_METHOD=$1
      shift
      ;;
    --decompress|-d)
      COMP_SUF=
      COMP_LVL=
      COMP_METHOD=$1
      shift
      ;;
    -[1-9]|--fast|--best)
      COMP_LVL=$1
      shift
      ;;
    --force|-F)
      FORCE_OPT=-F
      shift
      ;;
    --soft|-S)
      LN_OPT=-S
      shift
      ;;
    --hard|-H)
      LN_OPT=-H
      shift
      ;;
    --conf=*)
      MAN_CONF=`echo $1 | cut -d '=' -f2-`
      shift
      ;;
    --conf)
      MAN_CONF="$2"
      shift 2
      ;;
    --verbose|-v)
      let VERBOSE_LVL++
      shift
      ;;
    --backup)
      BACKUP=yes
      shift
      ;;
    --fake|-f)
      FAKE=yes
      shift
      ;;
    --help|-h)
      help
      exit 0
      ;;
    /*)
      MAN_DIR="${MAN_DIR} ${1}"
      shift
      ;;
    -*)
      help $1
      exit 1
      ;;
    *)
      echo "\"$1\" is not an absolute path name"
      exit 1
      ;;
  esac
done

# Redirections
case $VERBOSE_LVL in
  0)
     # O, be silent
     DEST_FD0=/dev/null
     DEST_FD1=/dev/null
     VERBOSE_OPT=
     ;;
  1)
     # 1, be a bit verbose
     DEST_FD0=/dev/stdout
     DEST_FD1=/dev/null
     VERBOSE_OPT=-v
     ;;
  *)
     # 2 and above, be most verbose
     DEST_FD0=/dev/stdout
     DEST_FD1=/dev/stdout
     VERBOSE_OPT="-v -v"
     ;;
esac

# Note: on my machine, 'man --path' gives /usr/share/man twice, once
# with a trailing '/', once without.
if [ -z "$MAN_DIR" ]; then
  MAN_DIR=`manpath -q -C "$MAN_CONF"/man_db.conf \
            | sed 's/:/\\n/g' \
            | while read foo; do dirname "$foo"/.; done \
            | sort -u \
            | while read bar; do echo -n "$bar "; done`
fi

# If no MANDATORY_MANPATH in ${MAN_CONF}/man_db.conf, abort as well
if [ -z "$MAN_DIR" ]; then
  echo "No directory specified, and no directory found with \`manpath'"
  exit 1
fi

# Check that the specified directories actually exist and are readable
for DIR in $MAN_DIR; do
  if [ ! -d "$DIR" -o ! -r "$DIR" ]; then
    echo "Directory '$DIR' does not exist or is not readable"
    exit 1
  fi
done

# Fake?
if [ "$FAKE" != "no" ]; then
  echo "Actual parameters used:"
  echo -n "Compression.......: "
  case $COMP_METHOD in
    --bzip2|--bz2|-b) echo -n "bzip2";;
    --gzip|--gz|-g) echo -n "gzip";;
    --automatic) echo -n "compressing";;
    --decompress|-d) echo -n "decompressing";;
    *) echo -n "unknown";;
  esac
  echo " ($COMP_METHOD)"
  echo "Compression level.: $COMP_LVL"
  echo "Compression suffix: $COMP_SUF"
  echo -n "Force compression.: "
  [ "foo$FORCE_OPT" = "foo-F" ] && echo "yes" || echo "no"
  echo "man_db.conf is....: ${MAN_CONF}/man_db.conf"
  echo -n "Hard-links........: "
  [ "foo$LN_OPT" = "foo-S" ] &&
  echo "convert to soft-links" || echo "leave as is"
  echo -n "Soft-links........: "
  [ "foo$LN_OPT" = "foo-H" ] &&
  echo "convert to hard-links" || echo "leave as is"
  echo "Backup............: $BACKUP"
  echo "Faking (yes!).....: $FAKE"
  echo "Directories.......: $MAN_DIR"
  echo "Verbosity level...: $VERBOSE_LVL"
  exit 0
fi

# If no method was specified, print help
if [ -z "${COMP_METHOD}" -a "${BACKUP}" = "no" ]; then
  help
  exit 1
fi

# In backup mode, do the backup solely
if [ "$BACKUP" = "yes" ]; then
  for DIR in $MAN_DIR; do
    cd "${DIR}/.."
    if [ ! -w "`pwd`" ]; then
      echo "Directory '`pwd`' is not writable"
      exit 1
    fi
    DIR_NAME=`basename "${DIR}"`
    echo "Backing up $DIR..." > $DEST_FD0
    [ -f "${DIR_NAME}.tar.old" ] && rm -f "${DIR_NAME}.tar.old"
    [ -f "${DIR_NAME}.tar" ] &&
    mv "${DIR_NAME}.tar" "${DIR_NAME}.tar.old"
    tar -cvf "${DIR_NAME}.tar" "${DIR_NAME}" > $DEST_FD1
  done
  exit 0
fi

# I know MAN_DIR has only absolute path names
# I need to take into account the localized man, so I'm going recursive
for DIR in $MAN_DIR; do
  MEM_DIR=`pwd`
  if [ ! -w "$DIR" ]; then
    echo "Directory '$DIR' is not writable"
    exit 1
  fi
  cd "$DIR"
  for FILE in *; do
    # Fixes the case were the directory is empty
    if [ "foo$FILE" = "foo*" ]; then continue; fi

    # Fixes the case when hard-links see their compression scheme change
    # (from not compressed to compressed, or from bz2 to gz, or from gz
    # to bz2)
    # Also fixes the case when multiple version of the page are present,
    # which are either compressed or not.
    if [ ! -L "$FILE" -a ! -e "$FILE" ]; then continue; fi

    # Do not compress whatis files
    if [ "$FILE" = "whatis" ]; then continue; fi

    if [ -d "$FILE" ]; then
      # We are going recursive to that directory
      echo "-> Entering ${DIR}/${FILE}..." > $DEST_FD0
      # I need not pass --conf, as I specify the directory to work on
      # But I need exit in case of error. We must change back to the
      # original directory so $0 is resolved correctly.
      (cd "$MEM_DIR" && eval "$0" ${COMP_METHOD} ${COMP_LVL} ${LN_OPT} \
        ${VERBOSE_OPT} ${FORCE_OPT} "${DIR}/${FILE}") || exit $?
      echo "<- Leaving ${DIR}/${FILE}." > $DEST_FD1

    else # !dir
      if ! check_unique "$DIR" "$FILE"; then continue; fi

      # With automatic compression, get the uncompressed file size of
      # the file (dereferencing symlinks), and choose an appropriate
      # compression method.
      if [ "$COMP_METHOD" = "--automatic" ]; then
        declare -i SIZE
        case "$FILE" in
          *.bz2)
            SIZE=$(bzcat "$FILE" | wc -c) ;;
          *.gz)
            SIZE=$(zcat "$FILE" | wc -c) ;;
          *)
            SIZE=$(wc -c < "$FILE") ;;
        esac
        if (( $SIZE >= (5 * 2**10) )); then
          COMP_SUF=.bz2
        elif (( $SIZE >= (1 * 2**10) )); then
          COMP_SUF=.gz
        else
          COMP_SUF=
        fi
      fi

      # Check if the file is already compressed with the specified method
      BASE_FILE=`basename "$FILE" .gz`
      BASE_FILE=`basename "$BASE_FILE" .bz2`
      if [ "${FILE}" = "${BASE_FILE}${COMP_SUF}" \
         -a "foo${FORCE_OPT}" = "foo" ]; then continue; fi

      # If we have a symlink
      if [ -h "$FILE" ]; then
        case "$FILE" in
          *.bz2)
            EXT=bz2 ;;
          *.gz)
            EXT=gz ;;
          *)
            EXT=none ;;
        esac

        if [ ! "$EXT" = "none" ]; then
          LINK=`ls -l "$FILE" | cut -d ">" -f2 \
               | tr -d " " | sed s/\.$EXT$//`
          NEWNAME=`echo "$FILE" | sed s/\.$EXT$//`
          mv "$FILE" "$NEWNAME"
          FILE="$NEWNAME"
        else
          LINK=`ls -l "$FILE" | cut -d ">" -f2 | tr -d " "`
        fi

        if [ "$LN_OPT" = "-H" ]; then
          # Change this soft-link into a hard- one
          rm -f "$FILE" && ln "${LINK}$COMP_SUF" "${FILE}$COMP_SUF"
          chmod --reference "${LINK}$COMP_SUF" "${FILE}$COMP_SUF"
        else
          # Keep this soft-link a soft- one.
          rm -f "$FILE" && ln -s "${LINK}$COMP_SUF" "${FILE}$COMP_SUF"
        fi
        echo "Relinked $FILE" > $DEST_FD1

      # else if we have a plain file
      elif [ -f "$FILE" ]; then
        # Take care of hard-links: build the list of files hard-linked
        # to the one we are {de,}compressing.
        # NB. This is not optimum has the file will eventually be
        # compressed as many times it has hard-links. But for now,
        # that's the safe way.
        inode=`ls -li "$FILE" | awk '{print $1}'`
        HLINKS=`find . \! -name "$FILE" -inum $inode`

        if [ -n "$HLINKS" ]; then
          # We have hard-links! Remove them now.
          for i in $HLINKS; do rm -f "$i"; done
        fi

        # Now take care of the file that has no hard-link
        # We do decompress first to re-compress with the selected
        # compression ratio later on...
        case "$FILE" in
          *.bz2)
            bunzip2 $FILE
            FILE=`basename "$FILE" .bz2`
          ;;
          *.gz)
            gunzip $FILE
            FILE=`basename "$FILE" .gz`
          ;;
        esac

        # Compress the file with the given compression ratio, if needed
        case $COMP_SUF in
          *bz2)
            bzip2 ${COMP_LVL} "$FILE" && chmod 644 "${FILE}${COMP_SUF}"
            echo "Compressed $FILE" > $DEST_FD1
            ;;
          *gz)
            gzip ${COMP_LVL} "$FILE" && chmod 644 "${FILE}${COMP_SUF}"
            echo "Compressed $FILE" > $DEST_FD1
            ;;
          *)
            echo "Uncompressed $FILE" > $DEST_FD1
            ;;
        esac

        # If the file had hard-links, recreate those (either hard or soft)
        if [ -n "$HLINKS" ]; then
          for i in $HLINKS; do
            NEWFILE=`echo "$i" | sed s/\.gz$// | sed s/\.bz2$//`
            if [ "$LN_OPT" = "-S" ]; then
              # Make this hard-link a soft- one
              ln -s "${FILE}$COMP_SUF" "${NEWFILE}$COMP_SUF"
            else
              # Keep the hard-link a hard- one
              ln "${FILE}$COMP_SUF" "${NEWFILE}$COMP_SUF"
            fi
            # Really work only for hard-links. Harmless for soft-links
            chmod 644 "${NEWFILE}$COMP_SUF"
          done
        fi

      else
        # There is a problem when we get neither a symlink nor a plain
        # file. Obviously, we shall never ever come here... :-(
        echo -n "Whaooo... \"${DIR}/${FILE}\" is neither a symlink "
        echo "nor a plain file. Please check:"
        ls -l "${DIR}/${FILE}"
        exit 1
      fi
    fi
  done # for FILE
done # for DIR

EOF

As root, make compressdoc executable for all users:

chmod -v 755 /usr/sbin/compressdoc

Now, as root, you can issue the command compressdoc --bz2 to compress all your system man pages. You can also run compressdoc --help to get comprehensive help about what the script is able to do.

Don't forget that a few programs, like the X Window System and XEmacs also install their documentation in non-standard places (such as /usr/X11R6/man, etc.). Be sure to add these locations to the file /etc/man_db.conf, as MANDATORY_MANPATH </path> lines.

Example:

    ...
    MANDATORY_MANPATH                       /usr/share/man
    MANDATORY_MANPATH                       /usr/X11R6/man
    MANDATORY_MANPATH                       /usr/local/man
    MANDATORY_MANPATH                       /opt/qt/doc/man
    ...

Generally, package installation systems do not compress man/info pages, which means you will need to run the script again if you want to keep the size of your documentation as small as possible. Also, note that running the script after upgrading a package is safe; when you have several versions of a page (for example, one compressed and one uncompressed), the most recent one is kept and the others are deleted.

Last updated on 2008-04-21 18:27:43 -0500

Automate Mounting of File Systems

Introduction to Autofs

The Autofs package contains userspace tools that work with the kernel to mount and un-mount removable file systems. The primary use is to mount external network file systems like NFS (see NFS Utilities-1.1.2) or Samba (see Samba-3.0.30) on demand.

It may also be useful for allowing users to mount floppies, cdroms and other removable storage devices without requiring the system administrator to mount the devices although this capability is now generally provided by HAL (see HAL-0.5.9.1). This may not be ideal for all installations, so be aware of the risks before implementing this feature.

Package Information

Additional Downloads

Recommended Patches: There are frequent patches issued for Autofs. One method you can use to get the current patches requires first installing the Wget-1.10.2 package. After ensuring the wget command is installed in a directory identified in the PATH variable, start in the same directory as the main tar file and issue the following commands:

wget http://ftp.kernel.org/pub/linux/daemons/autofs/v5/patch_order-5.0.3 &&
sed 's;autofs;http://ftp.kernel.org/pub/linux/daemons/autofs/v5/autofs;' \
    patch_order-5.0.3 > wget-list &&
wget -i wget-list

Autofs Dependencies

Optional

OpenLDAP-2.3.39 and Cyrus SASL-2.1.22

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/autofs

Kernel Configuration

Verify that kernel support has been compiled in or built as modules in the following areas:

File systems ⇒
    Kernel automounter version 4 support  Y or M
    Network File Systems ⇒
        NFS file system support     Y or M (optional)
        SMB file system support     Y or M (optional)

Recompile and install the new kernel, if necessary.

Installation of Autofs

Install Autofs by running the following commands:

for f in `cat ../patch_order-5.0.3`; do
  patch -Np1 -i ../$f
done &&
./configure --prefix=/ --mandir=/usr/share/man &&
make

This package does not come with a test suite.

Now, as the root user:

make install &&
ln -sf  ../init.d/autofs /etc/rc.d/rcsysinit.d/S52autofs

Command Explanations

for f in `cat ../patch_order-5.0.3`; do patch -Np1 -i ../$f; done: This command applies all the patches downloaded earlier in the correct order.

ln -sf ../init.d/autofs /etc/rc.d/rcsysinit.d/S52autofs: This command sets the link to properly start autofs upon boot.

Configuring Autofs

Config Files

/etc/sysconfig/autofs.conf, /etc/auto.master, /etc/auto.misc, and /etc/auto.net

Configuration Information

The installation process creates auto.master, auto.misc, auto.smb, and auto.net. Replace the auto.master file with the following commands:

mv /etc/auto.master /etc/auto.master.bak &&
cat > /etc/auto.master << "EOF"
# Begin /etc/auto.master

/media/auto  /etc/auto.misc  --ghost
#/home        /etc/auto.home

# End /etc/auto.master
EOF

This file creates a new media directory, /media/auto that will overlay any existing directory of the same name. In this example, the file, /etc/auto.misc, has a line:

cd   -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom

that will mount a cdrom as /media/auto/cd if that directory is accessed. The --ghost option tells the automounter to create “ghost” versions (i.e. empty directories) of all the mount points listed in the configuration file regardless whether any of the file systems are actually mounted or not. This is very convenient and highly recommended, because it will show you the available auto-mountable file systems as existing directories, even when their file systems aren't currently mounted. Without the --ghost option, you'll have to remember the names of the directories. As soon as you try to access one of them, the directory will be created and the file system will be mounted. When the file system gets unmounted again, the directory is destroyed too, unless the --ghost option was given.

Note

An alternative method would be to specify another automount location such as /var/lib/auto/cdrom and create a symbolic link from /media/cdrom to the automount location.

The auto.misc file must be configured to your working hardware. The loaded configuration file should load your cdrom if /dev/cdrom is active or it can be edited to match your device setup. Examples for floppies are available in the file and easily activated. Documentation for this file is available using the man 5 autofs command.

In the second line, if enabled, a user's home directory would be mounted via NFS upon login. The /etc/home.auto would need to exist and have an entry similar to:

joe  example.org:/export/home/joe

where the directory /export/home/joe is exported via NFS from the system example.org. NFS shares are covered on the next page.

This package could also be used to mount SMB shares, however that feature is not configured in these instructions. For additional configuration information, see the man pages for auto.master(5). There are also web resources such as this AUTOFS HOWTO available.

Contents

Installed Program: automount
Installed Libraries: lookup_file.so, lookup_hosts.so, lookup_multi.so, lookup_nisplus.so, lookup_program.so, lookup_userhome.so, lookup_yp.so, mount_afs.so, mount_autofs.so, mount_bind.so, mount_changer.so, mount_ext2.so, mount_generic.so, mount_nfs.so, parse_sun.so
Installed Directories: /lib/autofs and /var/run/autofs

Short Descriptions

automount

is the daemon that performs the mounting when a request is made for the device.

Last updated on 2008-08-11 15:01:37 -0500

Configuring for Network Filesystems

While LFS is capable of mounting network file systems such as NFS, these are not mounted by the mountfs init script. Network file systems must be mounted after the networking is activated and unmounted before the network goes down. The netfs bootscript was written to handle both boot-time mounting of network filesystems, if the entry in /etc/fstab contains the _netdev option, and unmounting of all network filesystems before the network is brought down.

As the root user, install the /etc/rc.d/init.d/netfs bootscript included with the blfs-bootscripts-20080816 package.

make install-netfs

Last updated on 2007-04-04 14:42:53 -0500

Chapter 4. Security

Security takes many forms in a computing environment. This chapter gives examples of three different types of security: access, prevention and detection.

Access for users is usually handled by login or an application designed to handle the login function. In this chapter, we show how to enhance login by setting policies with PAM modules. Access via networks can also be secured by policies set by iptables, commonly referred to as a firewall. The Network Security Services (NSS) and Netscape Portable Runtime (NSPR) libraries can be installed and shared among the many applications requiring them. For applications that don't offer the best security, you can use the Stunnel package to wrap an application daemon inside an SSL tunnel.

Prevention of breaches, like a trojan, are assisted by applications like GnuPG, specifically the ability to confirm signed packages, which recognizes modifications of the tarball after the packager creates it.

Finally, we touch on detection with a package that stores "signatures" of critical files (defined by the administrator) and then regenerates those "signatures" and compares for files that have been changed.

OpenSSL-0.9.8g

Introduction to OpenSSL

The OpenSSL package contains management tools and libraries relating to cryptography. These are useful for providing cryptography functions to other packages, notably OpenSSH, email applications and web browsers (for accessing HTTPS sites).

Package Information

Additional Downloads

OpenSSL Dependencies

Optional

bc-1.06 (recommended if you run the test suite during the build)

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/OpenSSL

Installation of OpenSSL

Install OpenSSL by running the following commands:

patch -Np1 -i ../openssl-0.9.8g-fix_manpages-1.patch &&
./config --openssldir=/etc/ssl --prefix=/usr shared &&
make MANDIR=/usr/share/man

To test the results, issue: make test.

Now, as the root user:

make MANDIR=/usr/share/man install &&
cp -v -r certs /etc/ssl &&
install -v -d -m755 /usr/share/doc/openssl-0.9.8g &&
cp -v -r doc/{HOWTO,README,*.{txt,html,gif}} \
    /usr/share/doc/openssl-0.9.8g

Command Explanations

no-rc5 no-idea: When added to the ./config command, this will eliminate the building of those encryption methods. Patent licenses may be needed for you to utilize either of those methods in your projects.

enable-tlsext: When added to the ./config command, this switch will enable TLS Extensions. Currently this is only RFC 3546 and 4507bis for Server Name Indication. This allows the use of multiple SSL certificates with multiple virtual hosts in Apache, while using only one IP address and one port for all virtual hosts.

make MANDIR=/usr/share/man; make MANDIR=/usr/share/man install: These commands install OpenSSL with the man pages in /usr/share/man instead of /etc/ssl/man.

cp -v -r certs /etc/ssl: The certificates must be copied manually as the default installation skips this step.

Configuring OpenSSL

Config Files

/etc/ssl/openssl.cnf

Configuration Information

Most people who just want to use OpenSSL for providing functions to other programs such as OpenSSH and web browsers won't need to worry about configuring OpenSSL. Configuring OpenSSL is an advanced topic and so those who do would normally be expected to either know how to do it or to be able to find out how to do it.

Contents

Installed Programs: c_rehash and openssl
Installed Libraries: libcrypto.{so,a}, libssl.{so,a}, and additional encryption libraries in /usr/lib/engines/ (lib4758cca.so, libaep.so, libatalla.so, libchil.so, libcswift.so, libgmp.so, libnuron.so, libsureware.so and libubsec.so)
Installed Directories: /etc/ssl, /usr/include/ssl, /usr/lib/engines and /usr/share/doc/openssl-0.9.8g

Short Descriptions

c_rehash

is a Perl script that scans all files in a directory and adds symbolic links to their hash values.

openssl

is a command-line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for various functions which are documented in man 1 openssl.

libcrypto.{so,a}

implements a wide range of cryptographic algorithms used in various Internet standards. The services provided by this library are used by the OpenSSL implementations of SSL, TLS and S/MIME, and they have also been used to implement OpenSSH, OpenPGP, and other cryptographic standards.

libssl.{so,a}

implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols. It provides a rich API, documentation on which can be found by running man 3 ssl.

Last updated on 2008-03-22 21:40:43 -0500

GnuTLS-1.6.3

Introduction to GnuTLS

The GnuTLS package contains a library and userspace tools which provide a secure layer over a reliable transport layer. Currently the GnuTLS library implements the proposed standards by the IETF's TLS working group. Quoting from the TLS protocol specification:

The TLS protocol provides communications privacy over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery.

GnuTLS provides support for TLS 1.1, TLS 1.0 and SSL 3.0 protocols, TLS extensions, including server name and max record size. Additionally, the library supports authentication using the SRP protocol, X.509 certificates and OpenPGP keys, along with support for the TLS Pre-Shared-Keys (PSK) extension, the Inner Application (TLS/IA) extension and X.509 and OpenPGP certificate handling.

Package Information

GnuTLS Dependencies

Required

Libgcrypt-1.2.4

Optional

GTK-Doc-1.8, OpenCDK, Tiny ASN.1, libcfg+, LZO-2.02, and Valgrind (used during the test suite)

Optional Debugging Libraries

Dmalloc and Electric Fence

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/gnutls

Installation of GnuTLS

Install GnuTLS by running the following commands:

./configure --prefix=/usr &&
make

To test the results, issue: make check.

Now, as the root user:

make install &&

install -v -m755 -d /usr/share/doc/gnutls-1.6.3/reference &&
install -v -m644    doc/reference/html/* \
                    /usr/share/doc/gnutls-1.6.3/reference &&
install -v -m644    doc/*.{html,png,eps,pdf,ps} \
                    /usr/share/doc/gnutls-1.6.3

Contents

Installed Programs: certtool, gnutls-cli, gnutls-cli-debug, gnutls-serv, libgnutls-config, libgnutls-extra-config, psktool, and srptool
Installed Libraries: libgnutls.{so,a}, libgnutls-extra.{so,a}, libgnutls-openssl.{so,a}, and libgnutlsxx.{so,a}
Installed Directory: /usr/include/gnutls and /usr/share/doc/gnutls-1.6.3

Short Descriptions

certtool

is used to generate X.509 certificates, certificate requests, and private keys.

gnutls-cli

is a simple client program to set up a TLS connection to some other computer.

gnutls-cli-debug

is a simple client program to set up a TLS connection to some other computer and produces very verbose progress results.

gnutls-serv

is a simple server program that listens to incoming TLS connections.

gnutls-config

is a utility used to configure and build applications based on the gnutls(3) library. It can be used to query the C compiler and linker flags which are required to correctly compile and link the application against the gnutls(3) library.

gnutls-extra-config

is a utility used to configure and build applications based on the gnutls-extra(3) library. It can be used to query the C compiler and linker flags which are required to correctly compile and link the application against the gnutls-extra(3) library.

psktool

is a simple program that generates random keys for use with TLS-PSK.

srptool

is a simple program that emulates the programs in the Stanford SRP (Secure Remote Password) libraries using GNU TLS.

libgnutls.{so,a}

contains the core API functions and X.509 certificate API functions.

Last updated on 2008-05-09 08:00:42 -0500

CrackLib-2.8.12

Introduction to CrackLib

The CrackLib package contains a library used to enforce strong passwords by comparing user selected passwords to words in chosen word lists.

Package Information

Additional Downloads

There are additional word lists available for download, e.g., from http://www.cotse.com/tools/wordlists.htm. CrackLib can utilize as many, or as few word lists you choose to install.

Important

Users tend to base their passwords on regular words of the spoken language, and crackers know that. CrackLib is intended to filter out such bad passwords at the source using a dictionary created from word lists. To accomplish this, the word list(s) for use with CrackLib must be an exhaustive list of words and word-based keystroke combinations likely to be chosen by users of the system as (guessable) passwords.

The default word list recommended above for downloading mostly satisfies this role in English-speaking countries. In other situations, it may be necessary to download (or even create) additional word lists.

Note that word lists suitable for spell-checking are not usable as CrackLib word lists in countries with non-Latin based alphabets, because of “word-based keystroke combinations” that make bad passwords.

CrackLib Dependencies

Optional

Python-2.5.2

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/cracklib

Installation of CrackLib

Install CrackLib by running the following commands:

./configure --prefix=/usr \
            --with-default-dict=/lib/cracklib/pw_dict &&
make

Now, as the root user:

make install &&
mv -v /usr/lib/libcrack.so.2* /lib &&
ln -v -sf ../../lib/libcrack.so.2.8.0 /usr/lib/libcrack.so

Issue the following commands as the root user to install the recommended word list and create the CrackLib dictionary. Other word lists (text based, one word per line) can also be used by simply installing them into /usr/share/dict and adding them to the create-cracklib-dict command.

install -v -m644 -D ../cracklib-words-20080203.gz \
    /usr/share/dict/cracklib-words.gz &&
gunzip -v /usr/share/dict/cracklib-words.gz &&
ln -v -s cracklib-words /usr/share/dict/words &&
echo $(hostname) >>/usr/share/dict/cracklib-extra-words &&
install -v -m755 -d /lib/cracklib &&
create-cracklib-dict /usr/share/dict/cracklib-words \
                     /usr/share/dict/cracklib-extra-words

If desired, check the proper operation of the library as an unprivileged user by creating a test data file and running the tests using the following commands:

cat > test-data <<"EOF" &&
antzer
G@ndalf
neulinger
lantzer
Pa$$w0rd
PaS$W0rd
Pas$w0rd
Pas$W0rd
Pa$sw0rd
Pa$sW0rd
EOF

make test

Important

If you are installing CrackLib after your LFS system has been completed and you have the Shadow package installed, you must reinstall Shadow-4.0.18.1 if you wish to provide strong password support on your system. If you are now going to install the Linux-PAM-0.99.10.0 package, you may disregard this note as Shadow will be reinstalled after the Linux-PAM installation.

Command Explanations

--with-default-dict=/lib/cracklib/pw_dict: This parameter forces the installation of the CrackLib dictionary to the /lib hierarchy.

mv -v /usr/lib/libcrack.so.2* /lib and ln -v -sf ../../lib/libcrack.so.2.8.0 ...: These two commands move the libcrack.so.2.8.0 library and associated symlink from /usr/lib to /lib, then recreates the /usr/lib/libcrack.so symlink pointing to the relocated file.

install -v -m644 -D ...: This command creates the /usr/share/dict directory (if it doesn't already exist) and installs the compressed word list there.

ln -v -s cracklib-words /usr/share/dict/words: The word list is linked to /usr/share/dict/words as historically, words is the primary word list in the /usr/share/dict directory. Omit this command if you already have a /usr/share/dict/words file installed on your system.

echo $(hostname) >>...: The value of hostname is echoed to a file called cracklib-extra-words. This extra file is intended to be a site specific list which includes easy to guess passwords such as company or department names, user's names, product names, computer names, domain names, etc.

create-cracklib-dict ...: This command creates the CrackLib dictionary from the word lists. Modify the command to add any additional word lists you have installed.

Contents

Installed Programs: cracklib-check, cracklib-format, cracklib-packer, cracklib-unpacker and create-cracklib-dict
Installed Libraries: libcrack.{so,a} and the cracklibmodule.{so,a} Python module
Installed Directories: /lib/cracklib, /usr/share/dict and /usr/share/cracklib

Short Descriptions

create-cracklib-dict

is used to create the CrackLib dictionary from the given word list(s).

libcrack.{so,a}

provides a fast dictionary lookup method for strong password enforcement.

Last updated on 2008-08-17 08:22:54 -0500

Linux-PAM-0.99.10.0

Introduction to Linux-PAM

The Linux-PAM package contains Pluggable Authentication Modules. This is useful to enable the local system administrator to choose how applications authenticate users.

Package Information

Additional Downloads

Linux-PAM Dependencies

Optional

CrackLib-2.8.12, and Prelude

Optional (To {,Re}build the Documentation)

libxslt-1.1.22, DocBook XML DTD-4.5, DocBook XSL Stylesheets-1.71.1, w3m, and FOP-0.93

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/linux-pam

Installation of Linux-PAM

If you downloaded the documentation, unpack the tarball from the same top-level directory you unpacked the source tarball from. The files will unpack into the correct directories of the source tree.

Install Linux-PAM by running the following commands:

./configure --libdir=/lib \
            --sbindir=/lib/security \
            --enable-securedir=/lib/security \
            --docdir=/usr/share/doc/Linux-PAM-0.99.10.0 \
            --enable-read-both-confs \
            --with-xauth=/usr/X11R6/bin/xauth &&
make

The test suite will not provide meaningful results until the package has been installed and minimally configured. If, after installing the package and creating a minimum configuration as shown below in the 'other' example, you wish to run the tests, issue make check.

Now, as the root user:

make install &&
chmod -v 4755 /lib/security/unix_chkpwd &&

mv -v /lib/security/pam_tally /sbin &&

mv -v /lib/libpam{,c,_misc}.la /usr/lib &&
sed -i 's| /lib| /usr/lib|' /usr/lib/libpam_misc.la &&

if [ -L /lib/libpam.so ]; then
   for LINK in libpam{,c,_misc}.so; do
       ln -v -sf ../../lib/$(readlink /lib/${LINK}) /usr/lib/${LINK} &&
       rm -v /lib/${LINK}
   done
fi

Command Explanations

--libdir=/lib: This parameter results in the libraries being installed in /lib as they may be required in single-user mode.

--sbindir=/lib/security: This parameter results in two executables, one of which is not intended to be run from the command line, being installed in the same directory as the PAM modules. The other executable is later moved to the /sbin directory.

--enable-securedir=/lib/security: This parameter results in the PAM modules being installed in /lib/security.

--docdir=...: This parameter results in the documentation being installed in a versioned directory name.

--enable-read-both-confs: This parameter allows the local administrator to choose which configuration file setup to use.

--with-xauth=/usr/X11R6/bin/xauth: This parameter forces the build of the pam_xauth module, even if xauth is not yet installed. Omit this switch if you have no plans to build Xorg, or modify the path if you intend to install Xorg into a non-standard path.

chmod -v 4755 /lib/security/unix_chkpwd: The unix_chkpwd password-helper program must be setuid so that non-root processes can access the shadow-password file.

mv -v /lib/security/pam_tally /sbin: The pam_tally program is designed to be run by the system administrator, possibly in single-user mode, so it is moved to the appropriate directory.

mv -v /lib/libpam{,c,_misc}.la /usr/lib: This command moves the Libtool library files to /usr/lib as they are expected to reside there.

sed -i 's| /lib| /usr/lib|' /usr/lib/libpam_misc.la: This command corrects an installation reference due to the file being moved in the previous step.

for ...; do ...; done: These commands are used to relocate the .so symbolic links into the /usr/lib directory by cloning and then removing the existing symlinks. Using readlink ensures the new symlinks point at the correct library filenames.

Configuring Linux-PAM

Config Files

/etc/security/* and /etc/pam.d/* or /etc/pam.conf

Configuration Information

Configuration information is placed in /etc/pam.d/ or /etc/pam.conf depending on system administrator preference. Below are example files of each type:

# Begin /etc/pam.d/other

auth            required        pam_unix.so     nullok
account         required        pam_unix.so
session         required        pam_unix.so
password        required        pam_unix.so     nullok

# End /etc/pam.d/other

# Begin /etc/pam.conf

other           auth            required        pam_unix.so     nullok
other           account         required        pam_unix.so
other           session         required        pam_unix.so
other           password        required        pam_unix.so     nullok

# End /etc/pam.conf

The PAM man page (man pam) provides a good starting point for descriptions of fields and allowable entries. The Linux-PAM System Administrators' Guide is recommended for additional information.

Refer to http://www.kernel.org/pub/linux/libs/pam/modules.html for a list of various modules available.

Important

You should now reinstall the Shadow-4.0.18.1 package.

Contents

Installed Program: pam_tally
Installed Libraries: libpam.{so,a}, libpamc.{so,a}, and libpam_misc.{so,a}
Installed Directories: /etc/pam.d, /etc/security, /lib/security and /usr/include/security

Short Descriptions

pam_tally

is used to view or manipulate the faillog file.

libpam.{so,a}

provides the interfaces between applications and the PAM modules.

Last updated on 2008-05-16 01:37:44 -0500

Shadow-4.0.18.1

Introduction to Shadow

Shadow was indeed installed in LFS and there is no reason to reinstall it unless you installed CrackLib or Linux-PAM after your LFS system was completed. If you have installed CrackLib after LFS, then reinstalling Shadow will enable strong password support. If you have installed Linux-PAM, reinstalling Shadow will allow programs such as login and su to utilize PAM.

Package Information

Additional Downloads

Shadow Dependencies

Required

Linux-PAM-0.99.10.0 and/or CrackLib-2.8.12

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/shadow

Installation of Shadow

Important

The installation shown below is for a situation where Linux-PAM has been installed (with or without a CrackLib installation) and Shadow is being reinstalled to support the Linux-PAM installation. If you are reinstalling Shadow to provide strong password support via the CrackLib library and you have not installed Linux-PAM, ensure you add the --with-libcrack parameter to the configure script below.

Reinstall Shadow by running the following commands:

patch -Np1 -i ../shadow-4.0.18.1-useradd_fix-2.patch &&

./configure --libdir=/lib \
            --sysconfdir=/etc \
            --enable-shared \
            --without-selinux &&

sed -i 's/groups$(EXEEXT) //' src/Makefile &&
find man -name Makefile -exec sed -i 's/groups\.1 / /' {} \; &&
sed -i -e 's/ ko//' -e 's/ zh_CN zh_TW//' man/Makefile &&

for i in de es fi fr id it pt_BR; do
    convert-mans UTF-8 ISO-8859-1 man/${i}/*.?
done &&

for i in cs hu pl; do
    convert-mans UTF-8 ISO-8859-2 man/${i}/*.?
done &&

convert-mans UTF-8 EUC-JP man/ja/*.? &&
convert-mans UTF-8 KOI8-R man/ru/*.? &&
convert-mans UTF-8 ISO-8859-9 man/tr/*.? &&

make

This package does not come with a test suite.

Now, as the root user:

make install &&
mv -v /usr/bin/passwd /bin &&
mv -v /lib/libshadow.*a /usr/lib &&
rm -v /lib/libshadow.so &&
ln -v -sf ../../lib/libshadow.so.0 /usr/lib/libshadow.so

Command Explanations

--without-selinux: Support for selinux is enabled by default, but selinux is not built in a base LFS system. The configure script will fail if this option is not used.

sed -i 's/groups$(EXEEXT) //' src/Makefile: This command is used to suppress the installation of the groups program as the version from the Coreutils package installed during LFS is preferred.

find man -name Makefile -exec ... {} \;: This command is used to suppress the installation of the groups man pages so the existing ones installed from the Coreutils package are not replaced.

sed -i -e '...' -e '...' man/Makefile: This command disables the installation of Chinese and Korean manual pages, since Man-DB cannot format them properly.

convert-mans ...: These commands are used to convert some of the man pages so that Man-DB will display them in the expected encodings.

mv -v /usr/bin/passwd /bin: The passwd program may be needed during times when the /usr filesystem is not mounted so it is moved into the root partition.

mv -v ...; rm -v ...; ln -v ...: These commands are used to move the libshadow library to the root partition to support the moving of the passwd program earlier.

Configuring Shadow

Shadow's stock configuration for the useradd utility is not suitable for LFS systems. Use the following commands as the root user to change the default home directory for new users and prevent the creation of mail spool files:

useradd -D -b /home &&
sed -i 's/yes/no/' /etc/default/useradd

Configuring Linux-PAM to Work with Shadow

Note

The rest of this page is devoted to configuring Shadow to work properly with Linux-PAM. If you do not have Linux-PAM installed, and you reinstalled Shadow to support strong passwords via the CrackLib library, no further configuration is required.

Config Files

/etc/pam.d/* or alternatively /etc/pam.conf, /etc/login.defs and /etc/security/*

Configuration Information

Configuring your system to use Linux-PAM can be a complex task. The information below will provide a basic setup so that Shadow's login and password functionality will work effectively with Linux-PAM. Review the information and links on the Linux-PAM-0.99.10.0 page for further configuration information. For information specific to integrating Shadow, Linux-PAM and CrackLib, you can visit the following links:

Configuring /etc/login.defs

The login program currently performs many functions which Linux-PAM modules should now handle. The following sed command will comment out the appropriate lines in /etc/login.defs, and stop login from performing these functions (a backup file named /etc/login.defs.orig is also created to preserve the original file's contents). Issue the following commands as the root user:

install -v -m644 /etc/login.defs /etc/login.defs.orig &&
for FUNCTION in LASTLOG_ENAB MAIL_CHECK_ENAB \
                PORTTIME_CHECKS_ENAB CONSOLE \
                MOTD_FILE NOLOGINS_FILE PASS_MIN_LEN \
                SU_WHEEL_ONLY MD5_CRYPT_ENAB \
                CONSOLE_GROUPS ENVIRON_FILE \
                ULIMIT ENV_TZ ENV_HZ ENV_SUPATH \
                ENV_PATH QMAIL_DIR MAIL_DIR MAIL_FILE \
                CHFN_AUTH FAILLOG_ENAB QUOTAS_ENAB FTMP_FILE \
                OBSCURE_CHECKS_ENAB CRACKLIB_DICTPATH \
                PASS_CHANGE_TRIES PASS_ALWAYS_WARN ISSUE_FILE
do
    sed -i "s/^$FUNCTION/# &/" /etc/login.defs
done
Configuring the /etc/pam.d/ Files

As mentioned previously in the Linux-PAM instructions, Linux-PAM has two supported methods for configuration. The commands below assume that you've chosen to use a directory based configuration, where each program has its own configuration file. You can optionally use a single /etc/pam.conf configuration file by using the text from the files below, and supplying the program name as an additional first field for each line.

As the root user, create the /etc/pam.d directory with the following command:

install -v -d -m755 /etc/pam.d

While still the root user, add the following Linux-PAM configuration files to the /etc/pam.d/ directory (or add the contents to the /etc/pam.conf file) with the following commands:

'login' (with CrackLib)
cat > /etc/pam.d/login << "EOF"
# Begin /etc/pam.d/login

auth        requisite      pam_nologin.so
auth        required       pam_securetty.so
auth        required       pam_unix.so
account     required       pam_access.so
account     required       pam_unix.so
session     required       pam_env.so
session     required       pam_motd.so
session     required       pam_limits.so
session     optional       pam_mail.so      dir=/var/mail standard
session     optional       pam_lastlog.so
session     required       pam_unix.so
password    required       pam_cracklib.so  retry=3
password    required       pam_unix.so      md5 shadow use_authtok

# End /etc/pam.d/login
EOF
'login' (without CrackLib)
cat > /etc/pam.d/login << "EOF"
# Begin /etc/pam.d/login

auth        requisite      pam_nologin.so
auth        required       pam_securetty.so
auth        required       pam_env.so
auth        required       pam_unix.so
account     required       pam_access.so
account     required       pam_unix.so
session     required       pam_motd.so
session     required       pam_limits.so
session     optional       pam_mail.so      dir=/var/mail standard
session     optional       pam_lastlog.so
session     required       pam_unix.so
password    required       pam_unix.so      md5 shadow

# End /etc/pam.d/login
EOF
'passwd' (with CrackLib)
cat > /etc/pam.d/passwd << "EOF"
# Begin /etc/pam.d/passwd

password    required       pam_cracklib.so  type=Linux retry=1 \
                                            difok=5 diffignore=23 minlen=9 \
                                            dcredit=1 ucredit=1 lcredit=1 \
                                            ocredit=1 \
                                            dictpath=/lib/cracklib/pw_dict
password    required       pam_unix.so      md5 shadow use_authtok

# End /etc/pam.d/passwd
EOF

Note

In its default configuration, owing to credits, pam_cracklib will allow multiple case passwords as short as 6 characters, even with the minlen value set to 11. You should review the pam_cracklib(8) man page and determine if these default values are acceptable for the security of your system.

'passwd' (without CrackLib)
cat > /etc/pam.d/passwd << "EOF"
# Begin /etc/pam.d/passwd

password    required       pam_unix.so      md5 shadow

# End /etc/pam.d/passwd
EOF
'su'
cat > /etc/pam.d/su << "EOF"
# Begin /etc/pam.d/su

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     optional        pam_mail.so     dir=/var/mail standard
session     optional        pam_xauth.so
session     required        pam_env.so
session     required        pam_unix.so

# End /etc/pam.d/su
EOF
'chage'
cat > /etc/pam.d/chage << "EOF"
# Begin /etc/pam.d/chage

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     required        pam_unix.so
password    required        pam_permit.so

# End /etc/pam.d/chage
EOF
'chpasswd', 'chgpasswd', 'groupadd', 'groupdel', 'groupmems', 'groupmod', 'newusers', 'useradd', 'userdel', and 'usermod'
for PROGRAM in chpasswd chgpasswd groupadd groupdel groupmems \
               groupmod newusers useradd userdel usermod
do
    install -v -m644 /etc/pam.d/chage /etc/pam.d/$PROGRAM
    sed -i "s/chage/$PROGRAM/" /etc/pam.d/$PROGRAM
done

Warning

At this point, you should do a simple test to see if Shadow is working as expected. Open another terminal and log in as a user, then su to root. If you do not see any errors, then all is well and you should proceed with the rest of the configuration. If you did receive errors, stop now and double check the above configuration files manually. You can also run the test suite from the Linux-PAM package to assist you in determining the problem. If you cannot find and fix the error, you should recompile Shadow adding the --without-libpam switch to the configure command in the above instructions (also move the /etc/login.defs.orig backup file to /etc/login.defs). If you fail to do this and the errors remain, you will be unable to log into your system.

Other

Currently, /etc/pam.d/other is configured to allow anyone with an account on the machine to use PAM-aware programs without a configuration file for that program. After testing Linux-PAM for proper configuration, install a more restrictive other file so that program-specific configuration files are required:

cat > /etc/pam.d/other << "EOF"
# Begin /etc/pam.d/other

auth        required        pam_deny.so
auth        required        pam_warn.so
account     required        pam_deny.so
session     required        pam_deny.so
password    required        pam_deny.so
password    required        pam_warn.so

# End /etc/pam.d/other
EOF

If you preserved the source tree from the Linux-PAM package (or you feel like unpacking that tarball, then running configure and make), now would be a good time to run the test suite from this package. This test suite will use the configuration you just finished during the tests. All the tests should pass.

Configuring Login Access

Instead of using the /etc/login.access file for controlling access to the system, Linux-PAM uses the pam_access.so module along with the /etc/security/access.conf file. Rename the /etc/login.access file using the following command:

if [ -f /etc/login.access ]; then
    mv -v /etc/login.access /etc/login.access.NOUSE
fi
Configuring Resource Limits

Instead of using the /etc/limits file for limiting usage of system resources, Linux-PAM uses the pam_limits.so module along with the /etc/security/limits.conf file. Rename the /etc/limits file using the following command:

if [ -f /etc/limits ]; then
    mv -v /etc/limits /etc/limits.NOUSE
fi
Configuring Default Environment

During previous configuration, several items were removed from /etc/login.defs. Some of these items are now controlled by the pam_env.so module and the /etc/security/pam_env.conf configuration file. In particular, the default path has been changed. To recover your default path, execute the following commands:

ENV_PATH=`grep '^ENV_PATH' /etc/login.defs.orig | \
    awk '{ print $2 }' | sed 's/PATH=//'` &&
echo 'PATH        DEFAULT='`echo "${ENV_PATH}"`\
'        OVERRIDE=${PATH}' \
    >> /etc/security/pam_env.conf &&
unset ENV_PATH

Note

ENV_SUPATH is no longer supported. You must create a valid /root/.bashrc file to provide a modified path for the super-user.

Contents

A list of the installed files, along with their short descriptions can be found at ../../../../lfs/view/6.3/chapter06/shadow.html#contents-shadow.

Last updated on 2008-06-27 00:27:03 -0500

Iptables-1.3.8

Introduction to Iptables

The next part of this chapter deals with firewalls. The principal firewall tool for Linux, as of the 2.4 kernel series, is iptables. It replaces ipchains from the 2.2 series and ipfwadm from the 2.0 series. You will need to install iptables if you intend on using any form of a firewall.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/iptables

Kernel Configuration

A firewall in Linux is accomplished through a portion of the kernel called netfilter. The interface to netfilter is iptables. To use it, the appropriate kernel configuration parameters are found in Networking ⇒ Networking Options ⇒ Network Packet Filtering ⇒ Core Netfilter Configuration (and) IP: Netfilter Configuration.

Installation of Iptables

Note

The installation below does not include building some specialized extension libraries which require the raw headers in the Linux source code. If you wish to build the additional extensions (if you aren't sure, then you probably don't), you can look at the INSTALL file to see an example of how to change the KERNEL_DIR= parameter to point at the Linux source code. Note that if you upgrade the kernel version, you may also need to recompile iptables and that the BLFS team has not tested using the raw kernel headers.

For some non-x86 architectures, the raw kernel headers may be required. In that case, modify the KERNEL_DIR= parameter to point at the Linux source code.

Install iptables by running the following commands:

sed -i 's/name="$node/name="node/' iptables.xslt &&
make LIBDIR=/lib KERNEL_DIR=/usr

This package does not come with a test suite.

Now, as the root user:

make PREFIX=/usr LIBDIR=/lib BINDIR=/sbin \
    MANDIR=/usr/share/man install &&
install -v -m644 iptables.xslt /lib/iptables

Command Explanations

sed -i 's/name="$node/name="node/' iptables.xslt: This corrects a syntax error in the XSLT stylesheet for use with iptables-xml.

PREFIX=/usr LIBDIR=/lib BINDIR=/sbin: Compiles and installs iptables modules into /lib, binaries into /sbin and the remainder into the /usr hierarchy instead of /usr/local. Firewalls are generally activated during the boot process and /usr may not be mounted at that time.

KERNEL_DIR=/usr: This parameter is used to point at the sanitized kernel headers in /usr and not use the raw kernel headers in /usr/src/linux.

Configuring Iptables

Introductory instructions for configuring your firewall are presented in the next section: Firewalling

Boot Script

To set up the iptables firewall at boot, install the /etc/rc.d/init.d/iptables init script included in the blfs-bootscripts-20080816 package.

make install-iptables

Contents

Installed Programs: iptables, iptables-restore, iptables-save, iptables-xml and ip6tables
Installed Libraries: libip6t_*.so and libipt_*.so
Installed Directory: /lib/iptables

Short Descriptions

iptables

is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel.

iptables-restore

is used to restore IP Tables from data specified on STDIN. Use I/O redirection provided by your shell to read from a file.

iptables-save

is used to dump the contents of an IP Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file.

iptables-xml

is used to convert the output of iptables-save to an XML format. Using the iptables.xslt stylesheet converts the XML back to the format of iptables-restore.

ip6tables

is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.

libip*.so

library modules are various modules (implemented as dynamic libraries) which extend the core functionality of iptables.

Last updated on 2008-05-09 07:42:27 -0500

Setting Up a Network Firewall

Before you read this part of the chapter, you should have already installed iptables as described in the previous section.

Introduction to Firewall Creation

The general purpose of a firewall is to protect a computer or a network against malicious access.

In a perfect world, every daemon or service on every machine is perfectly configured and immune to flaws such as buffer overflows or other problems regarding its security. Furthermore, you trust every user accessing your services. In this world, you do not need to have a firewall.

In the real world however, daemons may be misconfigured and exploits against essential services are freely available. You may wish to choose which services are accessible by certain machines or you may wish to limit which machines or applications are allowed external access. Alternatively, you may simply not trust some of your applications or users. You are probably connected to the Internet. In this world, a firewall is essential.

Don't assume however, that having a firewall makes careful configuration redundant, or that it makes any negligent misconfiguration harmless. It doesn't prevent anyone from exploiting a service you intentionally offer but haven't recently updated or patched after an exploit went public. Despite having a firewall, you need to keep applications and daemons on your system properly configured and up to date. A firewall is not a cure all, but should be an essential part of your overall security strategy.

Meaning of the Word "Firewall"

The word firewall can have several different meanings.

This is a hardware device or software program commercially sold (or offered via freeware) by companies such as Symantec which claims that it secures a home or desktop computer connected to the Internet. This type of firewall is highly relevant for users who do not know how their computers might be accessed via the Internet or how to disable that access, especially if they are always online and connected via broadband links.

This is a system placed between the Internet and an intranet. To minimize the risk of compromising the firewall itself, it should generally have only one role—that of protecting the intranet. Although not completely risk free, the tasks of doing the routing and IP masquerading (rewriting IP headers of the packets it routes from clients with private IP addresses onto the Internet so that they seem to come from the firewall itself) are commonly considered relatively secure.

This is often an old computer you may have retired and nearly forgotten, performing masquerading or routing functions, but offering non-firewall services such as a web-cache or mail. This may be used for home networks, but is not to be considered as secure as a firewall only machine because the combination of server and router/firewall on one machine raises the complexity of the setup.

Firewall with a Demilitarized Zone [Not Further Described Here]

This box performs masquerading or routing, but grants public access to some branch of your network which, because of public IPs and a physically separated structure, is essentially a separate network with direct Internet access. The servers on this network are those which must be easily accessible from both the Internet and intranet. The firewall protects both networks. This type of firewall has a minimum of three network interfaces.

Packetfilter

This type of firewall does routing or masquerading, but does not maintain a state table of ongoing communication streams. It is fast, but quite limited in its ability to block undesired packets without blocking desired packets.

Now You Can Start to Build your Firewall

Caution

This introduction on how to setup a firewall is not a complete guide to securing systems. Firewalling is a complex issue that requires careful configuration. The scripts quoted here are simply intended to give examples of how a firewall works. They are not intended to fit into any particular configuration and may not provide complete protection from an attack.

Customization of these scripts for your specific situation will be necessary for an optimal configuration, but you should make a serious study of the iptables documentation and creating firewalls in general before hacking away. Have a look at the list of links for further reading at the end of this section for more details. There you will find a list of URLs that contain quite comprehensive information about building your own firewall.

The firewall configuration script installed in the iptables section differs from the standard configuration script. It only has two of the standard targets: start and status. The other targets are clear and lock. For instance if you issue:

/etc/rc.d/init.d/iptables start

the firewall will be restarted just as it is upon system startup. The status target will present a list of all currently implemented rules. The clear target turns off all firewall rules and the lock target will block all packets in and out of the computer with the exception of the loopback interface.

The main startup firewall is located in the file /etc/rc.d/rc.iptables. The sections below provide three different approaches that can be used for a system.

Note

You should always run your firewall rules from a script. This ensures consistency and a record of what was done. It also allows retention of comments that are essential for understanding the rules long after they were written.

Personal Firewall

A Personal Firewall is designed to let you access all the services offered on the Internet, but keep your box secure and your data private.

Below is a slightly modified version of Rusty Russell's recommendation from the Linux 2.4 Packet Filtering HOWTO. It is still applicable to the Linux 2.6 kernels.

cat > /etc/rc.d/rc.iptables << "EOF"
#!/bin/sh

# Begin $rc_base/rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe ipt_LOG

# Enable broadcast echo Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

# Don¹t send Redirect Messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

# Log packets with impossible addresses.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

# be verbose on dynamic ip-addresses  (not needed in case of static IP)
echo 2 > /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 > /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT  -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log everything else. What's Windows' latest exploitable vulnerability?
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables
EOF
chmod 700 /etc/rc.d/rc.iptables

This script is quite simple, it drops all traffic coming into your computer that wasn't initiated from your computer, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.

If you frequently encounter certain delays at accessing FTP servers, take a look at BusyBox example number 4.

Even if you have daemons or services running on your system, these will be inaccessible everywhere but from your computer itself. If you want to allow access to services on your machine, such as ssh or ping, take a look at BusyBox.

Masquerading Router

A true Firewall has two interfaces, one connected to an intranet, in this example eth0, and one connected to the Internet, here ppp0. To provide the maximum security for the firewall itself, make sure that there are no unnecessary servers running on it such as X11 et al. As a general principle, the firewall itself should not access any untrusted service (think of a remote server giving answers that makes a daemon on your system crash, or even worse, that implements a worm via a buffer-overflow).

cat > /etc/rc.d/rc.iptables << "EOF"
#!/bin/sh

# Begin $rc_base/rc.iptables

echo
echo "You're using the example configuration for a setup of a firewall"
echo "from Beyond Linux From Scratch."
echo "This example is far from being complete, it is only meant"
echo "to be a reference."
echo "Firewall security is a complex issue, that exceeds the scope"
echo "of the configuration rules below."
echo "You can find additional information"
echo "about firewalls in Chapter 4 of the BLFS book."
echo "http://www.linuxfromscratch.org/blfs"
echo

# Insert iptables modules (not needed if built into the kernel).

modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ipt_MASQUERADE
modprobe ipt_LOG
modprobe ipt_REJECT

# Enable broadcast echo Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

# Don¹t send Redirect Messages
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

# Drop Spoofed Packets coming in on an interface where responses
# would result in the reply going out a different interface.
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

# Log packets with impossible addresses.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

# Be verbose on dynamic ip-addresses  (not needed in case of static IP)
echo 2 > /proc/sys/net/ipv4/ip_dynaddr

# Disable Explicit Congestion Notification
# Too many routers are still ignorant
echo 0 > /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local connections
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow forwarding if the initiated on the intranet
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD  -i ! ppp+ -m state --state NEW      -j ACCEPT

# Do masquerading
# (not needed if intranet is not using private ip-addresses)
iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE

# Log everything for debugging
# (last of all rules, but before policy rules)
iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT  "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD"
iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "

# Enable IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
EOF
chmod 700 /etc/rc.d/rc.iptables

With this script your intranet should be reasonably secure against external attacks. No one should be able to setup a new connection to any internal service and, if it's masqueraded, makes your intranet invisible to the Internet. Furthermore, your firewall should be relatively safe because there are no services running that a cracker could attack.

Note

If the interface you're connecting to the Internet doesn't connect via PPP, you will need to change <ppp+> to the name of the interface (e.g., eth1) which you are using.

BusyBox

This scenario isn't too different from the Masquerading Router, but additionally offers some services to your intranet. Examples of this can be when you want to administer your firewall from another host on your intranet or use it as a proxy or a name server.

Note

Outlining a true concept of how to protect a server that offers services on the Internet goes far beyond the scope of this document. See the references at the end of this section for more information.

Be cautious. Every service you have enabled makes your setup more complex and your firewall less secure. You are exposed to the risks of misconfigured services or running a service with an exploitable bug. A firewall should generally not run any extra services. See the introduction to the Masquerading Router for some more details.

If you want to add services such as internal Samba or name servers that do not need to access the Internet themselves, the additional statements are quite simple and should still be acceptable from a security standpoint. Just add the following lines into the script before the logging rules.

iptables -A INPUT  -i ! ppp+  -j ACCEPT
iptables -A OUTPUT -o ! ppp+  -j ACCEPT

If daemons, such as squid, have to access the Internet themselves, you could open OUTPUT generally and restrict INPUT.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT

However, it is generally not advisable to leave OUTPUT unrestricted. You lose any control over trojans who would like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it broadcasts its existence to the world.

To accomplish this, you should restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log files.

Have a Look at the Following Examples:

  • Squid is caching the web:

    iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
    iptables -A INPUT  -p tcp --sport 80 -m state --state ESTABLISHED \
      -j ACCEPT
    
  • Your caching name server (e.g., named) does its lookups via UDP:

    iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
    
  • You want to be able to ping your computer to ensure it's still alive:

    iptables -A INPUT  -p icmp -m icmp --icmp-type echo-request -j ACCEPT
    iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply   -j ACCEPT
    
  • If you are frequently accessing FTP servers or enjoy chatting, you might notice certain delays because some implementations of these daemons have the feature of querying an identd on your system to obtain usernames. Although there's really little harm in this, having an identd running is not recommended because many security experts feel the service gives out too much additional information.

    To avoid these delays you could reject the requests with a 'tcp-reset':

    iptables -A INPUT  -p tcp --dport 113 -j REJECT --reject-with tcp-reset
    
  • To log and drop invalid packets (packets that came in after netfilter's timeout or some types of network scans):

    iptables -I INPUT -p tcp -m state --state INVALID \
      -j LOG --log-prefix "FIREWALL:INVALID"
    iptables -I INPUT -p tcp -m state --state INVALID -j DROP
    
  • Anything coming from the outside should not have a private address, this is a common attack called IP-spoofing:

    iptables -A INPUT -i ppp+ -s 10.0.0.0/8     -j DROP
    iptables -A INPUT -i ppp+ -s 172.16.0.0/12  -j DROP
    iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP
    

    There are other addresses that you may also want to drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and experimental), 169.254.0.0/16 (Link Local Networks), and 192.0.2.0/24 (IANA defined test network).

  • If your firewall is a DHCP client, you need to allow those packets:

    iptables -A INPUT  -i ppp0 -p udp -s 0.0.0.0 --sport 67 \
       -d 255.255.255.255 --dport 68 -j ACCEPT
    
  • To simplify debugging and be fair to anyone who'd like to access a service you have disabled, purposely or by mistake, you could REJECT those packets that are dropped.

    Obviously this must be done directly after logging as the very last lines before the packets are dropped by policy:

    iptables -A INPUT -j REJECT
    

These are only examples to show you some of the capabilities of the firewall code in Linux. Have a look at the man page of iptables. There you will find much more information. The port numbers needed for this can be found in /etc/services, in case you didn't find them by trial and error in your log file.

Conclusion

Finally, there is one fact you must not forget: The effort spent attacking a system corresponds to the value the cracker expects to gain from it. If you are responsible for valuable information, you need to spend the time to protect it properly.

Last updated on 2007-10-16 08:26:18 -0500

GnuPG-1.4.7

Introduction to GnuPG

The GnuPG package contains a public/private key encryptor. This is becoming useful for signing files or emails as proof of identity and preventing tampering with the contents of the file or email. For a more enhanced version of GnuPG which supports S/MIME, see the GnuPG-2.0.8 package.

Package Information

GnuPG Dependencies

Optional

OpenSSL-0.9.8g, OpenLDAP-2.3.39, libusb-0.1.12, cURL-7.16.3, an MTA, DocBook-utils-0.6.14, and docbook-to-man

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/gnupg

Installation of GnuPG

Install GnuPG by running the following commands:

./configure --prefix=/usr --libexecdir=/usr/lib &&
make

If you have teTeX-3.0 installed and you wish to create documentation in alternate formats, issue the following command:

make -C doc pdf html

To test the results, issue: make check.

Now, as the root user:

make install &&
chmod -v 4755 /usr/bin/gpg &&

install -v -m755 -d /usr/share/doc/gnupg-1.4.7 &&
mv -v /usr/share/gnupg/{FAQ,faq.html} /usr/share/doc/gnupg-1.4.7 &&
install -v -m644 \
    doc/{highlights-1.4.txt,OpenPGP,samplekeys.asc,DETAILS,*.texi} \
    /usr/share/doc/gnupg-1.4.7

If you created alternate formats of the documentation, install it using the following command as the root user:

cp -v -R doc/gnupg1.{html,pdf} /usr/share/doc/gnupg-1.4.7

Command Explanations

--libexecdir=/usr/lib: This command creates a gnupg directory in /usr/lib instead of /usr/libexec.

chmod -v 4755 /usr/bin/gpg: gpg is installed setuid root to avoid swapping out sensitive data.

Contents

Installed Programs: gpg, gpg-zip, gpgsplit, and gpgv
Installed Libraries: None
Installed Directories: /usr/lib/gnupg, /usr/share/gnupg and /usr/share/doc/gnupg-1.4.7

Short Descriptions

gpg

is the backend (command-line interface) for this OpenPGP implementation.

gpgsplit

separates key rings.

gpgv

is a verify only version of gpg.

Last updated on 2008-08-24 11:52:33 -0500

GnuPG-2.0.8

Introduction to GnuPG 2

The GnuPG 2 package is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described by several RFCs. GnuPG 2 is the stable version of GnuPG integrating support for OpenPGP and S/MIME. It does not conflict with an installed GnuPG-1.4.7 OpenPGP-only version.

Package Information

GnuPG Dependencies

Required

Pth-2.0.7, Libassuan-1.0.4, Libgcrypt-1.2.4, and Libksba-1.0.2

Optional

OpenLDAP-2.3.39, libusb-0.1.12, cURL-7.16.3, and an MTA

Optional (Run-time Requirement For Most of the Package's Functionality)

PIN-Entry-0.7.3

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/gnupg2

Installation of GnuPG 2

Install GnuPG 2 by running the following commands:

./configure --prefix=/usr --libexecdir=/usr/lib/gnupg2 &&
make

If you have teTeX-3.0 installed and you wish to create documentation in alternate formats, issue the following commands:

make -C doc pdf ps html &&
makeinfo --html --no-split -o doc/gnupg_nochunks.html doc/gnupg.texi &&
makeinfo --plaintext       -o doc/gnupg.txt           doc/gnupg.texi

To test the results, issue: make check.

Now, as the root user:

make install &&

install -v -m755 -d         /usr/share/doc/gnupg-2.0.8 &&
ln -sv ../../gnupg/FAQ      /usr/share/doc/gnupg-2.0.8 &&
ln -sv ../../gnupg/faq.html /usr/share/doc/gnupg-2.0.8 &&

install -v -m644 doc/{DETAILS,KEYSERVER,OpenPGP,TRANSLATE} \
                            /usr/share/doc/gnupg-2.0.8

If you created alternate formats of the documentation, install it using the following command as the root user:

install -v -m755 -d /usr/share/doc/gnupg-2.0.8/html       &&
install -v -m644 doc/gnupg.html/* \
                    /usr/share/doc/gnupg-2.0.8/html       &&
install -v -m644 doc/gnupg_nochunks.html \
                    /usr/share/doc/gnupg-2.0.8/gnupg.html &&
install -v -m644 doc/*.texi \
                    /usr/share/doc/gnupg-2.0.8            &&
install -v -m644 doc/gnupg.{pdf,dvi,ps,txt} \
                    /usr/share/doc/gnupg-2.0.8

Command Explanations

--libexecdir=/usr/lib/gnupg2: This switch creates a gnupg directory in /usr/lib instead of /usr/libexec.

Contents

Installed Programs: addgnupghome, applygnupgdefaults, gpg-agent, gpg-connect-agent, gpg2, gpgconf, gpgkey2ssh, gpgparsemail, gpgsm, gpgsm-gencert.sh, gpgv2, kbxutil, scdaemon, symcryptrun, and watchgnupg
Installed Libraries: None
Installed Directories: /usr/lib/gnupg2, /usr/share/gnupg and /usr/share/doc/gnupg2-2.0.8

Short Descriptions

addgnupghome

is used to create and populate user's ~/.gnupg directories

applygnupgdefaults

is a wrapper script used to run gpgconf with the --apply-defaults parameter on all user's GnuPG home directories.

gpg-agent

is a daemon used to manage secret (private) keys independently from any protocol. It is used as a backend for gpg and gpgsm as well as for a couple of other utilities.

gpg-connect-agent

is a utility used to communicate with a running gpg-agent.

gpg2

is the OpenPGP part of the GNU Privacy Guard (GnuPG). It is a tool used to provide digital encryption and signing services using the OpenPGP standard.

gpgconf

is a utility used to automatically and reasonable safely query and modify configuration files in the ~/.gnupg home directory. It is designed not to be invoked manually by the user, but automatically by graphical user interfaces.

gpgparsemail

is a utility currently only useful for debugging. Run it with --help for usage information.

gpgsm

is a tool similar to gpg used to provide digital encryption and signing services on X.509 certificates and the CMS protocol. It is mainly used as a backend for S/MIME mail processing.

gpgsm-gencert.sh

is a simple tool used to interactivly generate a certificate request which will be printed to stdout.

gpgv2

is a verify only version of gpg2.

kbxutil

is used to list, export and import Keybox data.

scdaemon

is a daemon used to manage smartcards. It is usually invoked by gpg-agent and in general not used directly.

symcryptrun

is a simple symmetric encryption tool.

watchgnupg

is used to listen to a Unix Domain socket created by any of the GnuPG tools.

Last updated on 2008-08-24 11:52:33 -0500

Tripwire-2.4.1.2

Introduction to Tripwire

The Tripwire package contains programs used to verify the integrity of the files on a given system.

Package Information

Tripwire Dependencies

Required

OpenSSL-0.9.8g

Optional

An MTA

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/tripwire

Installation of Tripwire

Compile Tripwire by running the following commands:

sed -i -e 's@TWDB="${prefix}@TWDB="/var@' install/install.cfg &&
./configure --prefix=/usr --sysconfdir=/etc/tripwire &&
make

Warning

The default configuration is to use a local MTA. If you don't have an MTA installed and have no wish to install one, modify install/install.cfg to use an SMTP server instead. Otherwise the install will fail.

This package does not come with a test suite.

Now, as the root user:

make install &&
cp -v policy/*.txt /usr/doc/tripwire

Command Explanations

sed -i -e 's@TWDB="${prefix}@TWDB="/var@' install/install.cfg: This command tells the package to install the program database and reports in /var/lib/tripwire.

make install: This command creates the Tripwire security keys as well as installing the binaries. There are two keys: a site key and a local key which are stored in /etc/tripwire/.

cp -v policy/*.txt /usr/doc/tripwire: This command installs the tripwire sample policy files with the other tripwire documentation.

Configuring Tripwire

Config Files

/etc/tripwire/*

Configuration Information

Tripwire uses a policy file to determine which files are integrity checked. The default policy file (/etc/tripwire/twpol.txt) is for a default installation and will need to be updated for your system.

Policy files should be tailored to each individual distribution and/or installation. Some example policy files can be found in /usr/doc/tripwire/ (Note that /usr/doc/ is a symbolic link on LFS systems to /usr/share/doc/).

If desired, copy the policy file you'd like to try into /etc/tripwire/ instead of using the default policy file, twpol.txt. It is, however, recommended that you edit your policy file. Get ideas from the examples above and read /usr/doc/tripwire/policyguide.txt for additional information. twpol.txt is a good policy file for learning about Tripwire as it will note any changes to the file system and can even be used as an annoying way of keeping track of changes for uninstallation of software.

After your policy file has been edited to your satisfaction you may begin the configuration steps (perform as the root):

twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
    /etc/tripwire/twpol.txt &&
tripwire --init

Depending on your system and the contents of the policy file, the initialization phase above can take a relatively long time.

Usage Information

Tripwire will identify file changes in the critical system files specified in the policy file. Using Tripwire while making frequent changes to these directories will flag all these changes. It is most useful after a system has reached a configuration that the user considers stable.

To use Tripwire after creating a policy file to run a report, use the following command:

tripwire --check > /etc/tripwire/report.txt

View the output to check the integrity of your files. An automatic integrity report can be produced by using a cron facility to schedule the runs.

Reports are stored in binary and, if desired, encrypted. View reports, as the root user, with:

twprint --print-report -r /var/lib/tripwire/report/<report-name.twr>

After you run an integrity check, you should examine the report (or email) and then modify the Tripwire database to reflect the changed files on your system. This is so that Tripwire will not continually notify you that files you intentionally changed are a security violation. To do this you must first ls -l /var/lib/tripwire/report/ and note the name of the newest file which starts with your system name as presented by the command uname -n and ends in .twr. These files were created during report creation and the most current one is needed to update the Tripwire database of your system. As the root user, type in the following command making the appropriate report name:

tripwire --update --twrfile /var/lib/tripwire/report/<report-name.twr>

You will be placed into vim with a copy of the report in front of you. If all the changes were good, then just type :wq and after entering your local key, the database will be updated. If there are files which you still want to be warned about, remove the 'x' before the filename in the report and type :wq.

A good summary of tripwire operations can be found at http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/ch-tripwire.html.

Changing the Policy File

If you are unhappy with your policy file and would like to modify it or use a new one, modify the policy file and then execute the following commands as the root user:

twadmin --create-polfile /etc/tripwire/twpol.txt &&
tripwire --init

Contents

Installed Programs: siggen, tripwire, twadmin, and twprint
Installed Libraries: None
Installed Directories: /etc/tripwire, /var/lib/tripwire, and /usr/share/doc/tripwire

Short Descriptions

siggen

is a signature gathering utility that displays the hash function values for the specified files.

tripwire

is the main file integrity checking program.

twadmin

administrative and utility tool used to perform certain administrative functions related to Tripwire files and configuration options.

twprint

prints Tripwire database and report files in clear text format.

Last updated on 2008-05-09 08:00:42 -0500

Heimdal-1.1

Introduction to Heimdal

Heimdal is a free implementation of Kerberos 5 that aims to be compatible with MIT Kerberos 5 and is backward compatible with Kerberos 4. Kerberos is a network authentication protocol. Basically it preserves the integrity of passwords in any untrusted network (like the Internet). Kerberized applications work hand-in-hand with sites that support Kerberos to ensure that passwords cannot be stolen or compromised. A Kerberos installation will make changes to the authentication mechanisms on your network and will overwrite several programs and daemons from the Shadow, Inetutils and Qpopper packages. See http://anduin.linuxfromscratch.org/files/BLFS/6.3/heimdal-overwrites for a complete list of all the files and commands to rename each of them.

Package Information

Additional Downloads

Heimdal Dependencies

Required to Build the Server-Side Tools

Berkeley DB-4.5.20 is recommended (installed in LFS) or GDBM-1.8.3

Recommended
Optional

Linux-PAM-0.99.10.0, OpenLDAP-2.3.39, X Window System, and libcap

Note

Some sort of time synchronization facility on your system (like NTP-4.2.4p0) is required since Kerberos won't authenticate if the time differential between a kerberized client and the KDC server is more than 5 minutes.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/heimdal

Installation of Heimdal

Warning

Ensure you really need a Kerberos installation before you decide to install this package. Failure to install and configure the package correctly can alter your system so that users cannot log in.

Install Heimdal by running the following commands:

patch -Np1 -i ../heimdal-1.1-blfs_docs-1.patch &&
patch -Np1 -i ../heimdal-1.1-libss-1.patch &&

./configure --prefix=/usr \
            --sysconfdir=/etc/heimdal \
            --libexecdir=/usr/sbin \
            --localstatedir=/var/lib/heimdal \
            --datadir=/var/lib/heimdal \
            --with-hdbdir=/var/lib/heimdal \
            --with-readline=/usr \
            --enable-kcm &&
make

If you have teTeX-3.0 installed and wish to create alternate forms of the documentation, change into the doc directory and issue any or all of the following commands:

pushd doc                                        &&

make html                                        &&

texi2pdf                            heimdal.texi &&
texi2dvi                            heimdal.texi &&
dvips                -o heimdal.ps  heimdal.dvi  &&
makeinfo --plaintext -o heimdal.txt heimdal.texi &&

texi2pdf                            hx509.texi   &&
texi2dvi                            hx509.texi   &&
dvips                -o hx509.ps    hx509.dvi    &&
makeinfo --plaintext -o hx509.txt   hx509.texi   &&

popd

To test the results, issue: make -k check. The ipropd test is known to fail but all others should pass.

Now, as the root user:

make install &&

install -v -m755 -d /usr/share/doc/heimdal-1.1 &&
install -v -m644    doc/{init-creds,layman.asc} \
                    /usr/share/doc/heimdal-1.1 &&

ln -sfv         mech.5 /usr/share/man/man5/qop.5  &&
ln -sfv ../man5/mech.5 /usr/share/man/cat5/qop.5  &&
ln -sfv ../man5/mech.5 /usr/share/man/cat5        &&

mv -v /bin/login          /bin/login.SHADOW &&
mv -v /bin/su             /bin/su.SHADOW    &&
mv -v /usr/bin/{login,su} /bin              &&
ln -v -sf ../../bin/login /usr/bin          &&

for LINK in   lib{otp,kafs,krb5,hx509,asn1,roken,crypto}; do
    mv -v     /usr/lib/${LINK}.so.* /lib &&
    ln -v -sf ../../lib/$(readlink  /usr/lib/${LINK}.so) \
              /usr/lib/${LINK}.so
done &&

mv -v     /usr/lib/$(readlink /usr/lib/libdb.so) \
          /usr/lib/libdb-?.so \
          /lib &&
ln -v -sf ../../lib/$(readlink /usr/lib/libdb.so) \
          /usr/lib/libdb.so &&

ldconfig

If you built any of the alternate forms of documentation, install it using the following commands as the root user:

install -v -m644 doc/{heimdal,hx509}.{dvi,ps,pdf,html,txt} \
                 /usr/share/doc/heimdal-1.1

If you wish to use the CrackLib-2.8.12 library to enforce strong passwords in the KDC database, issue the following commands as the root user:

sed -e 's|/usr/pkg|/usr|' \
    -e 's|/usr/lib/cracklib_dict|/lib/cracklib/pw_dict|' \
    -e 's|/var/heimdal|/var/lib/heimdal|' \
        lib/kadm5/check-cracklib.pl \
    > /bin/krb5-check-cracklib.pl &&

chmod -v 755 /bin/krb5-check-cracklib.pl

Command Explanations

--libexecdir=/usr/sbin: This switch causes the daemon programs to be installed into /usr/sbin.

Tip

If you want to preserve all your existing Inetutils package daemons, install the Heimdal daemons into /usr/sbin/heimdal (or wherever you want). Since these programs will be called from (x)inetd or rc scripts, it really doesn't matter where they are installed, as long as they are correctly specified in the /etc/(x)inetd.conf file and rc scripts. If you choose something other than /usr/sbin, you may want to move some of the user programs (such as kadmin) to /usr/sbin manually so they'll be in the privileged user's default PATH.

--localstatedir=/var/lib/heimdal, --datadir=/var/lib/heimdal and --with-hdbdir=/var/lib/heimdal: These parameters are used so that the KDC database and associated files will all reside in /var/lib/heimdal.

--with-readline=/usr: This parameter must be used so that the configure script properly locates the installed Readline package.

--enable-kcm: This parameter enables building the Kerberos Credentials Manager.

ln -sfv .../mech.5 /usr/share/man/...: These commands are used to fix some broken symbolic links.

mv ... ...SHADOW, mv ... /bin and ln ... /usr/bin: The login and su programs installed by Heimdal belong in the /bin directory. The login program is symlinked because Heimdal is expecting to find it in /usr/bin. The old executables from the Shadow package are preserved before the move so that they can be restored if you experience problems logging into the system after the Heimdal package is installed and configured.

for LINK in ...; do ...; done, mv ... /lib and ln ... /usr/lib/libdb.so: The login and su programs previously moved into the /lib directory link against Heimdal libraries as well as libraries provided by the OpenSSL and Berkeley DB packages. These libraries are also moved to /lib so they are FHS compliant and also in case /usr is located on a separate partition which may not always be mounted.

Configuring Heimdal

Config Files

/etc/heimdal/*

Configuration Information

Note

All the configuration steps shown below must be accomplished by the root user unless otherwise noted.

Master KDC Server Configuration

Many of the commands below use <replaceable> tags to identify places where you need to substitute information specific to your network. Ensure you replace everything in these tags (there will be no angle brackets when you are done) with your site-specific information.

Create the Kerberos configuration file with the following commands:

install -v -m755 -d /etc/heimdal &&
cat > /etc/heimdal/krb5.conf << "EOF" &&
# Begin /etc/heimdal/krb5.conf

[libdefaults]
    default_realm = <EXAMPLE.COM>
    encrypt = true

[realms]
    <EXAMPLE.COM> = {
        kdc = <hostname.example.com>
        admin_server = <hostname.example.com>
        kpasswd_server = <hostname.example.com>
    }

[domain_realm]
    .<example.com> = <EXAMPLE.COM>

[logging]
    kdc = FILE:/var/log/kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb.log

# End /etc/heimdal/krb5.conf
EOF
chmod -v 644 /etc/heimdal/krb5.conf

You will need to substitute your domain and proper hostname for the occurrences of the <hostname> and <EXAMPLE.COM> names.

default_realm should be the name of your domain changed to ALL CAPS. This isn't required, but both Heimdal and MIT Kerberos recommend it.

encrypt = true provides encryption of all traffic between kerberized clients and servers. It's not necessary and can be left off. If you leave it off, you can encrypt all traffic from the client to the server using a switch on the client program instead. The [realms] parameters tell the client programs where to look for the KDC authentication services. The [domain_realm] section maps a domain to a realm.

Store the master password in a key file using the following commands:

install -v -m755 -d /var/lib/heimdal &&
kstash

Create the KDC database:

kadmin -l

The commands below will prompt you for information about the principles. Choose the defaults for now unless you know what you are doing and need to specify different values. You can go in later and change the defaults, should you feel the need. You may use the up and down arrow keys to use the history feature of kadmin in a similar manner as the bash history feature.

At the kadmin> prompt, issue the following statement:

init <EXAMPLE.COM>

The database must now be populated with at least one principle (user). For now, just use your regular login name or root. You may create as few, or as many principles as you wish using the following statement:

add <loginname>

The KDC server and any machine running kerberized server daemons must have a host key installed:

add --random-key host/<hostname.example.com>

After choosing the defaults when prompted, you will have to export the data to a keytab file:

ext host/<hostname.example.com>

This should have created two files in /etc/heimdal: krb5.keytab (Kerberos 5) and srvtab (Kerberos 4). Both files should have 600 (root rw only) permissions. Keeping the keytab files from public access is crucial to the overall security of the Kerberos installation.

Eventually, you'll want to add server daemon principles to the database and extract them to the keytab file. You do this in the same way you created the host principles. Below is an example:

add --random-key ftp/<hostname.example.com>

(choose the defaults)

ext ftp/<hostname.example.com>

Exit the kadmin program (use quit or exit) and return back to the shell prompt. Start the KDC daemon manually, just to test out the installation:

/usr/sbin/kdc &

Attempt to get a TGT (ticket granting ticket) with the following command:

kinit <loginname>

You will be prompted for the password you created. After you get your ticket, you should list it with the following command:

klist

Information about the ticket should be displayed on the screen.

To test the functionality of the keytab file, issue the following command:

ktutil list

This should dump a list of the host principals, along with the encryption methods used to access the principals.

At this point, if everything has been successful so far, you can feel fairly confident in the installation, setup and configuration of your new Heimdal Kerberos 5 installation.

If you wish to use the CrackLib-2.8.12 library to enforce strong passwords in the KDC database, you must do two things. First, add the following lines to the /etc/heimdal/krb5.conf configuration file:

[password_quality]
    policies = builtin:external-check
    external_program = /bin/krb5-check-cracklib.pl

Next you must install the Crypt::Cracklib Perl module. Download it from the CPAN site. The URL at the time of this writing is http://cpan.org/authors/id/D/DA/DANIEL/Crypt-Cracklib-1.2.tar.gz. After unpacking the tarball and changing into the newly created directory, issue the following command to add the BLFS Cracklib dictionary location to one of the source files:

sed -i 's|pw_dict|&\n\t\t/lib/cracklib/pw_dict|' Cracklib.pm

Then use the standard perl Makefile.PL; make; make test; make install commands. Note that one test fails due to an unknown reason.

Install the /etc/rc.d/init.d/heimdal init script included in the blfs-bootscripts-20080816 package:

make install-heimdal
Using Kerberized Client Programs

To use the kerberized client programs (telnet, ftp, rsh, rxterm, rxtelnet, rcp, xnlock), you first must get a TGT. Use the kinit program to get the ticket. After you've acquired the ticket, you can use the kerberized programs to connect to any kerberized server on the network. You will not be prompted for authentication until your ticket expires (default is one day), unless you specify a different user as a command line argument to the program.

The kerberized programs will connect to non-kerberized daemons, warning you that authentication is not encrypted.

In order to use the Heimdal X programs, you'll need to add a service port entry to the /etc/services file for the kxd server. There is no 'standardized port number' for the 'kx' service in the IANA database, so you'll have to pick an unused port number. Add an entry to the services file similar to the entry below (substitute your chosen port number for <49150>):

kx              <49150>/tcp   # Heimdal kerberos X
kx              <49150>/udp   # Heimdal kerberos X

For additional information consult the Heimdal hint on which the above instructions are based.

Contents

Installed Programs: afslog, ftp, ftpd, gss, hprop, hpropd, hxtool, iprop-log, ipropd-master, ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kdigest, kf, kfd, kgetcred, kimpersonate, kinit, klist, kpasswd, kpasswdd, krb5-check-cracklib.pl, krb5-config, kstash, ktutil, kx, kxd, login, mk_cmds-krb5, otp, otpprint, pagsh, pfrom, popper, push, rcp, rsh, rshd, rxtelnet, rxterm, string2key, su, telnet, telnetd, tenletxr, verify_krb5_conf and xnlock
Installed Libraries: hdb_ldap.{so,a}, libasn1.{so,a}, libeditline.{so,a}, libgssapi.{so,a}, libhdb.{so,a}, libheimntlm.{so,a}, libhx509.{so,a}, libkadm5clnt.{so,a}, libkadm5srv.{so,a}, libkafs.{so,a}, libkdc.{so,a}, libkrb5.{so,a}, libotp.{so,a}, libroken.{so,a}, libsl.{so,a}, libss-krb5.{so,a} and windc.{so,a}
Installed Directories: /etc/heimdal, /usr/include/gssapi, /usr/include/kadm5, /usr/include/krb5, /usr/include/roken, /usr/include/ss, /usr/share/doc/heimdal-1.1 and /var/lib/heimdal

Short Descriptions

afslog

obtains AFS tokens for a number of cells.

ftp

is a kerberized FTP client.

ftpd

is a kerberized FTP daemon.

hprop

takes a principal database in a specified format and converts it into a stream of Heimdal database records.

hpropd

is a server that receives a database sent by hprop and writes it as a local database.

iprop-log

is used to maintain the iprop log file.

ipropd-master

is a daemon which runs on the master KDC server which incrementally propagates changes to the KDC database to the slave KDC servers.

ipropd-slave

is a daemon which runs on the slave KDC servers which incrementally propagates changes to the KDC database from the master KDC server.

kadmin

is a utility used to make modifications to the Kerberos database.

kadmind

is a server for administrative access to the Kerberos database.

kauth

is a symbolic link to the kinit program.

kcm

is a process based credential cache for Kerberos tickets.

kdc

is a Kerberos 5 server.

kdestroy

removes a principle's current set of tickets.

kf

is a program which forwards tickets to a remote host through an authenticated and encrypted stream.

kfd

is a server used to receive forwarded tickets.

kgetcred

obtains a ticket for a service.

kinit

is used to authenticate to the Kerberos server as a principal and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

klist

reads and displays the current tickets in the credential cache.

kpasswd

is a program for changing Kerberos 5 passwords.

kpasswdd

is a Kerberos 5 password changing server.

krb5-config

gives information on how to link programs against Heimdal libraries.

kstash

stores the KDC master password in a file.

ktutil

is a program for managing Kerberos keytabs.

kx

is a program which securely forwards X connections.

kxd

is the daemon for kx.

login

is a kerberized login program.

otp

manages one-time passwords.

otpprint

prints lists of one-time passwords.

pfrom

is a script that runs push --from.

popper

is a kerberized POP-3 server.

push

is a kerberized POP mail retrieval client.

rcp

is a kerberized rcp client program.

rsh

is a kerberized rsh client program.

rshd

is a kerberized rsh server.

rxtelnet

starts a secure xterm window with a telnet to a given host and forwards X connections.

rxterm

starts a secure remote xterm.

string2key

maps a password into a key.

su

is a kerberized su client program.

telnet

is a kerberized telnet client program.

telnetd

is a kerberized telnet server.

tenletxr

forwards X connections backwards.

verify_krb5_conf

checks krb5.conf file for obvious errors.

xnlock

is a program that acts as a secure screen saver for workstations running X.

libasn1.{so,a}

provides the ASN.1 and DER functions to encode and decode the Kerberos TGTs.

libeditline.a

is a command-line editing library with history.

libgssapi.{so,a}

contain the Generic Security Service Application Programming Interface (GSSAPI) functions which provides security services to callers in a generic fashion, supportable with a range of underlying mechanisms and technologies and hence allowing source-level portability of applications to different environments.

libhdb.{so,a}

is a Heimdal Kerberos 5 authentication/authorization database access library.

libkadm5clnt.{so,a}

contains the administrative authentication and password checking functions required by Kerberos 5 client-side programs.

libkadm5srv.{so,a}

contain the administrative authentication and password checking functions required by Kerberos 5 servers.

libkafs.{so,a}

contains the functions required to authenticated to AFS.

libkrb5.{so,a}

is an all-purpose Kerberos 5 library.

libotp.{so,a}

contains the functions required to handle authenticating one time passwords.

libroken.{so,a}

is a library containing Kerberos 5 compatibility functions.

Last updated on 2008-05-09 08:00:42 -0500

MIT Kerberos V5-1.6

Introduction to MIT Kerberos V5

MIT Kerberos V5 is a free implementation of Kerberos 5. Kerberos is a network authentication protocol. It centralizes the authentication database and uses kerberized applications to work with servers or services that support Kerberos allowing single logins and encrypted communication over internal networks or the Internet.

Package Information

MIT Kerberos V5 Dependencies

Optional

Linux-PAM-0.99.10.0 (for xdm based logins), OpenLDAP-2.3.39, and DejaGnu-1.4.4 (required to run the test suite)

Note

Some sort of time synchronization facility on your system (like NTP-4.2.4p0) is required since Kerberos won't authenticate if there is a time difference between a kerberized client and the KDC server.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/mitkrb

Installation of MIT Kerberos V5

MIT Kerberos V5 is distributed in a TAR file containing a compressed TAR package and a detached PGP ASC file. You'll need to unpack the distribution tar file, then unpack the compressed tar file before starting the build.

After unpacking the distribution tarball and if you have GnuPG-1.4.7 installed, you can authenticate the package with the following command:

gpg - -verify krb5-1.6.tar.gz.asc

Build MIT Kerberos V5 by running the following commands:

cd src &&
./configure CPPFLAGS="-I/usr/include/et -I/usr/include/ss" \
            --prefix=/usr \
            --sysconfdir=/etc/krb5 \
            --localstatedir=/var/lib \
            --with-system-et \
            --with-system-ss \
            --enable-dns-for-realm \
            --mandir=/usr/share/man &&
make

The regression test suite is designed to be run after the installation has been completed.

Now, as the root user:

make install &&

mv -v /usr/bin/ksu /bin &&
chmod -v 755 /bin/ksu &&
mv -v /usr/lib/libkrb5.so.3* /lib &&
mv -v /usr/lib/libk5crypto.so.3* /lib &&
mv -v /usr/lib/libkrb5support.so.0* /lib &&

ln -v -sf ../../lib/libkrb5.so.3.3 /usr/lib/libkrb5.so &&
ln -v -sf ../../lib/libk5crypto.so.3.1 /usr/lib/libk5crypto.so &&
ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so&&

install -m644 -v ../doc/*.info* /usr/share/info &&
for INFOFILE in 425 5-admin 5-install 5-user; do
    install-info --info-dir=/usr/share/info \
                 /usr/share/info/krb$INFOFILE.info
    rm ../doc/krb$INFOFILE.info*
done &&

install -m755 -v -d /usr/share/doc/krb5-1.6 &&
cp -Rv ../doc/* /usr/share/doc/krb5-1.6

Warning

login.krb5 does not support Shadow passwords. As a result, when the Kerberos server is unavailable, the default fall through to /etc/passwd will not work because the passwords have been moved to /etc/shadow during the LFS build process. Entering the following commands without moving the passwords back to /etc/passwd could prevent any logins.

After considering (and understanding) the above warning, the following commands can be entered as the root user to replace the existing login program with the Kerberized version (after preserving the original) and move the support libraries to a location available when the /usr filesystem is not mounted:

mv -v /bin/login /bin/login.shadow &&
install -m755 -v /usr/sbin/login.krb5 /bin/login &&

mv -v /usr/lib/libdes425.so.3* /lib &&
mv -v /usr/lib/libkrb4.so.2* /lib &&

ln -v -sf ../../lib/libdes425.so.3.0 /usr/lib/libdes425.so &&
ln -v -sf ../../lib/libkrb4.so.2.0 /usr/lib/libkrb4.so &&

ldconfig

To test the installation, you must have DejaGnu-1.4.4 installed and issue: make check. The RPC layer tests will require a portmap daemon (see portmap-6.0) running and configured to listen on the regular network interface (not localhost). See the “Testing the Build” section of the krb5-install.html file in the ../doc directory for complete information on running the regression tests.

Command Explanations

--enable-dns-for-realm: This parameter allows realms to be resolved using the DNS server.

--with-system-et: This parameter causes the build to use the system-installed versions of the error-table support software.

--with-system-ss: This parameter causes the build to use the system-installed versions of the subsystem command-line interface software.

--localstatedir=/var/lib: This parameter is used so that the Kerberos variable run-time data is located in /var/lib instead of /usr/var.

mv -v /usr/bin/ksu /bin: Moves the ksu program to the /bin directory so that it is available when the /usr filesystem is not mounted.

mv -v ... /lib && ln -v -sf ...: These libraries are moved to /lib so they are available when the /usr filesystem is not mounted.

Configuring MIT Kerberos V5

Config Files

/etc/krb5/krb5.conf and /var/lib/krb5kdc/kdc.conf

Configuration Information

Kerberos Configuration

Tip

You should consider installing some sort of password checking dictionary so that you can configure the installation to only accept strong passwords. A suitable dictionary to use is shown in the CrackLib-2.8.12 instructions. Note that only one file can be used, but you can concatenate many files into one. The configuration file shown below assumes you have installed a dictionary to /usr/share/dict/words.

Create the Kerberos configuration file with the following commands issued by the root user:

install -v -m755 -d /etc/krb5 &&
cat > /etc/krb5/krb5.conf << "EOF"
# Begin /etc/krb5/krb5.conf

[libdefaults]
    default_realm = <LFS.ORG>
    encrypt = true

[realms]
    <LFS.ORG> = {
        kdc = <belgarath.lfs.org>
        admin_server = <belgarath.lfs.org>
        dict_file = /usr/share/dict/words
    }

[domain_realm]
    .<lfs.org> = <LFS.ORG>

[logging]
    kdc = SYSLOG[:INFO[:AUTH]]
    admin_server = SYSLOG[INFO[:AUTH]]
    default = SYSLOG[[:SYS]]

# End /etc/krb5/krb5.conf
EOF

You will need to substitute your domain and proper hostname for the occurences of the <belgarath> and <lfs.org> names.

default_realm should be the name of your domain changed to ALL CAPS. This isn't required, but both Heimdal and MIT recommend it.

encrypt = true provides encryption of all traffic between kerberized clients and servers. It's not necessary and can be left off. If you leave it off, you can encrypt all traffic from the client to the server using a switch on the client program instead.

The [realms] parameters tell the client programs where to look for the KDC authentication services.

The [domain_realm] section maps a domain to a realm.

Create the KDC database:

kdb5_util create -r <LFS.ORG> -s

Now you should populate the database with principles (users). For now, just use your regular login name or root.

kadmin.local
kadmin: add_policy dict-only
kadmin: addprinc -policy dict-only <loginname>

The KDC server and any machine running kerberized server daemons must have a host key installed:

kadmin: addprinc -randkey host/<belgarath.lfs.org>

After choosing the defaults when prompted, you will have to export the data to a keytab file:

kadmin: ktadd host/<belgarath.lfs.org>

This should have created a file in /etc/krb5 named krb5.keytab (Kerberos 5). This file should have 600 (root rw only) permissions. Keeping the keytab files from public access is crucial to the overall security of the Kerberos installation.

Eventually, you'll want to add server daemon principles to the database and extract them to the keytab file. You do this in the same way you created the host principles. Below is an example:

kadmin: addprinc -randkey ftp/<belgarath.lfs.org>
kadmin: ktadd ftp/<belgarath.lfs.org>

Exit the kadmin program (use quit or exit) and return back to the shell prompt. Start the KDC daemon manually, just to test out the installation:

/usr/sbin/krb5kdc &

Attempt to get a ticket with the following command:

kinit <loginname>

You will be prompted for the password you created. After you get your ticket, you can list it with the following command:

klist

Information about the ticket should be displayed on the screen.

To test the functionality of the keytab file, issue the following command:

ktutil
ktutil: rkt /etc/krb5/krb5.keytab
ktutil: l

This should dump a list of the host principal, along with the encryption methods used to access the principal.

At this point, if everything has been successful so far, you can feel fairly confident in the installation and configuration of the package.

Install the /etc/rc.d/init.d/kerberos init script included in the blfs-bootscripts-20080816 package.

make install-kerberos
Using Kerberized Client Programs

To use the kerberized client programs (telnet, ftp, rsh, rcp, rlogin), you first must get an authentication ticket. Use the kinit program to get the ticket. After you've acquired the ticket, you can use the kerberized programs to connect to any kerberized server on the network. You will not be prompted for authentication until your ticket expires (default is one day), unless you specify a different user as a command line argument to the program.

The kerberized programs will connect to non kerberized daemons, warning you that authentication is not encrypted.

Using Kerberized Server Programs

Using kerberized server programs (telnetd, kpropd, klogind and kshd) requires two additional configuration steps. First the /etc/services file must be updated to include eklogin and krb5_prop. Second, the inetd.conf or xinetd.conf must be modified for each server that will be activated, usually replacing the server from Inetutils-1.5.

Additional Information

For additional information consult Documentation for krb-1.6 on which the above instructions are based.

Contents

Installed Programs: ftp, ftpd, gss-client, gss-server, k5srvutil, kadmin, kadmin.local, kadmind, kdb5_ldap_util, kdb5_util, kdestroy, kinit, klist, klogind, kpasswd, kprop, kpropd, krb5-config, krb5-send-pr, krb524d, krb524init, krb5kdc, kshd, ksu, ktutil, kvno, login.krb5, rcp, rlogin, rsh, sclient, sim_client, sim_server, sserver, telnet, telnetd, uuclient, uuserver and v4rcp
Installed Libraries: libdes425.so, libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt.so, libkadm5srv.so, libkdb5.so, libkdb_ldap.so, libkrb4.so, libkrb5.so and libkrb5support.so
Installed Directories: /etc/krb5, /usr/include/{gssapi,gssrpc,kerberosIV,krb5}, /usr/lib/krb5, /usr/share/{doc/krb5-1.6,examples,gnats} and /var/lib/krb5kdc

Short Descriptions

ftp

is a kerberized FTP client.

ftpd

is a kerberized FTP daemon.

k5srvutil

is a host keytable manipulation utility.

kadmin

is an utility used to make modifications to the Kerberos database.

kadmind

is a server for administrative access to a Kerberos database.

kdb5_util

is the KDC database utility.

kdestroy

removes the current set of tickets.

kinit

is used to authenticate to the Kerberos server as a principal and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

klist

reads and displays the current tickets in the credential cache.

klogind

is the server that responds to rlogin requests.

kpasswd

is a program for changing Kerberos 5 passwords.

kprop

takes a principal database in a specified format and converts it into a stream of database records.

kpropd

receives a database sent by kprop and writes it as a local database.

krb5-config

gives information on how to link programs against libraries.

krb5kdc

is a Kerberos 5 server.

kshd

is the server that responds to rsh requests.

ksu

is the super user program using Kerberos protocol. Requires a properly configured /etc/shells and ~/.k5login containing principals authorized to become super users.

ktutil

is a program for managing Kerberos keytabs.

kvno

prints keyversion numbers of Kerberos principals.

login.krb5

is a kerberized login program.

rcp

is a kerberized rcp client program.

rlogin

is a kerberized rlogin client program.

rsh

is a kerberized rsh client program.

telnet

is a kerberized telnet client program.

telnetd

is a kerberized telnet server.

libgssapi_krb5.so

contain the Generic Security Service Application Programming Interface (GSSAPI) functions which provides security services to callers in a generic fashion, supportable with a range of underlying mechanisms and technologies and hence allowing source-level portability of applications to different environments.

libkadm5clnt.so

contains the administrative authentication and password checking functions required by Kerberos 5 client-side programs.

libkadm5srv.so

contain the administrative authentication and password checking functions required by Kerberos 5 servers.

libkdb5.so

is a Kerberos 5 authentication/authorization database access library.

libkrb5.so

is an all-purpose Kerberos 5 library.

Last updated on 2007-10-16 06:29:13 -0500

Cyrus SASL-2.1.22

Introduction to Cyrus SASL

The Cyrus SASL package contains a Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.

Package Information

Cyrus SASL Dependencies

Required

OpenSSL-0.9.8g

Optional

Linux-PAM-0.99.10.0, OpenLDAP-2.3.39, Heimdal-1.1 or MIT Kerberos V5-1.6, JDK-6 Update 5, MySQL-5.0.41, PostgreSQL-8.2.4, GDBM-1.8.3, krb4, SQLite, and Dmalloc

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/cyrus-sasl

Installation of Cyrus SASL

Install Cyrus SASL by running the following commands:

./configure --prefix=/usr --sysconfdir=/etc \
            --with-dbpath=/var/lib/sasl/sasldb2 \
            --with-saslauthd=/var/run/saslauthd &&
make

This package does not come with a test suite. If you are planning on using the GSSAPI authentication mechanism, it is recommended to test it after installing the package using the sample server and client programs which were built in the preceding step. Instructions for performing the tests can be found at http://www.linuxfromscratch.org/hints/downloads/files/cyrus-sasl.txt.

Now, as the root user:

make install &&
install -v -m755 -d /usr/share/doc/cyrus-sasl-2.1.22 &&
install -v -m644 doc/{*.{html,txt,fig},ONEWS,TODO} \
    saslauthd/LDAP_SASLAUTHD /usr/share/doc/cyrus-sasl-2.1.22 &&
install -v -m700 -d /var/lib/sasl /var/run/saslauthd

Command Explanations

--with-dbpath=/var/lib/sasl/sasldb2: This parameter forces the sasldb database to be created in /var/lib/sasl instead of /etc.

--with-saslauthd=/var/run/saslauthd: This parameter forces saslauthd to use the FHS compliant directory /var/run/saslauthd for variable run-time data.

--with-dblib=gdbm: This parameter forces GDBM to be used instead of Berkeley DB.

--with-ldap: This parameter enables use with OpenLDAP.

--enable-ldapdb: This parameter enables the LDAPDB authentication backend. There is a circular dependency with this parameter. See http://wiki.linuxfromscratch.org/blfs/wiki/cyrus-sasl for a solution to this problem.

install -v -m644 ...: These commands install documentation which is not installed by the make install command.

install -v -m700 -d /var/lib/sasl /var/run/saslauthd: These directories must exist when starting saslauthd or using the sasldb plugin. If you're not going to be running the daemon or using the plugins, you may omit the creation of this directory.

Configuring Cyrus SASL

Config Files

/etc/saslauthd.conf (for saslauthd LDAP configuration) and /etc/sasl2/Appname.conf (where "Appname" is the application defined name of the application)

Configuration Information

See file:///usr/share/doc/cyrus-sasl-2.1.22/sysadmin.html for information on what to include in the application configuration files. See file:///usr/share/doc/cyrus-sasl-2.1.22/LDAP_SASLAUTHD for configuring saslauthd with OpenLDAP.

Init Script

If you need to run the saslauthd daemon at system startup, install the /etc/rc.d/init.d/cyrus-sasl init script included in the blfs-bootscripts-20080816 package.

make install-cyrus-sasl

Note

You'll need to modify the init script and replace the <authmech> parameter to the -a switch with your desired authentication mechanism.

Contents

Installed Programs: saslauthd, sasldblistusers2, and saslpasswd2
Installed Libraries: libjavasasl.so, libsasl2.so, and numerous SASL plugins and Java classes
Installed Directories: /usr/include/sasl, /usr/lib/java/classes/sasl, /usr/lib/sasl2, /usr/share/doc/cyrus-sasl-2.1.22, and /var/lib/sasl

Short Descriptions

saslauthd

is the SASL authentication server.

sasldblistusers2

is used to list the users in the SASL password database sasldb2.

saslpasswd2

is used to set and delete a user's SASL password and mechanism specific secrets in the SASL password database sasldb2.

libsasl2.so

is a general purpose authentication library for server and client applications.

Last updated on 2007-09-04 07:50:55 -0500

Stunnel-4.21

Introduction to Stunnel

The Stunnel package contains a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) so you can easily communicate with clients over secure channels. Stunnel can be used to add SSL functionality to commonly used Inetd daemons like POP-2, POP-3, and IMAP servers, to standalone daemons like NNTP, SMTP and HTTP, and in tunneling PPP over network sockets without changes to the server package source code.

Package Information

Additional Downloads

Stunnel Dependencies

Required

OpenSSL-0.9.8g

Optional

TCP Wrapper-7.6

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/stunnel

Installation of Stunnel

The stunnel daemon will be run in a chroot jail by an unprivileged user. Create the new user and group using the following commands as the root user:

groupadd -g 51 stunnel &&
useradd -c "Stunnel Daemon" -d /var/lib/stunnel \
        -g stunnel -s /bin/false -u 51 stunnel

Note

A signed SSL Certificate and a Private Key is necessary to run the stunnel daemon. If you own, or have already created a signed SSL Certificate you wish to use, copy it to /etc/stunnel/stunnel.pem before starting the build (ensure only root has read and write access), otherwise you will be prompted to create one during the installation process. The .pem file must be formatted as shown below:

-----BEGIN RSA PRIVATE KEY-----
<many encrypted lines of unencrypted key>
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
<many encrypted lines of certificate>
-----END CERTIFICATE-----

Install Stunnel by running the following commands:

patch -Np1 -i ../stunnel-4.21-setuid-1.patch &&

sed -i 's|nogroup|stunnel|g' configure &&
sed -i 's|$(prefix)/var/lib|$(localstatedir)|' tools/Makefile.in &&

./configure --prefix=/usr \
            --sysconfdir=/etc \
            --localstatedir=/var/lib \
            --disable-libwrap &&
make

This package does not come with a test suite.

Now, as the root user:

make docdir=/usr/share/doc/stunnel-4.21 install

Command Explanations

sed -i 's|nogroup|stunnel|g' configure: This command is used to change the default group for the installed files in /var/lib/stunnel from nogroup to stunnel.

sed -i '...' tools/Makefile.in: This command ensures that the chroot jail will be located in /var/lib/stunnel instead of /usr/var/lib/stunnel.

--sysconfdir=/etc: This parameter forces the configuration directory to /etc instead of /usr/etc.

--localstatedir=/var/lib: This parameter sets the installation to use /var/lib/stunnel instead of creating and using /usr/var/stunnel.

--disable-libwrap: This parameter is required if you don't have tcpwrappers installed. Remove the parameter if tcpwrappers is installed.

make docdir=... install: This command installs the package, changes the documentation installation directory to standard naming conventions and, if you did not copy an stunnel.pem file to the /etc/stunnel directory, prompts you for the necessary information to create one. Ensure you reply to the

Common Name (FQDN of your server) [localhost]:

prompt with the name or IP address you will be using to access the service(s).

Configuring Stunnel

Config Files

/etc/stunnel/stunnel.conf

Configuration Information

As the root user, create the directory used for the .pid file that is created when the Stunnel daemon starts:

install -v -m750 -o stunnel -g stunnel -d /var/lib/stunnel/run

Next, create a basic /etc/stunnel/stunnel.conf configuration file using the following commands as the root user:

cat >/etc/stunnel/stunnel.conf << "EOF" &&
; File: /etc/stunnel/stunnel.conf

pid    = /run/stunnel.pid
chroot = /var/lib/stunnel
client = no
setuid = stunnel
setgid = stunnel

EOF
chmod -v 644 /etc/stunnel/stunnel.conf

Finally, you need to add the service(s) you wish to encrypt to the configuration file. The format is as follows:

[<service>]
accept  = <hostname:portnumber>
connect = <hostname:portnumber>

If you use Stunnel to encrypt a daemon started from [x]inetd, you may need to disable that daemon in the /etc/[x]inetd.conf file and enable a corresponding <service>_stunnel service. You may have to add an appropriate entry in /etc/services as well.

For a full explanation of the commands and syntax used in the configuration file, run man stunnel. To see a BLFS example of an actual setup of an stunnel encrypted service, read the the section called “Configuring SWAT” in the Samba instructions.

Boot Script

To automatically start the stunnel daemon when the system is rebooted, install the /etc/rc.d/init.d/stunnel bootscript from the blfs-bootscripts-20080816 package.

make install-stunnel

Contents

Installed Programs: stunnel and stunnel3
Installed Library: libstunnel.so
Installed Directories: /etc/stunnel, /usr/lib/stunnel, /usr/share/doc/stunnel-4.21 and /var/lib/stunnel

Short Descriptions

stunnel

is a program designed to work as an SSL encryption wrapper between remote clients and local ({x}inetd-startable) or remote servers.

stunnel3

is a Perl wrapper script to use stunnel 3.x syntax with stunnel >=4.05.

libstunnel.so

contains the API functions required by Stunnel.

Last updated on 2008-08-11 13:33:19 -0500

Sudo-1.6.9p15

Introduction to Sudo

The sudo package allows a system administrator to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while logging the commands and arguments.

Package Information

Sudo Dependencies

Optional

Linux-PAM-0.99.10.0, Opie, SecurID, FWTK, an MTA (that provides a sendmail command), krb4, Heimdal-1.1 or MIT Kerberos V5-1.6, OpenLDAP-2.3.39, and AFS

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/sudo

Installation of Sudo

Install sudo by running the following commands:

./configure --prefix=/usr --libexecdir=/usr/lib \
    --with-ignore-dot --with-all-insults \
    --enable-shell-sets-home --disable-root-sudo \
    --with-logfac=auth --without-pam --without-sendmail &&
make

This package does not come with a test suite.

Now, as the root user:

make install

Command Explanations

--with-ignore-dot: This switch causes sudo to ignore '.' in the PATH.

--with-all-insults: This switch includes all the sudo insult sets.

--enable-shell-sets-home: This switch sets HOME to the target user in shell mode.

--disable-root-sudo: This switch keeps the root user from running sudo, preventing users from chaining commands to get a root shell.

--with-logfac=auth: This switch forces use of the auth facility for logging.

--without-pam: This switch disables the use of PAM authentication. Omit if you have PAM installed.

--without-sendmail: This switch disables the use of sendmail. Remove if you have a sendmail compatible MTA.

--enable-noargs-shell: This switch allows sudo to run a shell if invoked with no arguments.

Note

There are many options to sudo's configure command. Check the configure --help output for a complete list.

Configuring Sudo

Config File

/etc/sudoers

Configuration Information

The sudoers file can be quite complicated. It is composed of two types of entries: aliases (basically variables) and user specifications (which specify who may run what). The installation installs a default configuration that has no privileges installed for any user.

One example usage is to allow the system administrator to execute any program without typing a password each time root privileges are needed. This can be configured as:

# User alias specification
User_Alias  ADMIN = YourLoginId

# Allow people in group ADMIN to run all commands without a password
ADMIN       ALL = NOPASSWD: ALL

For details, see man sudoers.

Note

The Sudo developers highly recommend using the visudo program to edit the sudoers file. This will provide basic sanity checking like syntax parsing and file permission to avoid some possible mistakes that could lead to a vulnerable configuration.

If you've built Sudo with PAM support, issue the following command as the root user to create the PAM configuration file:

sed -e 's@/su@/sudo@' -e '/pam_rootok/d' \
    /etc/pam.d/su > /etc/pam.d/sudo

Contents

Installed Programs: sudo, sudoedit, and visudo
Installed Library: sudo_noexec.so
Installed Directories: None

Short Descriptions

sudo

executes a command as another user as permitted by the /etc/sudoers configuration file.

sudoedit

is a hard link to sudo that implies the -e option to invoke an editor as another user.

visudo

allows for safer editing of the sudoers file.

sudo_noexec.so

enables support for the "noexec" functionality which prevents a dynamically-linked program being run by sudo from executing another program (think shell escapes).

Last updated on 2008-08-17 11:30:32 -0500

NSS-3.11.7

Introduction to NSS

The Network Security Services (NSS) package is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards. This is useful for implementing SSL and S/MIME or other Internet security standards into an application.

The NSS package requires the Netscape Portable Runtime (NSPR) libraries as a prerequisite for building. The NSS package tarball contains the code necessary to build the NSPR libraries. These libraries are built and installed using the instructions below. Essentially, the NSS package is now a combined NSS/NSPR installation.

Package Information

Additional Downloads

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/nss

Installation of NSS

Install NSS by running the following commands:

bash

export WORKINGDIR=$PWD &&
export BUILD_OPT=1 &&

patch -Np1 -i ../nss-3.11.7-with-nspr-4.6.7-fedora_fixes-1.patch &&

cd mozilla/security/nss &&
make nss_build_all &&
cd ../.. &&

export NSS_LINUXDIR=$(basename `ls -d $WORKINGDIR/mozilla/dist/Linux*`)

To test the results, you'll need to set the domain name of your system in the DOMSUF environment variable. Most of the tests will fail if you don't provide the correct domain name. A self-generated log file will be parsed at the end of the test to display how many tests passed. It should return 800. To run the tests, ensure you change the export DOMSUF command below to an appropriate value, e.g., mydomain.com and issue the following commands:

bash

export DOMSUF=<validdomain.name> &&
export PATH=$PATH:$WORKINGDIR/mozilla/dist/$NSS_LINUXDIR/bin &&
export TEST_RESULTSDIR=$WORKINGDIR/mozilla/tests_results/security &&

cd security/nss/tests &&
sed -i 's/gmake/make/' common/init.sh &&
./all.sh &&

grep Passed $TEST_RESULTSDIR/$(hostname).1/results.html | wc -l &&

exit

Caution

If you switch to the root user using a method that does not inherit the environment from the unprivileged user, ensure that root's NSS_LINUXDIR environment variable is set correctly before proceeding with the installation commands.

Now, as the root user:

install -v -m755 nsprpub/$NSS_LINUXDIR/config/nspr-config \
                 security/nss/cmd/config/nss-config \
    /usr/bin &&
install -v -m755 -d /usr/lib/pkgconfig &&
install -v -m644 nsprpub/lib/pkgconfig/nspr.pc \
                 security/nss/lib/pkgconfig/nss.pc \
    /usr/lib/pkgconfig &&

cd dist &&

install -v -m755 $NSS_LINUXDIR/lib/*.so /usr/lib &&
install -v -m644 $NSS_LINUXDIR/lib/{*.chk,libcrmf.a} /usr/lib &&

install -v -m755 -d /usr/include/{nss,nspr} &&
install -v -m644 {public,private}/nss/* /usr/include/nss &&
cp -v -RL $NSS_LINUXDIR/include/* /usr/include/nspr &&
chmod -v 644 /usr/include/nspr/prvrsion.h

Now as the unprivileged user, exit the bash shell started at the beginning of the installation to restore the environment to the original state.

exit

Command Explanations

bash: Shells are started as many environment variables are created during the installation process. Exiting the shells serves the purpose of restoring the environment and returning back to the original directory when the installation is complete.

export WORKINGDIR=$PWD: This variable is set because many of the commands are dependent on knowing the full path of certain directories. WORKINGDIR establishes a known path so that all others can be determined relative to this.

export BUILD_OPT=1: This variable is set so that the build is performed with no debugging symbols built into the binaries and that the default compiler optimizations are used.

export NSS_LINUXDIR=...: This variable is set so that the exact name of the architecture specific directories where the binaries are stored in the source tree can be determined.

make nss_build_all: This command builds the NSPR and NSS libraries and creates a dist directory which houses all the programs, libraries and interface headers. None of the programs created by this process are installed onto the system using the default instructions. If you need any of these programs installed, you can find them in the mozilla/dist/bin directory of the source tree.

export PATH=...: This command sets the PATH environment variable to include the executables in the source tree as some of them are required to run the test suite.

sed -i 's/gmake/make/' common/init.sh: This command changes the command used to compile some test programs.

Contents

Installed Programs: nspr-config and nss-config
Installed Libraries: libcrmf.a, libfreebl3.so, libnspr4.so, libnss3.so, libnssckbi.so, libplc4.so, libplds4.so, libsmime3.so, libsoftokn3.so and libssl3.so
Installed Directories: /usr/include/nspr and /usr/include/nss

Short Descriptions

nspr-config

is used to determine the NSPR installation settings of the installed NSPR libraries.

nss-config

is used to determine the NSS library settings of the installed NSS libraries.

The libnspr4.so, libplc4.so and libplds4.so libraries make up the Netscape Portable Runtime (NSPR) libraries. These libraries provide a platform-neutral API for system level and libc like functions. The API is used in the Mozilla client, many of the Netscape/AOL/iPlanet offerings and other software applications.

The libcrmf.a, libfreebl.so, libnss3.so, libnssckbi.so, libsmime3.so, libsoftokn3.so and libnssl3.so libraries make up the NSS libraries.

Last updated on 2007-07-15 10:53:33 -0500

Chapter 5. File Systems

Journaling file systems reduce the time needed to recover a file system that was not unmounted properly. While this can be extremely important in reducing downtime for servers, it has also become popular for desktop environments. This chapter contains two other journaling file systems you can use instead of the default LFS third extended file system.

ReiserFS-3.6.20

Introduction to ReiserFS

The ReiserFS package contains various utilities for use with the Reiser file system.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/reiser

Installation of ReiserFS

Install ReiserFS by running the following commands:

./configure --prefix=/usr --sbindir=/sbin &&
make

This package does not come with a test suite.

Now, as the root user:

make install &&
ln -sf reiserfsck /sbin/fsck.reiserfs &&
ln -sf mkreiserfs /sbin/mkfs.reiserfs

Command Explanations

--prefix=/usr: This ensures that the manual pages are installed in the correct location while still installing the programs in /sbin as they should be.

--sbindir=/sbin: This ensures that the ReiserFS utilities are installed in /sbin as they should be.

Contents

Installed Programs: debugreiserfs, mkreiserfs, reiserfsck, reiserfstune, and resize_reiserfs
Installed Libraries: None
Installed Directories: None

Short Descriptions

debugreiserfs

can sometimes help to solve problems with ReiserFS file systems. If it is called without options, it prints the super block of any ReiserFS file system found on the device.

mkreiserfs

creates a ReiserFS file system.

reiserfsck

is used to check or repair a ReiserFS file system.

reiserfstune

is used for tuning the ReiserFS journal. WARNING: Don't use this utility without first reading the man page thoroughly.

resize_reiserfs

is used to resize an unmounted ReiserFS file system.

Last updated on 2008-08-24 11:52:33 -0500

XFS-2.9.7

Introduction to XFS

The XFS package contains administration and debugging tools for the XFS file system.

Package Information

Caution

The XFS developers regularly remove the current package when a new package is available. Unfortunately, this has led to severe incompatibilities, including unmountable filesystems, due to kernel version requirements in new versions of the package. Using a version not in the book is strongly discouraged. Additional information, is available at the XFS project page.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/xfs

Installation of XFS

Install XFS by running the following commands:

make DEBUG=-DNDEBUG INSTALL_USER=root INSTALL_GROUP=root \
    LOCAL_CONFIGURE_OPTIONS="--enable-readline=yes"

This package does not come with a test suite.

Now, as the root user:

make install &&
make install-dev &&
chmod -v 755 /lib/libhandle.so* &&
rm -f /lib/libhandle.{a,la,so} &&
ln -svf ../../lib/libhandle.so.1 /usr/lib/libhandle.so

Command Explanations

make DEBUG=-DNDEBUG: Turns off debugging symbols.

INSTALL_USER=root INSTALL_GROUP=root: This sets the owner and group of the installed files.

LOCAL_CONFIGURE_OPTIONS="...": This passes extra configuration options to the configure script. The example --enable-readline=yes parameter enables linking the XFS programs with the libreadline.so library, in order to allow editing interactive commands.

OPTIMIZER="...": Adding this parameter to the end of the make command overrides the default optimization settings.

make install-dev: This command installs static XFS libraries, their headers and the corresponding documentation.

Contents

Installed Programs: fsck.xfs, mkfs.xfs, xfs_admin, xfs_bmap, xfs_check, xfs_copy, xfs_db, xfs_freeze, xfs_growfs, xfs_info, xfs_io, xfs_logprint, xfs_mdrestore, xfs_metadump, xfs_mkfile, xfs_ncheck, xfs_quota, xfs_repair, and xfs_rtcp
Installed Libraries: libdisk.a, libhandle.{so,a}, libxcmd.a, libxfs.a, and libxlog.a
Installed Directory: /usr/share/doc/xfsprogs

Short Descriptions

fsck.xfs

simply exits with a zero status, since XFS partitions are checked at mount time.

mkfs.xfs

constructs an XFS file system.

xfs_admin

changes the parameters of an XFS file system.

xfs_bmap

prints block mapping for an XFS file.

xfs_check

checks XFS file system consistency.

xfs_copy

copies the contents of an XFS file system to one or more targets in parallel.

xfs_db

is used to debug an XFS file system.

xfs_freeze

suspends access to an XFS file system.

xfs_growfs

expands an XFS file system.

xfs_info

is equivalent to invoking xfs_growfs, but specifying that no change to the file system is to be made.

xfs_io

is a debugging tool like xfs_db, but is aimed at examining the regular file I/O path rather than the raw XFS volume itself.

xfs_logprint

prints the log of an XFS file system.

xfs_mdrestore

restores an XFS metadump image to a filesystem image.

xfs_metadump

copies XFS filesystem metadata to a file.

xfs_mkfile

creates an XFS file, padded with zeroes by default.

xfs_ncheck

generates pathnames from inode numbers for an XFS file system.

xfs_quota

is a utility for reporting and editing various aspects of filesystem quota.

xfs_repair

repairs corrupt or damaged XFS file systems.

xfs_rtcp

copies a file to the real-time partition on an XFS file system.

libhandle.so

contains XFS-specific functions that provide a way to perform certain filesystem operations without using a file descriptor to access filesystem objects.

Last updated on 2008-05-09 08:00:42 -0500

Chapter 6. Editors

This chapter is referenced in the LFS book for those wishing to use other editors on their LFS system. You're also shown how some LFS installed programs benefit from being recompiled after GUI libraries have been installed.

Vim-7.1

Introduction to Vim

The Vim package, which is an abbreviation for VI IMproved, contains a vi clone with extra features as compared to the original vi.

The default LFS instructions install vim as a part of the base system. If you would prefer to link vim against X, you should recompile vim to enable GUI mode. There is no need for special instructions since X support is automatically detected.

Package Information

Additional Downloads

Vim Dependencies

Recommended
Optional

GTK+-2.10.13 or LessTif-0.95.0 or GTK+-1.2.10, Python-2.5.2, Tcl-8.4.18, Ruby-1.8.6-p111, and GPM-1.20.1

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/vim

Installation of Vim

Note

If you recompile Vim to link against X and your X libraries are not on the root partition, you will no longer have an editor for use in emergencies. You may choose to install an additional editor, not link Vim against X, or move the current vim executable to the /bin directory under a different name such as vi.

If desired, unpack the translated messages archive:

tar -xf ../vim-7.1-lang.tar.gz --strip-components=1

Install Vim by running the following commands:

patch -Np1 -i ../vim-7.1-mandir-1.patch &&
patch -Np1 -i ../vim-7.1-fixes-6.patch &&
echo '#define SYS_VIMRC_FILE "/etc/vimrc"' >> src/feature.h &&
echo '#define SYS_GVIMRC_FILE "/etc/gvimrc"' >> src/feature.h &&
./configure --prefix=/usr --with-features=huge &&
make

To test the results, issue: make test. The vim test suite outputs a lot of binary data to the screen, which can cause issues with the settings of the current terminal. This can be resolved by redirecting the output to a log file. Even if one of the tests fails to produce the file test.out in src/testdir, the remaining tests will still be executed. If all goes well,the final message in the log file will be ALL DONE. Note: Some color tests expect to be executed under the xterm terminal emulator.

Now, as the root user:

make install

By default, Vim's documentation is installed in /usr/share/vim. The following symlink allows the documentation to be accessed via /usr/share/doc/vim-7.1, making it consistent with the location of documentation for other packages:

ln -snfv ../vim/vim71/doc /usr/share/doc/vim-7.1

If you wish to update the runtime files, issue the following command (requires rsync-3.0.2):

rsync -avzcP --delete --exclude="/dos/" --exclude="/spell/" \
    ftp.nluug.nl::Vim/runtime/ ./runtime/

To install the runtime files and regenerate the tags file, as the root user issue:

make -C src installruntime &&
vim -c ":helptags /usr/share/doc/vim-7.1" -c ":q"

Command Explanations

patch …: These patches are the same as the ones in the LFS build used to update the package with upstream patches and ensure the man pages are placed in the proper locations.

--with-features=huge: This switch enables all the additional features available in Vim.

--enable-gui=no: This will prevent compilation of the GUI. Vim will still link against X, so that some features such as the client-server model or the x11-selection (clipboard) are still available.

--without-x: If you prefer not to link Vim against X, use this switch.

--enable-perlinterp, --enable-pythoninterp, --enable-tclinterp, --enable-rubyinterp: These options include the Perl, Python, Tcl, or Ruby interpreters that allow using other application code in vim scripts.

Configuring Vim

Config Files

/etc/vimrc and ~/.vimrc

Configuration Information

Vim has an integrated spell checker which you can enable it if you issue the following in a vim window:

:setlocal spell spelllang=ru

This setting will enable spell checking for the Russian language for the current session.

By default, Vim only installs spell files for the English language. If a spell file is not available for a language, then Vim will call the $VIMRUNTIME/plugin/spellfile.vim plugin and will try to obtain the *.spl and optionally *.sug from the vim ftp server, by using the $VIMRUNTIME/plugin/netrwPlugin.vim plugin.

Alternatively you can manually download the *.spl and *.sug files from: ftp://ftp.vim.org/pub/vim/runtime/spell/ and save them to ~/.vim/spell or in /usr/share/vim/vim71/spell/.

To find out what's new in Vim-7.1 issue the following command:

:help version-7.1

For additional information on setting up Vim configuration files, see The vimrc Files and http://www.vi-improved.org/vimrc.php.

Contents

A list of the reinstalled files, along with their short descriptions can be found in the LFS Vim Installation Instructions

Installed Programs: gview, gvim, gvimdiff, rgview, and rgvim
Installed Libraries: None
Installed Directory: /usr/share/vim

Short Descriptions

gview

starts gvim in read-only mode.

gvim

is the editor that runs under X and includes a GUI.

gvimdiff

edits two or three versions of a file with gvim and shows the differences.

rgview

is a restricted version of gview.

rgvim

is a restricted version of gvim.

Last updated on 2008-08-12 10:41:54 -0500

Emacs-22.1

Introduction to Emacs

The Emacs package contains an extensible, customizable, self-documenting real-time display editor.

Package Information

Emacs Dependencies

Optional

X Window System, libjpeg-6b, libpng-1.2.29, LibTIFF-3.8.2, and libungif

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/emacs

Installation of Emacs

Install Emacs by running the following commands:

./configure --prefix=/usr \
            --libexecdir=/usr/lib \
            --localstatedir=/var &&
make bootstrap

This package does not come with a test suite.

Now, as the root user:

make install &&
chown -v -R root:root /usr/share/emacs/22.1

Command Explanations

--libexecdir=/usr/lib: Place library executables in a Filesystem Hierarchy Standard (FHS) location.

--localstatedir=/var: Create game score files in /var/games/emacs instead of /usr/var/games/emacs.

Contents

Installed Programs: b2m, ctags, ebrowse, emacs, emacsclient, etags, grep-changelog, and rcs-checkin
Installed Libraries: None
Installed Directories: /usr/lib/emacs, /usr/share/emacs and /var/games/emacs

Short Descriptions

b2m

is a program to convert mail files from RMAIL format to Unix “mbox” format.

ctags

creates cross-reference tagfile database files for source code.

ebrowse

permits browsing of C++ class hierarchies from within emacs.

emacs

is an editor.

emacsclient

attaches an emacs session to an already running emacsserver instance.

etags

is another program to generate source code cross-reference tagfiles.

grep-changelog

prints entries in Change Logs matching various criteria.

rcs-checkin

is a shell script used to check files into RCS.

Last updated on 2007-08-17 14:03:17 -0500

Nano-2.0.7

Introduction to Nano

The nano package contains a small, simple text editor which aims to replace Pico, the default editor in the Pine package.

Package Information

Nano Dependencies

Optional

S-Lang-2.1.3

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/Nano

Installation of Nano

Install nano by running the following commands:

./configure --prefix=/usr --sysconfdir=/etc/nano \
    --enable-color --enable-multibuffer --enable-nanorc &&
make

This package does not come with a test suite.

Now, as the root user:

make install &&
install -v -m644 -D doc/nanorc.sample /etc/nano/nanorc.sample &&
install -v -m755 -d /usr/share/doc/nano-2.0.7 &&
install -v -m644 doc/{,man/,texinfo/}*.html /usr/share/doc/nano-2.0.7

Configuring nano

Config Files

/etc/nano/nanorc and ~/.nanorc

Configuration Information

Example configuration (create as a system-wide /etc/nano/nanorc or a personal ~/.nanorc file)

set autoindent
set const
set fill 72
set historylog
set multibuffer
set nohelp
set regexp
set smooth
set suspend

Another example is the nanorc.sample file in the /etc/nano directory. It includes color configurations and has some documentation included in the comments.

Contents

Installed Programs: nano and rnano
Installed Libraries: None
Installed Directories: /etc/nano, /usr/share/nano and /usr/share/doc/nano-2.0.7

Short Descriptions

nano

is a small, simple text editor which aims to replace Pico, the default editor in the Pine package.

rnano

is a restricted mode for nano.

Last updated on 2008-03-12 06:22:57 -0500

JOE-3.5

Introduction to JOE

JOE (Joe's own editor) is a small text editor capable of emulating WordStar, Pico, and Emacs.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/joe

Installation of JOE

Install JOE by running the following commands:

./configure --sysconfdir=/etc --prefix=/usr &&
make

This package does not come with a test suite.

Now, as the root user:

make install

Configuring JOE

Config Files

/etc/joe/jmacsrc, /etc/joe/joerc, /etc/joe/jpicorc, /etc/joe/jstarrc, /etc/joe/rjoerc, and ~/.joerc

Contents

Installed Programs: jmacs, joe, jpico, jstar, rjoe, and termidx
Installed Libraries: None
Installed Directory: /etc/joe

Short Descriptions

jmacs

is a symbolic link to joe used to launch Emacs emulation mode.

joe

is a small text editor capable of emulating WordStar, Pico, and Emacs.

jpico

is a symbolic link to joe used to launch Pico emulation mode.

jstar

is a symbolic link to joe used to launch WordStar emulation mode.

rjoe

is a symbolic link to joe that restricts JOE to editing only files which are specified on the command-line.

termidx

is a program used by joe to generate the termcap index file.

Last updated on 2007-04-04 14:42:53 -0500

Ed-0.8

Introduction to Ed

Ed is a line-oriented text editor. It is used to create, display, modify and otherwise manipulate text files, both interactively and via shell scripts. Ed isn't something which many people use. It's described here because it can be used by the patch program if you encounter an ed-based patch file. This happens rarely because diff-based patches are preferred these days.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/ed

Installation of Ed

Install Ed by running the following commands:

./configure --prefix=/usr &&
make

To test the results, issue: make check.

Now, as the root user:

make install &&
make install-man

Contents

Installed Programs: ed and red
Installed Libraries: None
Installed Directories: None

Short Descriptions

ed

is a line-oriented text editor.

red

is a restricted ed—it can only edit files in the current directory and cannot execute shell commands.

Last updated on 2008-04-25 18:22:22 -0500

Bluefish-1.0.7

Introduction to Bluefish

The Bluefish package contains a powerful X Window System editor designed for web designers, but also suitable as a programmer's editor. Bluefish supports many programming and markup languages, and as such is ideal for editing XML and HTML files.

Package Information

Bluefish Dependencies

Required

GTK+-2.10.13 and PCRE-7.6

Optional

GNOME Virtual File System-2.18.1 (for remote files), Aspell-0.60.5 (for spellchecking), libgnomeui-2.18.1, GNOME MIME Data-2.4.3, desktop-file-utils-0.13, and shared-mime-info-0.21

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/bluefish

Installation of Bluefish

Install Bluefish by running the following commands:

./configure --prefix=/usr &&
make

This package does not come with a test suite.

Now, as the root user:

make install

Configuring Bluefish

Config Files

~/.bluefish/*

Configuration Information

The directory ~/.bluefish is created by the program when it is first run, and the configuration files are maintained by the program automatically to preserve settings from run to run.

Contents

Installed Program: bluefish
Installed Libraries: None
Installed Directory: /usr/share/bluefish

Short Descriptions

bluefish

is an X Window System editor for markup and programming.

Last updated on 2008-04-09 10:40:36 -0500

Other Editors

pico is a text editor installed as a part of Pine-4.64.

mcedit is a text editor installed as part of MC-4.6.1.

Last updated on 2007-04-04 14:42:53 -0500

Chapter 7. Shells

We are all familiar with the Bourne Again SHell, but there are two other user interfaces that are considered useful modern shells – the Berkeley Unix C shell and the Korn shell. This chapter installs packages compatible with these additional shell types.

Tcsh-6.15.00

Introduction to Tcsh

The Tcsh package contains “an enhanced but completely compatible version of the Berkeley Unix C shell (csh)”. This is useful as an alternative shell for those who prefer C syntax to that of the bash shell, and also because some programs require the C shell in order to perform installation tasks.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/tcsh

Installation of Tcsh

Install Tcsh by running the following commands:

./configure --prefix=/usr --bindir=/bin &&
make &&
sh ./tcsh.man2html

To test the results, issue: make check. Note that test #68 (“nice” test) is known to fail.

Now, as the root user:

make install install.man &&
ln -v -sf tcsh   /bin/csh &&
ln -v -sf tcsh.1 /usr/man/man1/csh.1 &&
install -v -m755 -d /usr/share/doc/tcsh-6.15.00/html &&
install -v -m644 tcsh.html/* /usr/share/doc/tcsh-6.15.00/html &&
install -v -m644 FAQ         /usr/share/doc/tcsh-6.15.00

Command Explanations

--bindir=/bin: This installs the tcsh program in /bin instead of /usr/bin.

sh ./tcsh.man2html: This creates HTML documentation from the formatted man page.

ln -v -sf tcsh /bin/csh: The FHS states that if there is a C shell installed, there should be a symlink from /bin/csh to it. This creates that symlink.

Configuring Tcsh

Config Files

There are numerous configuration files for the C shell. Examples of these are /etc/csh.cshrc, /etc/csh.login, /etc/csh.logout, ~/.tcshrc, ~/.cshrc, ~/.history, ~/.cshdirs, ~/.login, and ~/.logout. More information on these files can be found in the tcsh(1) man page.

Configuration Information

Update /etc/shells to include the C shell program names (as the root user):

cat >> /etc/shells << "EOF"
/bin/tcsh
/bin/csh
EOF

Contents

Installed Program: tcsh
Installed Libraries: None
Installed Directory: /usr/share/doc/tcsh-6.15.00

Short Descriptions

tcsh

is an enhanced but completely compatible version of the Berkeley Unix C shell, csh. It is usable as both an interactive shell and a script processor.

Last updated on 2008-05-09 07:42:27 -0500

ZSH-4.3.6

Introduction to ZSH

The ZSH package contains a command interpreter (shell) usable as an interactive login shell and as a shell script command processor. Of the standard shells, ZSH most closely resembles KSH but includes many enhancements.

Note

This version of ZSH is a development release. The BLFS staff has determined that it provides a stable program which works properly with multibyte locales (e.g., UTF-8). To find the current stable release, refer to the ZSH home page and compile ZSH with the same instructions.

Package Information

Additional Downloads

ZSH Dependencies

Optional

PCRE-7.6 and libcap

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/zsh

Installation of ZSH

If you downloaded the optional documentation, unpack it with the following command:

tar --strip-components=1 -xvf ../zsh-4.3.6-doc.tar.bz2

Install ZSH by running the following commands:

./configure --prefix=/usr \
            --bindir=/bin \
            --sysconfdir=/etc/zsh \
            --enable-etcdir=/etc/zsh &&
make

If you have teTeX-3.0 installed, you can build additional formats of the documentation by issuing any or all of the following commands:

texi2pdf  Doc/zsh.texi -o Doc/zsh.pdf &&
texi2html Doc/zsh.texi --output=Doc/zsh_1file_t.html &&
makeinfo  Doc/zsh.texi --html --no-split --no-headers \
                       -o Doc/zsh_1file_m.html &&
makeinfo  Doc/zsh.texi --plaintext -o Doc/zsh.txt

To test the results, issue: make check.

Now, as the root user:

make install &&
make infodir=/usr/share/info install.info

If you downloaded the optional documentation, install it by issuing the following commands as the root user:

make htmldir=/usr/share/doc/zsh-4.3.6/html install.html &&
install -v -m644 Doc/zsh.dvi /usr/share/doc/zsh-4.3.6

If you built any additional formats of the documentation, install them by issuing the following command as the root user:

install -v -m644 Doc/{zsh_1file*,*.{pdf,txt}} \
        /usr/share/doc/zsh-4.3.6

Command Explanations

--sysconfdir=/etc/zsh and --enable-etcdir=/etc/zsh: These parameters are used so that all the ZSH configuration files are consolidated into the /etc/zsh directory. Omit these parameters if you wish to retain historical compatibility by having all the files located in the /etc directory.

--bindir=/bin: This parameter places the zsh binaries into the root filesystem.

--enable-cap: This parameter enables POSIX capabilities.

--enable-pcre: This parameter allows to use the PCRE regular expression library in shell builtins. Note: Linking ZSH dynamically against PCRE, produces a runtime dependency on libpcre.so. If /usr is a separate mount point and zsh needs to be available at boot time, either you have to statically link ZSH against PCRE (you can examine the config.modules file on how to link statically the module), or move the library to /lib as follows:

mv -v /usr/lib/libpcre.so.* /lib/ &&
ln -v -sf ../../lib/libpcre.so.0 /usr/lib/libpcre.so

Configuring ZSH

Config Files

There are a whole host of configuration files for ZSH including /etc/zsh/zshenv, /etc/zsh/zprofile, /etc/zsh/zshrc, /etc/zsh/zlogin and /etc/zsh/zlogout. You can find more information on these in the zsh(1) and related manual pages.

Configuration Information

Update /etc/shells to include the ZSH shell program names (as the root user):

cat >> /etc/shells << "EOF"
/bin/zsh
/bin/zsh-4.3.6
EOF

Contents

Installed Programs: zsh and zsh-4.3.6
Installed Libraries: Numerous plugin helper modules
Installed Directories: /etc/zsh, /usr/lib/zsh, /usr/share/doc/zsh-4.3.6 and /usr/share/zsh

Short Description

zsh

is a shell which has command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and a host of other features.

Last updated on 2008-05-09 08:00:42 -0500

Dash-0.5.4

Introduction to Dash

Dash is a POSIX compliant shell. It can be installed as /bin/sh or as the default shell for either root or a second user with a userid of 0. It depends on fewer libraries than the Bash shell and is therefore less likely to be affected by an upgrade problem or disk failure. Dash is also useful for checking that a script is completely compatible with POSIX syntax.

Package Information

Dash Dependencies

Optional

libedit (command line editor library)

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/dash

Installation of Dash

Install Dash by running the following commands:

./configure --bindir=/bin --mandir=/usr/share/man &&
make

This package does not come with a test suite.

Now, as the root user:

make install

If you would like to make dash the default sh, recreate the /bin/sh symlink as the root user:

ln -svf dash /bin/sh

Command Explanations

--bindir=/bin: This parameter places the dash binary into the root filesystem.

--with-libedit: To compile Dash with libedit support.

Configuring Dash

Config Files

Dash sources /etc/profile and $HOME/.profile

Configuration Information

Update /etc/shells to include the Dash shell by issuing the following command as the root user:

cat >> /etc/shells << "EOF"
/bin/dash
EOF

Contents

Installed Program: dash
Installed Libraries: None
Installed Directories: None

Short Description

dash

is a POSIX compliant shell.

Last updated on 2008-05-09 07:42:27 -0500

ksh-2008-02-02

Introduction to ksh

ksh is the AT&T Korn Shell.

Note

You must agree to the terms of the CPL-1.0 license in order to download the software. The download site is password protected, and the username and password are listed at the bottom of this license.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/ksh

Installation of ksh

Unlike other BLFS packages, you will need to first create a working directory in which to extract the sources and perform the build. Install ksh by running the following commands:

mkdir ksh &&
cd ksh &&
tar -xf ../INIT.2008-02-02.tgz &&
tar -xf ../ast-ksh.2008-02-02.tgz &&
bin/package make

The test suite for this package requires other packages from the AT&T ast software library, namely nmake, in which case, you'd be better to install the ast-base package using the same instructions. The package command will accept a test argument to test the package.

Now, as the root user:

install -v -m755 arch/linux.i386/bin/ksh /bin &&
install -v -m644 arch/linux.i386/man/man1/sh.1 \
    /usr/share/man/man1/ksh.1 &&
install -v -m755 -d /usr/share/doc/ksh-2008-02-02 &&
install -v -m644 lib/package/{ast-ksh,INIT}.html \
    /usr/share/doc/ksh-2008-02-02

Command Explanations

bin/package make: This command rebuilds the ast INIT package and builds the ast ksh package.

Configuring ksh

Config Files

ksh sources /etc/profile, /etc/suid_profile, and $HOME/.profile.

Configuration Information

Update /etc/shells to include the ksh shell by issuing the following command as the root user:

cat >> /etc/shells << "EOF"
/bin/ksh
EOF

Contents

Installed Program: ksh
Installed Libraries: None
Installed Directories: None

Short Description

ksh

is the AT&T ast Korn shell.

Last updated on 2008-05-09 07:42:27 -0500

Part III. General Libraries and Utilities

Chapter 8. General Libraries

Libraries contain code which is often required by more than one program. This has the advantage that each program doesn't need to duplicate code (and risk introducing bugs), it just has to call functions from the libraries installed on the system. The most obvious example of a set of libraries is Glibc which is installed during the LFS book. This contains all of the C library functions which programs use.

There are two types of libraries: static and shared. Shared libraries (usually libXXX.so) are loaded into memory from the shared copy at runtime (hence the name). Static libraries (libXXX.a ) are actually linked into the program executable file itself, thus making the program file larger. Quite often, you will find both static and shared copies of the same library on your system.

Generally, you only need to install libraries when you are installing software that needs the functionality they supply. In the BLFS book, each package is presented with a list of (known) dependencies. Thus, you can figure out which libraries you need to have before installing that program. If you are installing something without using BLFS instructions, usually the README or INSTALL file will contain details of the program's requirements.

There are certain libraries which nearly everyone will need at some point. In this chapter we list these and some others and explain why you may want to install them.

PCRE-7.6

Introduction to PCRE

The PCRE package contains Perl Compatible Regular Expression libraries. These are useful for implementing regular expression pattern matching using the same syntax and semantics as Perl 5.

Package Information

Additional Downloads

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/pcre

Installation of PCRE

Install PCRE by running the following commands:

patch -Np1 -i ../pcre-7.6-abi_breakage-1.patch &&
patch -Np1 -i ../pcre-7.6-security_fix-1.patch &&
./configure --prefix=/usr \
            --docdir=/usr/share/doc/pcre-7.6 \
            --enable-utf8 \
            --enable-pcregrep-libz \
            --enable-pcregrep-libbz2 &&
make

To test the results, issue: make check. Note: The third set of the tests cannot be run if the "fr_FR" locale is missing from the system.

Now, as the root user:

make install

If you reinstall Grep after installing PCRE, Grep will get linked against PCRE and may cause problems if /usr is a separate mount point. To avoid this, either pass the option --disable-perl-regexp when executing ./configure for Grep or move libpcre to /lib as follows.

mv -v /usr/lib/libpcre.so.* /lib/ &&
ln -v -sf ../../lib/libpcre.so.0 /usr/lib/libpcre.so

Command Explanations

--enable-utf8: This switch includes the code for handling UTF-8 character strings in the library.

--enable-unicode-properties: This switch enables Unicode properties support.

--enable-pcregrep-libz: This switch adds support to pcregrep to read .gz compressed files.

--enable-pcregrep-libbz2: This switch adds support to pcregrep to read .bz2 compressed files.

Contents

Installed Programs: pcregrep, pcretest, and pcre-config
Installed Libraries: libpcre.{so,a}, libpcrecpp.{so,a} and libpcreposix.{so,a}
Installed Directory: /usr/share/doc/pcre-7.6

Short Descriptions

pcregrep

is a grep that understands Perl compatible regular expressions.

pcretest

can test a Perl compatible regular expression.

pcre-config

is used during the compile process of programs linking to the PCRE libraries.

Last updated on 2008-07-09 09:23:33 -0500

Popt-1.10.4

Introduction to Popt

The popt package contains the popt libraries which are used by some programs to parse command-line options.

Package Information

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/popt

Installation of Popt

Install popt by running the following commands:

sed -i -e "/*origOptString ==/c 0)" popt.c &&
./configure --prefix=/usr &&
make

If you have Doxygen-1.5.2 installed and wish to build the API documentation, issue doxygen.

To test the results, issue:

make check

Now, as the root user:

make install

If you built the API documentation, install it using the following commands issued by the root user:

install -v -m755 -d /usr/share/doc/popt-1.10.4 &&
install -v -m644 doxygen/html/* /usr/share/doc/popt-1.10.4

Command Explanations

sed ...: This fix taken backported from the development version of popt fixes a problem identified by the included testsuite.

Contents

Installed Programs: None
Installed Library: libpopt.{so,a}
Installed Directories: /usr/share/doc/popt-1.10.4

Short Descriptions

libpopt.{so,a}

is used to parse command-line options.

Last updated on 2008-08-10 16:20:02 -0500

S-Lang-2.1.3

Introduction to S-Lang

The S-Lang package contains the S-Lang library, which provides facilities such as display/screen management, keyboard input, and keymaps.

Package Information

S-Lang Dependencies

Optional

libpng-1.2.29, PCRE-7.6, and Oniguruma

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/slang

Installation of S-Lang

Install S-Lang by running the following commands:

./configure --prefix=/usr --sysconfdir=/etc &&
make

To test the results, issue: make check. Note that this will also create a static version of the library which will then be installed in the next step.

Now, as the root user:

make \
    install_doc_dir=/usr/share/doc/slang-2.1.3 \
    SLSH_DOC_DIR=/usr/share/doc/slang-2.1.3/slsh \
    install-all &&
chmod -v 755 /usr/lib/libslang.so.2.1.3 \
             /usr/lib/slang/v2/modules/*.so

Command Explanations

make install_doc_dir=/usr/share/doc/slang-2.1.3 SLSH_DOC_DIR=/usr/share/doc/slang-2.1.3/slsh install-all: This command installs the static library as well as the dynamic shared version and related modules. It also changes the documentation installation directories to a versioned directory.

--with-readline=gnu: Use this parameter to use the Gnu Readline parser instead of the S-Lang internal version.

Configuring S-Lang

Config Files

~/.slshrc and /etc/slsh.rc

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory, i.e., /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

Contents