Prerequisites

You should have known-good floppy diskettes available. Some people prefer to use the fdformat command to prepare these because it also does a verification. See the man page for more details. Another good idea is to always prepare duplicates of the rescue diskette. Media does deteriorate.

These instructions presume a base LFS install using ext2/ext3 file systems.

You need to have loopback device support enabled in your host's kernel to use this procedure.

You should make a custom kernel that includes only those features needed to rescue your system, so it will have the least size. No sense in building in support for things like XFree86, DRI, etc, as most rescues are performed from the command prompt. Along the same lines, if you have GCC-2.95.3, it is known to produce smaller kernels. So you might want to use that compiler for this kernel. If you do so, don't overlook any loadable modules (which are not addressed here) you might need - they need to be compiled with same compiler used to make the kernel.

The rescue image must include support for the file system of your choice (we presume ext2/3 here), ramdisk and initial ramdisk (initrd). Disable everything that you can in the kernel configuration. You should keep support for the proc file system and tempfs file system enabled because of their general utility. The proc file system is needed for the mount to report properly.

If you install only the minimal set of components shown in this document, you will need a kernel that is 643 or fewer blocks in size. If you want the optional programs - a very basic editor, like ed, and rudimentary disk partitioning, like sfdisk - the kernel will need to be 595 or fewer blocks in size. This should not be a major problem unless your needs are fairly esoteric. On the system used to develop this version of the procedures, using only ext2 file systems and not using networking or CDs for recovery, the kernel image is only 481 blocks. And there may be more to gain - it has not been closely examined for additional gains.

This kernel image will be called "rescueimage" hereinafter. You can actually name your image anything you like and just use its name instead in any commands that include "rescueimage".

If you can not get your kernel down to the size needed to allow all you need on the ramdisk image, don't fret. You can always build a two diskette set, one boot and one root diskette. The kernel will prompt you to insert the root file system diskette. This will allow room for a compressed ramdisk image of 1440 blocks and a kernel of the same size.

The kernel size limits given above are likely to vary as local system-specific configurations change. Use them only as a guideline and not as gospel. The size of the kernel image as shown by ls -sk is only an approximation because of some "overhead". On the system used to develop this version of these procedures, that command shows 488 blocks but the actual number of blocks written is only 480 and a fraction, which means that 481 blocks are actually used.

Rescue Disk Build Process

The basic process will be:

• make a mount point for a file system

• make an empty file to hold the file system

• bind the empty file to a loopback device

• make a 4MB file system

• mount the file system

• add components to the file system

• make the compressed initrd

• join a kernel image and initrd onto a diskette

The initial ramdisk will be automatically loaded at boot time if setup is done correctly.

Make a mount point and an empty file to hold a file system

mkdir -p /mnt/loop1
dd if=/dev/zero of=/tmp/rfloppy bs=1k count=4096

Command explanations

dd: This is a generalized input-to-output copy utility that also has many transformation capabilities.

if=/dev/zero: This parameter assigns dd's input file to a device that returns an infinite stream of zeroes.

of=/tmp/rfloppy: This parameter directs dd's output to /tmp/rfloppy.

bs=1k count=4096: These parameters tell dd to read and write in "chunks" of 1024 bytes and process 4096 "chunks".

Bind the file to a loopback device, make a file system and mount it.

The reason these commands are used is that they work regardless of the version of mount (older ones don't have the -o loop option) or if /etc/mtab is symlinked to /proc (which causes mount to be unable to properly "unbind" a loop device, due to "lost" information). An alternate set of commands is provided, after these three commands, that you can use if you don't have either of these situations.

losetup /dev/loop1 /tmp/rfloppy
mke2fs -m 0 -N 504 /dev/loop1
mount -t ext2 /dev/loop1 /mnt/loop1

Command explanations

losetup /dev/loop1 /tmp/rfloppy: This command "binds" a loopback device to the empty file.

mke2fs -m 0 -N 504 /dev/loop1: This command makes an ext2 file system on the loopback device (which really means it is created in the file to which the loopback device is bound) and reserves no blocks. The -N 504 parameter causes only 504 inodes to be allocated, leaving more space for other things needed in the file system.

mount -t ext2 /dev/loop1 /mnt/loop1: This mounts the file system just created, just as if it were a real device, like a hard drive or diskette. This allows all the normal system I/O commands to operate as if a real device were present.

If your mount supports the -o loop option and your /etc/mtab is a real file, rather than a symlink to /proc, the three above commands can be replaced by these next two commands.

mke2fs -F -m 0 -N 504 /tmp/rfloppy
mount -o loop /tmp/rfloppy /mnt/loop1

Command explanations

mke2fs -F -m 0 -N 504 /tmp/rfloppy: As before, a file system is made, with only 504 inodes and no reserved blocks, that will be bound to a loopback device. The -F parameter just suppresses an irritating question issued when mke2fs realizes that you are not accessing a device.

mount -o loop /tmp/rfloppy /mnt/loop1: This command tells mount to bind the named file to a loopback device it automatically selects (the first available) and mount the device on /mnt/loop1.

Add components to the file system

A cautionary note: if you are not running in a chroot environment, be sure that you do not accidentally omit the /mnt/loop1 reference in the commands. If you do so, you might replace the equivalent components on your host with the components that are installed by these procedures. Even if you are in a chroot environment, you may need to be careful if the environment is your freshly built LFS system which you intend to use as a host in the future.

First, to have as much free space as possible, remove the lost+found directory, which is not needed because it is only used by fsck. Since fsck will never be run on this file system, it is unneeded.

rmdir /mnt/loop1/lost+found/

Now make a minimal set of directories.

mkdir /mnt/loop1/{dev,proc,etc,sbin,bin,lib,mnt,usr,var}

Add needed device files to the initrd image. If you use devfs, the following command works well, as you only have the devices you use anyway.

cp -dpR /dev/* /mnt/loop1/dev

If you used MAKEDEV to create your devices on your host, you'll want to use something similar to this longer command, to minimize wasting space with unneeded inodes.

You must modify this to suit your kernel configuration and other needs. For example, you may need SCSI devices and may not need frame buffer devices or the pseudo-terminal directory. Also, the number of hard drives and partitions that you include should be the minimal that you need. Extensive analysis has not been done on the list below, so there are more inodes and space to be gained by "fine tuning" this set.

mkdir /mnt/loop1/dev/pts
cp -a \ 
    /dev/null /dev/console \
    /dev/fb[0-7] /dev/fd /dev/fd0 /dev/fd0h1440 /dev/full \
    /dev/hda* /dev/hdb* /dev/hdc* /dev/hdd* /dev/initctl /dev/kmem \
    /dev/loop[0-3] /dev/lp0 /dev/mem /dev/port \
    /dev/psaux /dev/ram \
    /dev/ram0 /dev/ram1 /dev/ram2 /dev/ram3 /dev/random /dev/rtc \
    /dev/shm /dev/stderr /dev/stdin /dev/stdout /dev/tty \
    /dev/tty[0-9] /dev/ttyS0 /dev/ttyS1 /dev/urandom /dev/zero \
  /mnt/loop1/dev

What is needed in the /etc directory

If you choose, you can copy all or selected parts of your /etc/passwd and /etc/group files. But even if each is less than 1024 bytes, you will lose two inodes and two blocks of space on the initial ramdisk. This only really matters because of trying to squeeze everything onto a 1.44MB diskette. Every little bit helps. The strategy taken here is to create these two files as part of the rescue boot and initialization process. The commands that make the two files will be embedded inside the rcS script that linuxrc (really busybox ) invokes after the initrd is loaded. This way no more inodes or blocks are used on the diskette to carry these files.

Some might like to copy their /etc/rc* directory into the ramdisk image, but this may have no value, other than archival use, in a worst-case recovery scenario. If you want automatic initialization of the system after repair, they may have some value. But few people need or want this to happen. If the file system on the hard drives are corrupted, what good will mount scripts do? Some scripts may be useful, like access to a network to copy over backup data when the hard drive's file systems are usable again. The point is that you should copy only the parts that you can use because space is at a premium on the diskette.

Here, only the fstab will be included. This is handy because it eases mounting of partitions that may be useful and also can be examined and used as a guide as to what is available and what may need reconstruction. Because it may be larger than needed, you should edit it to remove any useless entries and minimize commentary. No other editing is needed because the boot scripts are not included and no automatic mounting will be done using the fstab. If you decide to include some boot scripts that might try to mount things, change the fstab's entries to noauto in the options field so they don't cause an attempt to mount a potentially corrupt partition. Copy it to /tmp, edit it as desired and then:

cp -a /tmp/fstab /mnt/loop1/etc

Now the initialization script will be added. As mentioned above, linuxrc is symlinked to busybox . After the kernel and initial ramdisk have been loaded, the kernel gives control to linuxrc (busybox ). It wants to run an /etc/init.d/rcS script to do any initial setup.

If you use devfsd, you will need to set up the rcS script to handle the devfsd startup. Put the following commands in /mnt/loop1/etc/init.d/rcS. You may also want to add some of the processes shown in the non-devfs version that follows.

#!/bin/sh
mount -t devfs devfs /dev
/sbin/devfsd /dev

If you don't use devfsd, but created a static /dev directory using MAKEDEV, or any similar process, the rcS script will do slightly different things. Also, don't forget that it is creating the /etc/passwd and /etc/group files, thus saving space on the diskette.

The script made next will mount /proc, turn on swap (no harm is done if it fails), make the /etc/passwd and /etc/group files, create a log directory and turn on swapping. Create the script with:

mkdir -p /mnt/loop1/etc/init.d
cat >/mnt/loop1/etc/init.d/rcS << EOD
#!/bin/sh
mount -t proc proc /proc
swapon -a

echo "root:x:0:0:root:/root:/bin/bash" > /etc/passwd

cat > /etc/group <<EOF
root:x:0:
bin:x:1:
sys:x:2:
kmem:x:3:
tty:x:4:
tape:x:5:
daemon:x:6:
floppy:x:7:
disk:x:8:
lp:x:9:
dialout:x:10:
audio:x:11:
EOF
chmod 644 /etc/passwd /etc/group

mkdir /var/log

EOD
chmod u+x /mnt/loop1/etc/init.d/rcS

Unless you add a lot to this script, which is encouraged, the above should be reasonably close to what you need.

Install packages

There are two packages that must be installed. The busybox package incorporates the core functions that provide a shell and many basic utilities. A file system package, like e2fsprogs, or a package for the file system you are using will provide a minimal set of utilities for file system checking and reconstruction. The whole package will not be installed, but only certain needed components.

If you use devfsd, you will also need to install that software.

Install busybox into the initial ramdisk image. Busybox incorporates many Unix utility program functions into a single small executable file.

make &&
make PREFIX=/mnt/loop1 install &&
> /mnt/loop1/var/utmp

A var/utmp is made because busybox needs it for the reboot command to work properly. If this file doesn't exist when busybox is started, the reboot command will not work. This would be a bad thing for people that have no reset button available to them.

If you use devfs to create devices on the fly and free up precious inodes on the floppy, you'll also install devfsd to facilitate the devices that busybox expects to find. Use the following commands to do the install.

mv GNUmakefile Makefile &&
make &&
make PREFIX=/mnt/loop1 install &&

Install part of e2fsprogs

If you use the ext2 or ext3 (journaling) file system, you can use the commands below to install the minimal functionality that should allow you to get your hard drives usable again. If you use ext3, keep in mind that it is a part of the e2fsprogs package and you can get the components, which are mostly hard links, from the same places shown below. If you use some other file system, such as reiserfs, you should apply the principals you see here to install parts of that package instead.

LDFLAGS='-s'
mkdir build &&
cd build &&
../configure --prefix=/mnt/loop1/usr --with-root-prefix="" \
    --disable-swapfs --disable-debugfs \
    --enable-dynamic-e2fsck --disable-nls --disable-evms \
    --disable-rpath &&
make LDFLAGS="$LDFLAGS" &&
strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/sbin/mke2fs misc/mke2fs &&
strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/sbin/e2fsck e2fsck/e2fsck &&
chmod 555 /mnt/loop1/sbin/{mke2f,e2fsck}

Two useful utilities

There are two very useful utilities that any rescue disk should have to help in faster and more accurate recovery. The first is a partitioning utility. The sfdisk program is used here because of its small size and great power. Be warned though - it is not what is considered to be "user friendly". But the fdisk and cfdisk programs are substantially larger or require more shared objects, like ncurses .

The second utility is an editor. Most graphical editors are inherently too large and also require additional shared objects. For this reason, ed is used here. It is small, requires no additional shared objects and is a regex-based editor that is the ancestor to almost all subsequent editors that support regex-based editing, whether graphical or not. It is a "context editor" and offers powerful, but non-graphical, editing features. There are many other editors that may be suitable - feel free to use one of them instead.

Read the busybox INSTALL and README files to see how to include a vi editor. It has not been investigated here yet, so it may or may not easily fit onto a single diskette image such as is made here.

You can install these or not, but it is important for you to have some capability such as these offer. Exactly how you would install the utilities you choose will have to be determined by you.

Sfdisk and ed are installed by, essentially, copying them from your host. Strip is used, just to assure that they carry no "excess baggage", even though the base LFS install should have stripped them already. Use the following commands:

strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/sbin/sfdisk /sbin/sfdisk
strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/bin/ed /bin/ed
chmod 555 /mnt/loop1/sbin/sfdisk /mnt/loop1/bin/ed

Also, keeping in mind your space limitations, copy any other binaries and libraries you need to the image. Use the ldd command to see which libraries you will need to copy over for any executables. Don't forget to also strip them before copying them to the ramdisk image or use the strip, as above, to "copy" them.

Set up the lib directory

Once you have installed all the utilities from above and any additional ones you want, use the ldd command, as mentioned above, on those that were not listed in this document. If any additional libraries are needed, add them into the setup commands shown next.

If you installed only those things shown above, the shared objects needed will be minimal. You can add them to the ramdisk image with:

strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/lib/libc.so.6 /lib/libc-2.3.2.so &&
strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/lib/ld-linux.so.2 /lib/ld-2.3.2.so &&
strip -p --strip-unneeded --remove-section=.comment \
    -o /mnt/loop1/lib/libdl.so.2 /lib/libdl-2.3.2.so &&
chmod 555 /mnt/loop1/lib/{libc.so.6,ld-linux.so.2,libdl.so.2}

Note that the above commands change the names of the libraries, eliminating the need for the usual symlinks. If you add any additional shared objects, be alert for similar opportunities and also the pitfalls that may be present.

Make the compressed initrd

Unmount the loopback file. If you used mount's -o loop option, the "bond" between the loop device and the file will be removed when the unmount is done. Just omit the losetup -d /dev/loop1 from the following sequence. The -9 parameter is used with gzip to make the smallest possible compressed image. To make sure it will fit on the diskette, list the file's size.

umount /mnt/loop1 &&
losetup -d /dev/loop1 &&  # Omit if mount's -o loop was used
gzip -9 < /tmp/rfloppy > /tmp/rootfs.gz
ls -l /tmp/rootfs.gz

Join a kernel image and initrd onto a diskette

Now the kernel image and initial ramdisk image will be written to the boot diskette. Before doing this, calculate the number of blocks needed for the kernel and for the initrd, individually, by dividing each size by 1024 and adding one if there is any remainder. Add these two results together. They must total 1,440 or fewer blocks. If they total more than this, don't worry too much. Changes to make a two-diskette set are presented later. Of course, you could reexamine your choices and try to shrink either the kernel or the initial ramdisk image.

To make a single-floppy rescue, using devfs, use the following commands. If you use the static /dev setup, use /dev/fd0 instead of the /dev/floppy/0.

dd if=rescueimage of=/dev/floppy/0 bs=1k
rdev /dev/floppy/0 0,0
rdev -R /dev/floppy/0 0

Command explanations

rdev /dev/floppy/0 0,0: sets the root file system the kernel will use when it boots. Because it loads an initrd, it will automatically set that as the root device, initially. So, the 0,0 gives it "no value", telling the kernel to not mount any other device. Some folks give /dev/fd0 or something similar. But this has effect only when linuxrc (really busybox ) exits and the normal init processes get invoked. Since this is not being done here, and the floppy is not a valid file system, it would be useless here. A hard drive would be a better choice if you are looking to automatically bring the system up after repair. Since busybox provides the reboot command, automatic initialization is not needed.

The rdev -R /dev/floppy/0 0 will set the "root flags" to zero. They have no use in this application.

The dd from above showed some results, like

        480+1 records in
        480+1 records out

In this example the rescueimage (kernel) was 480+1 blocks in size. Make sure that this number, which may be different for you, matches your calculations from above. You need to calculate a "magic number" now that will be inserted into the kernel image. The value consists of three significant parts. Two are discussed here. The third is touched upon later.

Bits 0 - 10 will contain the size of the kernel image, in blocks, that you calculated above, and which should match the results from the dd above. Bit 14 (the 15th bit, which is 2 to the 14th power, or 16,384) is a flag that, when set to 1, tells the kernel an initial ramdisk is to be loaded. So for the single-floppy rescue diskette, the two numbers 16,384 and 481 (or whatever number is right for your kernel size) are added together to produce a decimal value, like 16865. This value is inserted into the proper place in the kernel image by the rdev command done next.

Insert the "magic number" into the kernel image and then write the root file system right after the kernel on the floppy by executing the following commands, with the proper numbers inserted. Notice that the seek parameter's number must be the size, in blocks, of your kernel image. If you use the static /dev setup, use /dev/fd0 in the commands below, instead of /dev/floppy/0.

rdev -r /dev/floppy/0 16865
dd if=/tmp/rootfs.gz of=/dev/floppy/0 bs=1k seek=481

In this command, seek was used to position to the block following the end of the kernel (480+1) and begin writing the root file system to the floppy.

Package information

• Download (HTTP): http://www.kernel.org/pub/linux/libs/pam/pre/library/Linux-PAM-0.77.tar.bz2

• Download (FTP): ftp://ftp.kernel.org/pub/linux/libs/pam/pre/library/Linux-PAM-0.77.tar.bz2

• Download size: 332 KB

• Estimated Disk space required: 4.1 MB

• Estimated build time: 0.07 SBU

Additional download

• Required patch: http://www.linuxfromscratch.org/patches/blfs/5.0/Linux-PAM-0.77-linkage-1.patch

Linux-PAM dependencies

Config files

/etc/pam.d or /etc/pam.conf

Configuration Information

Configuration information is placed in /etc/pam.d or /etc/pam.conf depending on the application that is using PAM. Below are example files of each type:

# Begin /etc/pam.d/other

auth            required        pam_unix.so     nullok
account         required        pam_unix.so
session         required        pam_unix.so
password        required        pam_unix.so     nullok

# End /etc/pam.d/other

# Begin /etc/pam.conf

other           auth            required        pam_unix.so     nullok
other           account         required        pam_unix.so
other           session         required        pam_unix.so
other           password        required        pam_unix.so     nullok

# End /etc/pam.conf

The PAM man page (man pam) provides a good starting point for descriptions of fields and allowable entries. The Linux-PAM guide for system administrators is recommended for further reading.

unix-chkpwd

No description available.

libpam libraries

libpam libraries provide the interfaces between applications and the modules included with PAM.

Shadow dependencies

Config files

/etc/pam.d/login, /etc/pam.d/passwd, /etc/pam.d/su, /etc/pam.d/shadow, /etc/pam.d/useradd

Configuration Information

Add the following PAM configuration files to /etc/pam.d (or add them to /etc/pam.conf with the additional field for the program).

cat > /etc/pam.d/login << "EOF"
# Begin /etc/pam.d/login

auth        requisite      pam_securetty.so
auth        requisite      pam_nologin.so
auth        required       pam_env.so
auth        required       pam_unix.so
account     required       pam_access.so
account     required       pam_unix.so
session     required       pam_motd.so
session     required       pam_limits.so
session     optional       pam_mail.so     dir=/var/mail standard
session     optional       pam_lastlog.so
session     required       pam_unix.so

# End /etc/pam.d/login
EOF
cat > /etc/pam.d/passwd << "EOF"
# Begin /etc/pam.d/passwd

password    required       pam_unix.so     md5 shadow 

# End /etc/pam.d/passwd
EOF
cat > /etc/pam.d/shadow << "EOF"
# Begin /etc/pam.d/shadow

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     required        pam_unix.so
password    required        pam_permit.so

# End /etc/pam.d/shadow
EOF
cat > /etc/pam.d/su << "EOF"
# Begin /etc/pam.d/su

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     required        pam_unix.so

# End /etc/pam.d/su
EOF
cat > /etc/pam.d/useradd << "EOF"
# Begin /etc/pam.d/useradd

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     required        pam_unix.so
password    required        pam_permit.so

# End /etc/pam.d/useradd
EOF
cat > /etc/pam.d/chage << "EOF"
# Begin /etc/pam.d/chage

auth        sufficient      pam_rootok.so
auth        required        pam_unix.so
account     required        pam_unix.so
session     required        pam_unix.so
password    required        pam_permit.so

# End /etc/pam.d/chage
EOF

Currently, /etc/pam.d/other is configured to allow anyone with an account on the machine to use programs that do not specifically have a configuration file of their own. After testing PAM for proper configuration, it can be changed to the following:

cat > /etc/pam.d/other << "EOF"
# Begin /etc/pam.d/other

auth        required        pam_deny.so
auth        required        pam_warn.so
account     required        pam_deny.so
session     required        pam_deny.so
password    required        pam_deny.so
password    required        pam_warn.so

# End /etc/pam.d/other
EOF

Finally, edit /etc/login.defs by adding '#' to the beginning of the following lines:

DIALUPS_CHECK_ENAB
LASTLOG_ENAB
MAIL_CHECK_ENAB
PORTTIME_CHECKS_ENAB
CONSOLE
MOTD_FILE
NOLOGINS_FILE
PASS_MIN_LEN
SU_WHEEL_ONLY
MD5_CRYPT_ENAB
CONSOLE_GROUPS
ENVIRON_FILE

This stops login from performing these functions, as they will now be performed by PAM modules.

Package information

• Download (HTTP): http://www.iptables.org/files/iptables-1.2.8.tar.bz2

• Download (FTP): ftp://ftp.netfilter.org/pub/iptables/iptables-1.2.8.tar.bz2

• Download size: 128 KB

• Estimated Disk space required: 2.8 MB

• Estimated build time: 0.28 SBU

iptables

iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel.

iptables-save, ~-restore

These are used to save and to restore your elaborated set of chains and rules. Until iptables-1.2.5, they were declared experimental.

ip6tables

This is the same as iptables but for use with IPv6. As of v1.2.5, it is not as complete as the standard IPv4 version, especially with regard to some of the modules.

libip*.so

These are various modules (implemented as dynamic libraries) which extend the core functionality of iptables.

Personal Firewall

This is a setup or program, for Windows commercially sold by companies such as Symantec, of which they claim or pretend that it secures a home or desktop-pc with Internet access. This topic is highly relevant for users who do not know the ways their computers might be accessed via the Internet and how to disable these, especially if they are always online and if they are connected via broadband links.

Masquerading Router

This is a box placed between the Internet and an intranet. To minimize the risk of compromising the firewall itself it should generally have only one role, that of protecting the intranet. Although not completely risk free, the tasks of doing the routing and eventually IP masquerading (rewriting IP-headers of the packets it routes from clients with private IP-addresses onto the Internet so that they seem to come from the firewall itself) are commonly considered harmless.

BusyBox

This is often an old box you may have retired and nearly forgotten, performing masquerading or routing functions, but offering a bunch of services, e.g., web-cache, mail, etc. This may be very commonly used for home networks, but can definitely not to be considered as secure anymore because the combining of server and router on one machine raises the complexity of the setup.

Firewall with a demilitarized zone [not further described here]

This box performs masquerading or routing, but grants public access to some branch of your network which, because of public IP's and a physically separated structure, is neither considered to be part of the inter- nor intranet. These servers are those which must be easily accessible from both the inter- and intranet. The firewall protects them all.

Packetfilter / partly accessible net [partly described here, see BusyBox]

Doing routing or masquerading, but permitting only selected services to be accessible, sometimes only by selected internal users or boxes; mostly used in highly secure business contexts, sometimes by distrusting employers. This was the common configuration of a firewall at the time of the Linux 2.2 kernel. It's still possible to configure a firewall this way, but it makes the rules quite complex and lengthy.

Personal Firewall

A Personal Firewall is supposed to let you access the all services offered on the Internet, but keep your box secure and your data private.

Below is a slightly modified version of Rusty Russell's recommendation from the Linux 2.4 Packet Filtering HOWTO:

cat > /etc/rc.d/init.d/firewall << "EOF"
#!/bin/sh

# Begin $rc_base/init.d/firewall

# Insert connection-tracking modules (not needed if built into the kernel).
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe ipt_LOG

# allow local-only connections
iptables -A INPUT  -i lo -j ACCEPT
# free output on any interface to any ip for any service (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# permit answers on already established connections
# and permit new connections related to established ones (eg active-ftp)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log everything else:  What's Windows' latest exploitable vulnerability?
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# set a sane policy:    everything not accepted > /dev/null
iptables -P INPUT    DROP
iptables -P FORWARD  DROP
iptables -P OUTPUT   DROP

# be verbose on dynamic ip-addresses     (not needed in case of static IP)
echo 2 > /proc/sys/net/ipv4/ip_dynaddr

# disable ExplicitCongestionNotification - too many routers are still ignorant
echo 0 > /proc/sys/net/ipv4/tcp_ecn

# End $rc_base/init.d/firewall
EOF

His script is quite simple, it drops all traffic coming in into your computer that wasn't initiated from your box, but as long as you are simply surfing the Internet you are unlikely to exceed its limits.

If you frequently encounter certain delays at accessing ftp-servers, please have a look at BusyBox - example no. 4.

Even if you have daemons / services running on your box, these should be inaccessible everywhere but from your box itself. If you want to allow access to services on your machine, such as ssh or pinging, take a look at BusyBox.

Masquerading Router

A true Firewall has two interfaces, one connected to an intranet, in this example, eth0, and one connected to the Internet, here, ppp0. To provide the maximum security against the box itself being broken into, make sure that there are no servers running on it, especially not X11 et al. And, as a general principle, the box itself should not access any untrusted service (Think of a name server giving answers that make your bind crash, or, even worse, that implement a worm via a buffer-overflow).

cat > /etc/rc.d/init.d/firewall << "EOF"
#!/bin/sh

# Begin $rc_base/init.d/firewall

echo
echo "You're using the example-config for a setup of a firewall"
echo "from the firewalling-hint written for LinuxFromScratch."
echo "This example is far from being complete, it is only meant"
echo "to be a reference."
echo "Firewall security is a complex issue, that exceeds the scope"
echo "of the quoted configuration rules."
echo "You can find some quite comprehensive information"
echo "about firewalls in Chapter 4 of the BLFS book."
echo "http://www.linuxfromscratch.org/blfs"
echo

# Insert iptables modules (not needed if built into the kernel).

modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ipt_state
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ipt_MASQUERADE
modprobe ipt_LOG
modprobe ipt_REJECT

# allow local-only connections
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# allow forwarding
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -i ! ppp+	 -j ACCEPT

# do masquerading    (not needed if intranet is not using private ip-addresses)
iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE

# Log everything for debugging (last of all rules, but before DROP/REJECT)
iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT  "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD"
iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "

# set a sane policy
iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  DROP

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 > /proc/sys/net/ipv4/ip_dynaddr

# disable ExplicitCongestionNotification
echo 0 > /proc/sys/net/ipv4/tcp_ecn

# activate TCPsyncookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# activate Route-Verification = IP-Spoofing_protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
	echo 1 > $f
done

# activate IP-Forwarding 
echo 1 > /proc/sys/net/ipv4/ip_forward
EOF

With this script your intranet should be sufficiently secure against external attacks: no one should be able to setup a new connection to any internal service and, if it's masqueraded, it s even invisible; furthermore, your firewall should be nearly immune because there are no services running that a cracker could attack.

Note: if the interface you're connecting to the Internet doesn't connect via ppp, you will need to change ppp+ to the name of the interface which you are using. If you are using the same interface type to connect to both your intranet and the Internet, you need to use the actual name of the interface such as eth0, on both interfaces.

If you need stronger security (e.g., against DOS, connection highjacking, spoofing, etc.) have a look at the list of Links for further reading at the end of this section.

BusyBox

This scenario isn't too different from (Masquerading Router), but in this case you want to offer some services to your intranet. Examples of this can be when you want to admin your box from another host on your intranet or use it as a proxy or a name server. Note: Outlining a true concept of how to protect a server that offers services on the Internet goes far beyond the scope of this document, see Disclaimer.

Be cautious. Every service you offer and have enabled makes your setup more complex and your box less secure: You induce the risks of misconfigured services or running a service with an exploitable bug, both risks that a firewall principally should be immune of. See the introduction to Masquerading Router for some more details.

If the services you'd like to offer do not need to access the Internet themselves, like internal-only samba- or name-servers, it's quite simple and should still be acceptable from a security standpoint. Just add the following lines before the logging-rules into the script.

iptables -A INPUT -i ! ppp+ -j ACCEPT iptables -A OUTPUT -o ! ppp+ -j ACCEPT

If your daemons have to access the web themselves, like squid would need to, you could open OUTPUT generally and restrict INPUT.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -j ACCEPT

However, it is generally not advisable to leave OUTPUT unrestricted: you lose any control on trojans who'd like to "call home", and a bit of redundancy in case you've (mis-)configured a service so that it does broadcast its existence to the world.

If you prefer to have this protection, you may restrict INPUT and OUTPUT on all ports except those that it's absolutely necessary to have open. Which ports you have to open depends on your needs: mostly you will find them by looking for failed accesses in your log-files.

Have a look at the following examples:

• Squid is caching the web:

  iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

• Your caching name server (e.g., dnscache) does its lookups via udp:

  iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT

• Alternatively, if you want to be able to ping your box to ensure it's still alive:

  iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT

• If you are frequently accessing ftp-servers or enjoy chatting you might notice certain delays because some implementations of these daemons have the feature of querying an identd on your box for your username for logging. Although there's really no harm in this, having an identd running is not recommended because some implementations are known to be vulnerable.

  To avoid these delays you could reject the requests with a 'tcp-reset':

  iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --sport 113 -m state --state RELATED -j ACCEPT

• To log and drop invalid packets, mostly harmless packets that came in after netfilter's timeout, sometimes scans:

  iptables -I INPUT 1 -p tcp -m state --state INVALID -j LOG --log-prefix \ "FIREWALL:INVALID" iptables -I INPUT 2 -p tcp -m state --state INVALID -j DROP

• Anything coming from the outside should not have a private address, this is a common attack called IP-spoofing:

  iptables -t nat -A PREROUTING -i ppp+ -s 10.0.0.0/8 -j DROP iptables -t nat -A PREROUTING -i ppp+ -s 172.16.0.0/12 -j DROP iptables -t nat -A PREROUTING -i ppp+ -s 192.168.0.0/16 -j DROP

• To simplify debugging and be fair to anyone who'd like to access a service you have disabled, purposely or by mistake, you should REJECT those packets that are dropped.

  Obviously this must be done directly after logging as the very last lines before the packets are dropped by policy:

  iptables -A INPUT -j REJECT iptables -A OUTPUT -p icmp --icmp-type 3 -j ACCEPT

These are only examples to show you some of the capabilities of the new firewall code in Linux-Kernel 2.4. Have a look at the man page of iptables. There you will find more of them. The port-numbers you'll need for this can be found in /etc/services, in case you didn't find them by trial and error in your log file.

If you add any of your offered or accessed services such as the above, maybe even in FORWARD and for intranet-communication, and delete the general clauses, you get an old fashioned packet filter.

Where to start with further reading on firewalls.

www.netfilter.org - Homepage of the netfilter/iptables project
Netfilter related FAQ
Netfilter related HOWTO's
www.linuxdoc.org/LDP/nag2/x-087-2-firewall.html
www.linuxdoc.org/HOWTO/Security-HOWTO.html
www.linuxdoc.org/HOWTO/Firewall-HOWTO.html
www.ibm.com/developerworks/security/library/s-fire.html
www.ibm.com/developerworks/security/library/s-fire2.html
www.interhack.net/pubs/fw-faq/
csrc.nist.gov/isptg/html/ISPTG-6.html
www.linuxsecurity.com/docs/
www.little-idiot.de/firewall (German & outdated, but very comprehensive)
www.linuxgazette.com/issue65/stumpel.html
linux.oreillynet.com/pub/a/linux/2000/03/10/netadmin/ddos.html
staff.washington.edu/dittrich/misc/ddos
ipmasq.cjb.net/
www.e-infomax.com/ipmasq
www.circlemud.org/~jelson/writings/security/index.htm
www.securityfocus.com
www.cert.org - tech_tips
www.uni-siegen.de/security/pointers.html
security.ittoolbox.com
www.linux-firewall-tools.com/linux/
logi.cc/linux/athome-firewall.php3
www.insecure.org/reading.html
www.robertgraham.com/pubs/firewall-seen.html

firewall.status

If you'd like to have a look at the chains your firewall consists of and the order in which the rules take effect:

cat > /etc/rc.d/init.d/firewall.status << "EOF"
#!/bin/sh

# Begin $rc_base/init.d/firewall.status

echo "iptables.mangling:"
iptables -t mangle  -v -L -n --line-numbers

echo
echo "iptables.nat:"
iptables -t nat	    -v -L -n --line-numbers

echo
echo "iptables.filter:"
iptables	    -v -L -n --line-numbers
EOF

firewall.stop

If you need to turn the firewall off, this script will do it:

cat > /etc/rc.d/init.d/firewall.stop << "EOF"
#!/bin/sh

# Being $rc_base/init.d/firewall.stop

# deactivate IP-Forwarding 
echo 0 > /proc/sys/net/ipv4/ip_forward

iptables -Z
iptables -F
iptables -t nat         -F PREROUTING
iptables -t nat         -F OUTPUT
iptables -t nat         -F POSTROUTING
iptables -t mangle      -F PREROUTING
iptables -t mangle      -F OUTPUT
iptables -X
iptables -P INPUT       ACCEPT
iptables -P FORWARD     ACCEPT
iptables -P OUTPUT      ACCEPT
EOF

Package information

• Download (HTTP): http://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.2.3.tar.bz2

• Download (FTP): ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.2.3.tar.bz2

• Download size: 2.2 MB

• Estimated Disk space required: 26.1 MB

• Estimated build time: 0.32 SBU

gpg

gpg is the backend (command-line interface) for this OpenPGP implementation.

gpgsplit

gpgsplit separates key rings.

gpgv

gpgv is a verify only version of gpg.

Package information

• Download (HTTP): http://telia.dl.sourceforge.net/sourceforge/tripwire/tripwire-2.3.1-2.tar.gz

• Download (FTP): ftp://ftp.fu-berlin.de/unix/security/tripwire/tripwire-2.3.1-2.tar.gz

• Download size: 1.4 MB

• Estimated Disk space required: 63 MB

• Estimated build time: 2.35 SBU

Additional downloads

• Required patch to fix multiple build issues (see patch for more information): http://www.linuxfromscratch.org/patches/blfs/5.0/tripwire-2.3.1-2-gcc3-build-fixes.patch

Config files

/etc/tripwire

Configuration Information

Tripwire uses a policy file to determine which files integrity are checked. The default policy file (twpol.txt found in /etc/tripwire/) is for a default installation of Redhat 7.0 and is woefully outdated.

Policy files are also a custom thing and should be tailored to each individual distribution and/or installation. Some custom policy files can be found below:

http://home.iprimus.com.au/glombowski/blfs/twpol-all.txt
Checks integrity of all files
http://home.iprimus.com.au/glombowski/blfs/twpol-lfs.txt
Custom policy file for Base LFS 3.0 system
http://home.iprimus.com.au/glombowski/blfs/twpol-suse7.2.txt
Custom policy file for SuSE 7.2 system

Download the custom policy file you'd like to try, copy it into /etc/tripwire/, and use it instead of twpol.txt. It is, however, recommended that you make your own policy file. Get ideas from the examples above and read /usr/share/doc/tripwire/policyguide.txt. twpol.txt is a good policy file for beginners as it will note any changes to the file system and can even be used as an annoying way of keeping track of changes for uninstallation of software.

After your policy file has been transferred to /etc/tripwire/ you may begin the configuration steps:

twadmin -m P /etc/tripwire/twpol.txt &&
tripwire -m i

During configuration Tripwire will create two (2) keys: a site key and a local key which will be stored in /etc/tripwire/ .

Usage Information

To use Tripwire after this and run a report, use the following command:

tripwire -m c > /etc/tripwire/report.txt

View the output to check the integrity of your files. An automatic integrity report can be produced by using a cron facility to schedule the runs.

Please note that after you run an integrity check, you must check the report or email and then modify the Tripwire database of the files on your system so that Tripwire will not continually notify you that files you intentionally changed are a security violation. To do this you must first ls /var/lib/tripwire/report/ and note the name of the newest file which starts with linux- and ends in .twr. This encrypted file was created during the last report creation and is needed to update the Tripwire database of your system. Then, type in the following command making the appropriate substitutions for '?':

tripwire -m u -r /var/lib/tripwire/report/linux-???????-??????.twr 

You will be placed into vim with a copy of the report in front of you. If all the changes were good, then just type :x and after entering your local key, the database will be updated. If there are files which you still want to be warned about, please remove the x before the filename in the report and type :x.

Changing the Policy File

If you are unhappy with your policy file and would like to modify it or use a new one, modify the policy file and then execute the following commands:

twadmin -m P /etc/tripwire/twpol.txt &&
tripwire -m i

Package information

• Download (HTTP): http://ftp.namesys.com/pub/reiserfsprogs/reiserfsprogs-3.6.11.tar.gz

• Download (FTP): ftp://ftp.namesys.com/pub/reiserfsprogs/reiserfsprogs-3.6.11.tar.gz

• Download size: 368 KB

• Estimated Disk space required: 9.3 MB

• Estimated build time: 0.16 SBU

debugreiserfs

debugreiserfs can sometimes help to solve problems with ReiserFS file systems. If it is called without options it prints the super block of any reiserfs file system found on the device.

mkreiserfs

mkreiserfs creates a ReiserFS file system.

reiserfsck

reiserfsck checks a ReiserFS file system.

reiserfstune

reiserfstune is used for tuning the ReiserFS journal. WARNING: Don't use this utility without first reading the man page thoroughly.

resize_reiserfs

resize_reiserfs is used to resize an unmounted ReiserFS file system.

unpack

The unpack utility can be used to dump ReiserFS file system information to files for debugging, much like debugreiserfs.

Package information

• Download (HTTP):

• Download (FTP): ftp://oss.sgi.com/projects/xfs/download/patches/2.4.22/xfs-2.4.22-all-i386.bz2

• Download size: 860 KB

• Estimated Disk space required:

Package information

• Download (HTTP): http://gd.tuwien.ac.at/opsys/linux/slackware/slackware-current/source/a/xfsprogs/xfsprogs-2.5.6.src.tar.gz

• Download (FTP): ftp://oss.sgi.com/projects/xfs/download/Release-1.3/cmd_tars/xfsprogs-2.5.6.src.tar.gz

• Download size: 816 KB

• Estimated Disk space required: 42 MB

• Estimated build time: 0.67 SBU

xfsgrowfs

xfsgrowfs expands an XFS file system.

xfs_admin

xfs_admin changes the parameters of an XFS file system.

xfs_freeze

xfs_freeze suspends access to an XFS file system.

xfs_mkfile

xfs_mkfile creates an XFS file, padded with zeroes by default.

xfs_check

xfs_check checks XFS file system consistency.

xfs_bmap

xfs_bmap prints block mapping for an XFS file.

xfs_rtcp

xfs_rtcp copies a file to the real-time partition on an XFS file system.

xfs_repair

xfs_repair repairs corrupt or damaged XFS file systems.

xfs_db

xfs_db is used to debug an XFS file system.

xfs_logprint

xfs_logprint prints the log of an XFS file system.

xfs_ncheck

xfs_ncheck generates pathnames from inode numbers for an XFS file system.

mkfs.xfs

mkfs.xfs constructs an XFS file system.

fsck.xfs

fsck.xfs simply exits with a zero status, since XFS partitions are checked at mount time.

Package information

• Download (HTTP): http://ftp.at.vim.org/pub/vim/unix/vim-6.2.tar.bz2

• Download (FTP): ftp://ftp.vim.org/pub/vim/unix/vim-6.2.tar.bz2

• Download size: 3.2 MB

• Estimated Disk space required: 46 MB

• Estimated build time: 0.59 SBU

Vim dependencies

Package information

• Download (HTTP): http://ftp.gnu.org/pub/gnu/emacs/emacs-21.3.tar.gz

• Download (FTP): ftp://ftp.gnu.org/pub/gnu/emacs/emacs-21.3.tar.gz

• Download size: 20 MB

• Estimated Disk space required: 92.5 MB

• Estimated build time: 4.20 SBU

Emacs dependencies

emacs

The editor proper.

b2m

b2m is a program to convert mail files from RMAIL format to Unix `mbox' format.

ctags

ctags creates cross-reference tagfile database files for source code.

ebrowse

ebrowse permits browsing of C++ class hierarchies from with emacs.

emacsclient

emacsclient attaches an emacs session to an already running emacsserver instance.

etags

etags is another program to generate source code cross-reference tagfiles.

grep-changelog

grep-changelog prints entries in Change Logs matching various criteria.

rcs-checkin

rcs-checkin is a shell script used to check files into RCS.

cvt-mail

cvt-mail converts old style goslings emacs mail directories into gnu-rmail format.

digest-doc

digest-doc is a filter to create nroff output for man pages.

emacsserver

emacserver allows other applications/shells to access an already running emacs instance and share buffers with it.

fakemail

fakemail is a sendmail-like interface to /bin/mail.

hexl

hexl converts files for editing with emacs hexl-mode binary file editing mode.

movemail

movemail provide access to POP3 mailboxes.

profile

profile generates periodic events for profiling of Emacs Lisp code.

rcs2log

rcs2log generates change log prefixes from RCS files.

sorted-doc

sorted-doc is a filter to generate texinfo files.

vcdiff

vcdiff compares SCCS files.

yow

yow prints a quotation from Zippy the Pinhead.

Package information

• Download (HTTP): http://www.nano-editor.org/dist/v1.2/nano-1.2.2.tar.gz

• Download (FTP): ftp://ftp.uni-koeln.de/editor/nano-1.2.2.tar.gz

• Download size: 876 KB

• Estimated Disk space required: 4.4 MB

• Estimated build time: 0.04 SBU

nano dependencies

Config files

/etc/nanorc, ~/.nanorc

Example Configuration

set autoindent
set const
set fill 72
set historylog
set multibuffer
set nohelp
set regexp
set smooth
set suspend

Another example is in the /usr/share/doc/nano/examples directory in the nanorc.sample file. It includes color configurations and has some documentation included in the comments.

nano

nano is a small, simple text editor which aims to replace Pico, the default editor in the Pine package.

Package information

• Download (HTTP): http://unc.dl.sourceforge.net/sourceforge/joe-editor/joe-2.9.8.tar.gz

• Download (FTP): ftp://ftp.uni-koeln.de/editor/joe-2.9.8.tar.gz

• Download size: 284 KB

• Estimated Disk space required: 4.3 MB

• Estimated build time: 0.11 SBU

jmacs

jmacs is a symbolic link to joe used to launch Emacs emulation mode.

joe

joe is a small text editor capable of emulating WordStar, Pico, and Emacs.

jpico

jpico is a symbolic link to joe used to launch Pico emulation mode.

jstar

jstar is a symbolic link to joe used to launch WordStar emulation mode.

rjoe

rjoe is a symbolic link to joe that restricts JOE to editing only files which are specified on the command-line.

termidx

termidx is a program used by joe to generate the termcap index file.

Package information

• Download (HTTP):

• Download (FTP): ftp://distro.ibiblio.org/pub/Linux/distributions/slackware/slackware_source/ap/ash/

• Download size: 119 KB

• Estimated Disk space required: 700 KB

• Estimated build time:

Additional downloads

• Required patch: http://www.linuxfromscratch.org/patches/blfs/5.0/ash-0.4.0-cumulative-fixes.patch

Config files

ASH sources /etc/profile and $HOME/.profile

ash

ash is a sh-compliant shell.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/utils/shells/tcsh/tcsh-6.12.00.tar.gz

• Download (FTP): ftp://ftp.funet.fi/pub/unix/shells/tcsh/tcsh-6.12.00.tar.gz

• Download size: 804 KB

• Estimated Disk space required: 9.0 MB

• Estimated build time: 0.16 SBU

Config files

There are numerous configuration files for the C shell. Examples of these are /etc/csh.cshrc, /etc/csh.login, ~/.tcshrc, ~/.cshrc, ~/.history, ~/.login, ~/.cshdirs, /etc/csh.logout, ~/.logout and ~/.logout. More information on these files can be found in the tcsh(1) man page.

tcsh

tcsh is an enhanced but completely compatible version of the Berkeley Unix C shell, csh. It is usable as both an interactive shell and a script processor.

Package information

• Download (HTTP): http://www.zsh.org/pub/zsh-4.1.1.tar.bz2

• Download (FTP): ftp://ftp.zsh.org/zsh/zsh-4.1.1.tar.bz2

• Download size: 1.9 MB

• Estimated Disk space required: 16 MB

• Estimated build time: 0.55 SBU

Config files

There are a whole host of configuration files for ZSH including /etc/zshenv, /etc/zprofile, /etc/zshrc, /etc/zlogin and /etc/zlogout. You can find more information on these in the zsh(1) and related man pages.

zsh

zsh is a shell which has command-line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and a host of other features.

Package information

• Download (HTTP): http://www.openssl.org/source/openssl-0.9.7c.tar.gz

• Download (FTP): ftp://ftp.openssl.org/source/openssl-0.9.7c.tar.gz

• Download size: 2.7 MB

• Estimated Disk space required: 25.8 MB

• Estimated build time: 3.35 SBU

Additional downloads

• Man page patch (HTTP): http://www.linuxfromscratch.org/patches/blfs/5.0/openssl-0.9.7c-manpages.patch

Config files

/etc/ssl/openssl.cnf

Configuration Information

Most people who just want to use openssl for providing functions to other programs such as OpenSSH and web browsers won't need to worry about configuring OpenSSL. Configuring OpenSSL is an advanced topic and so those who do would normally be expected to either know how to do it or to be able to find out how to do it.

c_rehash

c_rehash is a Perl script that scans all files in a directory and adds symbolic links to their hash values.

openssl

The openssl program is a command-line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for various functions which are documented in man 1 openssl.

libcrypto

The OpenSSL crypto library implements a wide range of cryptographic algorithms used in various Internet standards. The services provided by this library are used by the OpenSSL implementations of SSL, TLS and S/MIME, and they have also been used to implement OpenSSH, OpenPGP , and other cryptographic standards.

libssl

The OpenSSL SSL library implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols. It provides a rich API, documentation on which can be found by running man 3 ssl.

Package information

• Download (HTTP): http://keihanna.dl.sourceforge.net/sourceforge/pcre/pcre-4.3.tar.bz2

• Download (FTP): ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-4.3.tar.bz2

• Download size: 336 KB

• Estimated Disk space required: 2.8 MB

• Estimated build time: 0.19 SBU

pcregrep

pcregrep is a grep that understands Perl compatible regular expressions.

pcretest

pcretest can test your Perl compatible regular expression.

pcre-config

pcre-config is used during the compile process of programs linking to this library.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/utils/rpm.org/dist/rpm-4.1.x/popt-1.7.tar.gz

• Download (FTP): ftp://ftp.rpm.org/pub/rpm/dist/rpm-4.1.x/popt-1.7.tar.gz

• Download size: 200 KB

• Estimated Disk space required: 4 MB

• Estimated build time: 0.06 SBU

popt library

The popt library is used to parse command-line options.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/editors/davis/slang/v1.4/slang-1.4.9.tar.bz2

• Download (FTP): ftp://space.mit.edu/pub/davis/slang/v1.4/slang-1.4.9.tar.bz2

• Download size: 624 KB

• Estimated Disk space required: 9.6 MB

• Estimated build time: 0.16 SBU

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory i.e. /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

Package information

• Download (HTTP): http://oss.sgi.com/projects/fam/download/fam-2.6.10.tar.gz

• Download (FTP): ftp://oss.sgi.com/projects/fam/download/fam-2.6.10.tar.gz

• Download size: 320 KB

• Estimated Disk space required: 6.9 MB

• Estimated build time: 0.68 SBU

Additional downloads

• Dnotify patch (HTTP): http://www.linuxfromscratch.org/patches/blfs/5.0/fam-2.6.10-dnotify.patch

FAM dependencies

Config files

/etc/rpc, /etc/fam.conf, /etc/inetd.conf, /etc/xinetd.d/fam or /etc/xinetd.conf

Configuration Information

Configuring the file alteration monitor.

If you use inetd, add the FAM entry to /etc/inetd.conf with the following command:

echo "sgi_fam/1-2 stream  rpc/tcp wait root /usr/bin/fam fam" >> /etc/inetd.conf

If you use xinetd, add an entry to /etc/xinetd.conf with the following command (be sure the "nogroup" group exists):

cat >> /etc/xinetd.conf << "EOF"
    # description: FAM - file alteration monitor
    service sgi_fam
    {
        type            = RPC UNLISTED
        socket_type     = stream
        user            = root
        group           = nogroup
        server          = /usr/bin/fam
        wait            = yes
        protocol        = tcp
        rpc_version     = 2
        rpc_number      = 391002
    }
EOF

fam

fam is the file alteration monitor.

Package information

• Download (HTTP): http://ftp.gnome.org/pub/GNOME/sources/libxml/1.8/libxml-1.8.17.tar.bz2

• Download (FTP): ftp://ftp.xmlsoft.org/old/libxml-1.8.17.tar.gz

• Download size: 973 KB

• Estimated Disk space required: 11 MB

• Estimated build time: 0.41 SBU

libxml libraries

libxml libraries provide the functions for programs to parse files that use the XML format.

Package information

• Download (HTTP): http://ftp.gnome.org/pub/GNOME/sources/libxml2/2.5/libxml2-2.5.11.tar.bz2

• Download (FTP): ftp://ftp.xmlsoft.org/libxml2-2.5.11.tar.gz

• Download size: 2.9 MB

• Estimated Disk space required: 41.8 MB

• Estimated build time: 0.97 SBU

libxml2 dependencies

libxml2 libraries

libxml2 libraries provide the functions for programs to parse files that use the XML format.

xmllint

xmllint parses XML files and outputs reports (based upon options) to detect errors in XML coding.

xmlcatalog

xmlcatalog allows users to monitor and manipulate XML and SGML catalogs.

Package information

• Download (HTTP): http://ftp.gnome.org/pub/GNOME/sources/libxslt/1.0/libxslt-1.0.33.tar.bz2

• Download (FTP): ftp://ftp.xmlsoft.org/libxslt-1.0.33.tar.gz

• Download size: 2.3 M

• Estimated Disk space required: 30 MB

• Estimated build time: 0.29 SBU

libxslt dependencies

libxslt libraries

libxslt libraries provide extensions to the libxml2 libraries to parse files that use the XSLT format.

xsltproc

xsltproc is used to apply XSLT stylesheets to XML documents.

Package information

• Download (HTTP): http://ftp.gnu.org/gnu/readline/readline-4.3.tar.gz

• Download (FTP): ftp://ftp.gnu.org/gnu/readline/readline-4.3.tar.gz

• Download size: 944 KB

• Estimated Disk space required: 9.2 MB

• Estimated build time: 0.10 SBU

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory i.e. /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

Package information

• Download (HTTP): http://www.ibiblio.org/pub/gnu/gmp/gmp-4.1.2.tar.bz2

• Download (FTP): ftp://ftp.gnu.org/gnu/gmp/gmp-4.1.2.tar.bz2

• Download size: 1.6 MB

• Estimated Disk space required: 29.0 MB

• Estimated build time: 0.86 SBU

GMP dependencies

gmp libraries

libgmp libraries contain the functions to operate on signed integers, rational numbers, and floating point numbers.

Package information

• Download (HTTP): http://www.ibiblio.org/pub/gnu/gdbm/gdbm-1.8.3.tar.gz

• Download (FTP): ftp://ftp.gnu.org/gnu/gdbm/gdbm-1.8.3.tar.gz

• Download size: 228 KB

• Estimated Disk space required: 4.1 MB

• Estimated build time: 0.08 SBU

gdbm libraries

libgdbm libraries contain functions that perform database routines using extendible hashing.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/graphics/gimp/gtk/v1.2/glib-1.2.10.tar.gz

• Download (FTP): ftp://ftp.gtk.org/pub/gtk/v1.2/glib-1.2.10.tar.gz

• Download size: 412 KB

• Estimated Disk space required: 7 MB

• Estimated build time: 0.26 SBU

GLib libraries

GLib libraries contain a low-level core library for the GIMP Toolkit.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/graphics/gimp/gtk/v2.2/glib-2.2.3.tar.bz2

• Download (FTP): ftp://ftp.gtk.org/pub/gtk/v2.2/glib-2.2.3.tar.bz2

• Download size: 1.6 MB

• Estimated Disk space required: 23.3 MB

• Estimated build time: 0.49 SBU

GLib dependencies

GLib libraries

GLib libraries contain a low-level core library for the GIMP Toolkit.

Package information

• Download (HTTP): http://umn.dl.sourceforge.net/sourceforge/expat/expat-1.95.6.tar.gz

• Download (FTP): ftp://ftp.yars.free.net/pub/software/unix/util/xml/expat-1.95.6.tar.gz

• Download size: 292 KB

• Estimated Disk space required: 3.2 MB

• Estimated build time: 0.25 SBU

Additional downloads

• Required Patch: http://www.linuxfromscratch.org/patches/blfs/5.0/expat-1.95.6-fix-declaration-order.patch

xmlwf

xmlwf is a non-validating utility to check whether or not XML documents are well formed.

Package information

• Download (HTTP): http://www.stafford.uklinux.net/libesmtp/libesmtp-1.0.tar.bz2

• Download (FTP):

• Download size: 232 KB

• Estimated Disk space required: 5.0 MB

• Estimated build time: 0.15 SBU

libesmtp library

The libesmtp library is used to manage submission of electronic mail to a Mail Transport Agent.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/gnu/gnusrc/aspell/aspell-0.50.3.tar.gz

• Download (FTP): ftp://ftp.gnu.org/gnu/aspell/aspell-0.50.3.tar.gz

• Download size: 917 KB

• Estimated Disk space required: 9.4 MB

• Estimated build time: 0.54 SBU

Additional downloads

• Required patch (HTTP): http://www.linuxfromscratch.org/patches/blfs/5.0/aspell-0.50.3-gcc33-1.patch

Configuration Information

After Aspell is installed at least one dictionary needs to be installed. You can find them at http://aspell.net/.

Install your dictionary or dictionaries by running the following commands:

./configure &&
make &&
make install

aspell library

The libaspell library is a spell checking library interface.

Package information

• Download (HTTP): http://membled.com/work/patches/ispell/ispell-3.2.06.epa6.tar.bz2

• Download (FTP):

• Download size: 1.2 MB

• Estimated Disk space required: 11 MB

• Estimated build time: 0.03 SBU

Package information

• Download (HTTP): http://ftp.gnu.org/pub/gnu/guile/guile-1.6.4.tar.gz

• Download (FTP): ftp://ftp.gnu.org/pub/gnu/guile/guile-1.6.4.tar.gz

• Download size: 2.7 MB

• Estimated Disk space required: 30 MB

• Estimated build time: 0.79 SBU

Guile dependencies

guile

guile is a stand-alone scheme interpreter for Guile.

guile-config

guile-config is a Guile script which provides the information necessary to link your programs against the Guile library, in much the same way pkgconfig-0.15.0 does.

guile-snarf

guile-snarf a script to parse declarations in your C code for Scheme visible C functions, Scheme objects to be used by C code, etc.

Package information

• Download (HTTP): http://www.swiss.ai.mit.edu/ftpdir/scm/slib2d6.tar.gz

• Download (FTP):

• Download size: 636 KB

• Estimated Disk space required: 2.9 MB

• Estimated build time: 0.00 SBU

slib dependencies

Package information

• Download (HTTP): http://www.gnucash.org/pub/g-wrap/source/g-wrap-1.3.4.tar.gz

• Download (FTP):

• Download size: 400 KB

• Estimated Disk space required: 4.6 MB

• Estimated build time: 0.09

G-wrap dependencies

g-wrap-config

g-wrap-config is a tool to generate CFLAGS for linking C code to the Scheme runtime libraries.

Package information

• Download (HTTP): http://www.oberhumer.com/opensource/lzo/download/lzo-1.08.tar.gz

• Download (FTP): http://ftp.uni-koeln.de/util/arc/lzo-1.08.tar.gz

• Download size: 421 KB

• Estimated Disk space required: 5.4 MB

• Estimated build time: 0.22 SBU

liblzo

liblzo is a data compression and decompression library.

Package information

• Download (HTTP): http://www.littlecms.com/lcms-1.11.tar.gz

• Download (FTP): ftp://sunsite.ccu.edu.tw/pub12/sourceforge/l/lcms/lcms-1.11.tar.gz

• Download size: 276 KB

• Estimated Disk space required: 8.5 MB

• Estimated build time: 0.19 SBU

lcms dependencies

liblcms library

The liblcms libraries are used by other programs to provide color management facilities.

icc2ps

icc2ps generates PostScript CRD or CSA from ICC profiles.

icclink

icclink links two or more profiles into a single device link profile.

icctrans

icctrans is a Color Space conversion calculator.

tifficc

tifficc is an ICC profile applier for TIFF files.

jpegicc

jpegicc is an ICC profile applier for JPEG files.

Package information

• Download (HTTP): http://www.ijg.org/files/jpegsrc.v6b.tar.gz

• Download (FTP): ftp://ftp.uu.net/graphics/jpeg/jpegsrc.v6b.tar.gz

• Download size: 599 KB

• Estimated Disk space required: 3.7 MB

• Estimated build time: 0.51 SBU

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory i.e. /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

cjpeg

cjpeg compresses image files to produce a JPEG/JFIF file on the standard output. Currently supported input file formats are: PPM (PBMPLUS color format), PGM (PBMPLUS gray-scale format), BMP, and Targa.

djpeg

djpeg decompresses image files from JPEG/JFIF format to either PPM (PBMPLUS color format), PGM (PBMPLUS gray-scale format), BMP, or Targa format.

jpegtran

jpegtran is used for lossless transformation of JPEG files.

rdjpgcom

rdjpgcom displays text comments from within a JPEG file.

wrjpgcom

wrjpgcom inserts text comments into a JPEG file.

jpeg libraries

These libraries are used by many programs for reading and writing jpeg format files.

Package information

• Download (HTTP): http://telia.dl.sourceforge.net/sourceforge/libpng/libpng-1.2.5.tar.bz2

• Download (FTP): ftp://ftp.iasi.roedu.net/pub/mirrors/ftp.gimp.org/gimp/libs/libpng-1.2.5.tar.bz2

• Download size: 376 KB

• Estimated Disk space required: 4.1 MB

• Estimated build time: 0.16

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory i.e. /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

png libraries

The PNG library is a collection of routines used to create and manipulate PNG format graphics files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

libpng-config

libpng-config provides configuration info for libpng.

Package information

• Download (HTTP): http://gd.tuwien.ac.at/hci/windowmaker/libs/tiff-v3.5.7.tar.gz

• Download (FTP): ftp://ftp.remotesensing.org/pub/libtiff/tiff-v3.5.7.tar.gz

• Download size: 928 KB

• Estimated Disk space required: 5.9 MB

• Estimated build time: 0.26 SBU

Additional downloads

• Download (HTTP): http://www.linuxfromscratch.org/patches/blfs/5.0/tiff-3.6.0-tiffio.patch

Configuration Information

As with most libraries, there is no configuration to do, save that the library directory i.e. /opt/lib or /usr/local/lib should appear in /etc/ld.so.conf so that ldd can find the shared libraries. After checking that this is the case, /sbin/ldconfig should be run while logged in as root.

fax2ps

fac2ps converts a TIFF facsimile to compressed PostScript file.

fax2tiff

fax2tiff creates a TIFF Class F fax file from raw fax data.

gif2tiff

gif2tiff creates a TIFF file from a GIF87 format image file.

pal2rgb

pal2rgb converts a palette color TIFF image to a full color image.

ppm2tiff

ppm2tiff creates a TIFF file from a PPM image file.

ras2tiff

ras2tiff creates a TIFF file from a Sun rasterfile.

rgb2ycbcr

rgb2ycbcr converts non-YCbCr TIFF images to a YCbCr TIFF image.

thumbnail

thumbnail creates a TIFF file with thumbnail images.

tiff2bw

tiff2bw converts a color TIFF image to grayscale.

tiff2ps

tiff2ps converts a TIFF image to a PostScript file.

tiff2rgba

No description available.

tiffcmp

tiffcmp compares two TIFF files.

tiffcp

tiffcp copies (and possibly converts) a TIFF file.

tiffdither

tiffdither converts a grayscale image to bilevel using dithering.

tiffdump

tiffdump prints verbatim information about TIFF files.

tiffinfo

tiffinfo prints information about TIFF files.

tiffmedian

tiffmedian applies the median cut algorithm to data in a TIFF file.

tiffsplit

tiffsplit splits a multi-image TIFF into single-image TIFF files.

tiff libraries

The tiff libraries are used by many programs to read and write tiff files.

Package information

• Download (HTTP): http://www.linuxpackages.net/packages/Slackware-8/robert/libungif-4.1.0b1/source/libungif-4.1.0b1.tar.gz

• Download (FTP): ftp://ftp.sunfreeware.com/pub/freeware/SOURCES/libungif-4.1.0b1.tar.gz

• Download size: 343 KB

• Estimated Disk space required: 3.1 MB

• Estimated build time: 0.11 SBU

Additional downloads

• Required patch: http://www.linuxfromscratch.org/patches/blfs/5.0/libungif-4.1.0b1-va_start.patch

gif2epsn

Dumps images saved as GIF files on Epson type printers.

gif2ps

Print GIF file on laser printers supporting PostScript.

gif2rgb

Convert images saved as GIF to 24-bit RGB image(s).

gifasm

assemble multiple GIFs into one, or burst a multiple-image GIF.

gifbg

Generate a single-color test pattern GIF.

gifburst

Burst a GIF image into subrectangles.

gifclip

Clip or crop a GIF image.

gifclrmp

Modify GIF image colormaps.

gifcolor

Generate color test patterns.

gifcomb

Combine 2 GIF images of exactly the same size into one.

gifcompose

Use (un)giflib tools to compose images.

giffiltr

Template code for filtering a GIF sequentially.

giffix

Clumsily attempts to fix truncated GIF images.

gifflip

Flip GIF image along X or Y axis or rotate by 90 degrees.

gifhisto

Generate color-frequency histogram from a GIF.

gifinfo

Gives information on a GIF file.

gifinter

Convert between interlaced and non interlaced images.

gifinto

End-of-pipe fitting for GIF-processing pipelines.

gifovly

Generate one composite GIF from a multiple-image GIF.

gifpos

Change a GIF's screen size or recondition it.

gifrotat

Rotate a GIF through any desired angle.

gifrsize

Resize a GIF by deletion or duplication of bits.

gifspnge

Template code for filtering a GIF with in-core operations.

giftext

Print (text only) general information about a GIF.

gifwedge

Create a test GIF image resembling a color monitor test pattern.

icon2gif

Converter/deconverter to/from an editable text format.

raw2gif

Convert raw 8-bit image data into GIF files.

rgb2gif

Convert 24 bit images to a GIF image using color quantization.

text2gif

Generate GIF images out of regular text in 8x8 font.

Package information

• Download (HTTP): http://www.mirror.ac.uk/sites/download.sourceforge.net/pub/sourceforge/libmng/libmng-1.0.5.tar.gz

• Download (FTP): ftp://unc.dl.sf.net/pub/sourceforge/libmng/libmng-1.0.5.tar.gz

• Download size: 616 KB

• Estimated Disk space required: 12.4 MB

• Estimated build time: 0.31 SBU

template dependencies

MNG libraries

libmng provides functions for programs wishing to read and write MNG files which are animation files without the patent problems associated with certain other formats.

Package information

• Download (HTTP): http://ftp.gnome.org/pub/GNOME/sources/imlib/1.9/imlib-1.9.14.tar.bz2

• Download (FTP): ftp://ftp.gnome.org/pub/GNOME/sources/imlib/1.9/imlib-1.9.14.tar.bz2

• Download size: 580 KB

• Estimated Disk space required: 16.4 MB

• Estimated build time: 0.43 SBU

Imlib dependencies