From owner-svn-doc-projects@FreeBSD.ORG  Mon Apr 29 12:44:23 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id D4920923;
 Mon, 29 Apr 2013 12:44:23 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id C65661266;
 Mon, 29 Apr 2013 12:44:23 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r3TCiNE7004917;
 Mon, 29 Apr 2013 12:44:23 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r3TCiN1H004916;
 Mon, 29 Apr 2013 12:44:23 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201304291244.r3TCiN1H004916@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Mon, 29 Apr 2013 12:44:23 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41513 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Apr 2013 12:44:23 -0000

Author: dru
Date: Mon Apr 29 12:44:22 2013
New Revision: 41513
URL: http://svnweb.freebsd.org/changeset/doc/41513

Log:
  First pass through this chapter. Due to its size, patch only addresses first 1/2 of chapter, fixing the following:
  
  - &os;
  
  - etc and you
  
  - some acronym tags
  
  - general tightening and grammo fixing
  
  - removed note in 15.3 as this belongs in preface, not in a chapter
  
  - fixed filesystems (which bled over into other part of chapter)
  
  Approved by:  gjb (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Sat Apr 27 14:18:12 2013	(r41512)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Mon Apr 29 12:44:22 2013	(r41513)
@@ -24,31 +24,27 @@
   <sect1 id="security-synopsis">
     <title>Synopsis</title>
 
-    <para>This chapter will provide a basic introduction to system
+    <para>This chapter provides a basic introduction to system
       security concepts, some general good rules of thumb, and some
-      advanced topics under &os;.  A lot of the topics covered here
-      can be applied to system and Internet security in general as
-      well.  The Internet is no longer a <quote>friendly</quote> place
-      in which everyone wants to be your kind neighbor.  Securing your
-      system is imperative to protect your data, intellectual
-      property, time, and much more from the hands of hackers and the
-      like.</para>
-
-    <para>&os; provides an array of utilities and mechanisms to ensure
-      the integrity and security of your system and network.</para>
+      advanced topics under &os;.  Many of the topics covered here
+      can be applied to system and Internet security in general. 
+      Securing a system is imperative to protect data,
+      intellectual property, time, and much more from the hands of
+      hackers and the like.</para>
+
+    <para>&os; provides an array of utilities and mechanisms to
+      protect the integrity and security of the system and
+      network.</para>
 
     <para>After reading this chapter, you will know:</para>
 
     <itemizedlist>
       <listitem>
-	<para>Basic system security concepts, in respect to
-	  &os;.</para>
+	<para>Basic &os; system security concepts.</para>
       </listitem>
 
       <listitem>
-	<para>About the various crypt mechanisms available in &os;,
-	  such as <acronym>DES</acronym> and
-	  <acronym>MD5</acronym>.</para>
+	<para>The various crypt mechanisms available in &os;.</para>
       </listitem>
 
       <listitem>
@@ -61,41 +57,37 @@
       </listitem>
 
       <listitem>
-	<para>How to set up <application>Kerberos5</application> on
+	<para>How to set up <application>Kerberos</application> on
 	  &os;.</para>
       </listitem>
 
       <listitem>
 	<para>How to configure IPsec and create a
-	  <acronym>VPN</acronym> between &os;/&windows;
-	  machines.</para>
+	  <acronym>VPN</acronym>.</para>
       </listitem>
 
       <listitem>
 	<para>How to configure and use
-	  <application>OpenSSH</application>, &os;'s
-	  <acronym>SSH</acronym> implementation.</para>
+	  <application>OpenSSH</application> on &os;.</para>
       </listitem>
 
       <listitem>
-	<para>What file system <acronym>ACL</acronym>s are and how to
-	  use them.</para>
+	<para>How to use filesystem <acronym>ACL</acronym>s.</para>
       </listitem>
 
       <listitem>
-	<para>How to use the <application>Portaudit</application>
-	  utility to audit third party software packages installed
-	  from the Ports Collection.</para>
+	<para>How to use <application>portaudit</application> to
+	  audit third party software packages installed from the
+	  Ports Collection.</para>
       </listitem>
 
       <listitem>
-	<para>How to utilize the &os; security advisories
-	  publications.</para>
+	<para>How to utilize &os; security advisories.</para>
       </listitem>
 
       <listitem>
-	<para>Have an idea of what Process Accounting is and how to
-	  enable it on &os;.</para>
+	<para>What Process Accounting is and how to enable it on
+	  &os;.</para>
       </listitem>
     </itemizedlist>
 
@@ -107,36 +99,26 @@
       </listitem>
     </itemizedlist>
 
-    <para>Additional security topics are covered throughout this book.
-      For example, Mandatory Access Control is discussed in <xref
-	linkend="mac"/> and Internet Firewalls are discussed in <xref
-	linkend="firewalls"/>.</para>
+    <para>Additional security topics are covered elsewhere in this
+      Handbook.  For example, Mandatory Access Control is discussed in
+      <xref linkend="mac"/> and Internet firewalls are discussed in
+      <xref linkend="firewalls"/>.</para>
   </sect1>
 
   <sect1 id="security-intro">
     <title>Introduction</title>
 
     <para>Security is a function that begins and ends with the system
-      administrator.  While all BSD &unix; multi-user systems have
-      some inherent security, the job of building and maintaining
-      additional security mechanisms to keep those users
-      <quote>honest</quote> is probably one of the single largest
-      undertakings of the sysadmin.  Machines are only as secure as
-      you make them, and security concerns are ever competing with the
-      human necessity for convenience.  &unix; systems, in general,
-      are capable of running a huge number of simultaneous processes
-      and many of these processes operate as servers &mdash; meaning
-      that external entities can connect and talk to them.  As
-      yesterday's mini-computers and mainframes become today's
-      desktops, and as computers become networked and inter-networked,
-      security becomes an even bigger issue.</para>
+      administrator.  While &os; provides some inherent security, the
+      job of configuring and maintaining additional security
+      mechanisms is probably one of the single largest undertakings of
+      the sysadmin.</para>
 
     <para>System security also pertains to dealing with various forms
       of attack, including attacks that attempt to crash, or otherwise
       make a system unusable, but do not attempt to compromise the
-      <username>root</username> account (<quote>break root</quote>).
-      Security concerns can be split up into several
-      categories:</para>
+      <username>root</username> account.  Security concerns can be
+      split up into several categories:</para>
 
     <orderedlist>
       <listitem>
@@ -148,7 +130,7 @@
       </listitem>
 
       <listitem>
-	<para>Root compromise through accessible servers.</para>
+	<para>Root compromise through accessible services.</para>
       </listitem>
 
       <listitem>
@@ -171,50 +153,36 @@
     </indexterm>
     <indexterm><primary>Denial of Service (DoS)</primary></indexterm>
 
-    <para>A denial of service attack is an action that deprives the
-      machine of needed resources.  Typically, DoS attacks are
-      brute-force mechanisms that attempt to crash or otherwise make a
-      machine unusable by overwhelming its servers or network stack.
-      Some DoS attacks try to take advantage of bugs in the networking
-      stack to crash a machine with a single packet.  The latter can
-      only be fixed by applying a bug fix to the kernel.  Attacks on
-      servers can often be fixed by properly specifying options to
+    <para>A Denial of Service <acronym>DoS</acronym> attack is an
+      action that deprives the machine of needed resources.
+      Typically, <acronym>DoS</acronym> attacks are brute-force
+      mechanisms that attempt to crash or otherwise make a machine
+      unusable by overwhelming its services or network stack.  Attacks
+      on servers can often be fixed by properly specifying options to
       limit the load the servers incur on the system under adverse
       conditions.  Brute-force network attacks are harder to deal
-      with.  A spoofed-packet attack, for example, is nearly
-      impossible to stop, short of cutting your system off from the
-      Internet.  It may not be able to take your machine down, but it
-      can saturate your Internet connection.</para>
+      with.  This type of attack may not be able to take the machine
+      down, but it can saturate the Internet connection.</para>
 
     <indexterm>
       <primary>security</primary>
       <secondary>account compromises</secondary>
     </indexterm>
 
-    <para>A user account compromise is even more common than a DoS
-      attack.  Many sysadmins still run standard
-      <application>telnetd</application>,
-      <application>rlogind</application>,
-      <application>rshd</application>, and
-      <application>ftpd</application> servers on their machines.
-      These servers, by default, do not operate over encrypted
-      connections.  The result is that if you have any moderate-sized
-      user base, one or more of your users logging into your system
-      from a remote location (which is the most common and convenient
-      way to login to a system) will have his or her password sniffed.
-      The attentive system admin will analyze his remote access logs
-      looking for suspicious source addresses even for successful
-      logins.</para>
-
-    <para>One must always assume that once an attacker has access to a
-      user account, the attacker can break <username>root</username>.
-      However, the reality is that in a well secured and maintained
-      system, access to a user account does not necessarily give the
-      attacker access to <username>root</username>.  The distinction
-      is important because without access to <username>root</username>
-      the attacker cannot generally hide his tracks and may, at best,
-      be able to do nothing more than mess with the user's files, or
-      crash the machine.  User account compromises are very common
+    <para>A user account compromise is more common than a
+      <acronym>DoS</acronym> attack.  Many sysadmins still run
+      unencrypted services, meaning that users logging into the
+      system from a remote location are vulnerable to having their
+      password sniffed.  The attentive sysadmin analyzes the
+      remote access logs looking for suspicious source addresses and
+      suspicious logins.</para>
+
+    <para>In a well secured and maintained system, access to a user
+      account does not necessarily give the attacker access to
+      <username>root</username>.  Without <username>root</username>
+      access, the attacker cannot generally hide his tracks and may,
+      at best, be able to do nothing more than mess with the user's
+      files or crash the machine.  User account compromises are common
       because users tend not to take the precautions that sysadmins
       take.</para>
 
@@ -223,27 +191,14 @@
       <secondary>backdoors</secondary>
     </indexterm>
 
-    <para>System administrators must keep in mind that there are
-      potentially many ways to break <username>root</username> on a
-      machine.  The attacker may know the <username>root</username>
-      password, the attacker may find a bug in a root-run server and
-      be able to break <username>root</username> over a network
-      connection to that server, or the attacker may know of a bug in
-      a suid-root program that allows the attacker to break
-      <username>root</username> once he has broken into a user's
-      account.  If an attacker has found a way to break
-      <username>root</username> on a machine, the attacker may not
-      have a need to install a backdoor.  Many of the
-      <username>root</username> holes found and closed to date involve
-      a considerable amount of work by the attacker to cleanup after
-      himself, so most attackers install backdoors.  A backdoor
-      provides the attacker with a way to easily regain
-      <username>root</username> access to the system, but it also
-      gives the smart system administrator a convenient way to detect
-      the intrusion.  Making it impossible for an attacker to install
-      a backdoor may actually be detrimental to your security, because
-      it will not close off the hole the attacker found to break in
-      the first place.</para>
+    <para>There are potentially many ways to break
+      <username>root</username>:  the attacker may know the
+      <username>root</username> password, the attacker may exploit a
+      bug in a service which runs as <username>root</username>, or the
+      attacker may know of a bug in a SUID-root program.  An attacker
+      may utilize a program known as a backdoor to search for
+      vulnerable systems, take advantage of unpatched exploits to
+      access a system, and hide traces of illegal activity.</para>
 
     <para>Security remedies should always be implemented with a
       multi-layered <quote>onion peel</quote> approach and can be
@@ -251,26 +206,26 @@
 
     <orderedlist>
       <listitem>
-	<para>Securing <username>root</username> and staff
+	<para>Secure <username>root</username> and staff
 	  accounts.</para>
       </listitem>
 
       <listitem>
-	<para>Securing <username>root</username>&ndash;run servers
-	  and suid/sgid binaries.</para>
+	<para>Secure <username>root</username>&ndash;run servers
+	  and SUID/SGID binaries.</para>
       </listitem>
 
       <listitem>
-	<para>Securing user accounts.</para>
+	<para>Secure user accounts.</para>
       </listitem>
 
       <listitem>
-	<para>Securing the password file.</para>
+	<para>Secure the password file.</para>
       </listitem>
 
       <listitem>
-	<para>Securing the kernel core, raw devices, and
-	  file systems.</para>
+	<para>Secure the kernel core, raw devices, and
+	  filesystems.</para>
       </listitem>
 
       <listitem>
@@ -283,8 +238,7 @@
       </listitem>
     </orderedlist>
 
-    <para>The next section of this chapter will cover the above bullet
-      items in greater depth.</para>
+    <para>The next section covers these items in greater depth.</para>
   </sect1>
 
   <sect1 id="securing-freebsd">
@@ -295,254 +249,141 @@
       <secondary>securing &os;</secondary>
     </indexterm>
 
-    <note>
-      <title>Command Versus Protocol</title>
-
-      <para>Throughout this document, we will use
-	<application>bold</application> text to refer to an
-	application, and a <command>monospaced</command> font to refer
-	to specific commands.  Protocols will use a normal font.  This
-	typographical distinction is useful for instances such as ssh,
-	since it is a protocol as well as command.</para>
-    </note>
-
-    <para>The sections that follow will cover the methods of securing
-      your &os; system that were mentioned in the <link
-	linkend="security-intro">last section</link> of this
-      chapter.</para>
+    <para>This section describes methods for securing a &os; system
+      against the attacks that were mentioned in the <link
+	linkend="security-intro">previous section</link>.</para>
 
     <sect2 id="securing-root-and-staff">
-      <title>Securing the <username>root</username> Account and
-	Staff Accounts</title>
+      <title>Securing the <username>root</username> Account</title>
 
       <indexterm>
 	<primary><command>su</command></primary>
       </indexterm>
 
-      <para>First off, do not bother securing staff accounts if you
-	have not secured the <username>root</username> account.  Most
+      <para>Most
 	systems have a password assigned to the
-	<username>root</username> account.  The first thing you do is
-	assume that the password is <emphasis>always</emphasis>
-	compromised.  This does not mean that you should remove the
-	password.  The password is almost always necessary for console
-	access to the machine.  What it does mean is that you should
-	not make it possible to use the password outside of the
-	console or possibly even with the &man.su.1; command.  For
-	example, make sure that your ptys are specified as being
-	insecure in the <filename>/etc/ttys</filename> file so that
-	direct <username>root</username> logins via
-	<command>telnet</command> or <command>rlogin</command> are
-	disallowed.  If using other login services such as
-	<application>sshd</application>, make sure that direct
-	<username>root</username> logins are disabled there as well.
-	You can do this by editing your
-	<filename>/etc/ssh/sshd_config</filename> file, and making
-	sure that <literal>PermitRootLogin</literal> is set to
-	<literal>no</literal>.  Consider every access method &mdash;
-	services such as FTP often fall through the cracks.  Direct
-	<username>root</username> logins should only be allowed via
-	the system console.</para>
+	<username>root</username> account.  Assume that this password
+	is <emphasis>always</emphasis> at risk of being compromised.
+	This does not mean that the password should be disabled as the
+	password is almost always necessary for console access to the
+	machine.  However, it should not be possible to use this
+	password outside of the console or possibly even with
+	&man.su.1;.  For example, setting the entries in
+	<filename>/etc/ttys</filename> to <literal>insecure</literal>
+	prevents <username>root</username> logins to the specified
+	terminals.  In &os;, <username>root</username> logins using
+	&man.ssh.1; are disabled by default as
+	<literal>PermitRootLogin</literal> is set to
+	<literal>no</literal> in
+	<filename>/etc/ssh/sshd_config</filename>.  Consider every
+	access method as services such as FTP often fall through the
+	cracks.  Direct <username>root</username> logins should only
+	be allowed via the system console.</para>
 
       <indexterm>
 	<primary><groupname>wheel</groupname></primary>
       </indexterm>
 
-      <para>Of course, as a sysadmin you have to be able to get to
-	<username>root</username>, so we open up a few holes.  But we
-	make sure these holes require additional password verification
-	to operate.  One way to make <username>root</username>
-	accessible is to add appropriate staff accounts to the
-	<groupname>wheel</groupname> group (in
-	<filename>/etc/group</filename>).  The staff members placed in
-	the <groupname>wheel</groupname> group are allowed to
-	<command>su</command> to <username>root</username>.  You
-	should never give staff members native
-	<groupname>wheel</groupname> access by putting them in the
-	<groupname>wheel</groupname> group in their password entry.
-	Staff accounts should be placed in a
-	<groupname>staff</groupname> group, and then added to the
-	<groupname>wheel</groupname> group via the
-	<filename>/etc/group</filename> file.  Only those staff
-	members who actually need to have <username>root</username>
-	access should be placed in the <groupname>wheel</groupname>
-	group.  It is also possible, when using an authentication
-	method such as Kerberos, to use Kerberos'
-	<filename>.k5login</filename> file in the
-	<username>root</username> account to allow a &man.ksu.1; to
-	<username>root</username> without having to place anyone at
-	all in the <groupname>wheel</groupname> group.  This may be
-	the better solution since the <groupname>wheel</groupname>
-	mechanism still allows an intruder to break
-	<username>root</username> if the intruder has gotten hold of
-	your password file and can break into a staff account.  While
-	having the <groupname>wheel</groupname> mechanism is better
-	than having nothing at all, it is not necessarily the safest
-	option.</para>
+      <para>Since a sysadmin needs access to
+	<username>root</username>, additional password verification
+	should be configured.  One method is to add appropriate user
+	accounts to <groupname>wheel</groupname> in
+	<filename>/etc/group</filename>.  Members of
+	<groupname>wheel</groupname> are allowed to
+	&man.su.1; to <username>root</username>.  Only
+	those users who actually need to have
+	<username>root</username> access should be placed in
+	<groupname>wheel</groupname>.  When using Kerberos for
+	authentication, create a <filename>.k5login</filename> in
+	the home directory of <username>root</username> to allow
+	&man.ksu.1; to be used without having to place anyone in
+	<groupname>wheel</groupname>.</para>
 
-      <para>To lock an account completely, the &man.pw.8; command
-	should be used:</para>
+      <para>To lock an account completely, use &man.pw.8;:</para>
 
       <screen>&prompt.root; <userinput>pw lock <replaceable>staff</replaceable></userinput></screen>
 
-      <para>This will prevent the user from logging in using any
-	mechanism, including &man.ssh.1;.</para>
+      <para>This will prevent the specified user from logging in using
+	any mechanism, including &man.ssh.1;.</para>
 
       <para>Another method of blocking access to accounts would be to
 	replace the encrypted password with a single
 	<quote><literal>*</literal></quote> character.  This character
-	would never match the encrypted password and thus block user
-	access.  For example, the following staff account:</para>
+	would never match the encrypted password and thus blocks user
+	access.  For example, the entry for the following
+	account:</para>
 
       <programlisting>foobar:R9DT/Fa1/LV9U:1000:1000::0:0:Foo Bar:/home/foobar:/usr/local/bin/tcsh</programlisting>
 
-      <para>Should be changed to this:</para>
+      <para>could be changed to this using &man.vipw.8;:</para>
 
       <programlisting>foobar:*:1000:1000::0:0:Foo Bar:/home/foobar:/usr/local/bin/tcsh</programlisting>
 
-      <para>This will prevent the <username>foobar</username> user
-	from logging in using conventional methods.  This method for
-	access restriction is flawed on sites using
+      <para>This prevents <username>foobar</username> from logging in
+	using conventional methods.  This method for access
+	restriction is flawed on sites using
 	<application>Kerberos</application> or in situations where the
 	user has set up keys with &man.ssh.1;.</para>
 
-      <para>These security mechanisms also assume that you are logging
+      <para>These security mechanisms assume that users are logging
 	in from a more restrictive server to a less restrictive
-	server.  For example, if your main box is running all sorts of
-	servers, your workstation should not be running any.  In order
-	for your workstation to be reasonably secure you should run as
-	few servers as possible, up to and including no servers at
-	all, and you should run a password-protected screen blanker.
-	Of course, given physical access to a workstation an attacker
-	can break any sort of security you put on it.  This is
-	definitely a problem that you should consider, but you should
-	also consider the fact that the vast majority of break-ins
-	occur remotely, over a network, from people who do not have
-	physical access to your workstation or servers.</para>
-
-      <para>Using something like Kerberos also gives you the ability
-	to disable or change the password for a staff account in one
-	place, and have it immediately affect all the machines on
-	which the staff member may have an account.  If a staff
-	member's account gets compromised, the ability to instantly
-	change his password on all machines should not be underrated.
-	With discrete passwords, changing a password on N machines can
-	be a mess.  You can also impose re-passwording restrictions
-	with Kerberos: not only can a Kerberos ticket be made to
-	timeout after a while, but the Kerberos system can require
-	that the user choose a new password after a certain period of
-	time (say, once a month).</para>
+	server.  For example, if the server is running network
+	services, the workstation should not be running any.  In
+	order for a workstation to be reasonably secure, run zero or
+	as few services as possible and run a password-protected
+	screensaver.  Of course, given physical access to any system,
+	an attacker can break any sort of security.  Fortunately,
+	many break-ins occur remotely, over a network,
+	from people who do not have physical access to the
+	system.</para>
+
+      <para>Using Kerberos provides the ability to disable or change
+	the password for a user in one place, and have it immediately
+	affect all the machines on which the user has an account.  If
+	an account is compromised, the ability to instantly change the
+	associated password on all machines should not be underrated.
+	Additional restrictions can be imposed with Kerberos:  a
+	Kerberos ticket can be configured to timeout and the Kerberos
+	system can require that the user choose a new password after a
+	configurable period of time.</para>
     </sect2>
 
     <sect2>
       <title>Securing Root-run Servers and SUID/SGID Binaries</title>
 
       <indexterm>
-	<primary><command>ntalk</command></primary>
-      </indexterm>
-      <indexterm>
-	<primary><command>comsat</command></primary>
-      </indexterm>
-      <indexterm>
-	<primary><command>finger</command></primary>
-      </indexterm>
-      <indexterm>
 	<primary>sandboxes</primary>
       </indexterm>
       <indexterm>
 	<primary><application>sshd</application></primary>
       </indexterm>
-      <indexterm>
-	<primary><application>telnetd</application></primary>
-      </indexterm>
-      <indexterm>
-	<primary><application>rshd</application></primary>
-      </indexterm>
-      <indexterm>
-	<primary><application>rlogind</application></primary>
-      </indexterm>
 
-      <para>The prudent sysadmin only runs the servers he needs to, no
-	more, no less.  Be aware that third party servers are often
-	the most bug-prone.  For example, running an old version of
-	<application>imapd</application> or
-	<application>popper</application> is like giving a universal
-	<username>root</username> ticket out to the entire world.
-	Never run a server that you have not checked out carefully.
-	Many servers do not need to be run as
-	<username>root</username>.  For example, the
-	<application>ntalk</application>,
-	<application>comsat</application>, and
-	<application>finger</application> daemons can be run in
-	special user <firstterm>sandboxes</firstterm>.  A sandbox is
-	not perfect, unless you go through a large amount of trouble,
-	but the onion approach to security still stands: If someone is
-	able to break in through a server running in a sandbox, they
-	still have to break out of the sandbox.  The more layers the
-	attacker must break through, the lower the likelihood of his
-	success.  Root holes have historically been found in virtually
-	every server ever run as <username>root</username>, including
-	basic system servers.  If you are running a machine through
-	which people only login via <application>sshd</application>
-	and never login via <application>telnetd</application> or
-	<application>rshd</application> or
-	<application>rlogind</application>, then turn off those
-	services!</para>
-
-      <para>&os; now defaults to running
-	<application>ntalkd</application>,
-	<application>comsat</application>, and
-	<application>finger</application> in a sandbox.  Another
-	program which may be a candidate for running in a sandbox is
-	&man.named.8;.  <filename>/etc/defaults/rc.conf</filename>
-	includes the arguments necessary to run
-	<application>named</application> in a sandbox in a
-	commented-out form.  Depending on whether you are installing a
-	new system or upgrading an existing system, the special user
-	accounts used by these sandboxes may not be installed.  The
-	prudent sysadmin would research and implement sandboxes for
-	servers whenever possible.</para>
+      <para>The prudent sysadmin only enables required services
+	and is aware that third party servers are often the most
+	bug-prone.  Never run a server that has not been checked
+	out carefully.  Think twice before running any service as
+	<username>root</username> as many daemons can be run as a
+	separate service account or can be started in a
+	<firstterm>sandbox</firstterm>.  Do not activate insecure
+	services such as <application>telnetd</application> or
+	<application>rlogind</application>.</para>
 
-      <indexterm>
-	<primary><application>sendmail</application></primary>
-      </indexterm>
-
-      <para>There are a number of other servers that typically do not
-	run in sandboxes: <application>sendmail</application>,
-	<application>popper</application>,
-	<application>imapd</application>,
-	<application>ftpd</application>, and others.  There are
-	alternatives to some of these, but installing them may require
-	more work than you are willing to perform (the convenience
-	factor strikes again).  You may have to run these servers as
-	<username>root</username> and rely on other mechanisms to
-	detect break-ins that might occur through them.</para>
-
-      <para>The other big potential <username>root</username> holes in
-	a system are the suid-root and sgid binaries installed on the
-	system.  Most of these binaries, such as
+      <para>Another potential security hole is SUID-root and SGID
+	binaries.  Most of these binaries, such as
 	<application>rlogin</application>, reside in <filename
 	  class="directory">/bin</filename>, <filename
 	  class="directory">/sbin</filename>, <filename
 	  class="directory">/usr/bin</filename>, or <filename
 	  class="directory">/usr/sbin</filename>.  While nothing is
-	100% safe, the system-default suid and sgid binaries can be
-	considered reasonably safe.  Still, <username>root</username>
-	holes are occasionally found in these binaries.  A
-	<username>root</username> hole was found in
-	<literal>Xlib</literal> in 1998 that made
-	<application>xterm</application> (which is typically suid)
-	vulnerable.  It is better to be safe than sorry and the
-	prudent sysadmin will restrict suid binaries, that only staff
-	should run, to a special group that only staff can access, and
-	get rid of (<command>chmod 000</command>) any suid binaries
-	that nobody uses.  A server with no display generally does not
-	need an <application>xterm</application> binary.  Sgid
-	binaries can be almost as dangerous.  If an intruder can break
-	an sgid-kmem binary, the intruder might be able to read
+	100% safe, the system-default SUID and SGID binaries can be
+	considered reasonably safe.  It is recommended to restrict
+	SUID binaries to a special group that only staff can access,
+	and to delete any unused SUID binaries.  SGID binaries can be
+	almost as dangerous.  If an intruder can break an SGID-kmem
+	binary, the intruder might be able to read
 	<filename>/dev/kmem</filename> and thus read the encrypted
-	password file, potentially compromising any passworded
-	account.  Alternatively an intruder who breaks group
+	password file, potentially compromising user accounts.
+	Alternatively, an intruder who breaks group
 	<literal>kmem</literal> can monitor keystrokes sent through
 	ptys, including ptys used by users who login through secure
 	methods.  An intruder that breaks the
@@ -558,226 +399,203 @@
       <title>Securing User Accounts</title>
 
       <para>User accounts are usually the most difficult to secure.
-	While you can impose draconian access restrictions on your
-	staff and <quote>star</quote> out their passwords, you may not
-	be able to do so with any general user accounts you might
-	have.  If you do have sufficient control, then you may win out
-	and be able to secure the user accounts properly.  If not, you
-	simply have to be more vigilant in your monitoring of those
-	accounts.  Use of ssh and Kerberos for user accounts is more
-	problematic, due to the extra administration and technical
-	support required, but still a very good solution compared to a
-	encrypted password file.</para>
+	Be vigilant in the monitoring of user accounts.  Use of
+	&man.ssh.1; and Kerberos for user accounts
+	requires extra administration and technical support, but
+	provides a good solution compared to an encrypted password
+	file.</para>
     </sect2>
 
     <sect2>
       <title>Securing the Password File</title>
 
       <para>The only sure fire way is to star out as many passwords as
-	you can and use ssh or Kerberos for access to those accounts.
-	Even though the encrypted password file
-	(<filename>/etc/spwd.db</filename>) can only be read by
-	<username>root</username>, it may be possible for an intruder
-	to obtain read access to that file even if the attacker cannot
-	obtain root-write access.</para>
+	possible and use &man.ssh.1; or Kerberos
+	for access to those accounts.  Even though the encrypted
+	password file (<filename>/etc/spwd.db</filename>) can only be
+	read by <username>root</username>, it may be possible for an
+	intruder to obtain read access to that file even if the
+	attacker cannot obtain root-write access.</para>
 
-      <para>Your security scripts should always check for and report
-	changes to the password file (see the <link
+      <para>Security scripts should be used to check for and report
+	changes to the password file as described in the <link
 	  linkend="security-integrity">Checking file integrity</link>
-	section below).</para>
+	section.</para>
     </sect2>
 
     <sect2>
       <title>Securing the Kernel Core, Raw Devices, and
-	File Systems</title>
+	Filesystems</title>
 
-      <para>If an attacker breaks <username>root</username> he can do
-	just about anything, but there are certain conveniences.  For
-	example, most modern kernels have a packet sniffing device
-	driver built in.  Under &os; it is called the
-	<devicename>bpf</devicename> device.  An intruder will
-	commonly attempt to run a packet sniffer on a compromised
-	machine.  You do not need to give the intruder the capability
-	and most systems do not have the need for the
-	<devicename>bpf</devicename> device compiled in.</para>
+      <para>Most modern kernels have a packet sniffing device driver
+	built in.  Under &os; it is called
+	<devicename>bpf</devicename>.  This device is needed for DHCP,
+	but can be removed in the custom kernel configuration file of
+	systems that do not provide or use DHCP.</para>
 
       <indexterm>
 	<primary><command>sysctl</command></primary>
       </indexterm>
 
-      <para>But even if you turn off the <devicename>bpf</devicename>
-	device, you still have <filename>/dev/mem</filename> and
-	<filename>/dev/kmem</filename> to worry about.  For that
-	matter, the intruder can still write to raw disk devices.
-	Also, there is another kernel feature called the module
-	loader, &man.kldload.8;.  An enterprising intruder can use a
-	KLD module to install his own <devicename>bpf</devicename>
-	device, or other sniffing device, on a running kernel.  To
-	avoid these problems you have to run the kernel at a higher
-	secure level, at least securelevel 1.</para>
-
-      <para>The secure level of the kernel can be set in a variety of
-	ways.  The simplest way of raising the secure level of a
-	running kernel is through a <command>sysctl</command> on the
-	<varname>kern.securelevel</varname> kernel variable:</para>
+      <para>Even if <devicename>bpf</devicename> is disabled,
+	<filename>/dev/mem</filename> and
+	<filename>/dev/kmem</filename> are still problematic.  An
+	intruder can still write to raw disk devices.  An enterprising
+	intruder can use &man.kldload.8; to install his own
+	<devicename>bpf</devicename>, or another sniffing device, on a
+	running kernel.  To avoid these problems, run the kernel at a
+	higher security level, at least security level 1.</para>
+
+      <para>The security level of the kernel can be set in a variety
+	of ways.  The simplest way of raising the security level of a
+	running kernel is to set
+	<varname>kern.securelevel</varname>:</para>
 
       <screen>&prompt.root; <userinput>sysctl kern.securelevel=<replaceable>1</replaceable></userinput></screen>
 
-      <para>By default, the &os; kernel boots with a secure level of
-	-1.  The secure level will remain at -1 unless it is altered,
-	either by the administrator or by &man.init.8; because of a
-	setting in the start up scripts.  The secure level may be
-	raised during system startup by setting the
-	<varname>kern_securelevel_enable</varname> variable to
-	<literal>YES</literal> in the
-	<filename>/etc/rc.conf</filename> file, and the value of the
-	<varname>kern_securelevel</varname> variable to the desired
-	secure level.</para>
-
-      <para>The default secure level of a &os; system right after the
-	startup scripts are done is -1.  This is called
-	<quote>insecure mode</quote> because immutable file flags may
-	be turned off, all devices may be read from or written to, and
-	so on.</para>
+      <para>By default, the &os; kernel boots with a security level of
+	-1.  This is called <quote>insecure mode</quote> because
+	immutable file flags may be turned off and all devices may be
+	read from or written to.  The security level will remain at -1
+	unless it is altered, either by the administrator or by
+	&man.init.8;, because of a setting in the startup scripts.
+	The security level may be raised during system startup by
+	setting
+	<varname>kern_securelevel_enable</varname> to
+	<literal>YES</literal> in <filename>/etc/rc.conf</filename>,
+	and the value of <varname>kern_securelevel</varname> to the
+	desired security level.</para>
 
-      <para>Once the secure level is set to 1 or a higher value, the
+      <para>Once the security level is set to 1 or a higher value, the
 	append-only and immutable files are honored, they cannot be
-	turned off, and access to raw devices will be denied.  Higher
+	turned off, and access to raw devices is denied.  Higher
 	levels restrict even more operations.  For a full description
-	of the effect of various secure levels, please read the
-	&man.security.7; manual page.</para>
+	of the effect of various security levels, refer to
+	&man.security.7; and &man.init.8;.</para>
 
       <note>
-	<para>Bumping the secure level to 1 or higher may cause a few
-	  problems to X11 (access to <filename>/dev/io</filename> will
-	  be blocked), or to the installation of &os; built from
-	  source (the <maketarget>installworld</maketarget> part of
-	  the process needs to temporarily reset the append-only and
-	  immutable flags of some files), and in a few other cases.
-	  Sometimes, as in the case of X11, it may be possible to work
-	  around this by starting &man.xdm.1; pretty early in the boot
-	  process, when the securelevel is still low enough.
-	  Workarounds like this may not be possible for all secure
+	<para>Bumping the security level to 1 or higher may cause a
+	  few
+	  problems to <application>&xorg;</application>, as access to
+	  <filename>/dev/io</filename> will be blocked, or to the
+	  installation of &os; built from source as
+	  <maketarget>installworld</maketarget> needs to temporarily
+	  reset the append-only and immutable flags of some files.
+	  In the case of <application>&xorg;</application>, it may be
+	  possible to work around this by starting &man.xdm.1; early
+	  in the boot process, when the security level is still low
+	  enough.  Workarounds may not be possible for all secure
 	  levels or for all the potential restrictions they enforce.
 	  A bit of forward planning is a good idea.  Understanding the
-	  restrictions imposed by each secure level is important as
+	  restrictions imposed by each security level is important as
 	  they severely diminish the ease of system use.  It will also
 	  make choosing a default setting much simpler and prevent any
 	  surprises.</para>
       </note>
 
-      <para>If the kernel's secure level is raised to 1 or a higher
+      <para>If the kernel's security level is raised to 1 or a higher
 	value, it may be useful to set the <literal>schg</literal>
-	flag on critical startup binaries, directories, and script
-	files (i.e., everything that gets run up to the point where
-	the securelevel is set).  This might be overdoing it, and
-	upgrading the system is much more difficult when it operates
-	at a high secure level.  A less strict compromise is to run
-	the system at a higher secure level but skip setting the
-	<literal>schg</literal> flag for every system file and
-	directory under the sun.  Another possibility is to simply
+	flag on critical startup binaries, directories, script
+	files, and  everything that gets run up to the point where
+	the security level is set.  A less strict compromise is to run
+	the system at a higher security level but skip setting the
+	<literal>schg</literal> flag.  Another possibility is to
 	mount <filename class="directory">/</filename> and <filename
 	  class="directory">/usr</filename> read-only.  It should be
 	noted that being too draconian about what is permitted may
-	prevent the all-important detection of an intrusion.</para>
+	prevent detection of an intrusion.</para>
     </sect2>
 
     <sect2 id="security-integrity">
-      <title>Checking File Integrity: Binaries, Configuration Files,
-	Etc.</title>
+      <title>Checking File Integrity</title>
 
-      <para>When it comes right down to it, you can only protect your
-	core system configuration and control files so much before the
-	convenience factor rears its ugly head.  For example, using
-	<command>chflags</command> to set the <literal>schg</literal>
-	bit on most of the files in <filename
-	  class="directory">/</filename> and <filename
+      <para>One can only protect the core system configuration and
+	control files so much before the convenience factor rears its
+	ugly head.  For example, using &man.chflags.1; to
+	set the <literal>schg</literal> bit on most of the files in
+	<filename class="directory">/</filename> and <filename
 	  class="directory">/usr</filename> is probably
 	counterproductive, because while it may protect the files, it
-	also closes a detection window.  The last layer of your
-	security onion is perhaps the most important &mdash;
-	detection.  The rest of your security is pretty much useless
-	(or, worse, presents you with a false sense of security) if
-	you cannot detect potential intrusions.  Half the job of the
-	onion is to slow down the attacker, rather than stop him, in
-	order to be able to catch him in the act.</para>
+	also closes an intrusion detection window.  Security measures
+	are useless or, worse, present a false sense of security, if
+	potential intrusions cannot be detected.  Half the job of
+	security is to slow down, not stop, an attacker, in order to
+	catch him in the act.</para>
 
       <para>The best way to detect an intrusion is to look for
 	modified, missing, or unexpected files.  The best way to look
-	for modified files is from another (often centralized)
+	for modified files is from another, often centralized,
 	limited-access system.  Writing your security scripts on the
-	extra-secure limited-access system makes them mostly invisible
-	to potential attackers, and this is important.  In order to
-	take maximum advantage you generally have to give the
-	limited-access box significant access to the other machines in
-	the business, usually either by doing a read-only NFS export
-	of the other machines to the limited-access box, or by setting
-	up ssh key-pairs to allow the limited-access box to ssh to the
-	other machines.  Except for its network traffic, NFS is the
-	least visible method &mdash; allowing you to monitor the file
-	systems on each client box virtually undetected.  If your
-	limited-access server is connected to the client boxes through
-	a switch, the NFS method is often the better choice.  If your
-	limited-access server is connected to the client boxes through
-	a hub, or through several layers of routing, the NFS method
-	may be too insecure (network-wise) and using ssh may be the
-	better choice even with the audit-trail tracks that ssh
-	lays.</para>
-
-      <para>Once you have given a limited-access box at least read
-	access to the client systems it is supposed to monitor, you
-	must write scripts to do the actual monitoring.  Given an NFS
-	mount, you can write scripts out of simple system utilities
-	such as &man.find.1; and &man.md5.1;.  It is best to
-	physically md5 the client-box files at least once a day, and
+	extra-security limited-access system makes them mostly
+	invisible
+	to potential attackers.  In order to take maximum advantage,
+	the limited-access box needs significant access to the other
+	machines, usually either through a read-only
+	<acronym>NFS</acronym> export or by setting up
+	&man.ssh.1; key-pairs.  Except for its
+	network traffic, <acronym>NFS</acronym> is the least visible
+	method, allowing the administrator to monitor the filesystems
+	on each client box virtually undetected.  If a limited-access
+	server is connected to the client boxes through
+	a switch, the <acronym>NFS</acronym> method is often the
+	better choice.  If a limited-access server is connected to the
+	client boxes through several layers of routing, the
+	<acronym>NFS</acronym> method may be too insecure and
+	&man.ssh.1; may be the better
+	choice.</para>
+
+      <para>Once a limited-access box has been given at least read
+	access to the client systems it is supposed to monitor, create
+	the monitoring scripts.  Given an <acronym>NFS</acronym>
+	mount, write scripts out of simple system utilities such as
+	&man.find.1; and &man.md5.1;.  It is best to physically
+	&man.md5.1; the client system's files at least once a day, and
 	to test control files such as those found in <filename
 	  class="directory">/etc</filename> and <filename
 	  class="directory">/usr/local/etc</filename> even more often.
 	When mismatches are found, relative to the base md5
 	information the limited-access machine knows is valid, it
-	should scream at a sysadmin to go check it out.  A good
-	security script will also check for inappropriate suid
-	binaries and for new or deleted files on system partitions
-	such as <filename class="directory">/</filename> and <filename
+	should alert the sysadmin.  A good security script will also
+	check for inappropriate SUID binaries and for new or deleted
+	files on system partitions such as <filename
+	  class="directory">/</filename> and <filename
 	  class="directory">/usr</filename>.</para>
 
-      <para>When using ssh rather than NFS, writing the security
-	script is much more difficult.  You essentially have to
-	<command>scp</command> the scripts to the client box in order
-	to run them, making them visible, and for safety you also need
-	to <command>scp</command> the binaries (such as find) that
-	those scripts use.  The <application>ssh</application> client
-	on the client box may already be compromised.  All in all,
-	using ssh may be necessary when running over insecure links,
-	but it is also a lot harder to deal with.</para>
-
-      <para>A good security script will also check for changes to user
-	and staff members access configuration files:
-	<filename>.rhosts</filename>, <filename>.shosts</filename>,
-	<filename>.ssh/authorized_keys</filename> and so forth, files
-	that might fall outside the purview of the
+      <para>When using &man.ssh.1; rather than
+	<acronym>NFS</acronym>, writing the security script is more
+	difficult.  For example, &man.scp.1; is needed to
+	send the scripts to the client box in order to run them.  The
+	&man.ssh.1; client
+	on the client box may already be compromised.  Using
+	&man.ssh.1; may be necessary when running
+	over insecure links, but it is harder to deal with.</para>
+
+      <para>A good security script will also check for changes to
+	hidden configuration files, such as
+	<filename>.rhosts</filename> and
+	<filename>.ssh/authorized_keys</filename>, as these files
+	might fall outside the purview of the
 	<literal>MD5</literal> check.</para>
 
-      <para>If you have a huge amount of user disk space, it may take
-	too long to run through every file on those partitions.  In
-	this case, setting mount flags to disallow suid binaries is a
-	good idea.  The <literal>nosuid</literal> option (see
-	&man.mount.8;) is what you want to look into.  You should
-	probably scan them anyway, at least once a week, since the
-	object of this layer is to detect a break-in attempt, whether
-	or not the attempt succeeds.</para>
+      <para>For a large amount of user disk space, it may take too
+	long to run through every file on those partitions.  In this
+	case, consider setting mount flags to disallow SUID binaries
+	by using <literal>nosuid</literal> with &man.mount.8;.  Scan
+	these partitions at least once a week, since the objective is
+	to detect a break-in attempt, whether or not the attempt
+	succeeds.</para>
 
       <para>Process accounting (see &man.accton.8;) is a relatively
-	low-overhead feature of the operating system which might help
-	as a post-break-in evaluation mechanism.  It is especially
-	useful in tracking down how an intruder has actually broken
-	into a system, assuming the file is still intact after the
-	break-in has occurred.</para>
+	low-overhead feature of &os; which might help as a
+	post-break-in evaluation mechanism.  It is especially useful
+	in tracking down how an intruder broke into a system, assuming
+	the file is still intact after the break-in has
+	occurred.</para>

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***

From owner-svn-doc-projects@FreeBSD.ORG  Mon Apr 29 12:49:45 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id 9DB43A1E;
 Mon, 29 Apr 2013 12:49:45 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 8F31812B0;
 Mon, 29 Apr 2013 12:49:45 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r3TCnjt7005896;
 Mon, 29 Apr 2013 12:49:45 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r3TCnj71005895;
 Mon, 29 Apr 2013 12:49:45 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201304291249.r3TCnj71005895@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Mon, 29 Apr 2013 12:49:45 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41514 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Apr 2013 12:49:45 -0000

Author: dru
Date: Mon Apr 29 12:49:45 2013
New Revision: 41514
URL: http://svnweb.freebsd.org/changeset/doc/41514

Log:
  This patch addresses the following:
  
  - you
  - some acronym tags
  
  This chapter needs much more work, further patches pending.
  
  Approved by: gjb (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml	Mon Apr 29 12:44:22 2013	(r41513)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml	Mon Apr 29 12:49:45 2013	(r41514)
@@ -125,7 +125,7 @@
 	  </indexterm>
 	  <listitem>
 	    <para>An account with an Internet Service Provider
-	    (<acronym>ISP</acronym>) which you connect to using
+	    (<acronym>ISP</acronym>) for connecting using
 	      <acronym>PPP</acronym>.</para>
 	  </listitem>
 
@@ -156,7 +156,7 @@
 	    <indexterm id="ppp-password">
 	      <primary>password</primary>
 	    </indexterm>
-	    <para>Your login name and password.  (Either a
+	    <para>A login name and password.  (Either a
 	      regular &unix; style login and password pair, or a PAP
 	      or CHAP login and password pair).</para>
 	  </listitem>
@@ -167,14 +167,14 @@
 	    </indexterm>
 
 	    <para>The IP address of one or more name servers.
-	      Normally, you will be given two IP addresses by your
-	      <acronym>ISP</acronym>.  If they have not given you at
-	      least one, use the <command>enable dns</command> command
-	      in <filename>ppp.conf</filename> and
-	      <command>ppp</command> will set the name
-	      servers.  This feature depends on the
-	      <acronym>ISP</acronym>'s <acronym>PPP</acronym>
-	      implementation supporting DNS negotiation.</para>
+	      Normally, the <acronym>ISP</acronym> will provide two
+	      IP addresses.  If it has not provided any IP addresses,
+	      include <command>enable dns</command> in
+	      <filename>ppp.conf</filename> and
+	      <command>ppp</command> will set the name servers.  This
+	      feature requires the <acronym>ISP</acronym>'s
+	      <acronym>PPP</acronym> implementation to support DNS
+	      negotiation.</para>
 	  </listitem>
 	</itemizedlist>
 
@@ -184,13 +184,13 @@
 
 	<itemizedlist>
 	  <listitem>
-	    <para>The IP address of your <acronym>ISP</acronym>'s
-	      gateway.  The gateway is the machine to which you will
-	      connect and will be set up as your <emphasis>default
-		route</emphasis>.  If you do not have this
-	      information, we can make one up and your
+	    <para>The IP address of the <acronym>ISP</acronym>'s
+	      gateway.  The gateway is the machine to connect to
+	      and will be set up as the <emphasis>default
+		route</emphasis>.  When in doubt, make one up and the
 	      <acronym>ISP</acronym>'s <acronym>PPP</acronym> server
-	      will tell us the correct value when we connect.</para>
+	      will set the correct value during connection
+	      setup.</para>
 
 	    <para>This IP number is referred to as
 	      <literal>HISADDR</literal> by
@@ -198,9 +198,8 @@
 	  </listitem>
 
 	  <listitem>
-	    <para>The netmask you should use.  If the
-	      <acronym>ISP</acronym> has not provided you with one,
-	      you can safely use <hostid
+	    <para>The netmask.  If the <acronym>ISP</acronym> has not
+	      provided one, use <hostid
 		role="netmask">255.255.255.255</hostid>.</para>
 	  </listitem>
 
@@ -215,8 +214,8 @@
 	  </listitem>
 	</itemizedlist>
 
-	<para>If you do not have any of the required information,
-	  contact your <acronym>ISP</acronym>.</para>
+	<para>If any of the required information is missing, contact
+	  the <acronym>ISP</acronym>.</para>
 
 	<note>
 	  <para>Throughout this section, many of the examples showing
@@ -243,13 +242,10 @@
 	  Examples can be found in <filename
 	    class="directory">/usr/share/examples/ppp/</filename>.</para>
 
-	<para>Configuring <command>ppp</command> requires that you
-	  edit a number of files, depending on your requirements.
-	  What you put in them depends to some extent on whether your
-	  <acronym>ISP</acronym> allocates IP addresses statically
-	  (i.e., you get given one IP address, and always use that
-	  one) or dynamically (i.e., your IP address changes each time
-	  you connect).</para>
+	<para>Configuring <command>ppp</command> requires a number of
+	  files to be edited, depending on the requirements and
+	  whether the <acronym>ISP</acronym> allocates IP addresses
+	  statically or dynamically.</para>
 
 	<sect4 id="userppp-staticIP">
 	  <title><acronym>PPP</acronym> and Static IP
@@ -260,9 +256,8 @@
 	    <secondary>with static IP addresses</secondary>
 	  </indexterm>
 
-	  <para>You will need to edit the
-	    <filename>/etc/ppp/ppp.conf</filename> configuration file.
-	    It should look similar to the example below.</para>
+	  <para>Edit <filename>/etc/ppp/ppp.conf</filename> so that it
+	    looks similar to the example below.</para>
 
 	  <note>
 	    <para>Lines that end in a <literal>:</literal> start in
@@ -347,9 +342,10 @@
 	      <term>Line 5:</term>
 
 	      <listitem>
-		<para>Sets the speed you want to connect at.  If
-		  115200 does not work (it should with any reasonably
-		  new modem), try 38400 instead.</para>
+		<para>Sets the connection speed.  If
+		  <literal>115200</literal> does not work (it should
+		  with any reasonably new modem), try
+		  <literal>38400</literal> instead.</para>
 	      </listitem>
 	    </varlistentry>
 
@@ -411,10 +407,10 @@
 	      <listitem>
 		<para>Identifies an entry for a provider called
 		  <quote>provider</quote>.  This could be changed
-		  to the name of your <acronym>ISP</acronym> so
-		  that later you can use the <option>load
-		    <replaceable>ISP</replaceable></option> to start
-		  the connection.</para>
+		  to the name of the <acronym>ISP</acronym> so
+		  that <option>load
+		    <replaceable>ISP</replaceable></option> can be
+		  used to start the connection.</para>
 	      </listitem>
 	    </varlistentry>
 
@@ -427,17 +423,16 @@
 		  colon (<literal>:</literal>) or pipe character
 		  (<literal>|</literal>) as a separator.  The
 		  difference between the two separators is described
-		  in &man.ppp.8;.  To summarize, if you want to rotate
-		  through the numbers, use a colon.  If you want to
-		  always attempt to dial the first number first and
-		  only use the other numbers if the first number
-		  fails, use the pipe character.  Always quote the
-		  entire set of phone numbers as shown.</para>
-
-		<para>You must enclose the phone number in quotation
-		  marks (<literal>"</literal>) if there is any
-		  intention on using spaces in the phone number.
-		  This can cause a simple, yet subtle error.</para>
+		  in &man.ppp.8;.  To summarize, to rotate through the
+		  numbers, use a colon.  To always attempt to dial the
+		  first number first and only use the other numbers if
+		  the first number fails, use the pipe character.
+		  Always quote the entire set of phone numbers as
+		  shown.</para>
+
+		<para>The phone number must be enclosed in quotation
+		  marks (<literal>"</literal>) if there are any spaces
+		  in the phone number.</para>
 	      </listitem>
 	    </varlistentry>
 
@@ -460,10 +455,9 @@
 	      <listitem>
 		<indexterm><primary>PAP</primary></indexterm>
 		<indexterm><primary>CHAP</primary></indexterm>
-		<para>If you are using PAP or CHAP, there will be no
-		  login at this point, and this line should be
-		  commented out or removed.  See <link
-		    linkend="userppp-PAPnCHAP">PAP and CHAP
+		<para>When using PAP or CHAP, there will be no login
+		  and this line should be commented out or removed.
+		  See <link linkend="userppp-PAPnCHAP">PAP and CHAP
 		    authentication</link> for further details.</para>
 
 		<para>The login string is of the same chat-like
@@ -476,11 +470,12 @@ login: <replaceable>foo</replaceable>
 password: <replaceable>bar</replaceable>
 protocol: ppp</screen>
 
-		<para>You will need to alter this script to suit your
-		  own needs.  When you write this script for the first
-		  time, you should ensure that you have enabled
-		  <quote>chat</quote> logging so you can determine if
-		  the conversation is going as expected.</para>
+		<para>Replace the login and password values with
+		  those required by the <acronym>ISP</acronym>.  When
+		  writing this script for the first time, ensure that
+		  <quote>chat</quote> logging is enabled in order to
+		  determine if the conversation is going as
+		  expected.</para>
 	      </listitem>
 	    </varlistentry>
 
@@ -492,10 +487,9 @@ protocol: ppp</screen>
 
 		<para>Sets the default idle timeout (in seconds) for
 		  the connection.  Here, the connection will be closed
-		  automatically after 300 seconds of inactivity.  If
-		  you never want to timeout, set this value to zero
-		  or use the <option>-ddial</option> command line
-		  switch.</para>
+		  automatically after 300 seconds of inactivity.  To
+		  never timeout, set this value to zero or use the
+		  <option>-ddial</option> command line switch.</para>
 	      </listitem>
 	    </varlistentry>
 
@@ -506,15 +500,15 @@ protocol: ppp</screen>
 
 		<para>Sets the interface addresses.  The string
 		  <replaceable>x.x.x.x</replaceable> should be
-		  replaced by the IP address that your provider has
-		  allocated to you.  The string
+		  replaced by the IP address the provider has
+		  allocated.  The string
 		  <replaceable>y.y.y.y</replaceable> should be
 		  replaced by the IP address of the
 		  <acronym>ISP</acronym>'s gateway.  If the ISP has
-		  not given you a gateway address, use <hostid
-		  role="netmask">10.0.0.2/0</hostid>.  If you need to
-		  use a <quote>guessed</quote> address, make sure that
-		  you create an entry in
+		  not provided a gateway address, use <hostid
+		  role="netmask">10.0.0.2/0</hostid>.  When using a
+		  <quote>guessed</quote> address, make sure to create
+		  an entry in
 		  <filename>/etc/ppp/ppp.linkup</filename> as per the
 		  instructions for <link
 		  linkend="userppp-dynamicIP"><acronym>PPP</acronym>
@@ -536,20 +530,19 @@ protocol: ppp</screen>
 		  otherwise <literal>HISADDR</literal> will not yet
 		  be initialized.</para>
 
-		<para>If you do not wish to run <command>ppp</command>
-		  in <option>-auto</option> mode, this line should be
-		  moved to the <filename>ppp.linkup</filename>
-		  file.</para>
+		<para>When <command>ppp</command> is not run in
+		  <option>-auto</option> mode, this line should be
+		  moved to <filename>ppp.linkup</filename>.</para>
 	      </listitem>
 	    </varlistentry>
 	  </variablelist>
 
 	  <para>It is not necessary to add an entry to
-	    <filename>ppp.linkup</filename> when you have a static
-	    IP address and are running <command>ppp</command> in
-	    <option>-auto</option> mode as your routing table entries
-	    are already correct before you connect.  You may however
-	    wish to create an entry to invoke programs after
+	    <filename>ppp.linkup</filename> when using a static
+	    IP address with <command>ppp</command> in
+	    <option>-auto</option> mode as the routing table entries
+	    are already correct before a connection is established. 
+	    However, an entry can be created to invoke programs after
 	    connection.  This is explained later with the sendmail
 	    example.</para>
 
@@ -572,7 +565,7 @@ protocol: ppp</screen>
 	    <primary>IPCP</primary>
 	  </indexterm>
 
-	  <para>If your service provider does not assign static IP
+	  <para>If the service provider does not assign static IP
 	    addresses, <command>ppp</command> can be configured to
 	    negotiate the local and remote addresses.  This is done by
 	    <quote>guessing</quote> an IP address and allowing
@@ -596,10 +589,9 @@ protocol: ppp</screen>
 	      <listitem>
 		<para>The number after the <literal>/</literal>
 		  character is the number of bits of the address that
-		  <command>ppp</command> will insist on.  You may wish
-		  to use IP numbers more appropriate to your
-		  circumstances, but the above example will always
-		  work.</para>
+		  <command>ppp</command> will insist on.  These
+		  IP numbers can be replaced, but the above example
+		  will always work.</para>
 
 		<para>The last argument (<literal>0.0.0.0</literal>)
 		  tells <acronym>PPP</acronym> to start negotiations
@@ -614,8 +606,8 @@ protocol: ppp</screen>
 	    </varlistentry>
 	  </variablelist>
 
-	  <para>If you are not running in <option>-auto</option> mode,
-	    you will need to create an entry in
+	  <para>When not running in <option>-auto</option> mode,
+	    create an entry in
 	    <filename>/etc/ppp/ppp.linkup</filename>.
 	    <filename>ppp.linkup</filename> is used after a connection
 	    has been established.  At this point,
@@ -672,15 +664,14 @@ protocol: ppp</screen>
 	    <secondary>receiving incoming calls</secondary>
 	  </indexterm>
 
-	  <para>When you configure <command>ppp</command> to
-	    receive incoming calls on a machine connected to a LAN,
-	    you must decide if you wish to forward packets to the LAN.
-	    If you do, you should allocate the peer an IP number from
-	    your LAN's subnet, and use the command <command>enable
-	      proxy</command> in your
-	    <filename>/etc/ppp/ppp.conf</filename> file.  You should
-	    also confirm that the <filename>/etc/rc.conf</filename>
-	    file contains the following:</para>
+	  <para>When configuring <command>ppp</command> to receive
+	    incoming calls on a machine connected to a LAN, decide if
+	    packets should be forwarded to the LAN.  If so, allocate
+	    the peer an IP number from the LAN's subnet and use
+	    <command>enable proxy</command> in
+	    <filename>/etc/ppp/ppp.conf</filename>.  Also, confirm
+	    that <filename>/etc/rc.conf</filename> contains the
+	    following:</para>
 
 	  <programlisting>gateway_enable="YES"</programlisting>
 	</sect4>
@@ -699,15 +690,15 @@ protocol: ppp</screen>
 	    designed with dial-up lines in mind.</para>
 
 	  <para>The advantages of using <command>mgetty</command> is
-	    that it actively <emphasis>talks</emphasis> to modems,
-	    meaning if port is turned off in
-	    <filename>/etc/ttys</filename> then your modem will not
-	    answer the phone.</para>
+	    that it actively <emphasis>talks</emphasis> to modems.
+	    If the port is turned off in
+	    <filename>/etc/ttys</filename>, the modem will not answer
+	    the phone.</para>
 
 	  <para>Later versions of <command>mgetty</command> (from
 	    0.99beta onwards) also support the automatic detection of
-	    <acronym>PPP</acronym> streams, allowing your clients
-	    script-less access to your server.</para>
+	    <acronym>PPP</acronym> streams, allowing clients
+	    scriptless access to the server.</para>
 
 	  <para>Refer to <link linkend="userppp-mgetty">Mgetty and
 	      AutoPPP</link> for more information on
@@ -718,16 +709,14 @@ protocol: ppp</screen>
 	  <title><acronym>PPP</acronym> Permissions</title>
 
 	  <para>The <command>ppp</command> command must normally be
-	    run as the <username>root</username> user.  If however,
-	    you wish to allow <command>ppp</command> to run in
-	    server mode as a normal user by executing
-	    <command>ppp</command> as described below, that user
-	    must be given permission to run <command>ppp</command>
-	    by adding them to the <groupname>network</groupname>
-	    group in <filename>/etc/group</filename>.</para>
+	    run as the <username>root</username> user.  To give a
+	    user permission to run <command>ppp</command> in server
+	    mode, add their user account to the
+	    <groupname>network</groupname> group in
+	    <filename>/etc/group</filename>.</para>
 
-	  <para>You will also need to give them access to one or more
-	    sections of the configuration file using the
+	  <para>Then, give the account access to one or more sections
+	    of the configuration file using the
 	    <command>allow</command> command:</para>
 
 	  <programlisting>allow users fred mary</programlisting>
@@ -769,12 +758,12 @@ exec /usr/sbin/ppp -direct $IDENT</progr
 
 	  <screen>&prompt.root; <userinput>ln -s ppp-shell /etc/ppp/ppp-dialup</userinput></screen>
 
-	  <para>You should use this script as the
-	    <emphasis>shell</emphasis> for all of your dialup users.
-	    This is an example from <filename>/etc/passwd</filename>
-	    for a dialup <acronym>PPP</acronym> user with username
-	    <username>pchilds</username> (remember do not directly
-	    edit the password file, use &man.vipw.8;).</para>
+	  <para>Use this script as the <emphasis>shell</emphasis> for
+	    all dialup users.  This is an example from
+	    <filename>/etc/passwd</filename> for a dialup
+	    <acronym>PPP</acronym> user with the username
+	    <username>pchilds</username>.  Do not directly edit this
+	    file, use &man.vipw.8;.</para>
 
 	    <programlisting>pchilds:*:1011:300:Peter Childs PPP:/home/ppp:/etc/ppp/ppp-dialup</programlisting>
 
@@ -803,10 +792,10 @@ exec /usr/sbin/ppp -direct $IDENT</progr
 	      IPs create a symbolic link to
 	      <filename>ppp-shell</filename>.</para>
 
-	    <para>For example, if you have three dialup customers,
+	    <para>Consider three dialup customers,
 	      <username>fred</username>, <username>sam</username>,
-	      and <username>mary</username>, that you route /24 CIDR
-	      networks for, you would type the following:</para>
+	      and <username>mary</username>.  In order to route /24
+	      CIDR networks, type the following:</para>
 
 	    <screen>&prompt.root; <userinput>ln -s /etc/ppp/ppp-shell /etc/ppp/ppp-fred</userinput>
 &prompt.root; <userinput>ln -s /etc/ppp/ppp-shell /etc/ppp/ppp-sam</userinput>
@@ -845,7 +834,7 @@ ttyu1:
 	      for each session.  For each dialup line enabled in
 	      <filename>/etc/ttys</filename> create an entry similar
 	      to the one for <literal>ttyu0:</literal> above.  Each
-	      line should get a unique IP address from your pool of
+	      line should get a unique IP address from the pool of
 	      IP addresses for dynamic users.</para>
 	  </sect4>
 
@@ -855,10 +844,8 @@ ttyu1:
 
 	    <para>Along with the contents of the sample
 	      <filename>/usr/share/examples/ppp/ppp.conf</filename>
-	      above you should add a section for each of the
-	      statically assigned dialup users.  We will continue with
-	      our <username>fred</username>, <username>sam</username>,
-	      and <username>mary</username> example.</para>
+	      above, add a section for each of the statically assigned
+	      dialup users:</para>
 
 	    <programlisting>fred:
   set ifaddr 203.14.100.1 203.14.101.1 255.255.255.255
@@ -916,9 +903,9 @@ mary:
 	      role="package">comms/mgetty+sendfax</filename> port on
 	    his system.</para>
 
-	  <para>Make sure your
+	  <para>Make sure
 	    <filename>/usr/local/etc/mgetty+sendfax/login.config</filename>
-	    file has the following in it:</para>
+	    has the following:</para>
 
 	  <programlisting>/AutoPPP/ -     - /etc/ppp/ppp-pap-dialup</programlisting>
 
@@ -953,8 +940,8 @@ exec /usr/sbin/ppp -direct pap$IDENT</pr
 
 	  <programlisting>enable passwdauth</programlisting>
 
-	  <para>If you wish to assign some users a static IP number,
-	    you can specify the number as the third argument in
+	  <para>To assign some users a static IP, specify the IP
+	    address as the third argument in
 	    <filename>/etc/ppp/ppp.secret</filename>.  See
 	    <filename>/usr/share/examples/ppp/ppp.secret.sample</filename>
 	    for examples.</para>
@@ -1015,8 +1002,8 @@ set nbns 203.14.100.5</programlisting>
 	    that the authentication part of the connection is done
 	    using either the PAP or CHAP authentication mechanism.  If
 	    this is the case, the <acronym>ISP</acronym> will not give
-	    a <prompt>login:</prompt> prompt when you connect, but
-	    will start talking <acronym>PPP</acronym>
+	    a <prompt>login:</prompt> during connection, but will
+	    start talking <acronym>PPP</acronym>
 	    immediately.</para>
 
 	  <para>PAP is less secure than CHAP, but security is not
@@ -1041,8 +1028,8 @@ set nbns 203.14.100.5</programlisting>
 	      <term>Line 13:</term>
 
 	      <listitem>
-		<para>This line specifies your PAP/CHAP user name.
-		  You will need to insert the correct value for
+		<para>This line specifies the PAP/CHAP user name.
+		  Insert the correct value for
 		  <replaceable>MyUserName</replaceable>.</para>
 	      </listitem>
 	    </varlistentry>
@@ -1052,10 +1039,10 @@ set nbns 203.14.100.5</programlisting>
 	      <listitem>
 		<indexterm><primary>password</primary></indexterm>
 
-		<para>This line specifies your PAP/CHAP password.
-		  You will need to insert the correct value for
-		  <replaceable>MyPassword</replaceable>.  You may
-		  want to add an additional line, such as:</para>
+		<para>This line specifies the PAP/CHAP password.
+		  Insert the correct value for
+		  <replaceable>MyPassword</replaceable>.  An
+		  additional line can be added, such as:</para>
 
 		<programlisting>16      accept PAP</programlisting>
 
@@ -1073,9 +1060,9 @@ set nbns 203.14.100.5</programlisting>
 	      <term>Line 15:</term>
 
 	      <listitem>
-		<para>Your <acronym>ISP</acronym> will not normally
-		  require you to log into the server when using PAP or
-		  CHAP.  You must therefore disable your <quote>set
+		<para>The <acronym>ISP</acronym> will not normally
+		  require a login into the server when using PAP or
+		  CHAP.  Therefore, disable the <quote>set
 		    login</quote> string.</para>
 	      </listitem>
 	    </varlistentry>
@@ -1083,13 +1070,13 @@ set nbns 203.14.100.5</programlisting>
 	</sect4>
 
 	<sect4>
-	  <title>Changing Your <command>ppp</command> Configuration
+	  <title>Changing the <command>ppp</command> Configuration
 	    on the Fly</title>
 
 	  <para>It is possible to talk to the <command>ppp</command>
 	    program while it is running in the background, but only
 	    if a suitable diagnostic port has been set up.  To do
-	    this, add the following line to your configuration:</para>
+	    this, add the following line to the configuration:</para>
 
 	  <programlisting>set server /var/run/ppp-tun<replaceable>%d</replaceable> DiagnosticPassword 0177</programlisting>
 
@@ -1127,8 +1114,8 @@ set nbns 203.14.100.5</programlisting>
 	  <literal>ppp_nat</literal>, which is enabled by
 	  default.</para>
 
-	<para>If you use this feature, you may also find useful
-	  the following <filename>/etc/ppp/ppp.conf</filename> options
+	<para>When using this feature, the following
+	  <filename>/etc/ppp/ppp.conf</filename> options are useful
 	  to enable incoming connections forwarding:</para>
 
 	<programlisting>nat port tcp 10.0.0.2:ftp ftp
@@ -1146,10 +1133,9 @@ nat port tcp 10.0.0.2:http http</program
 	  <primary>PPP</primary><secondary>configuration</secondary>
 	</indexterm>
 
-	<para>You now have <command>ppp</command> configured, but
-	  there are a few more things to do before it is ready to
-	  work.  They all involve editing the
-	  <filename>/etc/rc.conf</filename> file.</para>
+	<para>Now that <command>ppp</command> is configured, there are
+	  a few more things to edit in
+	  <filename>/etc/rc.conf</filename>.</para>
 
 	<para>Working from the top down in this file, make sure the
 	  <literal>hostname=</literal> line is set, e.g.:</para>
@@ -1157,11 +1143,11 @@ nat port tcp 10.0.0.2:http http</program
 	<programlisting>hostname="foo.example.com"</programlisting>
 
 	<para>If the <acronym>ISP</acronym> has supplied a static IP
-	  address and name, it is probably best that you use this name
-	  as your host name.</para>
+	  address and name, it is recommended to use this name as the
+	  host name.</para>
 
 	<para>Look for the <literal>network_interfaces</literal>
-	  variable.  If you want to configure your system to dial your
+	  variable.  To configure the system to dial the
 	  <acronym>ISP</acronym> on demand, make sure the
 	  <devicename>tun0</devicename> device is added to the list,
 	  otherwise remove it.</para>
@@ -1178,15 +1164,15 @@ ifconfig_tun0=</programlisting>
 	  <programlisting>ppp -auto mysystem</programlisting>
 
 	  <para>This script is executed at network configuration time,
-	    starting your <command>ppp</command> daemon in
-	    <option>-auto</option> mode.  If you have a LAN for which
-	    this machine is a gateway, you may also wish to use the
+	    starting the <command>ppp</command> daemon in
+	    <option>-auto</option> mode.  If the machine functions as
+	    a gateway for a LAN, consider using the
 	    <option>-alias</option> switch.  Refer to the manual page
-	    for further details.</para>
+	    for details.</para>
 	</note>
 
 	<para>Make sure that the router program is set to
-	  <literal>NO</literal> with the following line in your
+	  <literal>NO</literal> with the following line in
 	  <filename>/etc/rc.conf</filename>:</para>
 
 	<programlisting>router_enable="NO"</programlisting>
@@ -1204,24 +1190,22 @@ ifconfig_tun0=</programlisting>
 	  <literal>sendmail_flags</literal> line does not include the
 	  <option>-q</option> option, otherwise
 	  <command>sendmail</command> will attempt to do a network
-	  lookup every now and then, possibly causing your machine
-	  to dial out.  You may try:</para>
+	  lookup every now and then, possibly causing the machine
+	  to dial out.  Try this command instead:</para>
 
 	<programlisting>sendmail_flags="-bd"</programlisting>
 
 	<indexterm>
 	  <primary><application>sendmail</application></primary>
 	</indexterm>
-	<para>The downside of this is that you must force
-	  <command>sendmail</command> to re-examine the mail queue
-	    whenever the <acronym>PPP</acronym> link is up by
-	    typing:</para>
+	<para>The downside is that <command>sendmail</command> must be
+	  forced to re-examine the mail queue whenever the
+	  <acronym>PPP</acronym> link is up by typing:</para>
 
 	<screen>&prompt.root; <userinput>/usr/sbin/sendmail -q</userinput></screen>
 
-	<para>You may wish to use the <command>!bg</command> command
-	  in <filename>ppp.linkup</filename> to do this
-	  automatically:</para>
+	<para>To automatically use the <command>!bg</command> command
+	  in <filename>ppp.linkup</filename>:</para>
 
 	<programlisting>1     provider:
 2       delete ALL
@@ -1232,20 +1216,20 @@ ifconfig_tun0=</programlisting>
 	  <primary>SMTP</primary>
 	</indexterm>
 
-	<para>If you do not like this, it is possible to set up a
-	  <quote>dfilter</quote> to block SMTP traffic.  Refer to the
-	  sample files for further details.</para>
+	<para>It is possible to set up a <quote>dfilter</quote> to
+	  block SMTP traffic.  Refer to the sample files for further
+	  details.</para>
 
 	<para>All that is left is to reboot the machine.  After
-	  rebooting, you can now either type:</para>
+	  rebooting, either type:</para>
 
 	<screen>&prompt.root; <userinput>ppp</userinput></screen>
 
 	<para>and then <command>dial provider</command> to start the
-	  <acronym>PPP</acronym> session, or, if you want
+	  <acronym>PPP</acronym> session, or, to configure
 	  <command>ppp</command> to establish sessions automatically
-	  when there is outbound traffic (and you have not created the
-	  <filename>start_if.tun0</filename> script), type:</para>
+	  when there is outbound traffic and there is no existing
+	  <filename>start_if.tun0</filename> script, type:</para>
 
 	<screen>&prompt.root; <userinput>ppp -auto provider</userinput></screen>
       </sect3>
@@ -1261,7 +1245,7 @@ ifconfig_tun0=</programlisting>
 	<procedure>
 	  <step>
 	    <para>Ensure that the <devicename>tun</devicename> device
-	      is built into your kernel.</para>
+	      is built into the kernel.</para>
 	  </step>
 
 	  <step>
@@ -1279,18 +1263,17 @@ ifconfig_tun0=</programlisting>
 	  </step>
 
 	  <step>
-	    <para>If you have a dynamic IP address, create an entry in
+	    <para>When using a dynamic IP address, create an entry in
 	      <filename>/etc/ppp/ppp.linkup</filename>.</para>
 	  </step>
 
 	  <step>
-	    <para>Update your <filename>/etc/rc.conf</filename>
-	      file.</para>
+	    <para>Update <filename>/etc/rc.conf</filename>.</para>
 	  </step>
 
 	  <step>
 	    <para>Create a <filename>start_if.tun0</filename> script
-	      if you require demand dialing.</para>
+	      if demand dialing is required.</para>
 	  </step>
 	</procedure>
 
@@ -1299,7 +1282,7 @@ ifconfig_tun0=</programlisting>
 	<procedure>
 	  <step>
 	    <para>Ensure that the <devicename>tun</devicename> device
-	      is built into your kernel.</para>
+	      is built into the kernel.</para>
 	  </step>
 
 	  <step>
@@ -1334,8 +1317,7 @@ ifconfig_tun0=</programlisting>
 	  </step>
 
 	  <step>
-	    <para>Update your <filename>/etc/rc.conf</filename>
-	      file.</para>
+	    <para>Update <filename>/etc/rc.conf</filename>.</para>
 	  </step>
 	</procedure>
       </sect3>
@@ -1361,23 +1343,21 @@ ifconfig_tun0=</programlisting>
     </indexterm>
 
     <para>This section covers a few issues which may arise when
-      using <acronym>PPP</acronym> over a modem connection.  For
-      instance, perhaps you need to know exactly what prompts the
-      system you are dialing into will present.  Some
+      using <acronym>PPP</acronym> over a modem connection.  Some
       <acronym>ISP</acronym>s present the
       <literal>ssword</literal> prompt, and others will present
       <literal>password</literal>; if the <command>ppp</command>
       script is not written accordingly, the login attempt will
       fail.  The most common way to debug <command>ppp</command>
       connections is by connecting manually.  The following
-      information will walk you through a manual connection step by
+      information walks through a manual connection step by
       step.</para>
 
     <sect2>
       <title>Check the Device Nodes</title>
 
       <para>When using a custom kernel, make sure to include the
-	following line in your kernel configuration file:</para>
+	following line in the kernel configuration file:</para>
 
       <programlisting>device   uart</programlisting>
 
@@ -1389,17 +1369,13 @@ ifconfig_tun0=</programlisting>
 
       <screen>&prompt.root; <userinput>dmesg | grep uart</userinput></screen>
 
-      <para>You should get some pertinent output about the
-	<devicename>uart</devicename> devices.  These are the COM
-	ports we need.  If your modem acts like a standard serial
-	port then you should see it listed on
+      <para>The <devicename>uart</devicename> devices should provide
+	some pertinent output about the COM ports.  If the modem acts
+	like a standard serial port, it should be listed on
 	<devicename>uart1</devicename>, or
-	<devicename>COM2</devicename>.  If so, you are not required
-	to rebuild the kernel.  When matching up sio modem is on
-	<devicename>uart1</devicename> or
-	<devicename>COM2</devicename> if you are in DOS, then your
-	modem device would be <filename
-	  class="devicefile">/dev/cuau1</filename>.</para>
+	<devicename>COM2</devicename>.  If so, a custom kernel is not
+	needed.  In this configuration, the modem device would be
+	<filename class="devicefile">/dev/cuau1</filename>.</para>
     </sect2>
 
     <sect2>
@@ -1407,42 +1383,39 @@ ifconfig_tun0=</programlisting>
 
       <para>Connecting to the Internet by manually controlling
 	<command>ppp</command> is quick, easy, and a great way to
-	debug a connection or just get information on how your
+	debug a connection or just get information on how the
 	<acronym>ISP</acronym> treats <command>ppp</command> client
 	connections.  Lets start <application>PPP</application> from
-	the command line.  Note that in all of our examples we will
-	use <emphasis>example</emphasis> as the hostname of the
-	machine running <application>PPP</application>.  You start
-	<command>ppp</command> by just typing
+	the command line.  The following examples use
+	<emphasis>example</emphasis> as the hostname of the
+	machine running <application>PPP</application>.  To start
 	<command>ppp</command>:</para>
 
       <screen>&prompt.root; <userinput>ppp</userinput></screen>
 
-      <para>We have now started <command>ppp</command>.</para>
-
+      <para>This sets the modem device to
+	<devicename>cuau1</devicename>:</para>
+	
       <screen>ppp ON example&gt; <userinput>set device <filename class="devicefile">/dev/cuau1</filename></userinput></screen>
 
-      <para>We set our modem device, in this case it is
-	<devicename>cuau1</devicename>.</para>
+      <para>This sets the connection speed to 115,200
+	<acronym>kbps</acronym>:</para>
 
       <screen>ppp ON example&gt; <userinput>set speed 115200</userinput></screen>
 
-      <para>Set the connection speed, in this case we
-	are using 115,200 <acronym>kbps</acronym>.</para>
-
-      <screen>ppp ON example&gt; <userinput>enable dns</userinput></screen>
-
-      <para>Tell <command>ppp</command> to configure our
+      <para>This tells <command>ppp</command> to configure the
 	resolver and add the nameserver lines to
 	<filename>/etc/resolv.conf</filename>.  If
-	<command>ppp</command> cannot determine our hostname, we can
-	set one manually later.</para>
+	<command>ppp</command> cannot determine the hostname, it can
+	manually be set later.</para>
 
-      <screen>ppp ON example&gt; <userinput>term</userinput></screen>
+      <screen>ppp ON example&gt; <userinput>enable dns</userinput></screen>
 
       <para>Switch to <quote>terminal</quote> mode so that we can
 	manually control the modem.</para>
 
+      <screen>ppp ON example&gt; <userinput>term</userinput></screen>
+
       <programlisting>deflink: Entering terminal mode on <filename class="devicefile">/dev/cuau1</filename>
 type '~h' for help</programlisting>
 
@@ -1451,7 +1424,7 @@ OK
 <userinput>atdt<replaceable>123456789</replaceable></userinput></screen>
 
       <para>Use <command>at</command> to initialize the modem,
-	then use <command>atdt</command> and the number for your
+	then use <command>atdt</command> and the number for the
 	<acronym>ISP</acronym> to begin the dial in process.</para>
 
       <screen>CONNECT</screen>
@@ -1462,8 +1435,8 @@ OK
 
       <screen>ISP Login:<userinput>myusername</userinput></screen>
 
-      <para>Here you are prompted for a username, return the
-	prompt with the username that was provided by the
+      <para>When prompted for a username, return the prompt with the
+	username that was provided by the
 	<acronym>ISP</acronym>.</para>
 
       <screen>ISP Pass:<userinput>mypassword</userinput></screen>
@@ -1475,7 +1448,7 @@ OK
 
       <screen>Shell or PPP:<userinput>ppp</userinput></screen>
 
-      <para>Depending on your <acronym>ISP</acronym> this prompt
+      <para>Depending on the <acronym>ISP</acronym>, this prompt
 	may never appear.  Here we are being asked if we wish to
 	use a shell on the provider, or to start
 	<command>ppp</command>.  In this example, we have chosen
@@ -1504,47 +1477,45 @@ OK
       <para>Here we add our default route, we need to do this before
 	we can talk to the outside world as currently the only
 	established connection is with the peer.  If this fails due to
-	existing routes you can put a bang character
-	<literal>!</literal> in front of the <option>add</option>.
-	Alternatively, you can set this before making the actual
-	connection and it will negotiate a new route
-	accordingly.</para>
+	existing routes, put a bang character
+	(<literal>!</literal>) in front of the <option>add</option>.
+	Alternatively, set this before making the actual connection
+	and it will negotiate a new route accordingly.</para>
 
-      <para>If everything went good we should now have an active
-	connection to the Internet, which could be thrown into the
+      <para>If everything went well, there is now an active
+	connection to the Internet which can be placed into the
 	background using <keycombo
 	action="simul"><keycap>CTRL</keycap>
-	<keycap>z</keycap></keycombo> If you notice the
-	<command>PPP</command> return to <command>ppp</command> then
-	we have lost our connection.  This is good to know because it
-	shows our connection status.  Capital P's show that we have a
-	connection to the <acronym>ISP</acronym> and lowercase p's
-	show that the connection has been lost for whatever reason.
-	<command>ppp</command> only has these 2 states.</para>
+	<keycap>z</keycap></keycombo>.  If
+	<literal>PPP</literal> instead returns to
+	<literal>ppp</literal>, the connection has been lost.  An
+	uppercase <literal>P</literal> indicates a
+	connection to the <acronym>ISP</acronym> and a lowercase
+	<literal>p</literal> indicates that the connection has been
+	lost.  <command>ppp</command> only has these 2 states.</para>
 
       <sect3>
 	<title>Debugging</title>
 
-	<para>If you have a direct line and cannot seem to make a
-	  connection, then turn hardware flow
-	  <acronym>CTS/RTS</acronym> to off with the <option>set
-	  ctsrts off</option>.  This is mainly the case if you are
+	<para>For a direct line that cannot seem to make a connection,
+	  turn hardware flow <acronym>CTS/RTS</acronym> to off with
+	  <option>set ctsrts off</option>.  This can occur when
 	  connected to some <application>PPP</application> capable
-	  terminal servers, where <application>PPP</application> hangs
-	  when it tries to write data to your communication link, so
-	  it would be waiting for a <acronym>CTS</acronym>, or Clear
-	  To Send signal which may never come.  If you use this option
-	  however, you should also use the <option>set accmap</option>
-	  option, which may be required to defeat hardware dependent
-	  on passing certain characters from end to end, most of the
-	  time XON/XOFF.  See the &man.ppp.8; manual page for more
-	  information on this option, and how it is used.</para>
-
-	<para>If you have an older modem, you may need to use the
-	  <option>set parity even</option>.  Parity is set at none
-	  be default, but is used for error checking (with a large
+	  terminal servers as <application>PPP</application> hangs
+	  when it tries to write data to the communication link and
+	  then waits for a Clear To Send (<acronym>CTS</acronym>)
+	  signal which may never come.  When using this option,
+	  include <option>set accmap</option>, which may be required
+	  to defeat hardware which is dependent on passing certain
+	  characters from end to end, such as XON/XOFF.  See
+	  &man.ppp.8; for more information on how this option is
+	  used.</para>
+
+	<para>For an older modem, <option>set parity even</option> may
+	  be needed.  Parity is set at <literal>none</literal> by
+	  default, but is used for error checking (with a large
 	  increase in traffic) on older modems and some
-	  <acronym>ISP</acronym>s.  You may need this option for
+	  <acronym>ISP</acronym>s.  This option may be needed for
 	  the Compuserve <acronym>ISP</acronym>.</para>
 
 	<para><application>PPP</application> may not return to the
@@ -1554,13 +1525,13 @@ OK
 	  command will force <command>ppp</command> to start
 	  sending the configuration information.</para>
 
-	<para>If you never obtain a login prompt, then most likely you
-	  need to use <acronym>PAP</acronym> or
-	  <acronym>CHAP</acronym> authentication instead of the
-	  &unix; style in the example above.  To use
-	  <acronym>PAP</acronym> or <acronym>CHAP</acronym> just add
-	  the following options to <application>PPP</application>
-	  before going into terminal mode:</para>
+	<para>If a login prompt never appears, try using
+	  <acronym>PAP</acronym> or <acronym>CHAP</acronym>
+	  authentication instead of the &unix; style in the example
+	  above.  To use <acronym>PAP</acronym> or
+	  <acronym>CHAP</acronym>, add the following options to
+	  <application>PPP</application> before going into terminal
+	  mode:</para>
 
 	<screen>ppp ON example&gt; <userinput>set authname <replaceable>myusername</replaceable></userinput></screen>
 
@@ -1574,17 +1545,16 @@ OK
 	  replaced with the password that was assigned by the
 	  <acronym>ISP</acronym>.</para>
 
-	<para>If you connect fine, but cannot seem to find any domain
-	  name, try to use &man.ping.8; with an <acronym>IP</acronym>
-	  address and see if you can get any return information.  If
-	  you experience 100 percent (100%) packet loss, then it is
-	  most likely that you were not assigned a default route.
-	  Double check that the option <option>add default
-	    HISADDR</option> was set during the connection.  If you
-	  can connect to a remote <acronym>IP</acronym> address then
-	  it is possible that a resolver address has not been added
-	  to the <filename>/etc/resolv.conf</filename>.  This file
-	  should look like:</para>
+	<para>If the connection is active but cannot resolve any
+	  domain names, try to &man.ping.8; an <acronym>IP</acronym>
+	  address.  If there is 100% packet loss, it is likely that a
+	  default route was not assigned.  Double check that
+	  <option>add default HISADDR</option> was set during the
+	  connection.  If a connection to a remote
+	  <acronym>IP</acronym> address cannot be established, it is
+	  possible that a resolver address has not been added to
+	  <filename>/etc/resolv.conf</filename>.  This file should
+	  look like:</para>
 
 	<programlisting>domain <replaceable>example.com</replaceable>
 nameserver <replaceable>x.x.x.x</replaceable>
@@ -1592,15 +1562,11 @@ nameserver <replaceable>y.y.y.y</replace
 
 	<para>Where <replaceable>x.x.x.x</replaceable> and
 	  <replaceable>y.y.y.y</replaceable> should be replaced with
-	  the <acronym>IP</acronym> address of your
-	  <acronym>ISP</acronym>'s DNS servers.  This information may
-	  or may not have been provided when you signed up, but a
-	  quick call to your <acronym>ISP</acronym> should remedy
-	  that.</para>
-
-	<para>You could also have &man.syslog.3; provide a logging
-	  function for your <application>PPP</application> connection.
-	  Just add:</para>
+	  the <acronym>IP</acronym> address of the
+	  <acronym>ISP</acronym>'s DNS servers.</para>
+
+	<para>To configure &man.syslog.3; to log
+	  <application>PPP</application> connections, add:</para>
 
 	<programlisting>!ppp
 *.*     /var/log/ppp.log</programlisting>
@@ -1677,7 +1643,7 @@ name_of_service_provider:
     <sect2>
       <title>Running <command>ppp</command></title>
 
-      <para>As <username>root</username>, you can run:</para>
+      <para>As <username>root</username>, run:</para>
 
       <screen>&prompt.root; <userinput>ppp -ddial name_of_service_provider</userinput></screen>
 
@@ -1686,8 +1652,8 @@ name_of_service_provider:
     <sect2>
       <title>Starting <command>ppp</command> at Boot</title>
 
-      <para>Add the following to your
-	<filename>/etc/rc.conf</filename> file:</para>
+      <para>Add the following to
+	<filename>/etc/rc.conf</filename>:</para>
 
       <programlisting>ppp_enable="YES"
 ppp_mode="ddial"
@@ -1699,25 +1665,22 @@ ppp_profile="name_of_service_provider"</
       <title>Using a <acronym>PPPoE</acronym> Service Tag</title>
 
       <para>Sometimes it will be necessary to use a service tag to
-	establish your connection.  Service tags are used to

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***

From owner-svn-doc-projects@FreeBSD.ORG  Mon Apr 29 22:06:39 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id 6D4CCB86;
 Mon, 29 Apr 2013 22:06:39 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 5F4931904;
 Mon, 29 Apr 2013 22:06:39 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r3TM6d9F011957;
 Mon, 29 Apr 2013 22:06:39 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r3TM6dfb011955;
 Mon, 29 Apr 2013 22:06:39 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201304292206.r3TM6dfb011955@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Mon, 29 Apr 2013 22:06:39 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41522 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Apr 2013 22:06:39 -0000

Author: dru
Date: Mon Apr 29 22:06:38 2013
New Revision: 41522
URL: http://svnweb.freebsd.org/changeset/doc/41522

Log:
  Fix command/application tags that should be man page entities.
  
  Approved by: bcr (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml	Mon Apr 29 21:56:02 2013	(r41521)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/ppp-and-slip/chapter.xml	Mon Apr 29 22:06:38 2013	(r41522)
@@ -171,7 +171,7 @@
 	      IP addresses.  If it has not provided any IP addresses,
 	      include <command>enable dns</command> in
 	      <filename>ppp.conf</filename> and
-	      <command>ppp</command> will set the name servers.  This
+	      &man.ppp.8; will set the name servers.  This
 	      feature requires the <acronym>ISP</acronym>'s
 	      <acronym>PPP</acronym> implementation to support DNS
 	      negotiation.</para>
@@ -194,7 +194,7 @@
 
 	    <para>This IP number is referred to as
 	      <literal>HISADDR</literal> by
-	      <command>ppp</command>.</para>
+	      &man.ppp.8;.</para>
 	  </listitem>
 
 	  <listitem>
@@ -237,12 +237,13 @@
 	  <secondary>configuration</secondary>
 	</indexterm>
 
-	<para><command>ppp</command> uses the configuration files
-	  located in <filename class="directory">/etc/ppp</filename>.
+	<para>Several files located in <filename
+	    class="directory">/etc/ppp</filename> are used to
+	  configure &man.ppp.8;.
 	  Examples can be found in <filename
 	    class="directory">/usr/share/examples/ppp/</filename>.</para>
 
-	<para>Configuring <command>ppp</command> requires a number of
+	<para>Configuring &man.ppp.8; requires a number of
 	  files to be edited, depending on the requirements and
 	  whether the <acronym>ISP</acronym> allocates IP addresses
 	  statically or dynamically.</para>
@@ -292,7 +293,7 @@
 	      <listitem>
 		<para>Identifies the default entry.  Commands in this
 		  entry are executed automatically when
-		  <command>ppp</command> is
+		  &man.ppp.8; is
 		  run.</para>
 	      </listitem>
 	    </varlistentry>
@@ -513,7 +514,7 @@ protocol: ppp</screen>
 		  instructions for <link
 		  linkend="userppp-dynamicIP"><acronym>PPP</acronym>
 		  and Dynamic IP addresses</link>.  If this line is
-		  omitted, <command>ppp</command> cannot run in
+		  omitted, &man.ppp.8; cannot run in
 		  <option>-auto</option> mode.</para>
 	      </listitem>
 	    </varlistentry>
@@ -530,7 +531,7 @@ protocol: ppp</screen>
 		  otherwise <literal>HISADDR</literal> will not yet
 		  be initialized.</para>
 
-		<para>When <command>ppp</command> is not run in
+		<para>When &man.ppp.8; is not run in
 		  <option>-auto</option> mode, this line should be
 		  moved to <filename>ppp.linkup</filename>.</para>
 	      </listitem>
@@ -539,7 +540,7 @@ protocol: ppp</screen>
 
 	  <para>It is not necessary to add an entry to
 	    <filename>ppp.linkup</filename> when using a static
-	    IP address with <command>ppp</command> in
+	    IP address with &man.ppp.8; in
 	    <option>-auto</option> mode as the routing table entries
 	    are already correct before a connection is established. 
 	    However, an entry can be created to invoke programs after
@@ -566,10 +567,10 @@ protocol: ppp</screen>
 	  </indexterm>
 
 	  <para>If the service provider does not assign static IP
-	    addresses, <command>ppp</command> can be configured to
+	    addresses, &man.ppp.8; can be configured to
 	    negotiate the local and remote addresses.  This is done by
 	    <quote>guessing</quote> an IP address and allowing
-	    <command>ppp</command> to set it up correctly using the IP
+	    &man.ppp.8; to set it up correctly using the IP
 	    Configuration Protocol (IPCP) after connecting.  The
 	    <filename>ppp.conf</filename> configuration is the same as
 	    <link linkend="userppp-staticIP"><acronym>PPP</acronym>
@@ -589,7 +590,7 @@ protocol: ppp</screen>
 	      <listitem>
 		<para>The number after the <literal>/</literal>
 		  character is the number of bits of the address that
-		  <command>ppp</command> will insist on.  These
+		  &man.ppp.8; will insist on.  These
 		  IP numbers can be replaced, but the above example
 		  will always work.</para>
 
@@ -611,7 +612,7 @@ protocol: ppp</screen>
 	    <filename>/etc/ppp/ppp.linkup</filename>.
 	    <filename>ppp.linkup</filename> is used after a connection
 	    has been established.  At this point,
-	    <command>ppp</command> will have assigned the interface
+	    &man.ppp.8; will have assigned the interface
 	    addresses and it will now be possible to add the routing
 	    table entries:</para>
 
@@ -624,7 +625,7 @@ protocol: ppp</screen>
 
 	      <listitem>
 		<para>On establishing a connection,
-		  <command>ppp</command> will look for an entry in
+		  &man.ppp.8; will look for an entry in
 		  <filename>ppp.linkup</filename> according to the
 		  following rules: First, try to match the same label
 		  as we used in <filename>ppp.conf</filename>.  If
@@ -639,7 +640,7 @@ protocol: ppp</screen>
 	      <term>Line 2:</term>
 
 	      <listitem>
-		<para>This line tells <command>ppp</command> to add a
+		<para>This line tells &man.ppp.8; to add a
 		  default route that points to
 		  <literal>HISADDR</literal>.
 		  <literal>HISADDR</literal> will be replaced with the
@@ -664,7 +665,7 @@ protocol: ppp</screen>
 	    <secondary>receiving incoming calls</secondary>
 	  </indexterm>
 
-	  <para>When configuring <command>ppp</command> to receive
+	  <para>When configuring &man.ppp.8; to receive
 	    incoming calls on a machine connected to a LAN, decide if
 	    packets should be forwarded to the LAN.  If so, allocate
 	    the peer an IP number from the LAN's subnet and use
@@ -683,34 +684,34 @@ protocol: ppp</screen>
 	      Dial-up Services</link> provides a good description
 	    on enabling dial-up services using &man.getty.8;.</para>
 
-	  <para>An alternative to <command>getty</command> is <ulink
+	  <para>An alternative to &man.getty.8; is <ulink
 	      url="http://mgetty.greenie.net/">mgetty</ulink> (from
 	    <filename role="package">comms/mgetty+sendfax</filename>
-	    port), a smarter version of <command>getty</command>
+	    port), a smarter version of &man.getty.8;
 	    designed with dial-up lines in mind.</para>
 
-	  <para>The advantages of using <command>mgetty</command> is
+	  <para>The advantages of using &man.getty.8; is
 	    that it actively <emphasis>talks</emphasis> to modems.
 	    If the port is turned off in
 	    <filename>/etc/ttys</filename>, the modem will not answer
 	    the phone.</para>
 
-	  <para>Later versions of <command>mgetty</command> (from
+	  <para>Later versions of &man.getty.8; (from
 	    0.99beta onwards) also support the automatic detection of
 	    <acronym>PPP</acronym> streams, allowing clients
 	    scriptless access to the server.</para>
 
 	  <para>Refer to <link linkend="userppp-mgetty">Mgetty and
 	      AutoPPP</link> for more information on
-	    <command>mgetty</command>.</para>
+	    &man.getty.8;.</para>
 	</sect4>
 
 	<sect4>
 	  <title><acronym>PPP</acronym> Permissions</title>
 
-	  <para>The <command>ppp</command> command must normally be
+	  <para>Typically, &man.ppp.8; is
 	    run as the <username>root</username> user.  To give a
-	    user permission to run <command>ppp</command> in server
+	    user permission to run &man.ppp.8; in server
 	    mode, add their user account to the
 	    <groupname>network</groupname> group in
 	    <filename>/etc/group</filename>.</para>
@@ -874,10 +875,10 @@ mary:
 	</sect4>
 
 	<sect4 id="userppp-mgetty">
-	  <title><command>mgetty</command> and AutoPPP</title>
+	  <title>&man.getty.8; and AutoPPP</title>
 
 	  <indexterm>
-	    <primary><command>mgetty</command></primary>
+	    <primary>&man.getty.8;</primary>
 	  </indexterm>
 
 	  <indexterm>
@@ -891,9 +892,9 @@ mary:
 	  <para>By default the <filename
 	      role="package">comms/mgetty+sendfax</filename> port
 	    comes with the <literal>AUTO_PPP</literal> option enabled
-	    allowing <command>mgetty</command> to detect the LCP
+	    allowing &man.getty.8; to detect the LCP
 	    phase of <acronym>PPP</acronym> connections and
-	    automatically spawn off a <command>ppp</command> shell.
+	    automatically spawn off a &man.ppp.8; shell.
 	    However, since the default login/password sequence does
 	    not occur it is necessary to authenticate users using
 	    either PAP or CHAP.</para>
@@ -909,7 +910,7 @@ mary:
 
 	  <programlisting>/AutoPPP/ -     - /etc/ppp/ppp-pap-dialup</programlisting>
 
-	  <para>This will tell <command>mgetty</command> to run the
+	  <para>This will tell &man.getty.8; to run the
 	    <filename>ppp-pap-dialup</filename> script for detected
 	    <acronym>PPP</acronym> connections.</para>
 
@@ -1070,11 +1071,11 @@ set nbns 203.14.100.5</programlisting>
 	</sect4>
 
 	<sect4>
-	  <title>Changing the <command>ppp</command> Configuration
+	  <title>Changing the &man.ppp.8; Configuration
 	    on the Fly</title>
 
-	  <para>It is possible to talk to the <command>ppp</command>
-	    program while it is running in the background, but only
+	  <para>It is possible to talk to &man.ppp.8;
+	    while it is running in the background, but only
 	    if a suitable diagnostic port has been set up.  To do
 	    this, add the following line to the configuration:</para>
 
@@ -1133,7 +1134,7 @@ nat port tcp 10.0.0.2:http http</program
 	  <primary>PPP</primary><secondary>configuration</secondary>
 	</indexterm>
 
-	<para>Now that <command>ppp</command> is configured, there are
+	<para>Now that &man.ppp.8; is configured, there are
 	  a few more things to edit in
 	  <filename>/etc/rc.conf</filename>.</para>
 
@@ -1164,7 +1165,7 @@ ifconfig_tun0=</programlisting>
 	  <programlisting>ppp -auto mysystem</programlisting>
 
 	  <para>This script is executed at network configuration time,
-	    starting the <command>ppp</command> daemon in
+	    starting the &man.ppp.8; daemon in
 	    <option>-auto</option> mode.  If the machine functions as
 	    a gateway for a LAN, consider using the
 	    <option>-alias</option> switch.  Refer to the manual page
@@ -1181,24 +1182,24 @@ ifconfig_tun0=</programlisting>
 	  <primary><application>routed</application></primary>
 	</indexterm>
 
-	<para>It is important that the <command>routed</command>
-	  daemon is not started, as <command>routed</command> tends
+	<para>It is important that the &man.routed.8;
+	  daemon is not started, as &man.routed.8; tends
 	  to delete the default routing table entries created by
-	  <command>ppp</command>.</para>
+	  &man.ppp.8;.</para>
 
 	<para>It is probably a good idea to ensure that the
 	  <literal>sendmail_flags</literal> line does not include the
 	  <option>-q</option> option, otherwise
-	  <command>sendmail</command> will attempt to do a network
+	  &man.sendmail.8; will attempt to do a network
 	  lookup every now and then, possibly causing the machine
 	  to dial out.  Try this command instead:</para>
 
 	<programlisting>sendmail_flags="-bd"</programlisting>
 
 	<indexterm>
-	  <primary><application>sendmail</application></primary>
+	  <primary><application>Sendmail</application></primary>
 	</indexterm>
-	<para>The downside is that <command>sendmail</command> must be
+	<para>The downside is that &man.sendmail.8; must be
 	  forced to re-examine the mail queue whenever the
 	  <acronym>PPP</acronym> link is up by typing:</para>
 
@@ -1227,7 +1228,7 @@ ifconfig_tun0=</programlisting>
 
 	<para>and then <command>dial provider</command> to start the
 	  <acronym>PPP</acronym> session, or, to configure
-	  <command>ppp</command> to establish sessions automatically
+	  &man.ppp.8; to establish sessions automatically
 	  when there is outbound traffic and there is no existing
 	  <filename>start_if.tun0</filename> script, type:</para>
 
@@ -1346,9 +1347,9 @@ ifconfig_tun0=</programlisting>
       using <acronym>PPP</acronym> over a modem connection.  Some
       <acronym>ISP</acronym>s present the
       <literal>ssword</literal> prompt, and others will present
-      <literal>password</literal>; if the <command>ppp</command>
+      <literal>password</literal>; if the &man.ppp.8;
       script is not written accordingly, the login attempt will
-      fail.  The most common way to debug <command>ppp</command>
+      fail.  The most common way to debug &man.ppp.8;
       connections is by connecting manually.  The following
       information walks through a manual connection step by
       step.</para>
@@ -1364,7 +1365,7 @@ ifconfig_tun0=</programlisting>
       <para>The <devicename>uart</devicename> device is already
 	included in the <literal>GENERIC</literal> kernel, so no
 	additional steps are necessary in this case.  Just
-	check the <command>dmesg</command> output for the modem
+	check the &man.dmesg.8; output for the modem
 	device with:</para>
 
       <screen>&prompt.root; <userinput>dmesg | grep uart</userinput></screen>
@@ -1382,14 +1383,13 @@ ifconfig_tun0=</programlisting>
       <title>Connecting Manually</title>
 
       <para>Connecting to the Internet by manually controlling
-	<command>ppp</command> is quick, easy, and a great way to
+	&man.ppp.8; is quick, easy, and a great way to
 	debug a connection or just get information on how the
-	<acronym>ISP</acronym> treats <command>ppp</command> client
-	connections.  Lets start <application>PPP</application> from
-	the command line.  The following examples use
+	<acronym>ISP</acronym> treats &man.ppp.8; client
+	connections.  The following examples use
 	<emphasis>example</emphasis> as the hostname of the
-	machine running <application>PPP</application>.  To start
-	<command>ppp</command>:</para>
+	machine running &man.ppp.8;.  To start
+	&man.ppp.8;:</para>
 
       <screen>&prompt.root; <userinput>ppp</userinput></screen>
 
@@ -1403,10 +1403,10 @@ ifconfig_tun0=</programlisting>
 
       <screen>ppp ON example&gt; <userinput>set speed 115200</userinput></screen>
 
-      <para>This tells <command>ppp</command> to configure the
+      <para>This tells &man.ppp.8; to configure the
 	resolver and add the nameserver lines to
 	<filename>/etc/resolv.conf</filename>.  If
-	<command>ppp</command> cannot determine the hostname, it can
+	&man.ppp.8; cannot determine the hostname, it can
 	manually be set later.</para>
 
       <screen>ppp ON example&gt; <userinput>enable dns</userinput></screen>
@@ -1423,8 +1423,8 @@ type '~h' for help</programlisting>
 OK
 <userinput>atdt<replaceable>123456789</replaceable></userinput></screen>
 
-      <para>Use <command>at</command> to initialize the modem,
-	then use <command>atdt</command> and the number for the
+      <para>Use &man.at.1; to initialize the modem,
+	then type <command>atdt</command> and the number for the
 	<acronym>ISP</acronym> to begin the dial in process.</para>
 
       <screen>CONNECT</screen>
@@ -1451,8 +1451,8 @@ OK
       <para>Depending on the <acronym>ISP</acronym>, this prompt
 	may never appear.  Here we are being asked if we wish to
 	use a shell on the provider, or to start
-	<command>ppp</command>.  In this example, we have chosen
-	to use <command>ppp</command> as we want an Internet
+	&man.ppp.8;.  In this example, we have chosen
+	to use &man.ppp.8; as we want an Internet
 	connection.</para>
 
       <screen>Ppp ON example&gt;</screen>
@@ -1492,7 +1492,7 @@ OK
 	uppercase <literal>P</literal> indicates a
 	connection to the <acronym>ISP</acronym> and a lowercase
 	<literal>p</literal> indicates that the connection has been
-	lost.  <command>ppp</command> only has these 2 states.</para>
+	lost.  &man.ppp.8; only has these 2 states.</para>
 
       <sect3>
 	<title>Debugging</title>
@@ -1522,7 +1522,7 @@ OK
 	  command mode, which is usually a negotiation error where
 	  the <acronym>ISP</acronym> is waiting for your side to start
 	  negotiating.  At this point, using the <command>~p</command>
-	  command will force <command>ppp</command> to start
+	  command will force &man.ppp.8; to start
 	  sending the configuration information.</para>
 
 	<para>If a login prompt never appears, try using
@@ -1617,7 +1617,7 @@ nameserver <replaceable>y.y.y.y</replace
       <para>No kernel configuration is necessary for
 	<acronym>PPPoE</acronym>.  If the necessary netgraph support
 	is not built into the kernel, it will be dynamically loaded by
-	<command>ppp</command>.</para>
+	&man.ppp.8;.</para>
     </sect2>
 
     <sect2>
@@ -1641,7 +1641,7 @@ name_of_service_provider:
     </sect2>
 
     <sect2>
-      <title>Running <command>ppp</command></title>
+      <title>Running &man.ppp.8;</title>
 
       <para>As <username>root</username>, run:</para>
 
@@ -1650,7 +1650,7 @@ name_of_service_provider:
     </sect2>
 
     <sect2>
-      <title>Starting <command>ppp</command> at Boot</title>
+      <title>Starting &man.ppp.8; at Boot</title>
 
       <para>Add the following to
 	<filename>/etc/rc.conf</filename>:</para>
@@ -1685,8 +1685,8 @@ ppp_profile="name_of_service_provider"</
       <para>The profile name (service tag) will be used in the
 	<acronym>PPPoE</acronym> configuration entry in
 	<filename>ppp.conf</filename> as the provider part of the
-	<command>set device</command> command (see the &man.ppp.8;
-	manual page for full details).  It should look like
+	<command>set device</command> command (refer to &man.ppp.8;
+	for details).  It should look like
 	this:</para>
 
       <programlisting>set device PPPoE:<replaceable>xl1</replaceable>:<replaceable>ISP</replaceable></programlisting>
@@ -1801,7 +1801,7 @@ ppp_profile="name_of_service_provider"</
       <programlisting>usbd_enable="YES"</programlisting>
 
       <para>It is also possible to set up
-	<command>ppp</command> to dial up at startup.  To do
+	&man.ppp.8; to dial up at startup.  To do
 	this add the following lines to
 	<filename>/etc/rc.conf</filename>:</para>
 
@@ -1993,7 +1993,7 @@ ng0: flags=88d1&lt;UP,POINTOPOINT,RUNNIN
       <para>A <devicename>tun</devicename> virtual tunnel device
 	will be created for interaction between the
 	<application>pptp</application> and
-	<command>ppp</command> processes.  Once the prompt is
+	&man.ppp.8; processes.  Once the prompt is
 	returned, or the <application>pptp</application> process has
 	confirmed a connection, examine the tunnel:</para>
 
@@ -2004,7 +2004,7 @@ tun0: flags=8051&lt;UP,POINTOPOINT,RUNNI
 
       <para>If unable to connect, check the router configuration,
 	which is usually accessible via
-	<application>telnet</application> or a web browser.  Examine
+	&man.telnet.1; or a web browser.  Examine
 	the output of <command>pptp</command> and the contents of
 	<filename>/var/log/ppp.log</filename> for clues.</para>
     </sect2>

From owner-svn-doc-projects@FreeBSD.ORG  Tue Apr 30 09:50:27 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id E535DF25;
 Tue, 30 Apr 2013 09:50:27 +0000 (UTC)
 (envelope-from gabor@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id D53A6165C;
 Tue, 30 Apr 2013 09:50:27 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r3U9oRG7063111;
 Tue, 30 Apr 2013 09:50:27 GMT (envelope-from gabor@svn.freebsd.org)
Received: (from gabor@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r3U9oNqX063075;
 Tue, 30 Apr 2013 09:50:23 GMT (envelope-from gabor@svn.freebsd.org)
Message-Id: <201304300950.r3U9oNqX063075@svn.freebsd.org>
From: Gabor Kovesdan <gabor@FreeBSD.org>
Date: Tue, 30 Apr 2013 09:50:23 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41526 - in projects/xml-tools: de_DE.ISO8859-1/articles
 de_DE.ISO8859-1/articles/freebsd-update-server
 de_DE.ISO8859-1/articles/port-mentor-guidelines
 de_DE.ISO8859-1/books/handbook/cu...
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Apr 2013 09:50:28 -0000

Author: gabor
Date: Tue Apr 30 09:50:22 2013
New Revision: 41526
URL: http://svnweb.freebsd.org/changeset/doc/41526

Log:
  - MFH

Added:
  projects/xml-tools/de_DE.ISO8859-1/articles/freebsd-update-server/
     - copied from r41525, head/de_DE.ISO8859-1/articles/freebsd-update-server/
  projects/xml-tools/en_US.ISO8859-1/htdocs/internal/clusteradm.xml
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/internal/clusteradm.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2011-freebsd-gsoc-thumbnail.jpg
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/projects/2011-freebsd-gsoc-thumbnail.jpg
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2013-freebsd-gsoc-thumbnail.jpg
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/projects/2013-freebsd-gsoc-thumbnail.jpg
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2013-freebsd-gsoc.pdf
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/projects/2013-freebsd-gsoc.pdf
  projects/xml-tools/en_US.ISO8859-1/htdocs/security/reporting.xml
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/security/reporting.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/security/unsupported.xml
     - copied unchanged from r41525, head/en_US.ISO8859-1/htdocs/security/unsupported.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/security/reporting.xml
     - copied unchanged from r41525, head/ja_JP.eucJP/htdocs/security/reporting.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/security/unsupported.xml
     - copied unchanged from r41525, head/ja_JP.eucJP/htdocs/security/unsupported.xml
  projects/xml-tools/share/pgpkeys/asomers.key
     - copied unchanged from r41525, head/share/pgpkeys/asomers.key
  projects/xml-tools/share/pgpkeys/bhaga.key
     - copied unchanged from r41525, head/share/pgpkeys/bhaga.key
  projects/xml-tools/share/pgpkeys/bk.key
     - copied unchanged from r41525, head/share/pgpkeys/bk.key
  projects/xml-tools/share/pgpkeys/deb.key
     - copied unchanged from r41525, head/share/pgpkeys/deb.key
  projects/xml-tools/share/pgpkeys/dhw.key
     - copied unchanged from r41525, head/share/pgpkeys/dhw.key
  projects/xml-tools/share/pgpkeys/dutchdaemon.key
     - copied unchanged from r41525, head/share/pgpkeys/dutchdaemon.key
  projects/xml-tools/share/pgpkeys/hiren.key
     - copied unchanged from r41525, head/share/pgpkeys/hiren.key
  projects/xml-tools/share/pgpkeys/pgpkeys-other.xml
     - copied unchanged from r41525, head/share/pgpkeys/pgpkeys-other.xml
  projects/xml-tools/share/security/advisories/FreeBSD-SA-13:05.nfsserver.asc
     - copied unchanged from r41525, head/share/security/advisories/FreeBSD-SA-13:05.nfsserver.asc
  projects/xml-tools/share/security/patches/SA-13:05/
     - copied from r41525, head/share/security/patches/SA-13:05/
Deleted:
  projects/xml-tools/ja_JP.eucJP/htdocs/FAQ/
  projects/xml-tools/ja_JP.eucJP/htdocs/availability.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/tutorials/
Modified:
  projects/xml-tools/de_DE.ISO8859-1/articles/Makefile
  projects/xml-tools/de_DE.ISO8859-1/articles/freebsd-update-server/article.xml
  projects/xml-tools/de_DE.ISO8859-1/articles/port-mentor-guidelines/article.xml
  projects/xml-tools/de_DE.ISO8859-1/books/handbook/cutting-edge/chapter.xml
  projects/xml-tools/de_DE.ISO8859-1/books/porters-handbook/book.xml
  projects/xml-tools/de_DE.ISO8859-1/htdocs/docs/books.xml
  projects/xml-tools/de_DE.ISO8859-1/share/xml/news.xml
  projects/xml-tools/de_DE.ISO8859-1/share/xml/release.l10n.ent
  projects/xml-tools/en_US.ISO8859-1/articles/committers-guide/article.xml
  projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.additional.xml
  projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.committers.xml
  projects/xml-tools/en_US.ISO8859-1/books/handbook/jails/chapter.xml
  projects/xml-tools/en_US.ISO8859-1/books/handbook/kernelconfig/chapter.xml
  projects/xml-tools/en_US.ISO8859-1/books/handbook/pgpkeys/chapter.xml
  projects/xml-tools/en_US.ISO8859-1/books/handbook/ports/chapter.xml
  projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/book.xml
  projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/uses.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/administration.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/advocacy/myths.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/docs/books.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/internal/Makefile
  projects/xml-tools/en_US.ISO8859-1/htdocs/portmgr/policies_eol.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/Makefile
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/summerofcode.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/releases/8.4R/schedule.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/security/Makefile
  projects/xml-tools/en_US.ISO8859-1/htdocs/security/security.xml
  projects/xml-tools/en_US.ISO8859-1/htdocs/where.xml
  projects/xml-tools/ja_JP.eucJP/books/handbook/kernelconfig/chapter.xml
  projects/xml-tools/ja_JP.eucJP/books/handbook/ports/chapter.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/Makefile
  projects/xml-tools/ja_JP.eucJP/htdocs/docs/books.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/internal/Makefile
  projects/xml-tools/ja_JP.eucJP/htdocs/security/Makefile
  projects/xml-tools/ja_JP.eucJP/htdocs/security/security.xml
  projects/xml-tools/ja_JP.eucJP/htdocs/where.xml
  projects/xml-tools/ja_JP.eucJP/share/xml/navibar.l10n.ent
  projects/xml-tools/ja_JP.eucJP/share/xml/news.xml
  projects/xml-tools/ru_RU.KOI8-R/articles/freebsd-questions/article.xml
  projects/xml-tools/ru_RU.KOI8-R/articles/geom-class/article.xml
  projects/xml-tools/ru_RU.KOI8-R/articles/hubs/article.xml
  projects/xml-tools/ru_RU.KOI8-R/articles/pr-guidelines/article.xml
  projects/xml-tools/ru_RU.KOI8-R/books/design-44bsd/Makefile
  projects/xml-tools/ru_RU.KOI8-R/books/design-44bsd/book.xml
  projects/xml-tools/ru_RU.KOI8-R/books/handbook/install/chapter.xml
  projects/xml-tools/ru_RU.KOI8-R/books/handbook/ports/chapter.xml
  projects/xml-tools/share/pgpkeys/pgpkeys-developers.xml
  projects/xml-tools/share/pgpkeys/pgpkeys.ent
  projects/xml-tools/share/xml/advisories.xml
  projects/xml-tools/share/xml/authors.ent
  projects/xml-tools/share/xml/commercial.consult.xml
  projects/xml-tools/share/xml/commercial.isp.xml
  projects/xml-tools/share/xml/developers.ent
  projects/xml-tools/share/xml/navibar.ent
  projects/xml-tools/share/xml/news.xml
  projects/xml-tools/share/xml/release.ent
Directory Properties:
  projects/xml-tools/   (props changed)
  projects/xml-tools/de_DE.ISO8859-1/   (props changed)
  projects/xml-tools/en_US.ISO8859-1/   (props changed)
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2009-freebsd-gsoc.pdf   (props changed)
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2010-freebsd-gsoc.pdf   (props changed)
  projects/xml-tools/en_US.ISO8859-1/htdocs/projects/2011-freebsd-gsoc.pdf   (props changed)
  projects/xml-tools/ja_JP.eucJP/   (props changed)
  projects/xml-tools/ru_RU.KOI8-R/   (props changed)
  projects/xml-tools/share/   (props changed)

Modified: projects/xml-tools/de_DE.ISO8859-1/articles/Makefile
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/articles/Makefile	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/articles/Makefile	Tue Apr 30 09:50:22 2013	(r41526)
@@ -8,6 +8,7 @@
 SUBDIR = contributing
 SUBDIR+= contributing-ports
 SUBDIR+= explaining-bsd
+SUBDIR+= freebsd-update-server
 SUBDIR+= laptop
 SUBDIR+= linux-comparison
 SUBDIR+= nanobsd

Modified: projects/xml-tools/de_DE.ISO8859-1/articles/freebsd-update-server/article.xml
==============================================================================
--- head/de_DE.ISO8859-1/articles/freebsd-update-server/article.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/articles/freebsd-update-server/article.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -1,8 +1,6 @@
-<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>
-<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook XML V4.2-Based Extension//EN"
-        "../../../share/xml/freebsd42.dtd" [
-<!ENTITY % entities PUBLIC "-//FreeBSD//ENTITIES DocBook FreeBSD Entity Set//DE" "../../share/xml/entities.ent">
-%entities;
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE article PUBLIC "-//FreeBSD//DTD DocBook XML V4.5-Based Extension//EN"
+        "../../../share/xml/freebsd45.dtd" [
 <!ENTITY fbus.ap "<application>FreeBSD Update Server</application>">
 ]>
 
@@ -836,14 +834,14 @@ the new builds.</screen>
 
 	<screen>               # Build the world
 		   log "Building world"
-		   cd /usr/src &&
-		   make -j 2 ${COMPATFLAGS} buildworld 2>&1
+		   cd /usr/src &amp;&amp;
+		   make -j 2 ${COMPATFLAGS} buildworld 2&gt;&amp;1
 
 		# Distribute the world
 		   log "Distributing world"
-		   cd /usr/src/release &&
-		   make -j 2 obj &&
-		   make ${COMPATFLAGS} release.1 release.2 2>&1</screen>
+		   cd /usr/src/release &amp;&amp;
+		   make -j 2 obj &amp;&amp;
+		   make ${COMPATFLAGS} release.1 release.2 2&gt;&amp;1</screen>
       </listitem>
 
       <listitem>

Modified: projects/xml-tools/de_DE.ISO8859-1/articles/port-mentor-guidelines/article.xml
==============================================================================
Binary file (source and/or target). No diff available.

Modified: projects/xml-tools/de_DE.ISO8859-1/books/handbook/cutting-edge/chapter.xml
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/books/handbook/cutting-edge/chapter.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/books/handbook/cutting-edge/chapter.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -379,7 +379,7 @@ MergeChanges /etc/ /var/named/etc/</prog
           <literal>-p</literal>-Nummer, die von dem Kommando <command>uname
           -r</command> ausgegeben wird) wird aus dieser Datei ausgelesen.
           Die Neuinstallation des selbstkonfigurierten Kernels, selbst wenn
-          sich daran nichts geädert hat, erlaubt es &man.uname.1;, den
+          sich daran nichts geändert hat, erlaubt es &man.uname.1;, den
           aktuellen Patch-Level des Systems korrekt wiederzugeben.  Dies ist
           besonders hilfreich, wenn mehrere Systeme gewartet werden, da es
           eine schnelle Einschätzung der installierten Aktualisierungen in

Modified: projects/xml-tools/de_DE.ISO8859-1/books/porters-handbook/book.xml
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/books/porters-handbook/book.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/books/porters-handbook/book.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -8,7 +8,7 @@
 
     $FreeBSD$
     $FreeBSDde: de-docproj/books/porters-handbook/book.xml,v 1.241 2011/10/08 16:18:17 jkois Exp $
-    basiert auf: 1.1117
+    basiert auf: r37819
 -->
 
 <book id="of" lang="de">
@@ -15824,12 +15824,50 @@ Reference: &lt;http://www.freebsd.org/po
 	    </row>
 
 	    <row>
+	      <entry>900040</entry>
+	      <entry>19. Juli 2011</entry>
+	      <entry>Standardmäßige Erhöhung von MAXCPU für &os; auf
+		64 für amd64 und ia64 und auf 128 für XLP
+		(mips).</entry>
+	    </row>
+
+	    <row>
 	      <entry>900041</entry>
 	      <entry>13.&nbsp;August&nbsp;2011</entry>
 	      <entry>9.0-CURRENT, nachdem Capsicum-Funktionalitäten
 		implementiert wurden.  Zusätzlich wurde fget(9) um ein
 		Rechte-Argument erweitert.</entry>
             </row>
+
+	    <row>
+	      <entry>900042</entry>
+	      <entry>28. August 2011</entry>
+	      <entry>Versionssprünge für Shared-Libraries deren ABI
+		sich geändert hat, in Vorbereitung für 9.0.</entry>
+	    </row>
+
+	    <row>
+	      <entry>900043</entry>
+	      <entry>2. September 2011</entry>
+	      <entry>Automatische Erkennung von USB-Massenspeicher
+		Geräten, die das no synchronize cache SCSI Kommando
+		nicht unterstützen.</entry>
+	    </row>
+
+	    <row>
+	      <entry>900044</entry>
+	      <entry>10. September 2011</entry>
+	      <entry>Re-factor auto-quirk.</entry>
+	    </row>
+
+	    <row>
+	      <entry>900045</entry>
+	      <entry>13. Oktober 2011</entry>
+	      <entry>Allen nicht-kompatiblen
+		Systemaufruf-Einstiegspunkten wurde ein sys_
+		vorangestellt.</entry>
+	    </row>
+
 	  </tbody>
 	</tgroup>
       </table>

Modified: projects/xml-tools/de_DE.ISO8859-1/htdocs/docs/books.xml
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/htdocs/docs/books.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/htdocs/docs/books.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!DOCTYPE html PUBLIC "-//FreeBSD//DTD XHTML 1.0 Transitional-Based Extension//EN"
 "http://www.FreeBSD.org/XML/doc/share/xml/xhtml10-freebsd.dtd" [
-<!ENTITY dedate "$FreeBSDde: de-www/docs/books.xml,v 1.32 2011/02/20 14:05:21 jkois Exp $">
+<!ENTITY dedate "$FreeBSDde$">
 <!ENTITY title "Online vorhandene Bücher und Artikel">
-<!ENTITY reference "basiert auf: 1.41">
+<!ENTITY reference "basiert auf: r39632">
 <!ENTITY url.articles "../../doc/en_US.ISO8859-1/articles">
 <!ENTITY url.articles.de "../../doc/de_DE.ISO8859-1/articles">
 <!ENTITY url.books "../../doc/en_US.ISO8859-1/books">
@@ -256,7 +256,7 @@
         (mh)<br/>
       Eine Einführung in das MH-Mailprogramm.</p>
 
-    <p><a href="&url.articles;/nanobsd/index.html">NanoBSD</a>
+    <p><a href="&url.articles.de;/nanobsd/index.html">NanoBSD</a>
         (nanobsd)<br/>
       Informationen zu den NanoBSD-Werkzeugen, mit deren Hilfe
         sich FreeBSD-Images für den Einsatz in eingebetteten

Modified: projects/xml-tools/de_DE.ISO8859-1/share/xml/news.xml
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/share/xml/news.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/share/xml/news.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -4,7 +4,7 @@
 <!--
      $FreeBSD$
      $FreeBSDde$
-     basiert auf: r41381
+     basiert auf: r41484
 -->
 
 <!-- Simple schema for FreeBSD Project news.
@@ -42,6 +42,91 @@
       <name>4</name>
 
       <day>
+	<name>24</name>
+
+	<event>
+	  <title>Das FreeBSD Project nimmt am Google Summer of
+	    Code 2013 teil</title>
+
+	  <p>Das FreeBSD Project freut sich, bekanntgeben zu dürfen,
+	    das es auch dieses Jahr an Google's Summer of Code-Programm
+	    teilnimmt.  Durch dieses Programm wird die Arbeit von Studenten
+	    im Rahmen von Open Source-Projekten gefördert.  Das
+	    FreeBSD Project nimmt bereits zum neunten Mal hintereinander
+	    an diesem Programm teil und hat seit der ersten Teilnahme 2005
+	    mehr als 150 Studenten erfolgreich durch deren Arbeiten
+	    begleitet.</p>
+
+	  <p>Zu den erfolgreich abgeschlossenen Projekten gehören
+	    Verbesserungen an der Linux-ABI-Emulation, NFSv4 ACLs,
+	    TCP-Regressionstests, die Unterstützung für das
+	    FUSE-Dateisytem sowie zahlreiche andere Projekte.  Viele
+	    Studenten, die an diesem Programm teilnahmen, sind inzwischen
+	    aktive FreeBSD-Entwickler und/oder nehmen (nicht zuletzt
+	    dank der Unterstützung der FreeBSD Foundation) weiterhin
+	    aktiv an verschiedenen FreeBSD-Veranstaltungen auf der
+	    ganzen Welt teil.</p>
+
+	  <p>Wir laden alle Studenten ein, während des Sommers gegen
+	    Bezahlung an der Weiterentwicklung von &os; zu arbeiten!
+	    Weitere Informationen zu möglichen Projektvorschlägen
+	    sowie zum Ablauf finden sich auf der Seite <a
+	    href="&enbase;/projects/summerofcode.html">FreeBSD Summer
+	    Projects</a>.</p>
+	</event>
+      </day>
+   
+      <day>
+	<name>22</name>
+
+	<event>
+	  <title>&os;&nbsp;8.4-RC2 verfügbar</title>
+
+	  <p>Der zweite Release Candidate aus dem &os;-8.4-Releasezyklus
+	    ist <a
+	    href="&lists.stable;/2013-April/073198.html">verfügbar</a>.
+	    ISO-Images für die Architekturen amd64, i386 sowie
+	    pc98 sind inzwischen auf den meisten <a
+            href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/mirrors-ftp.html">&os;
+	    Spiegelservern</a> vorhanden.</p>  
+	</event>
+      </day>
+
+      <day>
+	<name>18</name>
+
+	<event>
+	  <p>Erweiterte Commit-Privilegien: <a
+	    href="mailto:cy@FreeBSD.org">Cy Schubert</a> (src, ports)</p>
+	</event>
+      </day>
+      
+      <day>
+	<name>12</name>
+
+	<event>
+	  <p>Neuer Committer: <a
+	    href="mailto:hiren@FreeBSD.org">Hiren Panchasara</a> (src)</p>
+	</event>
+      </day>
+
+      <day>
+	<name>10</name>
+
+	<event>
+	  <title>&os;&nbsp;8.4-RC1 verfügbar</title>
+
+	  <p>Der erste Release Candidate aus dem &os;-8.4-Releasezyklus
+	    ist <a
+	    href="&lists.stable;/2013-April/073070.html">verfügbar</a>.
+	    ISO-Images für die Architekturen amd64, i386 sowie
+	    pc98 sind inzwischen auf den meisten <a
+            href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/mirrors-ftp.html">&os;
+	    Spiegelservern</a> vorhanden.</p>
+	</event>
+      </day>
+
+      <day>
 	<name>3</name>
 
 	<event>

Modified: projects/xml-tools/de_DE.ISO8859-1/share/xml/release.l10n.ent
==============================================================================
--- projects/xml-tools/de_DE.ISO8859-1/share/xml/release.l10n.ent	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/de_DE.ISO8859-1/share/xml/release.l10n.ent	Tue Apr 30 09:50:22 2013	(r41526)
@@ -2,7 +2,7 @@
 <!--
      $FreeBSD$
      $FreeBSDde$
-     basiert auf: r41289
+     basiert auf: r41400
 -->
 <![%beta2.testing;[
 <!ENTITY beta.plural 'en'>
@@ -16,7 +16,7 @@
         <tr style="text-align: center;">
           <td colspan="2">Version &amp; Plattform</td>
           <td>Distribution</td>
-          <td title="ISO9660 CD image"><a href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/install-diff-media.html#INSTALL-CDROM">ISO</a></td>
+          <td title="ISO9660 CD image"><a href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/install-diff-media.html#install-cdrom">ISO</a></td>
 
           <td>Statusseite</td>
         </tr>
@@ -89,7 +89,7 @@
         <tr style="text-align: center;">
           <td colspan="2">Version &amp; Plattform</td>
           <td>Distribution</td>
-          <td title="ISO9660 CD image"><a href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/install-diff-media.html#INSTALL-CDROM">ISO</a></td>
+          <td title="ISO9660 CD image"><a href="&enbase;/doc/de_DE.ISO8859-1/books/handbook/install-diff-media.html#install-cdrom">ISO</a></td>
           <!--<td>Statusseite</td>-->
         </tr>
       </thead>

Modified: projects/xml-tools/en_US.ISO8859-1/articles/committers-guide/article.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/articles/committers-guide/article.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/articles/committers-guide/article.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -143,7 +143,6 @@
 		Branches</emphasis></entry>
 
 	    <entry>
-	      <literal>stable/7</literal> (7.X-STABLE),
 	      <literal>stable/8</literal> (8.X-STABLE),
 	      <literal>stable/9</literal> (9.X-STABLE),
 	      <literal>head</literal> (-CURRENT)
@@ -2426,10 +2425,10 @@ ControlPersist yes</screen>
       </varlistentry>
 
       <varlistentry>
-	<term>&a.simon;</term>
+	<term>&a.des;</term>
 
 	<listitem>
-	  <para>Simon is the
+	  <para>Dag-Erling is the
 	  <ulink url="&url.base;/security/">FreeBSD Security
 	  Officer</ulink>
 	  and oversees the &a.security-officer;.

Modified: projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.additional.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.additional.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.additional.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -2086,6 +2086,11 @@
     </listitem>
 
     <listitem>
+      <para>Daniel Levai
+	<email>leva@ecentrum.hu</email></para>
+    </listitem>
+
+    <listitem>
       <para>Daniel J. O'Connor
 	<email>darius@dons.net.au</email></para>
     </listitem>

Modified: projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.committers.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.committers.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/articles/contributors/contrib.committers.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -1088,6 +1088,10 @@
     </listitem>
 
     <listitem>
+      <para>&a.hiren;</para>
+    </listitem>
+
+    <listitem>
       <para>&a.hmp;</para>
     </listitem>
 
@@ -1376,6 +1380,10 @@
     </listitem>
 
     <listitem>
+      <para>&a.asomers;</para>
+    </listitem>
+
+    <listitem>
       <para>&a.brian;</para>
     </listitem>
 

Modified: projects/xml-tools/en_US.ISO8859-1/books/handbook/jails/chapter.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/handbook/jails/chapter.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/handbook/jails/chapter.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -556,7 +556,6 @@ jail_<replaceable>www</replaceable>_devf
 	    usage of its features.  If the presented steps below look
 	    too complicated, it is advised to take a look at a simpler
 	    system such as <filename
-	      role="package">sysutils/qjail</filename> or <filename
 	      role="package">sysutils/ezjail</filename>, which provides
 	    an easier method of administering &os; jails and is not as
 	    sophisticated as this setup.</para>

Modified: projects/xml-tools/en_US.ISO8859-1/books/handbook/kernelconfig/chapter.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/handbook/kernelconfig/chapter.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/handbook/kernelconfig/chapter.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -493,14 +493,16 @@ options         IPDIVERT</programlisting
       <filename>GENERIC</filename> will be also be added to the local
       kernel unless they are specifically prevented using
       <literal>nooptions</literal> or <literal>nodevice</literal>.
-      The remainder of this chapter addresses the contents of a
+      A comprehensive list of configuration directives and their
+      descriptions may be found in &man.config.5;.</para>
+
+    <para>The remainder of this chapter addresses the contents of a
       typical configuration file and the role various options and
       devices play.</para>
 
     <note>
       <para>To build a file which contains all available options,
 	run the following command as <username>root</username>:</para>
-
       <screen>&prompt.root; <userinput>cd /usr/src/sys/<replaceable>i386</replaceable>/conf &amp;&amp; make LINT</userinput></screen>
     </note>
 

Modified: projects/xml-tools/en_US.ISO8859-1/books/handbook/pgpkeys/chapter.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/handbook/pgpkeys/chapter.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/handbook/pgpkeys/chapter.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -37,4 +37,10 @@
 
     &section.pgpkeys-developers;
   </sect1>
+
+  <sect1 id="pgpkeys-other">
+    <title>Other Cluster Account Holders</title>
+
+    &section.pgpkeys-other;
+  </sect1>
 </appendix>

Modified: projects/xml-tools/en_US.ISO8859-1/books/handbook/ports/chapter.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/handbook/ports/chapter.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/handbook/ports/chapter.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -1337,7 +1337,7 @@ Deinstalling ca_root_nss-3.13.5... done<
 
       <para>Once the compile is complete, you are returned to the
 	prompt.  The next step is to install the port using
-	<maketarget>make install</maketarget>:</para>
+	<command>make <maketarget>install</maketarget></command>:</para>
 
       <screen>&prompt.root; <userinput>make install</userinput>
 ===&gt;  Installing for lsof-4.57
@@ -1778,7 +1778,8 @@ ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/
 
       <note>
 	<para>The <command>portsclean</command> utility is part of the
-	  <application>portupgrade</application> suite.</para>
+	  <filename role="package">ports-mgmt/portupgrade</filename>
+	  suite.</para>
       </note>
 
       <para><filename

Modified: projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/book.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/book.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/book.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -2072,10 +2072,7 @@ PORTEPOCH=	1</programlisting>
 		  directly supports the window system.  Do not put
 		  regular X applications here; most of them should go
 		  into other <filename>x11-*</filename> categories
-		  (see below).  If your port <emphasis>is</emphasis>
-		  an X application, define <makevar>USE_XLIB</makevar>
-		  (implied by <makevar>USE_IMAKE</makevar>) and put it
-		  in the appropriate category.</entry>
+		  (see below).</entry>
 	      </row>
 
 	      <row>
@@ -3866,17 +3863,6 @@ ALWAYS_KEEP_DISTFILES=	yes
 	      </row>
 
 	      <row>
-		<entry><makevar>USE_CDRTOOLS</makevar></entry>
-		<entry>The port requires
-		  <application>cdrecord</application> either from
-		  <filename
-		    role="package">sysutils/cdrtools</filename> or
-		  <filename
-		    role="package">sysutils/cdrtools-cjk</filename>,
-		  according to the user's preference.</entry>
-	      </row>
-
-	      <row>
 		<entry><makevar>USE_GCC</makevar></entry>
 		<entry>The port requires a specific version of
 		  <command>gcc</command> to build.  The exact version
@@ -5775,69 +5761,18 @@ CMAKE_SOURCE_PATH=	&dollar;{WRKSRC}/subp
       </sect2>
     </sect1>
 
-    <sect1 id="using-pkg-config">
-      <title>Using <literal>pkg-config</literal></title>
-
-      <para>If your ports requires <literal>pkg-config</literal>,
-	just set <makevar>USE_PKGCONFIG</makevar> to the following
-	possible values:</para>
-      <table frame="none">
-	<title>Values for <makevar>USE_PKGCONFIG</makevar></title>
-
-	<tgroup cols="2">
-	  <thead>
-	    <row>
-	      <entry>Definition</entry>
-	      <entry>Description</entry>
-	    </row>
-	  </thead>
-
-	  <tbody>
-	    <row>
-	      <entry><makevar>USE_PKGCONFIG= yes</makevar></entry>
-	      <entry>The ports uses pkg-config only at build
-		time</entry>
-	    </row>
-
-	    <row>
-	      <entry><makevar>USE_PKGCONFIG= build</makevar></entry>
-	      <entry>The ports uses pkg-config only at build
-		time</entry>
-	    </row>
-
-	    <row>
-	      <entry><makevar>USE_PKGCONFIG= run</makevar></entry>
-	      <entry>The ports uses pkg-config only at run
-		time</entry>
-	    </row>
-
-	    <row>
-	      <entry><makevar>USE_PKGCONFIG= both</makevar></entry>
-	      <entry>The ports uses pkg-config both at build and run
-		time</entry>
-	    </row>
-	  </tbody>
-	</tgroup>
-      </table>
-    </sect1>
-
     <sect1 id="using-gettext">
       <title>Using GNU <literal>gettext</literal></title>
 
       <sect2>
 	<title>Basic Usage</title>
 
-	<para>If your port requires <literal>gettext</literal>,
-	  just set <makevar>USE_GETTEXT</makevar> to
-	  <literal>yes</literal>, and your port will grow the
-	  dependency on <filename
-	    role="package">devel/gettext</filename>.  The value of
-	  <makevar>USE_GETTEXT</makevar> can also specify the required
-	  version of the <literal>libintl</literal> library, the basic
-	  part of <literal>gettext</literal>, but using this feature
-	  is <emphasis>strongly discouraged</emphasis>: Your port
-	  should work with just the current version of <filename
-	    role="package">devel/gettext</filename>.</para>
+	<para>If your port requires <literal>gettext</literal>, set
+	  <literal>USES= gettext</literal>, and your
+	  port will inherit a dependency on <filename
+	    role="package">devel/gettext</filename>. Other values for
+	  <literal>gettext</literal> usage are listed in <xref
+	  linkend="uses-values"/>.</para>
 
 	<para>A rather common case is a port using
 	  <literal>gettext</literal> and <command>configure</command>.
@@ -5848,7 +5783,7 @@ CMAKE_SOURCE_PATH=	&dollar;{WRKSRC}/subp
 	  <envar>CPPFLAGS</envar> and <envar>LDFLAGS</envar> as
 	  follows:</para>
 
-	<programlisting>USE_GETTEXT=	yes
+	<programlisting>USES=	gettext
 CPPFLAGS+=	-I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 
@@ -5857,7 +5792,7 @@ GNU_CONFIGURE=	yes</programlisting>
 	<para>Of course, the code can be more compact if there are no
 	  more flags to pass to <command>configure</command>:</para>
 
-	<programlisting>USE_GETTEXT=	yes
+	<programlisting>USES=	gettext
 GNU_CONFIGURE=	yes</programlisting>
       </sect2>
 
@@ -5878,7 +5813,7 @@ GNU_CONFIGURE=	yes</programlisting>
 .include &lt;bsd.port.options.mk&gt;
 
 .if ${PORT_OPTIONS:MNLS}
-USE_GETTEXT=		yes
+USES+=			gettext
 PLIST_SUB+=		NLS=""
 .else
 CONFIGURE_ARGS+=	--disable-nls
@@ -6134,25 +6069,12 @@ PLIST_SUB+=		NLS="@comment "
 USE_GL=		glu</programlisting>
 	</example>
 
-	<para>Some ports define <makevar>USE_XLIB</makevar>, which
-	  makes the port depend on all the 50 or so libraries.  This
-	  variable exists for backwards compatibility, as it predates
-	  modular X.Org, and should not be used on new ports.</para>
-
 	<table frame="none">
 	  <title>Variables for Ports That Use X</title>
 
 	  <tgroup cols="2">
 	    <tbody>
 	      <row>
-		<entry><makevar>USE_XLIB</makevar></entry>
-		<entry>The port uses the X libraries.  Deprecated -
-		  use a list of X.Org components in
-		  <makevar>USE_XORG</makevar> variable
-		  instead.</entry>
-	      </row>
-
-	      <row>
 		<entry><makevar>USE_IMAKE</makevar></entry>
 		<entry>The port uses <command>imake</command>.</entry>
 	      </row>

Modified: projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/uses.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/uses.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/books/porters-handbook/uses.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -40,15 +40,51 @@
 </row>
 
 <row>
+  <entry><literal>desktop-file-utils</literal></entry>
+  <entry>none</entry>
+
+  <entry>Implies that the port uses the
+    <application>update-desktop-database</application> from
+    <filename role="package">devel/desktop-file-utils</filename>.
+    This uses will automatically add a post-install step in such a way
+    that the port itself still can specify there own post-install step
+    if needed.  It also insert lines into the plist for package
+    install and removal to run
+    <application>update-desktop-database</application>.</entry>
+</row>
+
+<row>
   <entry><literal>fuse</literal></entry>
   <entry>none</entry>
 
   <entry>Implies the port will depend on the FUSE library and handle
-    the the dependency on the kernel module depending on the version
+    the dependency on the kernel module depending on the version
     of &os;.</entry>
 </row>
 
 <row>
+  <entry><literal>gettext</literal></entry>
+  <entry>none, <literal>lib</literal>, <literal>build</literal>,
+    <literal>run</literal></entry>
+  <entry>Implies that the port uses <filename
+      role="package">devel/gettext</filename> in one way or another.  By
+    default, with no arguments or with the <literal>lib</literal>
+    argument, implies <command>gettext</command> with build-time and 
+    run-time dependencies, <literal>build</literal> implies a build-time
+    dependency, and <literal>run</literal> implies a run-time
+    dependency.</entry>
+</row>
+
+<row>
+  <entry><literal>iconv</literal></entry>
+  <entry>none</entry>
+  <entry>Implies that the port uses <filename
+      role="package">converters/libiconv</filename> as build-time and
+    run-time dependency.
+  </entry>
+</row>
+
+<row>
   <entry><literal>pathfix</literal></entry>
   <entry>none</entry>
   <entry>Look for the <filename>Makefile.in</filename> and
@@ -58,6 +94,21 @@
 </row>
 
 <row>
+  <entry><literal>pkgconfig</literal></entry>
+
+  <entry>none, <literal>build</literal>, <literal>run</literal>,
+    <literal>both</literal></entry>
+
+  <entry>Implies that the port uses <filename
+      role="package">devel/pkgconf</filename> in one way or another.
+    With no arguments or with the <literal>build</literal>
+    argument, it implies <command>pkg-config</command> as a build-time
+    dependency; <literal>run</literal> implies a run-time dependency;
+    and <literal>both</literal> implies both run-time and build-time
+    dependencies.</entry>
+</row>
+
+<row>
   <entry><literal>qmail</literal></entry>
   <entry>none, <literal>build</literal>, <literal>run</literal>,
     <literal>both</literal>, <literal>vars</literal></entry>
@@ -72,6 +123,21 @@
 </row>
 
 <row>
+  <entry><literal>shared-mime-info</literal></entry>
+  <entry>none</entry>
+
+  <entry>Implies that the port uses
+    <application>update-mime-database</application> from
+    <filename role="package">misc/shared-mime-info</filename>.  This
+    uses will automatically add a post-install step in such a way that
+    the port itself still can specify there own post-install step if
+    needed.  It also insert lines into the plist for package install
+    and removal to run
+    <application>update-mime-data</application> with the correct
+    arguments.</entry>
+</row>
+
+<row>
   <entry><literal>zenoss</literal></entry>
   <entry>none</entry>
   <entry>Implies the port uses <filename

Modified: projects/xml-tools/en_US.ISO8859-1/htdocs/administration.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/htdocs/administration.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/administration.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -129,7 +129,8 @@
     <li>&a.tabthorpe; &lt;<a href="mailto:tabthorpe@FreeBSD.org">tabthorpe@FreeBSD.org</a>&gt;</li>
     <li>&a.marcus; &lt;<a href="mailto:marcus@FreeBSD.org">marcus@FreeBSD.org</a>&gt;</li>
     <li>&a.bapt; &lt;<a href="mailto:bapt@FreeBSD.org">bapt@FreeBSD.org</a>&gt;</li>
-    <li>&a.bdrewery; &lt;<a href="mailto:bdrewery@FreeBSD.org">bdrewery@FreeBSD.org</a>&gt;</li>
+    <li>&a.bdrewery; &lt;<a href="mailto:bdrewery@FreeBSD.org">bdrewery@FreeBSD.org</a>&gt;
+      (Release Engineering Team Liaison)</li>
     <li>&a.decke; &lt;<a href="mailto:decke@FreeBSD.org">decke@FreeBSD.org</a>&gt;</li>
     <li>&a.erwin; &lt;<a href="mailto:erwin@FreeBSD.org">erwin@FreeBSD.org</a>&gt;</li>
     <li>&a.itetcu; &lt;<a href="mailto:itetcu@FreeBSD.org">itetcu@FreeBSD.org</a>&gt;</li>
@@ -150,12 +151,20 @@
     Engineering Team in greater detail.</p>
 
   <ul>
+    <li>&a.mva; &lt;<a href="mailto:mva@FreeBSD.org">mva@FreeBSD.org</a>&gt;</li>
+    <li>&a.gjb; &lt;<a href="mailto:gjb@FreeBSD.org">gjb@FreeBSD.org</a>&gt;</li>
     <li>&a.kib; &lt;<a href="mailto:kib@FreeBSD.org">kib@FreeBSD.org</a>&gt;</li>
+    <li>&a.joel; &lt;<a href="mailto:joel@FreeBSD.org">joel@FreeBSD.org</a>&gt;</li>
     <li>&a.blackend; &lt;<a href="mailto:blackend@FreeBSD.org">blackend@FreeBSD.org</a>&gt;</li>
+    <li>&a.skreuzer; &lt;<a href="mailto:skreuzer@FreeBSD.org">skreuzer@FreeBSD.org</a>&gt;</li>
+    <li>&a.delphij; &lt;<a href="mailto:delphij@FreeBSD.org">delphij@FreeBSD.org</a>&gt;</li>
     <li>&a.jpaetzel; &lt;<a href="mailto:jpaetzel@FreeBSD.org">jpaetzel@FreeBSD.org</a>&gt;</li>
+    <li>&a.rodrigc; &lt;<a href="mailto:rodrigc@FreeBSD.org">rodrigc@FreeBSD.org</a>&gt;</li>
     <li>&a.hrs; &lt;<a href="mailto:hrs@FreeBSD.org">hrs@FreeBSD.org</a>&gt;</li>
+    <li>&a.glebius; &lt;<a href="mailto:glebius@FreeBSD.org">glebius@FreeBSD.org</a>&gt;</li>
     <li>&a.kensmith; &lt;<a href="mailto:kensmith@FreeBSD.org">kensmith@FreeBSD.org</a>&gt;
       (Lead)</li>
+    <li>&a.marius; &lt;<a href="mailto:marius@FreeBSD.org">marius@FreeBSD.org</a>&gt;</li>
   </ul>
 
   <h3><a name="t-re-builder">Builders Release Engineering Team</a>
@@ -206,12 +215,12 @@
       href="mailto:denise@ixsystems.com">denise@ixsystems.com</a>&gt;</li>
     <li>Deb Goodkin &lt;<a href="mailto:deb@FreeBSD.org">deb@FreeBSD.org</a>&gt;</li>
     <li>&a.jkoshy; &lt;<a href="mailto:jkoshy@FreeBSD.org">jkoshy@FreeBSD.org</a>&gt;</li>
-    <li>Dru Lavigne &lt;<a
-      href="mailto:dlavigne6@sympatico.ca">dlavigne6@sympatico.ca</a>&gt;</li>
+    <li>&a.dru; &lt;<a
+      href="mailto:dru@FreeBSD.org">dru@FreeBSD.org</a>&gt;</li>
     <li>&a.mwlucas; &lt;<a href="mailto:mwlucas@FreeBSD.org">mwlucas@FreeBSD.org</a>&gt;</li>
     <li>&a.imp; &lt;<a href="mailto:imp@FreeBSD.org">imp@FreeBSD.org</a>&gt;</li>
-    <li>Kris Moore &lt;<a
-      href="mailto:kris@pcbsd.org">kris@pcbsd.org</a>&gt;</li>
+    <li>&a.kmoore; &lt;<a
+      href="mailto:kmoore@FreeBSD.org">kmoore@FreeBSD.org</a>&gt;</li>
     <li>&a.murray; &lt;<a href="mailto:murray@FreeBSD.org">murray@FreeBSD.org</a>&gt;</li>
     <li>Matt Olander &lt;<a href="mailto:matt@FreeBSD.org">matt@FreeBSD.org</a>&gt;</li>
     <li>Jeremy C. Reed &lt;<a
@@ -341,30 +350,36 @@
     also responsible for the problem report group.</p>
 
   <ul>
-    <li>&a.eadler; &lt; <a href="mailto:eadler@FreeBSD.org">eadler@FreeBSD.org</a>&gt;</li>
+    <li>&a.eadler; &lt;<a href="mailto:eadler@FreeBSD.org">eadler@FreeBSD.org</a>&gt;</li>
     <li>&a.gavin; &lt;<a href="mailto:gavin@FreeBSD.org">gavin@FreeBSD.org</a>&gt;</li>
     <li>&a.gonzo; &lt;<a href="mailto:gonzo@FreeBSD.org">gonzo@FreeBSD.org</a>&gt;</li>
   </ul>
 
   <h3><a name="t-clusteradm">Cluster Administrators</a>
     <!-- admins mail aliases intentionally left incomplete -->
-    &lt;clusteradm@&gt;</h3>
+    &lt;admins@&gt;</h3>
 
   <p>The Cluster Administrators consists of the people responsible for
     administrating the machines that the project relies on for its
     distributed work and communication to be synchronised.  It
     consists mainly of those people who have physical access to the servers.
     Issues concerning the projects infrastructure or setting up new
-    machines should be directed to the cluster administrators.</p>
+    machines should be directed to the cluster administrators. This
+    team is led by the lead cluster administrator whose duties and
+    responsbilities are described in the <a
+      href="internal/clusteradm.html">cluster administration charter</a>
+    in greater detail.</p>
 
   <ul>
     <li>&a.bhaga; &lt;<a href="mailto:bhaga@FreeBSD.org">bhaga@FreeBSD.org</a>&gt;</li>
     <li>&a.brd; &lt;<a href="mailto:brd@FreeBSD.org">brd@FreeBSD.org</a>&gt;</li>
     <li>&a.bz; &lt;<a href="mailto:bz@FreeBSD.org">bz@FreeBSD.org</a>&gt;</li>
+    <li>&a.gjb; &lt;<a href="mailto:gjb@FreeBSD.org">gjb@FreeBSD.org</a>&gt;</li>
     <li>&a.kensmith; &lt;<a href="mailto:kensmith@FreeBSD.org">kensmith@FreeBSD.org</a>&gt;</li>
-    <li>&a.peter; &lt;<a href="mailto:peter@FreeBSD.org">peter@FreeBSD.org</a>&gt;</li>
+    <li>&a.peter; &lt;<a href="mailto:peter@FreeBSD.org">peter@FreeBSD.org</a>&gt; (Lead)</li>
     <li>&a.sbruno; &lt;<a href="mailto:sbruno@FreeBSD.org">sbruno@FreeBSD.org</a>&gt;</li>
     <li>&a.simon; &lt;<a href="mailto:simon@FreeBSD.org">simon@FreeBSD.org</a>&gt;</li>
+    <li>&a.zi; &lt;<a href="mailto:zi@FreeBSD.org">zi@FreeBSD.org</a>&gt;</li>
   </ul>
 
   <h3><a name="t-cvsup-master">CVSup Mirror Site Coordinators</a>

Modified: projects/xml-tools/en_US.ISO8859-1/htdocs/advocacy/myths.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/htdocs/advocacy/myths.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/advocacy/myths.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -27,8 +27,8 @@
       particular project it is indicated as such.</blockquote>
 
     <blockquote>If you are aware of an omission or error on this page, please
-      let the maintainer, Tom Rhodes &lt;<a href="mailto:trhodes@FreeBSD.org">trhodes@FreeBSD.org</a>&gt;
-      know.</blockquote>
+      let the <a href="mailto:doc@freebsd.org">FreeBSD
+      documentation project mailing list</a> know.</blockquote>
 
     <h2>Index</h2>
 
@@ -88,8 +88,8 @@
           from the Internet, 24 hours a day. You don't need to wait for
           someone else to roll a release.</p>
 
-	<p><b>FreeBSD, NetBSD:</b> An installable snapshot of the current
-	  progress is made every 24 hours. These snapshots can be installed
+	<p><b>FreeBSD:</b> An installable snapshot of the current
+	  progress is made weekly. These snapshots can be installed
 	  exactly like an ordinary release, and do not require installation
 	  over an existing system.</p>
 
@@ -105,13 +105,6 @@
 	  released, simply because for most *BSD users it is an every day
 	  event.</p></li>
 
-        <li><p>All the *BSD Projects use CVS to maintain their source code.</p>
-
-	<p><b>All the *BSD Projects:</b> make a CVS tree available for anyone to
-	  browse and download, 24 hours a day. The tree can be retrieved using
-	  Anonymous CVS, CVSup, CVSupit, CTM (by e-mail), or through simple
-	  FTP.</p></li>
-
         <li><p>Anyone can submit patches, bug reports, documentation, and
 	  other contributions. They can do this by using the <tt>send-pr</tt>
 	  program installed on their *BSD system, or by using a web based
@@ -185,8 +178,7 @@
 
 	<li><p><a href="http://code.google.com/p/tinybsd/">TinyBSD</a> is
 	  a set of tools made up of shell scripts designed to allow easy
-	  development of Embedded Systems based on FreeBSD 5.x and
-	  6.x.</p></li>
+	  development of Embedded Systems based on FreeBSD.</p></li>
 
 	<li><p><a href="http://thinbsd.zefyris.com/">ThinBSD</a> is a small
 	  FreeBSD based boot image that allows a standard PC to act as
@@ -258,40 +250,8 @@
       outdated nor dying.  Many professional users like the stability that years
       of testing has provided FreeBSD.</p>
 
-    <p>Technological enhancements continue to be added to *BSD, including,
-      but not limited to;</p>
-
-    <ul>
-        <li><p>SMP: Symmetric Multi-Processing, making use of systems with
-	  multiple CPUs.</p></li>
-
-        <li><p>SoftUpdates: Makes the BSD filesystem at least as fast as the
-	  Linux filesystem, <strong>without</strong> needing to enable
-	  asynchronous writes, with their associated risk.</p></li>
-
-        <li><p>VM system: The VM (Virtual Memory) subsystem continues to be
-	  refined. The merged VM/cache design helps systems like
-	  wcarchive.cdrom.com juggle thousands (literally, more than 10,000)
-	  simultaneous FTP connections without falling over.</p></li>
-
-        <li><p>Architecture ports: FreeBSD supports seven main architectures
-	  currently: Alpha, AMD64, i386, Itanium, PC-98, PowerPC and UltraSPARC.
-	  There are also ongoing works to port the project for further
-	  architectures.  See the <a
-	  href="../platforms/index.html">Supported Platforms</a> page
-	  for more information.</p></li>
-
-	<li><p>MAC Framework: FreeBSD supports Mandatory Access Control, a feature
-	  usually found in trusted operating systems available for high
-	  prices.  FreeBSD gives you advanced security for free!  The
-	  <a href="http://www.trustedbsd.org">TrustedBSD Project</a>
-	  provides further trusted operating system extensions.</p></li>
-
-	<li><p>GEOM classess: GEOM is a modular disk framework that lets
-	  you concatenate, mirror, stripe, or encrypt disks.  It is rich
-	  in functionality and keeps your data safe.</p></li>
-
-</ul>
+    <p><a href="../features.html">Technological
+      enhancements</a> continue to be added to *BSD.</p>
 
     <hr noshade="noshade" size="1"/>
 

Modified: projects/xml-tools/en_US.ISO8859-1/htdocs/docs/books.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/htdocs/docs/books.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/docs/books.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -257,6 +257,11 @@
 	      A guide to the PAM system and modules under
 	        FreeBSD.</p>
 
+	    <p><a href="&url.articles;/port-mentor-guidelines/index.html">
+	        Port Mentor Guidelines</a> (port-mentor-guidelines)<br/>
+	      Guidelines for new and/or potential port mentors and
+	        mentees.</p>
+
 	    <p><a href="&url.articles;/portbuild/index.html">Package
 		building procedures</a> (portbuild)<br/>
 	      Describes the approach used by the FreeBSD port

Modified: projects/xml-tools/en_US.ISO8859-1/htdocs/internal/Makefile
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/htdocs/internal/Makefile	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/internal/Makefile	Tue Apr 30 09:50:22 2013	(r41526)
@@ -9,6 +9,7 @@
 
 DOCS= 	about.xml
 DOCS+=	bylaws.xml
+DOCS+=	clusteradm.xml
 DOCS+=	core-vote.xml
 DOCS+= 	data.xml
 DOCS+= 	developer.xml

Copied: projects/xml-tools/en_US.ISO8859-1/htdocs/internal/clusteradm.xml (from r41525, head/en_US.ISO8859-1/htdocs/internal/clusteradm.xml)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/internal/clusteradm.xml	Tue Apr 30 09:50:22 2013	(r41526, copy of r41525, head/en_US.ISO8859-1/htdocs/internal/clusteradm.xml)
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!DOCTYPE html PUBLIC "-//FreeBSD//DTD XHTML 1.0 Transitional-Based Extension//EN"
+"http://www.FreeBSD.org/XML/doc/share/xml/xhtml10-freebsd.dtd" [
+<!ENTITY title "Charter for the Cluster Administrators">
+]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+      <title>&title;</title>
+
+      <cvs:keyword xmlns:cvs="http://www.FreeBSD.org/XML/CVS">$FreeBSD$</cvs:keyword>
+    </head>
+
+    <body class="navinclude.docs">
+
+
+<p>Lead cluster administrator is a delegated officer role (aka.  "hat")
+  that answers to the &os; Core Team and ultimately the &os; community
+  at large.  This person shall have the operational authority over the
+  &os; cluster infrastructure (to the extent that the Core Team can
+  delegate this authority) and will be responsible for the following in
+  general:</p>
+
+<ul>
+  <li>Ensure the reliable operation of the Project's equipment and
+    network resources.</li>
+
+  <li>Ensure that the Project's resources are suitably and effectively
+    used to serve the Project's interests.</li>
+
+  <li>Ensure that reasonable security precautions and mitigations are
+    implemented within the constraints of the nature of a highly
+    distributed project.</li>
+
+  <li>Delegate to and coordinating with both the site-specific admin
+    teams and the admins at large.</li>
+
+  <li>Ensure that standard operating procedures, rules, guidelines etc
+    are documented and understandable.</li>
+
+  <li>Take measures to ensure that a competent administrator would be
+    expected to be able to adopt a predecessor's work in a reasonable
+    amount of time.</li>
+
+  <li>Contingency planning and implementation to ensure continuity
+    across site specific problems (including donated site withdrawal or
+    outages).</li>
+
+  <li>Keep the interested parties (Core Team, Security Team, &os;
+    Foundation, Port Management Team, etc), project members and community
+    members appropriately informed.</li>
+
+  <li>Give timely and authoritive answers to questions, or a direct
+    referral to the appropriate party.</li>
+
+  <li>Aid other hat wearers and cluster administrators to get their job
+    done.</li>
+
+  <li>Where practical and appropriate, use the Project's own product as
+    a proving ground.</li>
+
+  <li>Make sure that it is easy for developers to know what hardware
+    resources they have access to for project purposes.</li>
+</ul>
+
+<p>The lead cluster administrator answers to the &os; Core Team.  If a
+  party is unhappy with a position that the hat wearer takes and is
+  unable to change their mind, they may take the issue to the Core Team.
+  The Core Team has the final say in the matter.  If the lead cluster
+  administrator is a member of the Core Team then a complaint may be
+  made in confidence via the core secretary or another member if
+  desired.</p>
+
+<p>Any of the following still require a sign-off from the Core Team:</p>
+
+<ul>
+  <li>New public facing services.</li>
+
+  <li>Planned withdrawal of public facing services.</li>
+
+  <li>New team members.</li>
+</ul>
+
+<p>Notable interaction with other hats:</p>
+
+<ul>
+  <li>The lead cluster administrator will consult with the Security
+    Officer and the Security Team where appropriate but will be
+    responsible for making decisions.  However, the Security Officer may
+    respond to security emergencies involving project infrastructure as
+    necessary.</li>
+
+  <li>The Port Management Team has a large resource footprint and
+    arrangements will be made with them to effectively operate their
+    resources within the constraints of the overall cluster
+    operation.</li>
+</ul>
+
+<p>Earmarked resources:</p>
+
+<p>Some site resources are provided for specific purposes.  Any such
+  earmarking or use restrictions will be documented to make sure such
+  resources are used as intended.</p>
+
+  </body>
+</html>

Modified: projects/xml-tools/en_US.ISO8859-1/htdocs/portmgr/policies_eol.xml
==============================================================================
--- projects/xml-tools/en_US.ISO8859-1/htdocs/portmgr/policies_eol.xml	Tue Apr 30 01:29:18 2013	(r41525)
+++ projects/xml-tools/en_US.ISO8859-1/htdocs/portmgr/policies_eol.xml	Tue Apr 30 09:50:22 2013	(r41526)
@@ -56,52 +56,38 @@
     <th>Estimated EoL</th>
   </tr>
   <tr>
-    <td>RELENG_7</td>
-    <td>n/a</td>
-    <td>RELENG_7_3</td>
-    <td>packages-7-stable</td>
-    <td>February 28, 2013</td>
-  </tr>
-  <tr>
-    <td>RELENG_7_3</td>
-    <td>7.3-RELEASE</td>
-    <td>RELENG_7_3</td>
-    <td>packages-7-stable</td>
-    <td>March 31, 2012</td>
-  </tr>
-  <tr>
-    <td>RELENG_7_4</td>
-    <td>7.4-RELEASE</td>
-    <td>RELENG_7_3</td>
-    <td>packages-7-stable</td>
-    <td>February 28, 2013</td>
-  </tr>
-  <tr>
     <td>RELENG_8</td>

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***

From owner-svn-doc-projects@FreeBSD.ORG  Thu May  2 14:22:16 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 5FD2E40D;
 Thu,  2 May 2013 14:22:16 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 5120B1FA5;
 Thu,  2 May 2013 14:22:16 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r42EMGtb080646;
 Thu, 2 May 2013 14:22:16 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r42EMGne080645;
 Thu, 2 May 2013 14:22:16 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201305021422.r42EMGne080645@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Thu, 2 May 2013 14:22:16 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41541 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 May 2013 14:22:16 -0000

Author: dru
Date: Thu May  2 14:22:15 2013
New Revision: 41541
URL: http://svnweb.freebsd.org/changeset/doc/41541

Log:
  This patch addresses the following in the second half of this chapter:
  
  - you
  
  - &os;
  
  - some acronym tags
  
  - the remaining command/application tags that should be man page entities
  
  - some grammar fixes
  
  Approved by:  bcr (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Thu May  2 13:02:26 2013	(r41540)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Thu May  2 14:22:15 2013	(r41541)
@@ -53,7 +53,7 @@
 
       <listitem>
 	<para>How to configure <acronym>TCP</acronym> Wrappers for use
-	  with <application>inetd</application>.</para>
+	  with &man.inetd.8;.</para>
       </listitem>
 
       <listitem>
@@ -257,7 +257,7 @@
       <title>Securing the <username>root</username> Account</title>
 
       <indexterm>
-	<primary><command>su</command></primary>
+	<primary>&man.su.1;</primary>
       </indexterm>
 
       <para>Most
@@ -355,7 +355,7 @@
 	<primary>sandboxes</primary>
       </indexterm>
       <indexterm>
-	<primary><application>sshd</application></primary>
+	<primary>&man.sshd.8;</primary>
       </indexterm>
 
       <para>The prudent sysadmin only enables required services
@@ -365,12 +365,12 @@
 	<username>root</username> as many daemons can be run as a
 	separate service account or can be started in a
 	<firstterm>sandbox</firstterm>.  Do not activate insecure
-	services such as <application>telnetd</application> or
-	<application>rlogind</application>.</para>
+	services such as &man.telnetd.8; or
+	&man.rlogind.8;.</para>
 
       <para>Another potential security hole is SUID-root and SGID
 	binaries.  Most of these binaries, such as
-	<application>rlogin</application>, reside in <filename
+	&man.rlogin.1;, reside in <filename
 	  class="directory">/bin</filename>, <filename
 	  class="directory">/sbin</filename>, <filename
 	  class="directory">/usr/bin</filename>, or <filename
@@ -434,7 +434,7 @@
 	systems that do not provide or use DHCP.</para>
 
       <indexterm>
-	<primary><command>sysctl</command></primary>
+	<primary>&man.sysctl.8;</primary>
       </indexterm>
 
       <para>Even if <devicename>bpf</devicename> is disabled,
@@ -525,7 +525,7 @@
       <para>The best way to detect an intrusion is to look for
 	modified, missing, or unexpected files.  The best way to look
 	for modified files is from another, often centralized,
-	limited-access system.  Writing your security scripts on the
+	limited-access system.  Writing security scripts on the
 	extra-security limited-access system makes them mostly
 	invisible
 	to potential attackers.  In order to take maximum advantage,
@@ -657,7 +657,7 @@
 	&man.inetd.8; carefully and pay specific attention to
 	<option>-c</option>, <option>-C</option>, and
 	<option>-R</option>.  Spoofed IP attacks will circumvent
-	<option>-C</option> to <application>inetd</application>, so
+	<option>-C</option> to &man.inetd.8;, so
 	typically a combination of options must be used.  Some
 	standalone servers have self-fork-limitation
 	parameters.</para>
@@ -681,7 +681,7 @@
 	reasonable <literal>MaxDaemonChildren</literal> to prevent
 	cascade failures.</para>
 
-      <para><application>Syslogd</application> can be attacked
+      <para>&man.syslogd.8; can be attacked
 	directly and it is strongly recommended to use
 	<option>-s</option> whenever possible, and
 	<option>-a</option> otherwise.</para>
@@ -722,10 +722,10 @@
 	with ICMP responses.  This type of attack can crash the
 	server by running it out of memory, especially if the server
 	cannot drain the ICMP responses it generates fast enough.  Use
-	the <application>sysctl</application> variable
+	the &man.sysctl.8; variable
 	<literal>net.inet.icmp.icmplim</literal> to limit these
 	attacks.  The last major class of springboard attacks is
-	related to certain internal <application>inetd</application>
+	related to certain internal &man.inetd.8;
 	services such as the UDP echo service.  An attacker spoofs a
 	UDP packet with a source address of server A's echo port
 	and a destination address of server B's echo port, where
@@ -744,7 +744,7 @@
 	parameters.  A spoofed packet attack that uses a random source
 	IP will cause the kernel to generate a temporary cached route
 	in the route table, viewable with <command>netstat -rna |
-	fgrep W3</command>.  These routes typically timeout in 1600
+	  fgrep W3</command>.  These routes typically timeout in 1600
 	seconds or so.  If the kernel detects that the cached route
 	table has gotten too big, it will dynamically reduce the
 	<varname>rtexpire</varname> but will never decrease it to less
@@ -774,15 +774,15 @@
     </sect2>
 
     <sect2>
-      <title>Access Issues with Kerberos and SSH</title>
+      <title>Access Issues with Kerberos and &man.ssh.1;</title>
 
-      <indexterm><primary><command>ssh</command></primary></indexterm>
+      <indexterm><primary>&man.ssh.1;</primary></indexterm>
 
       <para>There are a few issues with both Kerberos and
 	&man.ssh.1; that need to be addressed if
 	they are used.  Kerberos is an excellent authentication
-	protocol, but there are bugs in the kerberized
-	&man.telnet.1; and &man.rlogin.1; applications that make them
+	protocol, but there are bugs in the kerberized versions of
+	&man.telnet.1; and &man.rlogin.1; that make them
 	unsuitable for dealing with binary streams.  By default,
 	Kerberos does not encrypt a session unless
 	<option>-x</option> is used whereas  &man.ssh.1;
@@ -801,13 +801,14 @@
 
       <para>It is recommended that &man.ssh.1; is
 	used in combination with Kerberos whenever possible for staff
-	logins and  &man.ssh.1; can be compiled with
+	logins and &man.ssh.1; can be compiled with
 	Kerberos support.  This reduces reliance on potentially
-	exposed ssh keys while protecting passwords via Kerberos.
+	exposed <acronym>SSH</acronym> keys while protecting
+	passwords via Kerberos.
 	Keys should only be used for automated tasks from secure
 	machines as this is something that Kerberos is unsuited to.
 	It is recommended to either turn off key-forwarding in the
-	<application>ssh</application> configuration, or to make use
+	<acronym>SSH</acronym> configuration, or to make use
 	of <literal>from=IP/DOMAIN</literal> in
 	<filename>authorized_keys</filename> to make the key only
 	usable to entities logging in from specific machines.</para>
@@ -971,7 +972,7 @@
       <title>Secure Connection Initialization</title>
 
       <para>To initialize <acronym>OPIE</acronym> for the first time,
-	execute <command>opiepasswd</command>:</para>
+	execute &man.opiepasswd.1;:</para>
 
       <screen>&prompt.user; <userinput>opiepasswd -c</userinput>
 [grimreaper] ~ $ opiepasswd -f -c
@@ -1173,7 +1174,7 @@ Enter secret pass phrase: <userinput>&lt
       <title>Initial Configuration</title>
 
       <para>To enable <acronym>TCP</acronym> Wrappers in &os;, ensure
-	the <application>inetd</application> server is started from
+	the &man.inetd.8; server is started from
 	<filename>/etc/rc.conf</filename> with
 	<option>-Ww</option>.  Then, properly configure
 	<filename>/etc/hosts.allow</filename>.</para>
@@ -1189,7 +1190,7 @@ Enter secret pass phrase: <userinput>&lt
 	are set to either be permitted or blocked depending on the
 	options in <filename>/etc/hosts.allow</filename>.  The default
 	configuration in &os; is to allow a connection to every daemon
-	started with <application>inetd</application>.</para>
+	started with &man.inetd.8;.</para>
 
       <para>Basic configuration usually takes the form of
 	<literal>daemon : address : action</literal>, where
@@ -1213,7 +1214,7 @@ Enter secret pass phrase: <userinput>&lt
       <programlisting># This line is required for POP3 connections:
 qpopper : ALL : allow</programlisting>
 
-      <para>After adding this line, <application>inetd</application>
+      <para>After adding this line, &man.inetd.8;
 	needs to be restarted:</para>
 
 	<screen>&prompt.root; <userinput>service inetd restart</userinput></screen>
@@ -1575,7 +1576,7 @@ Verifying password - Password: <userinpu
 	services.  While there will not be any kerberized daemons
 	running at this point, it is possible to confirm that
 	the <acronym>KDC</acronym> is functioning by obtaining and
-	listing a ticket for the principal (user) that you just
+	listing a ticket for the principal (user) that was just
 	created from the command-line of the <acronym>KDC</acronym>
 	itself:</para>
 
@@ -2134,31 +2135,31 @@ kadmind5_server_enable="YES"</programlis
       <secondary>OpenSSL</secondary>
     </indexterm>
 
-    <para>One feature that many users overlook is the
-      <application>OpenSSL</application> toolkit included in &os;.
-      <application>OpenSSL</application> provides an encryption
-      transport layer on top of the normal communications layer;
-      thus allowing it to be intertwined with many network
+    <para>The
+      <application>OpenSSL</application> toolkit is included in &os;.
+      It provides an encryption
+      transport layer on top of the normal communications layer,
+      allowing it to be intertwined with many network
       applications and services.</para>
 
     <para>Some uses of <application>OpenSSL</application> may
-      include encrypted authentication of mail clients, web based
-      transactions such as credit card payments and more.  Many
+      include encrypted authentication of mail clients and web based
+      transactions such as credit card payments.  Many
       ports such as
       <filename role="package">www/apache22</filename>, and
-      <filename role="package">mail/claws-mail</filename> will offer
+      <filename role="package">mail/claws-mail</filename> offer
       compilation support for building with
       <application>OpenSSL</application>.</para>
 
     <note>
-      <para>In most cases the Ports Collection will attempt to build
+      <para>In most cases, the Ports Collection will attempt to build
 	the <filename role="package">security/openssl</filename>
-	port unless the <makevar>WITH_OPENSSL_BASE</makevar> make
-	variable is explicitly set to <quote>yes</quote>.</para>
+	port unless <makevar>WITH_OPENSSL_BASE</makevar>
+	is explicitly set to <quote>yes</quote>.</para>
     </note>
 
     <para>The version of <application>OpenSSL</application> included
-      in &os; supports Secure Sockets Layer v2/v3 (SSLv2/SSLv3),
+      in &os; supports Secure Sockets Layer v2/v3 (SSLv2/SSLv3) and
       Transport Layer Security v1 (TLSv1) network security protocols
       and can be used as a general cryptographic library.</para>
 
@@ -2168,7 +2169,7 @@ kadmind5_server_enable="YES"</programlis
 	due to United States patents.  To use it, the license should
 	be reviewed and, if the restrictions are acceptable, the
 	<makevar>MAKE_IDEA</makevar> variable must be set in
-	<filename>make.conf</filename>.</para>
+	<filename>/etc/make.conf</filename>.</para>
     </note>
 
     <para>One of the most common uses of
@@ -2176,15 +2177,14 @@ kadmind5_server_enable="YES"</programlis
       for use with software applications.  These certificates ensure
       that the credentials of the company or individual are valid
       and not fraudulent.  If the certificate in question has not
-      been verified by one of the several <quote>Certificate
-      Authorities</quote>, or <acronym>CA</acronym>s, a warning is
-      usually produced.  A Certificate Authority is a company, such
+      been verified by a <quote>Certificate
+      Authority</quote> (<acronym>CA</acronym>), a warning is
+      produced.  A <acronym>CA</acronym> is a company, such
       as <ulink url="http://www.verisign.com">VeriSign</ulink>,
-      which will sign certificates in order to validate credentials
+      signs certificates in order to validate the credentials
       of individuals or companies.  This process has a cost
-      associated with it and is definitely not a requirement for
-      using certificates; however, it can put some of the more
-      paranoid users at ease.</para>
+      associated with it and is not a requirement for
+      using certificates; however, it can put users at ease.</para>
 
     <sect2>
       <title>Generating Certificates</title>
@@ -2226,22 +2226,23 @@ An optional company name []:<userinput><
       <para>Notice the response directly after the
 	<quote>Common Name</quote> prompt shows a domain name.  This
 	prompt requires a server name to be entered for verification
-	purposes; placing anything but a domain name would yield a
-	useless certificate.  Other options, for instance expire
-	time, alternate encryption algorithms, etc. are available.
-	A complete list may be obtained by viewing the
-	&man.openssl.1; manual page.</para>
-
-      <para>Two files should now exist in the directory in which the
-	aforementioned command was issued.  The certificate request,
-	<filename>req.pem</filename>, may be sent to a certificate
-	authority who will validate the credentials that you
-	entered, sign the request and return the certificate to you.
-	The second file created will be named
+	purposes and placing anything but a domain name yields a
+	useless certificate.  Other options, such as the expire
+	time and alternate encryption algorithms, are available.
+	A complete list of options is described in
+	&man.openssl.1;.</para>
+
+      <para>Two files should now exist in the directory in which this
+	command was issued.  The certificate request,
+	<filename>req.pem</filename>, may be sent to a
+	<acronym>CA</acronym>
+	who will validate the entered credentials,
+	sign the request, and return the signed certificate.
+	The second file is named
 	<filename>cert.pem</filename> and is the private key for the
-	certificate and should be protected at all costs; if this
+	certificate and should be protected at all costs.  If this
 	falls in the hands of others it can be used to impersonate
-	you (or your server).</para>
+	the user or the server.</para>
 
       <para>In cases where a signature from a <acronym>CA</acronym>
 	is not required, a self signed certificate can be created.
@@ -2263,30 +2264,31 @@ An optional company name []:<userinput><
 	<filename>new.crt</filename>.  These should be placed in a
 	directory, preferably under
 	<filename class="directory">/etc</filename>, which is readable
-	only by <username>root</username>.  Permissions of 0700 should
-	be fine for this and they can be set with the
-	<command>chmod</command> utility.</para>
+	only by <username>root</username>.  Permissions of 0700 are
+	appropriate and can be set using
+	&man.chmod.1;.</para>
     </sect2>
 
     <sect2>
-      <title>Using Certificates, an Example</title>
+      <title>Using Certificates</title>
 
-      <para>So what can these files do?  A good use would be to
+      <para>One use for a certificate is to
 	encrypt connections to the
 	<application>Sendmail</application> <acronym>MTA</acronym>.
-	This would dissolve the use of clear text authentication for
+	This prevents the use of clear text authentication for
 	users who send mail via the local
 	<acronym>MTA</acronym>.</para>
 
       <note>
-	<para>This is not the best use in the world as some
-	  <acronym>MUA</acronym>s will present the user with an
-	  error if they have not installed the certificate locally.
+	<para>Some
+	  <acronym>MUA</acronym>s will display
+	  error if the user has not installed the certificate locally.
 	  Refer to the documentation included with the software for
 	  more information on certificate installation.</para>
       </note>
 
-      <para>The following lines should be placed inside the local
+      <para>To configure <application>Sendmail</application>, the
+	following lines should be placed in the local
 	<filename>.mc</filename> file:</para>
 
       <programlisting>dnl SSL Options
@@ -2296,24 +2298,24 @@ define(`confSERVER_CERT',`/etc/certs/new
 define(`confSERVER_KEY',`/etc/certs/myca.key')dnl
 define(`confTLS_SRV_OPTIONS', `V')dnl</programlisting>
 
-      <para>Where <filename class="directory">/etc/certs/</filename>
-	is the directory to be used for storing the certificate and
-	key files locally.  The last few requirements are a rebuild
-	of the local <filename>.cf</filename> file.  This is easily
-	achieved by typing <command>make
-	  <maketarget>install</maketarget></command> within the
-	<filename class="directory">/etc/mail</filename> directory.
+      <para>In this example,  <filename
+	  class="directory">/etc/certs/</filename>
+	stores the certificate and
+	key files locally.  After saving the edits, rebuild
+	the local <filename>.cf</filename> file by typing
+	<command>make <maketarget>install</maketarget></command>
+	within <filename class="directory">/etc/mail</filename>.
 	Follow that up with <command>make
 	  <maketarget>restart</maketarget></command> which should
 	start the <application>Sendmail</application> daemon.</para>
 
-      <para>If all went well there will be no error messages in the
-	<filename>/var/log/maillog</filename> file and
+      <para>If all went well, there will be no error messages in
+	<filename>/var/log/maillog</filename> and
 	<application>Sendmail</application> will show up in the
 	process list.</para>
 
-      <para>For a simple test, simply connect to the mail server
-	using the &man.telnet.1; utility:</para>
+      <para>For a simple test, connect to the mail server
+	using &man.telnet.1;:</para>
 
       <screen>&prompt.root; <userinput>telnet <replaceable>example.com</replaceable> 25</userinput>
 Trying 192.0.34.166...
@@ -2337,7 +2339,7 @@ Escape character is '^]'.
 Connection closed by foreign host.</screen>
 
       <para>If the <quote>STARTTLS</quote> line appears in the
-	output then everything is working correctly.</para>
+	output, everything is working correctly.</para>
     </sect2>
   </sect1>
 
@@ -2355,15 +2357,12 @@ Connection closed by foreign host.</scre
       </authorgroup>
     </sect1info>
 
-    <title>VPN over IPsec</title>
+    <title><acronym>VPN</acronym> over IPsec</title>
 
     <indexterm>
       <primary>IPsec</primary>
     </indexterm>
 
-    <para>Creating a VPN between two networks, separated by the
-      Internet, using FreeBSD gateways.</para>
-
     <sect2>
       <sect2info>
 	<authorgroup>
@@ -2380,18 +2379,19 @@ Connection closed by foreign host.</scre
 
       <title>Understanding IPsec</title>
 
-      <para>This section will guide you through the process of
-	setting up IPsec.  In order to set up IPsec, it is necessary
-	that you are familiar with the concepts of building a custom
+      <para>This section demonstrates the process of
+	setting up IPsec.  It assumes
+	familiarity with the concepts of building a custom
 	kernel (see <xref linkend="kernelconfig"/>).</para>
 
       <para><emphasis>IPsec</emphasis> is a protocol which sits on
-	top of the Internet Protocol (IP) layer.  It allows two or
-	more hosts to communicate in a secure manner (hence the
-	name).  The FreeBSD IPsec <quote>network stack</quote> is
+	top of the Internet Protocol (<acronym>IP</acronym>) layer.
+	It allows two or
+	more hosts to communicate in a secure manner.
+	The &os; IPsec <quote>network stack</quote> is
 	based on the <ulink url="http://www.kame.net/">KAME</ulink>
-	implementation, which has support for both protocol
-	families, IPv4 and IPv6.</para>
+	implementation, which has support for both IPv4 and
+	IPv6.</para>
 
       <indexterm>
 	<primary>IPsec</primary>
@@ -2408,16 +2408,18 @@ Connection closed by foreign host.</scre
       <itemizedlist>
 	<listitem>
 	  <para><emphasis>Encapsulated Security Payload
-	      ESP)</emphasis>, protects the IP packet data from
-	    third party interference, by encrypting the contents
-	    using symmetric cryptography algorithms (like Blowfish,
-	    3DES).</para>
+	      <acronym>ESP</acronym>)</emphasis>: this protocol
+	    protects the IP packet data from
+	    third party interference by encrypting the contents
+	    using symmetric cryptography algorithms such as Blowfish
+	    and 3DES.</para>
 	</listitem>
 
 	<listitem>
-	  <para><emphasis>Authentication Header (AH)</emphasis>,
+	  <para><emphasis>Authentication Header
+	    (<acronym>AH</acronym>)</emphasis>: this protocol
 	    protects the IP packet header from third party
-	    interference and spoofing, by computing a cryptographic
+	    interference and spoofing by computing a cryptographic
 	    checksum and hashing the IP packet header fields with a
 	    secure hashing function.  This is then followed by an
 	    additional header that contains the hash, to allow the
@@ -2439,18 +2441,17 @@ Connection closed by foreign host.</scre
       </indexterm>
 
       <para>IPsec can either be used to directly encrypt the traffic
-	between two hosts (known as <emphasis>Transport
-	  Mode</emphasis>); or to build <quote>virtual
-	  tunnels</quote> between two subnets, which could be used for
-	secure communication between two corporate networks (known
-	as <emphasis>Tunnel Mode</emphasis>).  The latter is more
+	between two hosts using <emphasis>Transport
+	  Mode</emphasis> or to build <quote>virtual
+	  tunnels</quote> using
+	<emphasis>Tunnel Mode</emphasis>.  The latter mode is more
 	commonly known as a <emphasis>Virtual Private Network
-	(VPN)</emphasis>.  The &man.ipsec.4; manual page should be
-	consulted for detailed information on the IPsec subsystem in
-	FreeBSD.</para>
+	(<acronym>VPN</acronym>)</emphasis>.  Consult &man.ipsec.4;
+	for detailed information on the IPsec subsystem in
+	&os;.</para>
 
-      <para>To add IPsec support to your kernel, add the following
-	options to your kernel configuration file:</para>
+      <para>To add IPsec support to the kernel, add the following
+	options to the custom kernel configuration file:</para>
 
       <indexterm>
 	<primary>kernel options</primary>
@@ -2474,40 +2475,30 @@ options   IPSEC_DEBUG  #debug for IP sec
     </sect2>
 
     <sect2>
-      <title>The Problem</title>
-
-      <para>There is no standard for what constitutes a VPN.  VPNs
-	can be implemented using a number of different technologies,
-	each of which have their own strengths and weaknesses.  This
-	section presents a scenario, and the strategies used for
-	implementing a VPN for this scenario.</para>
-    </sect2>
-
-    <sect2>
-      <title>The Scenario: Two networks, one home based and one
-	corporate based.  Both are connected to the Internet, and
-	expected, via this <acronym>VPN</acronym> to behave as
-	one.</title>
+      <title><acronym>VPN</acronym> Between a Home and Corporate
+	Network</title>
 
       <indexterm>
 	<primary>VPN</primary>
 	<secondary>creating</secondary>
       </indexterm>
 
-      <para>The premise is as follows:</para>
+      <para>There is no standard for what constitutes a
+	<acronym>VPN</acronym>.  <acronym>VPN</acronym>s can be
+	implemented using a number of different technologies, each
+	of which has their own strengths and weaknesses.  This
+	section presents the strategies used for implementing a
+	<acronym>VPN</acronym> for the following scenario:</para>
 
       <itemizedlist>
 	<listitem>
-	  <para>You have at least two sites</para>
-	</listitem>
-
-	<listitem>
-	  <para>Both sites are using IP internally</para>
+	  <para>There are at least two sites where each site is using
+	    IP internally.</para>
 	</listitem>
 
 	<listitem>
-	  <para>Both sites are connected to the Internet, through a
-	    gateway that is running FreeBSD.</para>
+	  <para>Both sites are connected to the Internet through a
+	    gateway that is running &os;.</para>
 	</listitem>
 
 	<listitem>
@@ -2517,15 +2508,15 @@ options   IPSEC_DEBUG  #debug for IP sec
 
 	<listitem>
 	  <para>The internal addresses of the two networks can be
-	    public or private IP addresses, it does not matter.
-	    They just may not collide; e.g.: may not both use
+	    either public or private IP addresses.  However, the
+	    address space must not collide.  For example, both
+	    networks cannot use
 	    <hostid role="ipaddr">192.168.1.x</hostid>.</para>
 	</listitem>
       </itemizedlist>
-    </sect2>
 
-    <sect2>
-      <sect2info>
+    <sect3>
+      <sect3info>
 	<authorgroup>
 	  <author>
 	    <firstname>Tom</firstname>
@@ -2536,23 +2527,24 @@ options   IPSEC_DEBUG  #debug for IP sec
 	    <contrib>Written by </contrib>
 	  </author>
 	</authorgroup>
-      </sect2info>
+      </sect3info>
 
       <title>Configuring IPsec on &os;</title>
 
-      <para>To begin, the
+      <para>To begin,
 	<filename role="package">security/ipsec-tools</filename>
-	must be installed from the Ports Collection.  This third
-	party software package provides a number of applications
-	which will help support the configuration.</para>
+	must be installed from the Ports Collection.  This
+	software provides a number of applications
+	which support the configuration.</para>
 
       <para>The next requirement is to create two &man.gif.4;
 	pseudo-devices which will be used to tunnel packets and
 	allow both networks to communicate properly.  As
 	<username>root</username>, run the following commands,
-	replacing the <replaceable>internal</replaceable> and
-	<replaceable>external</replaceable> items with the real
-	internal and external gateways:</para>
+	replacing <replaceable>internal</replaceable> and
+	<replaceable>external</replaceable> with the real IP
+	addresses of the
+	internal and external interfaces of the two gateways:</para>
 
       <screen>&prompt.root; <userinput>ifconfig gif0 create</userinput></screen>
 
@@ -2560,18 +2552,19 @@ options   IPSEC_DEBUG  #debug for IP sec
 
       <screen>&prompt.root; <userinput>ifconfig gif0 tunnel <replaceable>external1 external2</replaceable></userinput></screen>
 
-      <para>For example, the corporate <acronym>LAN</acronym>'s
-	public <acronym>IP</acronym> is
-	<hostid role="ipaddr">172.16.5.4</hostid> having a private
-	<acronym>IP</acronym> of
+      <para>In this example, the corporate <acronym>LAN</acronym>'s
+	external <acronym>IP</acronym> address is
+	<hostid role="ipaddr">172.16.5.4</hostid> and its internal
+	<acronym>IP</acronym> address is
 	<hostid role="ipaddr">10.246.38.1</hostid>.  The home
-	<acronym>LAN</acronym>'s public <acronym>IP</acronym> is
-	<hostid role="ipaddr">192.168.1.12</hostid> with an internal
-	private <acronym>IP</acronym> of
+	<acronym>LAN</acronym>'s external <acronym>IP</acronym>
+	address is
+	<hostid role="ipaddr">192.168.1.12</hostid> and its internal
+	private <acronym>IP</acronym> address is
 	<hostid role="ipaddr">10.0.0.5</hostid>.</para>
 
-      <para>This may seem confusing, so review the following example
-	output from the &man.ifconfig.8; command:</para>
+      <para>If this is confusing, review the following example output
+	from &man.ifconfig.8;:</para>
 
       <programlisting>Gateway 1:
 
@@ -2587,9 +2580,8 @@ tunnel inet 192.168.1.12 --&gt; 172.16.5
 inet 10.0.0.5 --&gt; 10.246.38.1 netmask 0xffffff00
 inet6 fe80::250:bfff:fe3a:c1f%gif0 prefixlen 64 scopeid 0x4</programlisting>
 
-      <para>Once complete, both private <acronym>IP</acronym>s
-	should be reachable using the &man.ping.8; command like
-	the following output suggests:</para>
+      <para>Once complete, both internal <acronym>IP</acronym>
+	addresses should be reachable using &man.ping.8;:</para>
 
       <programlisting>priv-net# ping 10.0.0.5
 PING 10.0.0.5 (10.0.0.5): 56 data bytes
@@ -2629,8 +2621,8 @@ round-trip min/avg/max/stddev = 28.106/9
 
       <para>At this point, internal machines should be reachable
 	from each gateway as well as from machines behind the
-	gateways.  This is easily determined from the following
-	example:</para>
+	gateways.  Again, use &man.ping.8; to
+	confirm:</para>
 
       <programlisting>corp-net# ping 10.0.0.8
 PING 10.0.0.8 (10.0.0.8): 56 data bytes
@@ -2655,12 +2647,13 @@ PING 10.246.38.1 (10.246.38.107): 56 dat
 round-trip min/avg/max/stddev = 21.145/31.721/53.491/12.179 ms</programlisting>
 
       <para>Setting up the tunnels is the easy part.  Configuring
-	a secure link is a much more in depth process.  The
+	a secure link is a more in depth process.  The
 	following configuration uses pre-shared
-	(<acronym>PSK</acronym>) <acronym>RSA</acronym> keys.  Aside
-	from the <acronym>IP</acronym> addresses, both
-	<filename>/usr/local/etc/racoon/racoon.conf</filename> files
-	will be identical and look similar to</para>
+	(<acronym>PSK</acronym>) <acronym>RSA</acronym> keys.  Other than
+	the <acronym>IP</acronym> addresses, the
+	<filename>/usr/local/etc/racoon/racoon.conf</filename> on
+	both gateways
+	will be identical and look similar to:</para>
 
       <programlisting>path    pre_shared_key  "/usr/local/etc/racoon/psk.txt"; #location of pre-shared key file
 log     debug;	#log verbosity setting: set to 'notify' when testing and debugging is complete
@@ -2720,19 +2713,18 @@ sainfo  (address 10.246.38.0/24 any addr
         compression_algorithm   deflate;
 }</programlisting>
 
-      <para>Explaining every available option, along with those
-	listed in these examples is beyond the scope of this
-	document.  There is plenty of relevant information in the
-	<application>racoon</application> configuration manual
-	page.</para>
-
-      <para>The <acronym>SPD</acronym> policies need to be
-	configured so &os; and <application>racoon</application> is
-	able to encrypt and decrypt network traffic between
+      <para>For descriptions of each available option, refer to the
+	manual
+	page for <filename>racoon.conf</filename>.</para>
+
+      <para>The Security Policy Database (<acronym>SPD</acronym>)
+	needs to be configured so that &os; and
+	<application>racoon</application> are
+	able to encrypt and decrypt network traffic between the
 	hosts.</para>
 
-      <para>This task may be undertaken with a simple shell script
-	similar to the following which is on the corporate gateway.
+      <para>This can be achieved with a shell script,
+	similar to the following, on the corporate gateway.
 	This file will be used during system initialization and
 	should be saved as
 	<filename>/usr/local/etc/racoon/setkey.conf</filename>.</para>
@@ -2767,12 +2759,12 @@ Foreground mode.
 	another console and use &man.tcpdump.1; to view network
 	traffic using the following command.  Replace
 	<literal>em0</literal> with the network interface card as
-	required.</para>
+	required:</para>
 
       <screen>&prompt.root; <userinput>tcpdump -i em0 host <replaceable>172.16.5.4 and dst 192.168.1.12</replaceable></userinput></screen>
 
       <para>Data similar to the following should appear on the
-	console.  If not, there is an issue, and debugging the
+	console.  If not, there is an issue and debugging the
 	returned data will be required.</para>
 
       <programlisting>01:47:32.021683 IP corporatenetwork.com &gt; 192.168.1.12.privatenetwork.com: ESP(spi=0x02acbf9f,seq=0xa)
@@ -2781,9 +2773,9 @@ Foreground mode.
 
       <para>At this point, both networks should be available and
 	seem to be part of the same network.  Most likely both
-	networks are protected by a firewall, as they should be.  To
+	networks are protected by a firewall.  To
 	allow traffic to flow between them, rules need to be added
-	to pass packets back and forth.  For the &man.ipfw.8;
+	to pass packets.  For the &man.ipfw.8;
 	firewall, add the following lines to the firewall
 	configuration file:</para>
 
@@ -2819,7 +2811,8 @@ pass out quick on gif0 from any to any</
 ipsec_program="/usr/local/sbin/setkey"
 ipsec_file="/usr/local/etc/racoon/setkey.conf" # allows setting up spd policies on boot
 racoon_enable="yes"</programlisting>
-    </sect2>
+    </sect3>
+  </sect2>
   </sect1>
 
   <sect1 id="openssh">
@@ -2844,65 +2837,63 @@ racoon_enable="yes"</programlisting>
 
     <para><application>OpenSSH</application> is a set of network
       connectivity tools used to access remote machines securely.
-      It can be used as a direct replacement for
-      <command>rlogin</command>, <command>rsh</command>,
-      <command>rcp</command>, and <command>telnet</command>.
       Additionally, TCP/IP connections can be tunneled/forwarded
-      securely through SSH.  <application>OpenSSH</application>
+      securely through <acronym>SSH</acronym> connections. 
+      <application>OpenSSH</application>
       encrypts all traffic to effectively eliminate eavesdropping,
       connection hijacking, and other network-level attacks.</para>
 
     <para><application>OpenSSH</application> is maintained by the
-      OpenBSD project, and is based upon SSH v1.2.12 with all the
-      recent bug fixes and updates.  It is compatible with both SSH
-      protocols 1 and 2.</para>
+      OpenBSD project and is installed by default in &os;.  It is
+      compatible with both <acronym>SSH</acronym> version
+      1 and 2 protocols.</para>
 
     <sect2>
-      <title>Advantages of Using OpenSSH</title>
-
-      <para>Normally, when using &man.telnet.1; or &man.rlogin.1;,
-	data is sent over the network in a clear, un-encrypted form.
-	Network sniffers anywhere in between the client and server
-	can steal your user/password information or data transferred
-	in your session.  <application>OpenSSH</application> offers
+      <title>Advantages of Using
+	<application>OpenSSH</application></title>
+
+      <para>When
+	data is sent over the network in an unencrypted form,
+	network sniffers anywhere in between the client and server
+	can steal user/password information or data transferred
+	during the session.  <application>OpenSSH</application> offers
 	a variety of authentication and encryption methods to
 	prevent this from happening.</para>
     </sect2>
 
     <sect2>
-      <title>Enabling <application>sshd</application></title>
+      <title>Enabling &man.sshd.8;</title>
 
       <indexterm>
 	<primary>OpenSSH</primary>
 	<secondary>enabling</secondary>
       </indexterm>
 
-      <para>The <application>sshd</application> is an option
-	presented during a <literal>Standard</literal> install of
-	&os;.  To see if <application>sshd</application> is enabled,
-	check the <filename>rc.conf</filename> file for:</para>
+      <para>To see if &man.sshd.8; is enabled,
+	check <filename>/etc/rc.conf</filename> for this line:</para>
 
       <programlisting>sshd_enable="YES"</programlisting>
 
-      <para>This will load &man.sshd.8;, the daemon program for
-	<application>OpenSSH</application>, the next time your
+      <para>This will start &man.sshd.8;, the daemon program for
+	<application>OpenSSH</application>, the next time the
 	system initializes.  Alternatively, it is possible to use
 	&man.service.8; to
-	start <application>OpenSSH</application>:</para>
+	start <application>OpenSSH</application> now:</para>
 
       <screen>&prompt.root; <userinput>service sshd start</userinput></screen>
     </sect2>
 
     <sect2>
-      <title>SSH Client</title>
+      <title>&man.ssh.1; Client</title>
 
       <indexterm>
 	<primary>OpenSSH</primary>
 	<secondary>client</secondary>
       </indexterm>
 
-      <para>The &man.ssh.1; utility works similarly to
-	&man.rlogin.1;.</para>
+      <para>To use &man.ssh.1; to connect to a system running
+	&man.sshd.8;, specify the username and host to log
+	into:</para>
 
       <screen>&prompt.root; <userinput>ssh <replaceable>user@example.com</replaceable></userinput>
 Host key not found from the list of known hosts.
@@ -2910,22 +2901,19 @@ Are you sure you want to continue connec
 Host 'example.com' added to the list of known hosts.
 user@example.com's password: <userinput>*******</userinput></screen>
 
-      <para>The login will continue just as it would have if a
-	session was created using <command>rlogin</command> or
-	<command>telnet</command>.  SSH utilizes a key fingerprint
-	system for verifying the authenticity of the server when the
-	client connects.  The user is prompted to enter
-	<literal>yes</literal> only when connecting for the first
-	time.  Future attempts to login are all verified against the
-	saved fingerprint key.  The SSH client will alert you if the
+      <para><acronym>SSH</acronym> utilizes a key fingerprint
+	system to verify the authenticity of the server when the
+	client connects.  The user is prompted to type
+	<literal>yes</literal> when connecting for the first
+	time.  Future attempts to login are verified against the
+	saved fingerprint key and the &man.ssh.1; client will display
+	an alert if the
 	saved fingerprint differs from the received fingerprint on
 	future login attempts.  The fingerprints are saved in
-	<filename>~/.ssh/known_hosts</filename>, or
-	<filename>~/.ssh/known_hosts2</filename> for SSH v2
-	fingerprints.</para>
+	<filename>~/.ssh/known_hosts</filename>.</para>
 
-      <para>By default, recent versions of the
-	<application>OpenSSH</application> servers only accept SSH
+      <para>By default, recent versions of &man.sshd.8; only accept
+	<acronym>SSH</acronym>
 	v2 connections.  The client will use version 2 if possible
 	and will fall back to version 1.  The client can also be
 	forced to use one or the other by passing it the
@@ -2943,11 +2931,11 @@ user@example.com's password: <userinput>
 	<secondary>secure copy</secondary>
       </indexterm>
       <indexterm>
-	<primary><command>scp</command></primary>
+	<primary>&man.scp.1;</primary>
       </indexterm>
 
-      <para>The &man.scp.1; command works similarly to &man.rcp.1;;
-	it copies a file to or from a remote machine, except in a
+      <para>Use &man.scp.1; to
+	copy a file to or from a remote machine in a
 	secure fashion.</para>
 
       <screen>&prompt.root; <userinput> scp <replaceable>user@example.com:/COPYRIGHT COPYRIGHT</replaceable></userinput>
@@ -2961,10 +2949,12 @@ COPYRIGHT            100% |*************
 	here.</para>
 
       <para>The arguments passed to &man.scp.1; are similar to
-	&man.cp.1;, with the file or files in the first argument,
+	&man.cp.1;, with the file or files to copy in the first
+	argument,
 	and the destination in the second.  Since the file is
-	fetched over the network, through SSH, one or more of the
-	file arguments takes on the form
+	fetched over the network, through an <acronym>SSH</acronym>,
+	connection, one or more of the
+	file arguments takes the form
 	<option>user@host:&lt;path_to_remote_file&gt;</option>.</para>
     </sect2>
 
@@ -2978,24 +2968,20 @@ COPYRIGHT            100% |*************
 
       <para>The system-wide configuration files for both the
 	<application>OpenSSH</application> daemon and client reside
-	within the <filename class="directory">/etc/ssh</filename>
-	directory.</para>
+	in <filename class="directory">/etc/ssh</filename>.</para>
 
       <para><filename>ssh_config</filename> configures the client
 	settings, while <filename>sshd_config</filename> configures
-	the daemon.</para>
-
-      <para>Additionally, the <option>sshd_program</option>
-	(<filename>/usr/sbin/sshd</filename> by default), and
-	<option>sshd_flags</option> <filename>rc.conf</filename>
-	options can provide more levels of configuration.</para>
+	the daemon.  Each file has its own manual page which describes
+	the available configuration options.</para>
     </sect2>
 
     <sect2 id="security-ssh-keygen">
-      <title><application>ssh-keygen</application></title>
+      <title>&man.ssh-keygen.1;</title>
 
       <para>Instead of using passwords, &man.ssh-keygen.1; can
-	be used to generate DSA or RSA keys to authenticate a
+	be used to generate <acronym>DSA</acronym> or
+	<acronym>RSA</acronym> keys to authenticate a
 	user:</para>
 
       <screen>&prompt.user; <userinput>ssh-keygen -t <replaceable>dsa</replaceable></userinput>
@@ -3014,7 +3000,7 @@ bb:48:db:f2:93:57:80:b6:aa:bc:f5:d5:ba:8
 	in <filename>~/.ssh/id_dsa</filename> or
 	<filename>~/.ssh/id_rsa</filename>, whereas the public key
 	is stored in <filename>~/.ssh/id_dsa.pub</filename> or
-	<filename>~/.ssh/id_rsa.pub</filename>, respectively for
+	<filename>~/.ssh/id_rsa.pub</filename>, respectively for the
 	<acronym>DSA</acronym> and <acronym>RSA</acronym> key types.
 	The public key must be placed in the
 	<filename>~/.ssh/authorized_keys</filename> file of the
@@ -3022,43 +3008,42 @@ bb:48:db:f2:93:57:80:b6:aa:bc:f5:d5:ba:8
 	<acronym>DSA</acronym> keys in order for the setup to
 	work.</para>
 
-      <para>This will allow connection to the remote machine based
-	upon SSH keys instead of passwords.</para>
+      <para>This setup allows connections to the remote machine based
+	upon <acronym>SSH</acronym> keys instead of passwords.</para>
 
       <para>If a passphrase is used in &man.ssh-keygen.1;, the user
-	will be prompted for a password each time in order to use
+	will be prompted for the passphrase each time in order to use
 	the private key.  &man.ssh-agent.1; can alleviate the strain
 	of repeatedly entering long passphrases, and is explored in
-	the <xref linkend="security-ssh-agent"/> section
-	below.</para>
+	<xref linkend="security-ssh-agent"/>.</para>
 
       <warning>
 	<para>The various options and files can be different
 	  according to the <application>OpenSSH</application>
-	  version you have on your system; to avoid problems you
-	  should consult the &man.ssh-keygen.1; manual page.</para>
+	  version.  To avoid problems,
+	  consult &man.ssh-keygen.1;.</para>
       </warning>
     </sect2>
 
     <sect2 id="security-ssh-agent">
-      <title><application>ssh-agent</application> and <application>ssh-add</application></title>
+      <title>&man.ssh-agent.1; and &man.ssh-add.1;</title>
 
-      <para>The &man.ssh-agent.1; and &man.ssh-add.1; utilities
-	provide methods for <application>SSH</application> keys to
-	be loaded into memory for use, without needing to type the
-	passphrase each time.</para>
-
-      <para>The &man.ssh-agent.1; utility will handle the
-	authentication using the private key(s) that are loaded into
-	it.  &man.ssh-agent.1; should be used to launch another
+      <para>To load <acronym>SSH</acronym>
+	keys into memory for use, without needing to type the
+	passphrase each time, use &man.ssh-agent.1; and
+	&man.ssh-add.1;.</para>
+
+      <para>Authentication is handled by &man.ssh-agent.1;, using the
+	private key(s) that are loaded into
+	it.  Then, &man.ssh-agent.1; should be used to launch another
 	application.  At the most basic level, it could spawn a
-	shell or at a more advanced level, a window manager.</para>
+	shell or a window manager.</para>
 
-      <para>To use &man.ssh-agent.1; in a shell, first it will need
-	to be spawned with a shell as an argument.  Secondly, the
-	identity needs to be added by running &man.ssh-add.1; and
+      <para>To use &man.ssh-agent.1; in a shell, start it
+	with a shell as an argument.  Next, add the identity
+	by running &man.ssh-add.1; and
 	providing it the passphrase for the private key.  Once these
-	steps have been completed the user will be able to
+	steps have been completed, the user will be able to
 	&man.ssh.1; to any host that has the corresponding public
 	key installed.  For example:</para>
 
@@ -3068,24 +3053,28 @@ Enter passphrase for /home/user/.ssh/id_
 Identity added: /home/user/.ssh/id_dsa (/home/user/.ssh/id_dsa)
 &prompt.user;</screen>
 
-      <para>To use &man.ssh-agent.1; in X11, a call to
-	&man.ssh-agent.1; will need to be placed in
-	<filename>~/.xinitrc</filename>.  This will provide the
-	&man.ssh-agent.1; services to all programs launched in X11.
+      <para>To use &man.ssh-agent.1; in
+	<application>&xorg;</application>, a call to
+	&man.ssh-agent.1; needs to be placed in
+	<filename>~/.xinitrc</filename>.  This provides the
+	&man.ssh-agent.1; services to all programs launched in
+	<application>&xorg;</application>.

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***

From owner-svn-doc-projects@FreeBSD.ORG  Thu May  2 15:47:18 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 1E5631CC;
 Thu,  2 May 2013 15:47:18 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 0F6E714DC;
 Thu,  2 May 2013 15:47:18 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r42FlItg009980;
 Thu, 2 May 2013 15:47:18 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r42FlIcE009979;
 Thu, 2 May 2013 15:47:18 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201305021547.r42FlIcE009979@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Thu, 2 May 2013 15:47:18 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41542 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/eresources
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 May 2013 15:47:18 -0000

Author: dru
Date: Thu May  2 15:47:17 2013
New Revision: 41542
URL: http://svnweb.freebsd.org/changeset/doc/41542

Log:
  Initial pass, further patches needed. This patch addresses the following:
  
  - &os;
  
  - you/we, e.g.
  
  - fix Project and filesystems
  
  - removes deprecated KDE list
  
  Approved by:  bcr (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/eresources/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/eresources/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/eresources/chapter.xml	Thu May  2 14:22:15 2013	(r41541)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/eresources/chapter.xml	Thu May  2 15:47:17 2013	(r41542)
@@ -8,18 +8,18 @@
 <appendix id="eresources">
   <title>Resources on the Internet</title>
 
-  <para>The rapid pace of FreeBSD progress makes print media
+  <para>The rapid pace of &os; progress makes print media
     impractical as a means of following the latest developments.
     Electronic resources are the best, if not often the only, way
-    to stay informed of the latest advances.  Since FreeBSD is a
+    to stay informed of the latest advances.  Since &os; is a
     volunteer effort, the user community itself also generally serves
     as a <quote>technical support department</quote> of sorts, with
     electronic mail, web forums, and USENET news being the most
     effective way of reaching that community.</para>
 
-  <para>The most important points of contact with the FreeBSD user
-    community are outlined below.  If you are aware of other resources
-    not mentioned here, please send them to the &a.doc; so that they
+  <para>The most important points of contact with the &os; user
+    community are outlined below.  Please send other resources
+    not mentioned here to the &a.doc; so that they
     may also be included.</para>
 
   <sect1 id="eresources-mail">
@@ -27,23 +27,23 @@
 
     <para>The mailing lists are the most direct way of addressing
       questions or opening a technical discussion to a concentrated
-      FreeBSD audience.  There are a wide variety of lists on a number
-      of different FreeBSD topics.  Addressing your questions to the
+      &os; audience.  There are a wide variety of lists on a number
+      of different &os; topics.  Sending questions to the
       most appropriate mailing list will invariably assure a faster
       and more accurate response.</para>
 
     <para>The charters for the various lists are given at the bottom
       of this document.  <emphasis>Please read the charter before
-      joining or sending mail to any list</emphasis>.  Most of our
-      list subscribers now receive many hundreds of FreeBSD related
-      messages every day, and by setting down charters and rules for
-      proper use we are striving to keep the signal-to-noise ratio
+      joining or sending mail to any list</emphasis>.  Most
+      list subscribers receive many hundreds of &os; related
+      messages every day, and the charters and rules for
+      use are meant to keep the signal-to-noise ratio
       of the lists high.  To do less would see the mailing lists
       ultimately fail as an effective communications medium for the
-      project.</para>
+      Project.</para>
 
     <note>
-      <para><emphasis>If you wish to test your ability to send to
+      <para><emphasis>To test the ability to send email to
 	  &os; lists, send a test message to &a.test.name;.</emphasis>
 	Please do not send test messages to any other list.</para>
     </note>
@@ -61,11 +61,11 @@
 
     <para>Archives are kept for all of the mailing lists and can be
       searched using the <ulink
-	url="&url.base;/search/index.html">FreeBSD World Wide Web
+	url="&url.base;/search/index.html">&os; World Wide Web
       server</ulink>.  The keyword searchable archive offers an
       excellent way of finding answers to frequently asked questions
       and should be consulted before posting a question.  Note that
-      this also means that messages sent to FreeBSD mailing lists
+      this also means that messages sent to &os; mailing lists
       are archived in perpetuity.  When protecting privacy is a
       concern, consider using a disposable secondary email address
       and posting only public information.</para>
@@ -89,12 +89,13 @@
 	  <tbody>
 	    <row>
 	      <entry>&a.advocacy.name;</entry>
-	      <entry>FreeBSD Evangelism</entry>
+	      <entry>&os; Evangelism</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.announce.name;</entry>
-	      <entry>Important events and project milestones (moderated)</entry>
+	      <entry>Important events and Project milestones
+(moderated)</entry>
 	    </row>
 
 	    <row>
@@ -105,7 +106,7 @@
 	    <row>
 	      <entry>&a.bugbusters.name;</entry>
 	      <entry>Discussions pertaining to the maintenance of
-		the FreeBSD problem report database and related
+		the &os; problem report database and related
 		tools</entry>
 	    </row>
 
@@ -116,13 +117,13 @@
 
 	    <row>
 	      <entry>&a.chat.name;</entry>
-	      <entry>Non-technical items related to the FreeBSD
+	      <entry>Non-technical items related to the &os;
 		community</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.chromium.name;</entry>
-	      <entry>FreeBSD-specific Chromium issues</entry>
+	      <entry>&os;-specific Chromium issues</entry>
 	    </row>
 
 	    <row>
@@ -134,12 +135,12 @@
 	    <row>
 	      <entry>&a.isp.name;</entry>
 	      <entry>Issues for Internet Service Providers using
-		FreeBSD</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.jobs.name;</entry>
-	      <entry>FreeBSD employment and consulting
+	      <entry>&os; employment and consulting
 		opportunities</entry>
 	    </row>
 
@@ -161,7 +162,7 @@
 
 	    <row>
 	      <entry>&a.test.name;</entry>
-	      <entry>Where to send your test messages instead of
+	      <entry>Where to send test messages instead of to
 		one of the actual lists</entry>
 	    </row>
 	  </tbody>
@@ -169,7 +170,7 @@
       </informaltable>
 
       <para><emphasis>Technical lists:</emphasis> The following
-	lists are for technical discussion.  You should read the
+	lists are for technical discussion.  Read the
 	charter for each list carefully before joining or sending
 	mail to one as there are firm guidelines for their use and
 	content.</para>
@@ -191,7 +192,7 @@
 
 	    <row>
 	      <entry>&a.afs.name;</entry>
-	      <entry>Porting AFS to FreeBSD</entry>
+	      <entry>Porting AFS to &os;</entry>
 	    </row>
 
 	    <row>
@@ -202,7 +203,7 @@
 
 	    <row>
 	      <entry>&a.amd64.name;</entry>
-	      <entry>Porting FreeBSD to AMD64 systems (moderated)</entry>
+	      <entry>Porting &os; to AMD64 systems (moderated)</entry>
 	    </row>
 
 	    <row>
@@ -214,22 +215,22 @@
 
 	    <row>
 	      <entry>&a.arm.name;</entry>
-	      <entry>Porting FreeBSD to &arm; processors</entry>
+	      <entry>Porting &os; to &arm; processors</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.atm.name;</entry>
-	      <entry>Using ATM networking with FreeBSD</entry>
+	      <entry>Using ATM networking with &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.bluetooth.name;</entry>
-	      <entry>Using &bluetooth; technology in FreeBSD</entry>
+	      <entry>Using &bluetooth; technology in &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.cluster.name;</entry>
-	      <entry>Using FreeBSD in a clustered environment</entry>
+	      <entry>Using &os; in a clustered environment</entry>
 	    </row>
 
 	    <row>
@@ -240,7 +241,7 @@
 	    <row>
 	      <entry>&a.database.name;</entry>
 	      <entry>Discussing database use and development under
-		FreeBSD</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
@@ -250,7 +251,7 @@
 
 	    <row>
 	      <entry>&a.doc.name;</entry>
-	      <entry>Creating FreeBSD related documents</entry>
+	      <entry>Creating &os; related documents</entry>
 	    </row>
 
 	    <row>
@@ -260,19 +261,19 @@
 
 	    <row>
 	      <entry>&a.eclipse.name;</entry>
-	      <entry>FreeBSD users of Eclipse IDE, tools, rich client
+	      <entry>&os; users of Eclipse IDE, tools, rich client
 		applications and ports.</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.embedded.name;</entry>
-	      <entry>Using FreeBSD in embedded applications</entry>
+	      <entry>Using &os; in embedded applications</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.eol.name;</entry>
-	      <entry>Peer support of FreeBSD-related software that
-		is no longer supported by the FreeBSD project.</entry>
+	      <entry>Peer support of &os;-related software that
+		is no longer supported by the &os; Project.</entry>
 	    </row>
 
 	    <row>
@@ -283,7 +284,7 @@
 
 	    <row>
 	      <entry>&a.firewire.name;</entry>
-	      <entry>FreeBSD &firewire; (iLink, IEEE 1394) technical
+	      <entry>&os; &firewire; (iLink, IEEE 1394) technical
 		discussion</entry>
 	    </row>
 
@@ -318,29 +319,29 @@
 	    <row>
 	      <entry>&a.hardware.name;</entry>
 	      <entry>General discussion of hardware for running
-		FreeBSD</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.i18n.name;</entry>
-	      <entry>FreeBSD Internationalization</entry>
+	      <entry>&os; Internationalization</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.ia32.name;</entry>
-	      <entry>FreeBSD on the IA-32 (&intel; x86)
+	      <entry>&os; on the IA-32 (&intel; x86)
 		platform</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.ia64.name;</entry>
-	      <entry>Porting FreeBSD to &intel;'s upcoming IA64
+	      <entry>Porting &os; to &intel;'s upcoming IA64
 		systems</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.infiniband.name;</entry>
-	      <entry>Infiniband on FreeBSD</entry>
+	      <entry>Infiniband on &os;</entry>
 	    </row>
 
 	    <row>
@@ -363,23 +364,17 @@
 	    <row>
 	      <entry>&a.java.name;</entry>
 	      <entry>&java; developers and people porting &jdk;s to
-		FreeBSD</entry>
-	    </row>
-
-	    <row>
-	      <entry>&a.kde.name;</entry>
-	      <entry>Porting <application>KDE</application> and
-		<application>KDE</application> applications</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.lfs.name;</entry>
-	      <entry>Porting LFS to FreeBSD</entry>
+	      <entry>Porting LFS to &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.mips.name;</entry>
-	      <entry>Porting FreeBSD to &mips;</entry>
+	      <entry>Porting &os; to &mips;</entry>
 	    </row>
 
 	    <row>
@@ -389,13 +384,13 @@
 
 	    <row>
 	      <entry>&a.mono.name;</entry>
-	      <entry>Mono and C# applications on FreeBSD</entry>
+	      <entry>Mono and C# applications on &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.mozilla.name;</entry>
 	      <entry>Porting <application>Mozilla</application> to
-		FreeBSD</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
@@ -468,18 +463,18 @@
 
 	    <row>
 	      <entry>&a.ppc.name;</entry>
-	      <entry>Porting FreeBSD to the &powerpc;</entry>
+	      <entry>Porting &os; to the &powerpc;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.proliant.name;</entry>
-	      <entry>Technical discussion of FreeBSD on HP ProLiant
+	      <entry>Technical discussion of &os; on HP ProLiant
 		server platforms</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.python.name;</entry>
-	      <entry>FreeBSD-specific Python issues</entry>
+	      <entry>&os;-specific Python issues</entry>
 	    </row>
 
 	    <row>
@@ -492,12 +487,12 @@
 	    <row>
 	      <entry>&a.realtime.name;</entry>
 	      <entry>Development of realtime extensions to
-		FreeBSD</entry>
+		&os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.ruby.name;</entry>
-	      <entry>FreeBSD-specific Ruby discussions</entry>
+	      <entry>&os;-specific Ruby discussions</entry>
 	    </row>
 
 	    <row>
@@ -507,12 +502,12 @@
 
 	    <row>
 	      <entry>&a.security.name;</entry>
-	      <entry>Security issues affecting FreeBSD</entry>
+	      <entry>Security issues affecting &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.small.name;</entry>
-	      <entry>Using FreeBSD in embedded applications
+	      <entry>Using &os; in embedded applications
 		(obsolete; use &a.embedded.name; instead)</entry>
 	    </row>
 
@@ -523,12 +518,12 @@
 
 	    <row>
 	      <entry>&a.sparc.name;</entry>
-	      <entry>Porting FreeBSD to &sparc; based systems</entry>
+	      <entry>Porting &os; to &sparc; based systems</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.standards.name;</entry>
-	      <entry>FreeBSD's conformance to the C99 and the &posix;
+	      <entry>&os;'s conformance to the C99 and the &posix;
 		standards</entry>
 	    </row>
 
@@ -539,23 +534,23 @@
 
 	    <row>
 	      <entry>&a.tcltk.name;</entry>
-	      <entry>FreeBSD-specific Tcl/Tk discussions</entry>
+	      <entry>&os;-specific Tcl/Tk discussions</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.threads.name;</entry>
-	      <entry>Threading in FreeBSD</entry>
+	      <entry>Threading in &os;</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.tilera.name;</entry>
-	      <entry>Porting FreeBSD to the Tilera family of
+	      <entry>Porting &os; to the Tilera family of
 		CPUs</entry>
 	    </row>
 
 	    <row>
 	      <entry>&a.tokenring.name;</entry>
-	      <entry>Support Token Ring in FreeBSD</entry>
+	      <entry>Support Token Ring in &os;</entry>
 	    </row>
 
 	    <row>
@@ -582,7 +577,7 @@
 
 	    <row>
 	      <entry>&a.x11.name;</entry>
-	      <entry>Maintenance and support of X11 on FreeBSD</entry>
+	      <entry>Maintenance and support of X11 on &os;</entry>
 	    </row>
 
 	    <row>
@@ -610,7 +605,7 @@
 	are for more specialized (and demanding) audiences and are
 	probably not of interest to the general public.  It is also
 	a good idea to establish a presence in the technical lists
-	before joining one of these limited lists so that you will
+	before joining one of these limited lists in order to
 	understand the communications etiquette involved.</para>
 
       <informaltable frame="none" pgwide="1">
@@ -636,7 +631,7 @@
 
 	    <row>
 	      <entry>&a.wip-status.name;</entry>
-	      <entry>FreeBSD Work-In-Progress Status</entry>
+	      <entry>&os; Work-In-Progress Status</entry>
 	    </row>
 
 	    <row>
@@ -650,7 +645,7 @@
 
       <para><emphasis>Digest lists:</emphasis> All of the above lists
 	are available in a digest format.  Once subscribed to a list,
-	you can change your digest options in your account options
+	the digest options can be changed in the account options
 	section.</para>
 
       <para><emphasis>SVN lists:</emphasis> The following lists
@@ -834,38 +829,38 @@
     <sect2 id="eresources-subscribe">
       <title>How to Subscribe</title>
 
-      <para>To subscribe to a list, click on the list name above or
-	go to &a.mailman.lists.link; and click on the list that you
-	are interested in.  The list page should contain all of the
-	necessary subscription instructions.</para>
+      <para>To subscribe to a list, click the list name at
+	&a.mailman.lists.link;.
+	The page that is displayed should contain all of the
+	necessary subscription instructions for that list.</para>
 
       <para>To actually post to a given list, send mail to
 	<email><replaceable>listname</replaceable>@FreeBSD.org</email>.
 	It will then be redistributed to mailing list members
 	world-wide.</para>
 
-      <para>To unsubscribe yourself from a list, click on the URL
+      <para>To unsubscribe from a list, click on the URL
 	found at the bottom of every email received from the list.
 	It is also possible to send an email to
 	<email><replaceable>listname</replaceable>-unsubscribe@FreeBSD.org</email>
-	to unsubscribe yourself.</para>
+	to unsubscribe.</para>
 
-      <para>Again, we would like to request that you keep discussion
-	in the technical mailing lists on a technical track.  If you
-	are only interested in important announcements then it is
-	suggested that you join the &a.announce;, which is intended
-	only for infrequent traffic.</para>
+      <para>It is important to keep discussion
+	in the technical mailing lists on a technical track.  To
+	only receive important announcements, instead
+	join the &a.announce;, which is intended
+	for infrequent traffic.</para>
     </sect2>
 
     <sect2 id="eresources-charters">
       <title>List Charters</title>
 
-      <para><emphasis>All</emphasis> FreeBSD mailing lists have
+      <para><emphasis>All</emphasis> &os; mailing lists have
 	certain basic rules which must be adhered to by anyone using
 	them.  Failure to comply with these guidelines will result
-	in two (2) written warnings from the FreeBSD Postmaster
+	in two (2) written warnings from the &os; Postmaster
 	  <email>postmaster@FreeBSD.org</email>, after which, on a
-	third offense, the poster will removed from all FreeBSD
+	third offense, the poster will removed from all &os;
 	mailing lists and filtered from further posting to them.  We
 	regret that such rules and measures are necessary at all,
 	but today's Internet is a pretty harsh environment, it would
@@ -877,8 +872,8 @@
       <itemizedlist>
 	<listitem>
 	  <para>The topic of any posting should adhere to the basic
-	    charter of the list it is posted to, e.g., if the list
-	    is about technical issues then your posting should contain
+	    charter of the list it is posted to.  If the list
+	    is about technical issues, the posting should contain
 	    technical discussion.  Ongoing irrelevant chatter or
 	    flaming only detracts from the value of the mailing list
 	    for everyone on it and will not be tolerated.  For
@@ -893,11 +888,11 @@
 	    a great deal of subscriber overlap and except for the most
 	    esoteric mixes (say <quote>-stable &amp; -scsi</quote>),
 	    there really is no reason to post to more than one list at
-	    a time.  If a message is sent to you in such a way that
-	    multiple mailing lists appear on the <literal>Cc</literal>
-	    line then the <literal>Cc</literal> line should also be
-	    trimmed before sending it out again.  <emphasis>You are
-	      still responsible for your own cross-postings, no matter
+	    a time.  If a message is received with
+	    multiple mailing lists on the <literal>Cc</literal>
+	    line, trim the <literal>Cc</literal> line
+	    before replying.  <emphasis>The person who replies is
+	      still responsible for cross-posting, no matter
 	      who the originator might have been.</emphasis></para>
 	</listitem>
 
@@ -915,7 +910,7 @@
 	</listitem>
 
 	<listitem>
-	  <para>Advertising of non-FreeBSD related products or
+	  <para>Advertising of non-&os; related products or
 	    services is strictly prohibited and will result in an
 	    immediate ban if it is clear that the offender is
 	    advertising by spam.</para>
@@ -954,10 +949,10 @@
 		milestones</emphasis></para>
 
 	    <para>This is the mailing list for people interested
-	      only in occasional announcements of significant FreeBSD
+	      only in occasional announcements of significant &os;
 	      events.  This includes announcements about snapshots
 	      and other releases.  It contains announcements of new
-	      FreeBSD capabilities.  It may contain calls for
+	      &os; capabilities.  It may contain calls for
 	      volunteers etc.  This is a low volume, strictly
 	      moderated mailing list.</para>
 	  </listitem>
@@ -970,7 +965,7 @@
 	    <para><emphasis>Architecture and design
 		discussions</emphasis></para>
 
-	    <para>This list is for discussion of the FreeBSD
+	    <para>This list is for discussion of the &os;
 	      architecture.  Messages will mostly be kept strictly
 	      technical in nature.  Examples of suitable topics
 	      are:</para>
@@ -1003,9 +998,9 @@
 	  <term>&a.bluetooth.name;</term>
 
 	  <listitem>
-	    <para><emphasis>&bluetooth; in FreeBSD</emphasis></para>
+	    <para><emphasis>&bluetooth; in &os;</emphasis></para>
 
-	    <para>This is the forum where FreeBSD's &bluetooth; users
+	    <para>This is the forum where &os;'s &bluetooth; users
 	      congregate.  Design issues, implementation details,
 	      patches, bug reports, status reports, feature requests,
 	      and all matters related to &bluetooth; are fair
@@ -1035,7 +1030,7 @@
 	    <para><emphasis>Bug reports</emphasis></para>
 
 	    <para>This is the mailing list for reporting bugs in
-	      FreeBSD.  Whenever possible, bugs should be submitted
+	      &os;.  Whenever possible, bugs should be submitted
 	      using the &man.send-pr.1; command or the <ulink
 		url="&url.base;/send-pr.html">WEB
 		interface</ulink> to it.</para>
@@ -1046,7 +1041,7 @@
 	  <term>&a.chat.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Non technical items related to the FreeBSD
+	    <para><emphasis>Non technical items related to the &os;
 		community</emphasis></para>
 
 	    <para>This list contains the overflow from the other
@@ -1066,11 +1061,11 @@
 	  <term>&a.chromium.name;</term>
 
 	  <listitem>
-	    <para><emphasis>FreeBSD-specific Chromium
+	    <para><emphasis>&os;-specific Chromium
 		issues</emphasis></para>
 
 	    <para>This is a list for the discussion of Chromium
-	      support for FreeBSD.  This is a technical list to
+	      support for &os;.  This is a technical list to
 	      discuss development and installation of Chromium.</para>
 	  </listitem>
 	</varlistentry>
@@ -1079,11 +1074,11 @@
 	  <term>&a.core.name;</term>
 
 	  <listitem>
-	    <para><emphasis>FreeBSD core team</emphasis></para>
+	    <para><emphasis>&os; core team</emphasis></para>
 
 	    <para>This is an internal mailing list for use by the core
 	      members.  Messages can be sent to it when a serious
-	      FreeBSD-related matter requires arbitration or
+	      &os;-related matter requires arbitration or
 	      high-level scrutiny.</para>
 	  </listitem>
 	</varlistentry>
@@ -1109,10 +1104,10 @@
 	  <term>&a.cvsweb.name;</term>
 
 	  <listitem>
-	    <para><emphasis>FreeBSD CVSweb Project</emphasis></para>
+	    <para><emphasis>&os; CVSweb Project</emphasis></para>
 
 	    <para>Technical discussions about use, development and
-	      maintenance of FreeBSD-CVSweb.</para>
+	      maintenance of &os;-CVSweb.</para>
 	  </listitem>
 	</varlistentry>
 
@@ -1134,12 +1129,12 @@
 	  <term>&a.doc.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Documentation project</emphasis></para>
+	    <para><emphasis>Documentation Project</emphasis></para>
 
 	    <para>This mailing list is for the discussion of issues
 	      and projects related to the creation of documentation
-	      for FreeBSD.  The members of this mailing list are
-	      collectively referred to as <quote>The FreeBSD
+	      for &os;.  The members of this mailing list are
+	      collectively referred to as <quote>The &os;
 	      Documentation Project</quote>.  It is an open list;
 	      feel free to join and contribute!</para>
 	  </listitem>
@@ -1189,13 +1184,13 @@
 	  <term>&a.embedded.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Using FreeBSD in embedded
+	    <para><emphasis>Using &os; in embedded
 		applications</emphasis></para>
 
-	    <para>This list discusses topics related to using FreeBSD
+	    <para>This list discusses topics related to using &os;
 	      in embedded systems.  This is a technical mailing list
 	      for which strictly technical content is expected.  For
-	      the purpose of this list we define embedded systems as
+	      the purpose of this list, embedded systems are
 	      those computing devices which are not desktops and which
 	      usually serve a single purpose as opposed to being
 	      general computing environments.  Examples include, but
@@ -1223,15 +1218,15 @@
 	  <term>&a.eol.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Peer support of FreeBSD-related software
-		that is no longer supported by the FreeBSD
-		project.</emphasis></para>
+	    <para><emphasis>Peer support of &os;-related software
+		that is no longer supported by the &os;
+		Project.</emphasis></para>
 
 	    <para>This list is for those interested in providing or
-	      making use of peer support of FreeBSD-related software
-	      for which the FreeBSD project no longer provides
-	      official support (e.g., in the form of security
-	      advisories and patches).</para>
+	      making use of peer support of &os;-related software
+	      for which the &os; Project no longer provides
+	      official support in the form of security
+	      advisories and patches.</para>
 	  </listitem>
 	</varlistentry>
 
@@ -1244,7 +1239,7 @@
 
 	    <para>This is a mailing list for discussion of the design
 	      and implementation of a &firewire; (aka IEEE 1394 aka
-	      iLink) subsystem for FreeBSD.  Relevant topics
+	      iLink) subsystem for &os;.  Relevant topics
 	      specifically include the standards, bus devices and
 	      their protocols, adapter boards/cards/chips sets, and
 	      the architecture and implementation of code for their
@@ -1258,7 +1253,7 @@
 	  <listitem>
 	    <para><emphasis>File systems</emphasis></para>
 
-	    <para>Discussions concerning FreeBSD file systems.
+	    <para>Discussions concerning &os; filesystems.
 	      This is a technical mailing list for which strictly
 	      technical content is expected.</para>
 	  </listitem>
@@ -1300,7 +1295,7 @@
 
 	    <para>Discussions concerning The
 	      <application>GNOME</application> Desktop Environment
-	      for FreeBSD systems.  This is a technical mailing list
+	      for &os; systems.  This is a technical mailing list
 	      for which strictly technical content is expected.</para>
 	  </listitem>
 	</varlistentry>
@@ -1324,7 +1319,7 @@
 
 	    <para>This is the forum for technical discussions
 	      concerning the redesign of the IP firewall code in
-	      FreeBSD.  This is a technical mailing list for which
+	      &os;.  This is a technical mailing list for which
 	      strictly technical content is expected.</para>
 	  </listitem>
 	</varlistentry>
@@ -1333,10 +1328,10 @@
 	  <term>&a.ia64.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Porting FreeBSD to IA64</emphasis></para>
+	    <para><emphasis>Porting &os; to IA64</emphasis></para>
 
 	    <para>This is a technical mailing list for individuals
-	      actively working on porting FreeBSD to the IA-64
+	      actively working on porting &os; to the IA-64
 	      platform from &intel;, to bring up problems or discuss
 	      alternative solutions.  Individuals interested in
 	      following the technical discussion are also
@@ -1351,7 +1346,7 @@
 	    <para><emphasis>ISDN Communications</emphasis></para>
 
 	    <para>This is the mailing list for people discussing the
-	      development of ISDN support for FreeBSD.</para>
+	      development of ISDN support for &os;.</para>
 	  </listitem>
 	</varlistentry>
 
@@ -1363,7 +1358,7 @@
 
 	    <para>This is the mailing list for people discussing the
 	      development of significant &java; applications for
-	      FreeBSD and the porting and maintenance of
+	      &os; and the porting and maintenance of
 	      &jdk;s.</para>
 	  </listitem>
 	</varlistentry>
@@ -1375,17 +1370,17 @@
 	    <para><emphasis>Jobs offered and sought</emphasis></para>
 
 	    <para>This is a forum for posting employment notices
-	      and resumes specifically related to &os;, e.g., if you
-	      are seeking &os;-related employment or have a job
-	      involving &os; to advertise then this is the right
-	      place.  This is <emphasis>not</emphasis> a mailing list
+	      specifically related to &os; and resumes from those
+	      seeking &os;-related employment.  This is
+	      <emphasis>not</emphasis> a mailing list
 	      for general employment issues since adequate forums
 	      for that already exist elsewhere.</para>
 
 	    <para>Note that this list, like other <hostid
 		role="domainname">FreeBSD.org</hostid> mailing lists,
-	      is distributed worldwide.  Thus, you need to be clear
-	      about location and the extent to which telecommuting or
+	      is distributed worldwide.  Be clear
+	      about the geographic location and the extent to which
+	      telecommuting or
 	      assistance with relocation is available.</para>
 
 	    <para>Email should use open formats only &mdash;
@@ -1404,7 +1399,7 @@
 	    <para><emphasis>KDE</emphasis></para>
 
 	    <para>Discussions concerning
-	      <application>KDE</application> on FreeBSD systems.
+	      <application>KDE</application> on &os; systems.
 	      This is a technical mailing list for which strictly
 	      technical content is expected.</para>
 	  </listitem>
@@ -1417,8 +1412,8 @@
 	    <para><emphasis>Technical discussions</emphasis></para>
 
 	    <para>This is a forum for technical discussions related
-	      to FreeBSD.  This is the primary technical mailing list.
-	      It is for individuals actively working on FreeBSD, to
+	      to &os;.  This is the primary technical mailing list.
+	      It is for individuals actively working on &os;, to
 	      bring up problems or discuss alternative solutions.
 	      Individuals interested in following the technical
 	      discussion are also welcome.  This is a technical
@@ -1431,11 +1426,11 @@
 	  <term>&a.hardware.name;</term>
 
 	  <listitem>
-	    <para><emphasis>General discussion of FreeBSD
+	    <para><emphasis>General discussion of &os;
 		hardware</emphasis></para>
 
 	    <para>General discussion about the types of hardware
-	      that FreeBSD runs on, various problems and suggestions
+	      that &os; runs on, various problems and suggestions
 	      concerning what to buy or avoid.</para>
 	  </listitem>
 	</varlistentry>
@@ -1447,7 +1442,7 @@
 	    <para><emphasis>Mirror sites</emphasis></para>
 
 	    <para>Announcements and discussion for people who run
-	      FreeBSD mirror sites.</para>
+	      &os; mirror sites.</para>
 	  </listitem>
 	</varlistentry>
 
@@ -1459,7 +1454,7 @@
 		Providers</emphasis></para>
 
 	    <para>This mailing list is for discussing topics relevant
-	      to Internet Service Providers (ISPs) using FreeBSD.
+	      to Internet Service Providers (ISPs) using &os;.
 	      This is a technical mailing list for which strictly
 	      technical content is expected.</para>
 	  </listitem>
@@ -1470,7 +1465,7 @@
 
 	  <listitem>
 	    <para><emphasis>Mono and C# applications on
-		FreeBSD</emphasis></para>
+		&os;</emphasis></para>
 
 	    <para>This is a list for discussions related to the Mono
 	      development framework on &os;.  This is a technical
@@ -1503,7 +1498,7 @@
 		Announcements</emphasis></para>
 
 	    <para>This is the mailing list for people interested in
-	      changes and issues related to the FreeBSD.org project
+	      changes and issues related to the FreeBSD.org Project
 	      infrastructure.</para>
 
 	    <para>This moderated list is strictly for announcements: no replies,
@@ -1515,21 +1510,21 @@
 	  <term>&a.performance.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Discussions about tuning or speedingup
-		FreeBSD</emphasis></para>
+	    <para><emphasis>Discussions about tuning or speeding up
+		&os;</emphasis></para>
 
 	    <para>This mailing list exists to provide a place for
 	      hackers, administrators, and/or concerned parties to
 	      discuss performance related topics pertaining to
-	      FreeBSD.  Acceptable topics includes talking about
-	      FreeBSD installations that are either under high load,
+	      &os;.  Acceptable topics includes talking about
+	      &os; installations that are either under high load,
 	      are experiencing performance problems, or are pushing
-	      the limits of FreeBSD.  Concerned parties that are
+	      the limits of &os;.  Concerned parties that are
 	      willing to work toward improving the performance of
-	      FreeBSD are highly encouraged to subscribe to this list.
+	      &os; are highly encouraged to subscribe to this list.
 	      This is a highly technical list ideally suited for
-	      experienced FreeBSD users, hackers, or administrators
-	      interested in keeping FreeBSD fast, robust, and
+	      experienced &os; users, hackers, or administrators
+	      interested in keeping &os; fast, robust, and
 	      scalable.  This list is not a question-and-answer list
 	      that replaces reading through documentation, but it is a
 	      place to make contributions or inquire about unanswered
@@ -1546,7 +1541,7 @@
 		filter firewall system</emphasis></para>
 
 	    <para>Discussion concerning the packet filter (pf)
-	      firewall system in terms of FreeBSD.  Technical
+	      firewall system in terms of &os;.  Technical
 	      discussion and user questions are both welcome.  This
 	      list is also a place to discuss the ALTQ QoS
 	      framework.</para>
@@ -1581,8 +1576,8 @@
 	    <para><emphasis>Porting to Non &intel;
 		platforms</emphasis></para>
 
-	    <para>Cross-platform FreeBSD issues, general discussion
-	      and proposals for non &intel; FreeBSD ports.  This is
+	    <para>Cross-platform &os; issues, general discussion
+	      and proposals for non &intel; &os; ports.  This is
 	      a technical mailing list for which strictly technical
 	      content is expected.</para>
 	  </listitem>
@@ -1595,7 +1590,7 @@
 	    <para><emphasis>Discussion of
 		<quote>ports</quote></emphasis></para>
 
-	    <para>Discussions concerning FreeBSD's <quote>ports
+	    <para>Discussions concerning &os;'s <quote>ports
 		collection</quote> (<filename>/usr/ports</filename>),
 	      ports infrastructure, and general ports coordination
 	      efforts.  This is a technical mailing list for which
@@ -1628,7 +1623,7 @@
 	    <para><emphasis>Discussion of
 		<quote>ports</quote> bugs</emphasis></para>
 
-	    <para>Discussions concerning problem reports for FreeBSD's
+	    <para>Discussions concerning problem reports for &os;'s
 	      <quote>ports collection</quote>
 	      (<filename>/usr/ports</filename>), proposed ports, or
 	      modifications to ports.  This is a technical mailing
@@ -1641,11 +1636,11 @@
 	  <term>&a.proliant.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Technical discussion of FreeBSD on HP
+	    <para><emphasis>Technical discussion of &os; on HP
 		ProLiant server platforms</emphasis></para>
 
 	    <para>This mailing list is to be used for the technical
-	      discussion of the usage of FreeBSD on HP ProLiant
+	      discussion of the usage of &os; on HP ProLiant
 	      servers, including the discussion of ProLiant-specific
 	      drivers, management software, configuration tools, and
 	      BIOS updates.  As such, this is the primary place to
@@ -1658,13 +1653,13 @@
 	  <term>&a.python.name;</term>
 
 	  <listitem>
-	    <para><emphasis>Python on FreeBSD</emphasis></para>
+	    <para><emphasis>Python on &os;</emphasis></para>
 
 	    <para>This is a list for discussions related to improving
-	      Python-support on FreeBSD.  This is a technical mailing
+	      Python-support on &os;.  This is a technical mailing
 	      list.  It is for individuals working on porting Python,
 	      its 3rd party modules and
-		<application>Zope</application> stuff to FreeBSD.
+		<application>Zope</application> stuff to &os;.
 	      Individuals interested in following the technical
 	      discussion are also welcome.</para>
 	  </listitem>
@@ -1677,9 +1672,9 @@
 	    <para><emphasis>User questions</emphasis></para>
 
 	    <para>This is the mailing list for questions about
-	      FreeBSD.  You should not send <quote>how to</quote>
-	      questions to the technical lists unless you consider
-	      the question to be pretty technical.</para>
+	      &os;.  Do not send <quote>how to</quote>
+	      questions to the technical lists unless
+	      the question is quite technical.</para>
 	  </listitem>
 	</varlistentry>
 
@@ -1687,11 +1682,11 @@
 	  <term>&a.ruby.name;</term>
 
 	  <listitem>
-	    <para><emphasis>FreeBSD-specific Ruby
+	    <para><emphasis>&os;-specific Ruby
 		discussions</emphasis></para>
 
 	    <para>This is a list for discussions related to the Ruby
-	      support on FreeBSD.  This is a technical mailing
+	      support on &os;.  This is a technical mailing
 	      list.  It is for individuals working on Ruby ports,
 	      3rd party libraries and frameworks.</para>
 
@@ -1707,7 +1702,7 @@
 	    <para><emphasis>SCSI subsystem</emphasis></para>
 
 	    <para>This is the mailing list for people working on
-	      the SCSI subsystem for FreeBSD.  This is a technical
+	      the SCSI subsystem for &os;.  This is a technical
 	      mailing list for which strictly technical content is
 	      expected.</para>
 	  </listitem>
@@ -1719,7 +1714,7 @@
 	  <listitem>
 	    <para><emphasis>Security issues</emphasis></para>
 
-	    <para>FreeBSD computer security issues (DES, Kerberos,
+	    <para>&os; computer security issues (DES, Kerberos,
 	      known security holes and fixes, etc).  This is a
 	      technical mailing list for which strictly technical
 	      discussion is expected. Note that this is not a
@@ -1734,7 +1729,7 @@
 	  <listitem>
 	    <para><emphasis>Security Notifications</emphasis></para>
 
-	    <para>Notifications of FreeBSD security problems and

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***

From owner-svn-doc-projects@FreeBSD.ORG  Fri May  3 12:16:08 2013
Return-Path: <owner-svn-doc-projects@FreeBSD.ORG>
Delivered-To: svn-doc-projects@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 1DEE29BB;
 Fri,  3 May 2013 12:16:08 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 0FCF81CEA;
 Fri,  3 May 2013 12:16:08 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r43CG78S047076;
 Fri, 3 May 2013 12:16:07 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r43CG72x047075;
 Fri, 3 May 2013 12:16:07 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201305031216.r43CG72x047075@svn.freebsd.org>
From: Dru Lavigne <dru@FreeBSD.org>
Date: Fri, 3 May 2013 12:16:07 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-projects@freebsd.org
Subject: svn commit: r41544 -
 projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security
X-SVN-Group: doc-projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-projects@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for doc projects trees
 <svn-doc-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-doc-projects>
List-Post: <mailto:svn-doc-projects@freebsd.org>
List-Help: <mailto:svn-doc-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-doc-projects>, 
 <mailto:svn-doc-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 03 May 2013 12:16:08 -0000

Author: dru
Date: Fri May  3 12:16:07 2013
New Revision: 41544
URL: http://svnweb.freebsd.org/changeset/doc/41544

Log:
  White space fix only. Translators can ignore.
  
  Approved by:  bcr (mentor)

Modified:
  projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml

Modified: projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml
==============================================================================
--- projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Fri May  3 08:43:29 2013	(r41543)
+++ projects/ISBN_1-57176-407-0/en_US.ISO8859-1/books/handbook/security/chapter.xml	Fri May  3 12:16:07 2013	(r41544)
@@ -27,10 +27,10 @@
     <para>This chapter provides a basic introduction to system
       security concepts, some general good rules of thumb, and some
       advanced topics under &os;.  Many of the topics covered here
-      can be applied to system and Internet security in general. 
-      Securing a system is imperative to protect data,
-      intellectual property, time, and much more from the hands of
-      hackers and the like.</para>
+      can be applied to system and Internet security in general.
+      Securing a system is imperative to protect data, intellectual
+      property, time, and much more from the hands of hackers and the
+      like.</para>
 
     <para>&os; provides an array of utilities and mechanisms to
       protect the integrity and security of the system and
@@ -173,8 +173,8 @@
       <acronym>DoS</acronym> attack.  Many sysadmins still run
       unencrypted services, meaning that users logging into the
       system from a remote location are vulnerable to having their
-      password sniffed.  The attentive sysadmin analyzes the
-      remote access logs looking for suspicious source addresses and
+      password sniffed.  The attentive sysadmin analyzes the remote
+      access logs looking for suspicious source addresses and
       suspicious logins.</para>
 
     <para>In a well secured and maintained system, access to a user
@@ -289,10 +289,9 @@
 	should be configured.  One method is to add appropriate user
 	accounts to <groupname>wheel</groupname> in
 	<filename>/etc/group</filename>.  Members of
-	<groupname>wheel</groupname> are allowed to
-	&man.su.1; to <username>root</username>.  Only
-	those users who actually need to have
-	<username>root</username> access should be placed in
+	<groupname>wheel</groupname> are allowed to &man.su.1; to
+	<username>root</username>.  Only those users who actually need
+	to have <username>root</username> access should be placed in
 	<groupname>wheel</groupname>.  When using Kerberos for
 	authentication, create a <filename>.k5login</filename> in
 	the home directory of <username>root</username> to allow
@@ -333,9 +332,8 @@
 	as few services as possible and run a password-protected
 	screensaver.  Of course, given physical access to any system,
 	an attacker can break any sort of security.  Fortunately,
-	many break-ins occur remotely, over a network,
-	from people who do not have physical access to the
-	system.</para>
+	many break-ins occur remotely, over a network, from people who
+	do not have physical access to the system.</para>
 
       <para>Using Kerberos provides the ability to disable or change
 	the password for a user in one place, and have it immediately
@@ -358,21 +356,19 @@
 	<primary>&man.sshd.8;</primary>
       </indexterm>
 
-      <para>The prudent sysadmin only enables required services
-	and is aware that third party servers are often the most
-	bug-prone.  Never run a server that has not been checked
-	out carefully.  Think twice before running any service as
+      <para>The prudent sysadmin only enables required services and is
+	aware that third party servers are often the most bug-prone.
+	Never run a server that has not been checked out carefully.
+	Think twice before running any service as
 	<username>root</username> as many daemons can be run as a
 	separate service account or can be started in a
 	<firstterm>sandbox</firstterm>.  Do not activate insecure
-	services such as &man.telnetd.8; or
-	&man.rlogind.8;.</para>
+	services such as &man.telnetd.8; or &man.rlogind.8;.</para>
 
       <para>Another potential security hole is SUID-root and SGID
-	binaries.  Most of these binaries, such as
-	&man.rlogin.1;, reside in <filename
-	  class="directory">/bin</filename>, <filename
-	  class="directory">/sbin</filename>, <filename
+	binaries.  Most of these binaries, such as &man.rlogin.1;,
+	reside in <filename class="directory">/bin</filename>,
+	<filename class="directory">/sbin</filename>, <filename
 	  class="directory">/usr/bin</filename>, or <filename
 	  class="directory">/usr/sbin</filename>.  While nothing is
 	100% safe, the system-default SUID and SGID binaries can be
@@ -400,22 +396,21 @@
 
       <para>User accounts are usually the most difficult to secure.
 	Be vigilant in the monitoring of user accounts.  Use of
-	&man.ssh.1; and Kerberos for user accounts
-	requires extra administration and technical support, but
-	provides a good solution compared to an encrypted password
-	file.</para>
+	&man.ssh.1; and Kerberos for user accounts requires extra
+	administration and technical support, but provides a good
+	solution compared to an encrypted password file.</para>
     </sect2>
 
     <sect2>
       <title>Securing the Password File</title>
 
       <para>The only sure fire way is to star out as many passwords as
-	possible and use &man.ssh.1; or Kerberos
-	for access to those accounts.  Even though the encrypted
-	password file (<filename>/etc/spwd.db</filename>) can only be
-	read by <username>root</username>, it may be possible for an
-	intruder to obtain read access to that file even if the
-	attacker cannot obtain root-write access.</para>
+	possible and use &man.ssh.1; or Kerberos for access to those
+	accounts.  Even though the encrypted password file
+	(<filename>/etc/spwd.db</filename>) can only be read by
+	<username>root</username>, it may be possible for an intruder
+	to obtain read access to that file even if the attacker cannot
+	obtain root-write access.</para>
 
       <para>Security scripts should be used to check for and report
 	changes to the password file as described in the <link
@@ -475,9 +470,8 @@
 
       <note>
 	<para>Bumping the security level to 1 or higher may cause a
-	  few
-	  problems to <application>&xorg;</application>, as access to
-	  <filename>/dev/io</filename> will be blocked, or to the
+	  few problems to <application>&xorg;</application>, as access
+	  to <filename>/dev/io</filename> will be blocked, or to the
 	  installation of &os; built from source as
 	  <maketarget>installworld</maketarget> needs to temporarily
 	  reset the append-only and immutable flags of some files.
@@ -495,9 +489,9 @@
 
       <para>If the kernel's security level is raised to 1 or a higher
 	value, it may be useful to set the <literal>schg</literal>
-	flag on critical startup binaries, directories, script
-	files, and  everything that gets run up to the point where
-	the security level is set.  A less strict compromise is to run
+	flag on critical startup binaries, directories, script files,
+	and  everything that gets run up to the point where the
+	security level is set.  A less strict compromise is to run
 	the system at a higher security level but skip setting the
 	<literal>schg</literal> flag.  Another possibility is to
 	mount <filename class="directory">/</filename> and <filename
@@ -511,9 +505,9 @@
 
       <para>One can only protect the core system configuration and
 	control files so much before the convenience factor rears its
-	ugly head.  For example, using &man.chflags.1; to
-	set the <literal>schg</literal> bit on most of the files in
-	<filename class="directory">/</filename> and <filename
+	ugly head.  For example, using &man.chflags.1; to set the
+	<literal>schg</literal> bit on most of the files in <filename
+	  class="directory">/</filename> and <filename
 	  class="directory">/usr</filename> is probably
 	counterproductive, because while it may protect the files, it
 	also closes an intrusion detection window.  Security measures
@@ -527,21 +521,19 @@
 	for modified files is from another, often centralized,
 	limited-access system.  Writing security scripts on the
 	extra-security limited-access system makes them mostly
-	invisible
-	to potential attackers.  In order to take maximum advantage,
-	the limited-access box needs significant access to the other
-	machines, usually either through a read-only
+	invisible to potential attackers.  In order to take maximum
+	advantage, the limited-access box needs significant access to
+	the other machines, usually either through a read-only
 	<acronym>NFS</acronym> export or by setting up
-	&man.ssh.1; key-pairs.  Except for its
-	network traffic, <acronym>NFS</acronym> is the least visible
-	method, allowing the administrator to monitor the filesystems
-	on each client box virtually undetected.  If a limited-access
-	server is connected to the client boxes through
-	a switch, the <acronym>NFS</acronym> method is often the
-	better choice.  If a limited-access server is connected to the
-	client boxes through several layers of routing, the
-	<acronym>NFS</acronym> method may be too insecure and
-	&man.ssh.1; may be the better
+	&man.ssh.1; key-pairs.  Except for its network traffic,
+	<acronym>NFS</acronym> is the least visible method, allowing
+	the administrator to monitor the filesystems on each client
+	box virtually undetected.  If a limited-access server is
+	connected to the client boxes through a switch, the
+	<acronym>NFS</acronym> method is often the better choice.  If
+	a limited-access server is connected to the client boxes
+	through several layers of routing, the <acronym>NFS</acronym>
+	method may be too insecure and &man.ssh.1; may be the better
 	choice.</para>
 
       <para>Once a limited-access box has been given at least read
@@ -561,14 +553,13 @@
 	  class="directory">/</filename> and <filename
 	  class="directory">/usr</filename>.</para>
 
-      <para>When using &man.ssh.1; rather than
-	<acronym>NFS</acronym>, writing the security script is more
-	difficult.  For example, &man.scp.1; is needed to
-	send the scripts to the client box in order to run them.  The
-	&man.ssh.1; client
-	on the client box may already be compromised.  Using
-	&man.ssh.1; may be necessary when running
-	over insecure links, but it is harder to deal with.</para>
+      <para>When using &man.ssh.1; rather than <acronym>NFS</acronym>,
+	writing the security script is more difficult.  For example,
+	&man.scp.1; is needed to send the scripts to the client box in
+	order to run them.  The &man.ssh.1; client on the client box
+	may already be compromised.  Using &man.ssh.1; may be
+	necessary when running over insecure links, but it is harder
+	to deal with.</para>
 
       <para>A good security script will also check for changes to
 	hidden configuration files, such as
@@ -613,8 +604,7 @@
 	thought.  More importantly, a security administrator should
 	mix it up a bit.  If recommendations, such as those mentioned
 	in this section, are applied verbatim, those methodologies are
-	given to
-	the prospective attacker who also has access to this
+	given to the prospective attacker who also has access to this
 	document.</para>
     </sect2>
 
@@ -657,10 +647,9 @@
 	&man.inetd.8; carefully and pay specific attention to
 	<option>-c</option>, <option>-C</option>, and
 	<option>-R</option>.  Spoofed IP attacks will circumvent
-	<option>-C</option> to &man.inetd.8;, so
-	typically a combination of options must be used.  Some
-	standalone servers have self-fork-limitation
-	parameters.</para>
+	<option>-C</option> to &man.inetd.8;, so typically a
+	combination of options must be used.  Some standalone servers
+	have self-fork-limitation parameters.</para>
 
       <para><application>Sendmail</application> provides
 	<option>-OMaxDaemonChildren</option>, which tends to work
@@ -681,13 +670,12 @@
 	reasonable <literal>MaxDaemonChildren</literal> to prevent
 	cascade failures.</para>
 
-      <para>&man.syslogd.8; can be attacked
-	directly and it is strongly recommended to use
+      <para>&man.syslogd.8; can be attacked directly and it is
+	strongly recommended to use
 	<option>-s</option> whenever possible, and
 	<option>-a</option> otherwise.</para>
 
-      <para>Be careful with connect-back
-	services such as
+      <para>Be careful with connect-back services such as
 	reverse-identd, which can be attacked directly.  The
 	reverse-ident feature of
 	<application>TCP Wrappers</application> is not recommended for
@@ -701,7 +689,7 @@
 	exclusive firewall which denies everything by default except
 	for traffic which is explicitly allowed.  The range of port
 	numbers used for dynamic binding in &os; is controlled by
-	several	<varname>net.inet.ip.portrange</varname>
+	several <varname>net.inet.ip.portrange</varname>
 	&man.sysctl.8; variables.</para>
 
       <para>Another common <acronym>DoS</acronym> attack, called a
@@ -725,26 +713,26 @@
 	the &man.sysctl.8; variable
 	<literal>net.inet.icmp.icmplim</literal> to limit these
 	attacks.  The last major class of springboard attacks is
-	related to certain internal &man.inetd.8;
-	services such as the UDP echo service.  An attacker spoofs a
-	UDP packet with a source address of server A's echo port
-	and a destination address of server B's echo port, where
-	server A and B on the same LAN.  The two servers bounce this
-	one packet back and forth between each other.  The attacker
-	can overload both servers and the LAN by injecting a few
-	packets in this manner.  Similar problems exist with the
+	related to certain internal &man.inetd.8; services such as the
+	UDP echo service.  An attacker spoofs a UDP packet with a
+	source address of server A's echo port and a destination
+	address of server B's echo port, where server A and B on the
+	same LAN.  The two servers bounce this one packet back and
+	forth between each other.  The attacker can overload both
+	servers and the LAN by injecting a few packets in this manner.
+	Similar problems exist with the
 	<application>chargen</application> port.  These inetd-internal
 	test services should remain disabled.</para>
 
-      <para>Spoofed packet attacks may be used to overload the
-	kernel route cache.  Refer to the
+      <para>Spoofed packet attacks may be used to overload the kernel
+	route cache.  Refer to the
 	<varname>net.inet.ip.rtexpire</varname>,
 	<varname>rtminexpire</varname>, and
-	<varname>rtmaxcache</varname> &man.sysctl.8;
-	parameters.  A spoofed packet attack that uses a random source
-	IP will cause the kernel to generate a temporary cached route
-	in the route table, viewable with <command>netstat -rna |
-	  fgrep W3</command>.  These routes typically timeout in 1600
+	<varname>rtmaxcache</varname> &man.sysctl.8; parameters.  A
+	spoofed packet attack that uses a random source IP will cause
+	the kernel to generate a temporary cached route in the route
+	table, viewable with <command>netstat -rna | fgrep
+	  W3</command>.  These routes typically timeout in 1600
 	seconds or so.  If the kernel detects that the cached route
 	table has gotten too big, it will dynamically reduce the
 	<varname>rtexpire</varname> but will never decrease it to less
@@ -768,9 +756,9 @@
 	better, it may be prudent to manually override both
 	<varname>rtexpire</varname> and <varname>rtminexpire</varname>
 	via &man.sysctl.8;.  Never set either parameter to zero
-	as this could crash the machine.  Setting both
-	parameters to 2 seconds should be sufficient to protect the
-	route table from attack.</para>
+	as this could crash the machine.  Setting both parameters to 2
+	seconds should be sufficient to protect the route table from
+	attack.</para>
     </sect2>
 
     <sect2>
@@ -778,36 +766,32 @@
 
       <indexterm><primary>&man.ssh.1;</primary></indexterm>
 
-      <para>There are a few issues with both Kerberos and
-	&man.ssh.1; that need to be addressed if
-	they are used.  Kerberos is an excellent authentication
-	protocol, but there are bugs in the kerberized versions of
-	&man.telnet.1; and &man.rlogin.1; that make them
-	unsuitable for dealing with binary streams.  By default,
-	Kerberos does not encrypt a session unless
-	<option>-x</option> is used whereas  &man.ssh.1;
-	encrypts everything.</para>
-
-      <para>While &man.ssh.1; works well, it
-	forwards encryption keys by default.  This introduces a
-	security risk to a user who uses
-	&man.ssh.1; to access an insecure
-	machine from a secure workstation.  The keys themselves are
-	not exposed, but &man.ssh.1; installs a
-	forwarding port for the duration of the login.  If an attacker
-	has broken <username>root</username> on the insecure machine,
-	he can utilize that port to gain access to any other machine
-	that those keys unlock.</para>
-
-      <para>It is recommended that &man.ssh.1; is
-	used in combination with Kerberos whenever possible for staff
-	logins and &man.ssh.1; can be compiled with
-	Kerberos support.  This reduces reliance on potentially
-	exposed <acronym>SSH</acronym> keys while protecting
-	passwords via Kerberos.
-	Keys should only be used for automated tasks from secure
-	machines as this is something that Kerberos is unsuited to.
-	It is recommended to either turn off key-forwarding in the
+      <para>There are a few issues with both Kerberos and &man.ssh.1;
+	that need to be addressed if they are used.  Kerberos is an
+	excellent authentication protocol, but there are bugs in the
+	kerberized versions of &man.telnet.1; and &man.rlogin.1; that
+	make them unsuitable for dealing with binary streams.  By
+	default, Kerberos does not encrypt a session unless
+	<option>-x</option> is used whereas  &man.ssh.1; encrypts
+	everything.</para>
+
+      <para>While &man.ssh.1; works well, it forwards encryption keys
+	by default.  This introduces a security risk to a user who
+	uses &man.ssh.1; to access an insecure machine from a secure
+	workstation.  The keys themselves are not exposed, but
+	&man.ssh.1; installs a forwarding port for the duration of the
+	login.  If an attacker has broken <username>root</username> on
+	the insecure machine, he can utilize that port to gain access
+	to any other machine that those keys unlock.</para>
+
+      <para>It is recommended that &man.ssh.1; is used in combination
+	with Kerberos whenever possible for staff logins and
+	&man.ssh.1; can be compiled with Kerberos support.  This
+	reduces reliance on potentially exposed <acronym>SSH</acronym>
+	keys while protecting passwords via Kerberos.  Keys should
+	only be used for automated tasks from secure machines as this
+	is something that Kerberos is unsuited to.  It is recommended
+	to either turn off key-forwarding in the
 	<acronym>SSH</acronym> configuration, or to make use
 	of <literal>from=IP/DOMAIN</literal> in
 	<filename>authorized_keys</filename> to make the key only
@@ -853,11 +837,11 @@
     <para>Originally, the only secure way to encrypt passwords in
       &unix; was based on the Data Encryption Standard
       (<acronym>DES</acronym>).  Since the source code for
-      <acronym>DES</acronym> could not be exported
-      outside the US, &os; had to find a way to both comply with US
-      law and retain compatibility with other &unix; variants that
-      used <acronym>DES</acronym>.  The solution was MD5 which is
-      believed to be more secure than <acronym>DES</acronym>.</para>
+      <acronym>DES</acronym> could not be exported outside the US,
+      &os; had to find a way to both comply with US law and retain
+      compatibility with other &unix; variants that used
+      <acronym>DES</acronym>.  The solution was MD5 which is believed
+      to be more secure than <acronym>DES</acronym>.</para>
 
     <sect2>
       <title>Recognizing the Crypt Mechanism</title>
@@ -943,30 +927,27 @@
       <acronym>OPIE</acronym> must be reinitialized.</para>
 
     <para>There are a few programs involved in this process.
-      &man.opiekey.1; accepts an iteration count, a seed,
-      and a secret password, and generates a one-time password or a
-      consecutive list of one-time passwords.  In addition to
-      initializing <acronym>OPIE</acronym>,
-      &man.opiepasswd.1; is used to change passwords,
-      iteration counts, or seeds.  It takes either a secret
+      &man.opiekey.1; accepts an iteration count, a seed, and a secret
+      password, and generates a one-time password or a consecutive
+      list of one-time passwords.  In addition to initializing
+      <acronym>OPIE</acronym>, &man.opiepasswd.1; is used to change
+      passwords, iteration counts, or seeds.  It takes either a secret
       passphrase, or an iteration count, seed, and a one-time
       password.  The relevant credential files in
       <filename>/etc/opiekeys</filename> are examined by
-      &man.opieinfo.1; which prints out the invoking user's
-      current iteration count and seed.</para>
+      &man.opieinfo.1; which prints out the invoking user's current
+      iteration count and seed.</para>
 
     <para>There are four different sorts of operations.  The first is
-      to use &man.opiepasswd.1; over a secure connection to
-      set up one-time-passwords for the first time, or to change the
-      password or seed.  The second operation is to use
-      &man.opiepasswd.1; over an insecure connection, in
-      conjunction with &man.opiekey.1; over a secure
-      connection, to do the same.  The third is to use
-      &man.opiekey.1; to log in over an insecure
-      connection.  The fourth is to use &man.opiekey.1; to
-      generate a number of keys which can be written down or printed
-      out to carry to insecure locations in order to make a connection
-      to anywhere.</para>
+      to use &man.opiepasswd.1; over a secure connection to set up
+      one-time-passwords for the first time, or to change the password
+      or seed.  The second operation is to use &man.opiepasswd.1; over
+      an insecure connection, in conjunction with &man.opiekey.1; over
+      a secure connection, to do the same.  The third is to use
+      &man.opiekey.1; to log in over an insecure connection.  The
+      fourth is to use &man.opiekey.1; to generate a number of keys
+      which can be written down or printed out to carry to insecure
+      locations in order to make a connection to anywhere.</para>
 
     <sect2>
       <title>Secure Connection Initialization</title>
@@ -1005,11 +986,11 @@ MOS MALL GOAT ARM AVID COED</screen>
 
       <para>To initialize or change the secret password over an
 	insecure connection, a secure connection is needed to some
-	place where &man.opiekey.1; can be run.  This might
-	be a shell prompt on a trusted machine.  An iteration count
-	is needed, where 100 is probably a good value, and the seed
-	can either be specified or the randomly-generated one used.
-	On the insecure connection, the machine being initialized, use
+	place where &man.opiekey.1; can be run.  This might be a shell
+	prompt on a trusted machine.  An iteration count is needed,
+	where 100 is probably a good value, and the seed can either be
+	specified or the randomly-generated one used.  On the insecure
+	connection, the machine being initialized, use
 	&man.opiepasswd.1;:</para>
 
       <screen>&prompt.user; <userinput>opiepasswd</userinput>
@@ -1070,10 +1051,10 @@ Password: </screen>
 
       <para>At this point, generate the one-time password to answer
 	this login prompt.  This must be done on a trusted system
-	where it is safe to run &man.opiekey.1;.  There
-	are versions of this command for &windows;, &macos; and &os;.
-	This command needs the iteration count and the seed as command
-	line options.  Use cut-and-paste from the login prompt on the
+	where it is safe to run &man.opiekey.1;.  There are versions
+	of this command for &windows;, &macos; and &os;.  This command
+	needs the iteration count and the seed as command line
+	options.  Use cut-and-paste from the login prompt on the
 	machine being logged in to.</para>
 
       <para>On the trusted system:</para>
@@ -1093,8 +1074,8 @@ GAME GAG WELT OUT DOWN CHAT</screen>
 
       <para>Sometimes there is no access to a trusted machine or
 	secure connection.  In this case, it is possible to use
-	&man.opiekey.1; to generate a number of one-time
-	passwords beforehand.  For example:</para>
+	&man.opiekey.1; to generate a number of one-time passwords
+	beforehand.  For example:</para>
 
       <screen>&prompt.user; <userinput>opiekey -n 5 30 zz99999</userinput>
 Using the MD5 algorithm to compute response.
@@ -1158,12 +1139,12 @@ Enter secret pass phrase: <userinput>&lt
     <para><acronym>TCP</acronym> Wrappers extends the abilities of
       <xref linkend="network-inetd"/> to provide support for every
       server daemon under its control.  It can be configured
-      to provide logging support, return messages to
-      connections, and permit a daemon to only accept internal
-      connections.  While some of these features can be provided
-      by implementing a firewall, <acronym>TCP</acronym> Wrappers adds
-      an extra layer of protection and goes beyond the amount of
-      control a firewall can provide.</para>
+      to provide logging support, return messages to connections, and
+      permit a daemon to only accept internal connections.  While some
+      of these features can be provided by implementing a firewall,
+      <acronym>TCP</acronym> Wrappers adds an extra layer of
+      protection and goes beyond the amount of control a firewall can
+      provide.</para>
 
     <para><acronym>TCP</acronym> Wrappers should not be considered a
       replacement for a properly configured firewall.
@@ -1194,9 +1175,8 @@ Enter secret pass phrase: <userinput>&lt
 
       <para>Basic configuration usually takes the form of
 	<literal>daemon : address : action</literal>, where
-	<literal>daemon</literal> is the daemon which
-	&man.inetd.8; started,
-	<literal>address</literal> is a valid hostname,
+	<literal>daemon</literal> is the daemon which &man.inetd.8;
+	started, <literal>address</literal> is a valid hostname,
 	<acronym>IP</acronym> address, or an IPv6 address enclosed in
 	brackets ([&nbsp;]), and <literal>action</literal> is
 	either <literal>allow</literal> or <literal>deny</literal>.
@@ -1205,17 +1185,16 @@ Enter secret pass phrase: <userinput>&lt
 	ascending order for a matching rule.  When a match is found,
 	the rule is applied and the search process stops.</para>
 
-      <para>For example, to
-	allow <acronym>POP</acronym>3 connections via the
-	<filename role="package">mail/qpopper</filename> daemon,
-	the following lines should be appended to
+      <para>For example, to allow <acronym>POP</acronym>3 connections
+	via the <filename role="package">mail/qpopper</filename>
+	daemon, the following lines should be appended to
 	<filename>hosts.allow</filename>:</para>
 
       <programlisting># This line is required for POP3 connections:
 qpopper : ALL : allow</programlisting>
 
-      <para>After adding this line, &man.inetd.8;
-	needs to be restarted:</para>
+      <para>After adding this line, &man.inetd.8; needs to be
+	restarted:</para>
 
 	<screen>&prompt.root; <userinput>service inetd restart</userinput></screen>
     </sect2>
@@ -1224,12 +1203,12 @@ qpopper : ALL : allow</programlisting>
       <title>Advanced Configuration</title>
 
       <para><acronym>TCP</acronym> Wrappers provides advanced options
-	to allow more control over the way connections are
-	handled.  In some cases, it may be appropriate to return a
-	comment to certain hosts or daemon connections.  In other
-	cases, a log entry should be recorded or an email sent
-	to the administrator.  Other situations may require the use of
-	a service for local connections only.  This is all possible
+	to allow more control over the way connections are handled.
+	In some cases, it may be appropriate to return a comment to
+	certain hosts or daemon connections.  In other cases, a log
+	entry should be recorded or an email sent to the
+	administrator.  Other situations may require the use of a
+	service for local connections only.  This is all possible
 	through the use of configuration options known as
 	<literal>wildcards</literal>, expansion characters and
 	external command execution.</para>
@@ -1241,8 +1220,8 @@ qpopper : ALL : allow</programlisting>
 	  should be denied yet a reason should be sent to the
 	  individual who attempted to establish that connection.  That
 	  action is possible with <option>twist</option>.  When a
-	  connection attempt is made, <option>twist</option>
-	  executes a shell command or script.  An example exists in
+	  connection attempt is made, <option>twist</option> executes
+	  a shell command or script.  An example exists in
 	  <filename>hosts.allow</filename>:</para>
 
 	<programlisting># The rest of the daemons are protected.
@@ -1250,15 +1229,14 @@ ALL : ALL \
 	: severity auth.info \
 	: twist /bin/echo "You are not welcome to use %d from %h."</programlisting>
 
-	<para>In this example, the message
-	  <quote>You are not allowed to use <literal>daemon</literal>
-	    from <literal>hostname</literal>.</quote> will be returned
-	  for any daemon not previously configured in the access file.
-	  This is useful for sending a reply back to the
-	  connection initiator right after the established connection
-	  is dropped.  Any message returned <emphasis>must</emphasis>
-	  be wrapped in quote (<literal>"</literal>)
-	  characters.</para>
+	<para>In this example, the message <quote>You are not allowed
+	    to use <literal>daemon</literal> from
+	    <literal>hostname</literal>.</quote> will be returned for
+	  any daemon not previously configured in the access file.
+	  This is useful for sending a reply back to the connection
+	  initiator right after the established connection is dropped.
+	  Any message returned <emphasis>must</emphasis> be wrapped in
+	  quote (<literal>"</literal>) characters.</para>
 
 	<warning>
 	  <para>It may be possible to launch a denial of service
@@ -1268,13 +1246,13 @@ ALL : ALL \
 	</warning>
 
 	<para>Another possibility is to use <option>spawn</option>.
-	  Like <option>twist</option>,
-	  <option>spawn</option> implicitly denies the
-	  connection and may be used to run external shell commands or
-	  scripts.  Unlike <option>twist</option>,
-	  <option>spawn</option> will not send a reply back to the
-	  individual who established the connection.  For example,
-	  consider the following configuration line:</para>
+	  Like <option>twist</option>, <option>spawn</option>
+	  implicitly denies the connection and may be used to run
+	  external shell commands or scripts.  Unlike
+	  <option>twist</option>, <option>spawn</option> will not send
+	  a reply back to the individual who established the
+	  connection.  For example, consider the following
+	  configuration line:</para>
 
 	<programlisting># We do not allow connections from example.com:
 ALL : .example.com \
@@ -1283,9 +1261,9 @@ ALL : .example.com \
 	: deny</programlisting>
 
 	<para>This will deny all connection attempts from <hostid
-	    role="fqdn">*.example.com</hostid> and log
-	  the hostname, <acronym>IP</acronym> address, and the
-	  daemon to which access was attempted to
+	    role="fqdn">*.example.com</hostid> and log the hostname,
+	  <acronym>IP</acronym> address, and the daemon to which
+	  access was attempted to
 	  <filename>/var/log/connections.log</filename>.</para>
 
 	<para>This example uses the substitution characters
@@ -1298,17 +1276,16 @@ ALL : .example.com \
 
 	<para>The <literal>ALL</literal> option may be used to match
 	  every instance of a daemon, domain, or an
-	  <acronym>IP</acronym> address.  Another wildcard
-	  is <literal>PARANOID</literal> which may be used to match
+	  <acronym>IP</acronym> address.  Another wildcard is
+	  <literal>PARANOID</literal> which may be used to match
 	  any host which provides an <acronym>IP</acronym> address
 	  that may be forged.  For example,
 	  <literal>PARANOID</literal> may be used to define an action
 	  to be taken whenever a connection is made from an
 	  <acronym>IP</acronym> address that differs from its
 	  hostname.  In this example, all connection requests to
-	  &man.sendmail.8; which have an
-	  <acronym>IP</acronym> address that varies from its hostname
-	  will be denied:</para>
+	  &man.sendmail.8; which have an <acronym>IP</acronym> address
+	  that varies from its hostname will be denied:</para>
 
 	<programlisting># Block possibly spoofed requests to sendmail:
 sendmail : PARANOID : deny</programlisting>
@@ -1355,23 +1332,22 @@ sendmail : PARANOID : deny</programlisti
       through the services of a secure server.
       <application>Kerberos</application> can be described as an
       identity-verifying proxy system.  It can also be described as a
-      trusted third-party authentication system.  After a
-      user authenticates with <application>Kerberos</application>,
-      their communications can be encrypted to assure privacy and data
+      trusted third-party authentication system.  After a user
+      authenticates with <application>Kerberos</application>, their
+      communications can be encrypted to assure privacy and data
       integrity.</para>
 
-    <para>The only function of
-      <application>Kerberos</application> is to provide
-      the secure authentication of users on the network.  It
-      does not provide authorization functions (what users are allowed
-      to do) or auditing functions (what those users did).  It is
-      recommended that
-      <application>Kerberos</application> be used with other security
-      methods which provide authorization and audit services.</para>
-
-    <para>This section provides a guide on how to
-      set up <application>Kerberos</application> as distributed for
-      &os;.  Refer to the relevant manual pages for more complete
+    <para>The only function of <application>Kerberos</application> is
+      to provide the secure authentication of users on the network.
+      It does not provide authorization functions (what users are
+      allowed to do) or auditing functions (what those users did).  It
+      is recommended that <application>Kerberos</application> be used
+      with other security methods which provide authorization and
+      audit services.</para>
+
+    <para>This section provides a guide on how to set up
+      <application>Kerberos</application> as distributed for &os;.
+      Refer to the relevant manual pages for more complete
       descriptions.</para>
 
     <para>For purposes of demonstrating a
@@ -1416,8 +1392,8 @@ sendmail : PARANOID : deny</programlisti
       <para><application>Kerberos</application> is both the name of a
 	network authentication protocol and an adjective to describe
 	programs that implement it, such as
-	<application>Kerberos</application> telnet.
-	The current version of the protocol is version 5, described in
+	<application>Kerberos</application> telnet.  The current
+	version of the protocol is version 5, described in
 	<acronym>RFC</acronym>&nbsp;1510.</para>
 
       <para>Several free implementations of this protocol are
@@ -1427,24 +1403,22 @@ sendmail : PARANOID : deny</programlisti
 	<application>Kerberos</application> was originally developed,
 	continues to develop their <application>Kerberos</application>
 	package.  It is commonly used in the <acronym>US</acronym> as
-	a cryptography product, and has historically been
-	affected by <acronym>US</acronym> export regulations.  The
+	a cryptography product, and has historically been affected by
+	<acronym>US</acronym> export regulations.  The
 	<acronym>MIT</acronym> <application>Kerberos</application> is
 	available as the <filename
-	  role="package">security/krb5</filename> package or port. 
-	Heimdal
-	<application>Kerberos</application> is another version 5
-	implementation, and was explicitly developed outside of the
+	  role="package">security/krb5</filename> package or port.
+	Heimdal <application>Kerberos</application> is another version
+	5 implementation, and was explicitly developed outside of the
 	<acronym>US</acronym> to avoid export regulations.  The
 	Heimdal <application>Kerberos</application> distribution is
 	available as a the <filename
 	  role="package">security/heimdal</filename> package or port,
-        and a minimal installation is included in the base &os;
+	and a minimal installation is included in the base &os;
 	install.</para>
 
-      <para>These instructions
-	assume the use of the Heimdal distribution included in
-	&os;.</para>
+      <para>These instructions assume the use of the Heimdal
+	distribution included in &os;.</para>
     </sect2>
 
     <sect2>
@@ -1464,11 +1438,10 @@ sendmail : PARANOID : deny</programlisti
 	<application>Kerberos</application> realm, and thus has
 	heightened security concerns.</para>
 
-      <para>While running the
-	<application>Kerberos</application> server requires very few
-	computing resources, a dedicated machine acting only as a
-	<acronym>KDC</acronym> is recommended for security
-	reasons.</para>
+      <para>While running the <application>Kerberos</application>
+	server requires very few computing resources, a dedicated
+	machine acting only as a <acronym>KDC</acronym> is recommended
+	for security reasons.</para>
 
       <para>To begin setting up a <acronym>KDC</acronym>, ensure that
 	<filename>/etc/rc.conf</filename> contains the correct
@@ -1493,15 +1466,14 @@ kadmind5_server_enable="YES"</programlis
 
       <para>This <filename>/etc/krb5.conf</filename> implies that the
 	<acronym>KDC</acronym> will use the fully-qualified hostname
-	<hostid role="fqdn">kerberos.example.org</hostid>.
-	Add a CNAME (alias) entry to the zone file to accomplish this
-	if the <acronym>KDC</acronym> has a different
-	hostname.</para>
+	<hostid role="fqdn">kerberos.example.org</hostid>.  Add a
+	CNAME (alias) entry to the zone file to accomplish this
+	if the <acronym>KDC</acronym> has a different hostname.</para>
 
       <note>
 	<para>For large networks with a properly configured
-	  <acronym>DNS</acronym> server, the
-	  above example could be trimmed to:</para>
+	  <acronym>DNS</acronym> server, the above example could be
+	  trimmed to:</para>
 
 	<programlisting>[libdefaults]
       default_realm = EXAMPLE.ORG</programlisting>
@@ -1526,33 +1498,28 @@ _kerberos           IN  TXT     EXAMPLE.
 	  server.</para>
       </note>
 
-      <para>Next, create the
-	<application>Kerberos</application> database which
-	contains the keys of all principals encrypted with a master
-	password.  It is not required to remember this password as it
-	will be stored in
+      <para>Next, create the <application>Kerberos</application>
+	database which contains the keys of all principals encrypted
+	with a master password.  It is not required to remember this
+	password as it will be stored in
 	<filename>/var/heimdal/m-key</filename>.  To create the
-	master key, run &man.kstash.8; and enter a
-	password.</para>
+	master key, run &man.kstash.8; and enter a password.</para>
 
-      <para>Once the master key has been created, initialize
-	the database using <command>kadmin -l</command>.
-	This option instructs
-	&man.kadmin.8; to modify the local database files
-	directly rather than going through the
-	&man.kadmind.8; network service.  This handles the
-	chicken-and-egg problem of trying to connect to the database
-	before it is created.  At the &man.kadmin.8;
-	prompt, use <command>init</command> to create the realm's
-	initial database.</para>
-
-      <para>Lastly, while still in &man.kadmin.8;, create
-	the first principal using <command>add</command>.
-	Stick to the default options for the principal for now, as
-	these can be changed later with <command>modify</command>.
-	Type <literal>?</literal> at the
-	&man.kadmin.8; prompt to see the available
-	options.</para>
+      <para>Once the master key has been created, initialize the
+	database using <command>kadmin -l</command>.  This option
+	instructs &man.kadmin.8; to modify the local database files
+	directly rather than going through the &man.kadmind.8; network
+	service.  This handles the chicken-and-egg problem of trying
+	to connect to the database before it is created.  At the
+	&man.kadmin.8; prompt, use <command>init</command> to create
+	the realm's initial database.</para>
+
+      <para>Lastly, while still in &man.kadmin.8;, create the first
+	principal using <command>add</command>.  Stick to the default
+	options for the principal for now, as these can be changed
+	later with <command>modify</command>.  Type
+	<literal>?</literal> at the &man.kadmin.8; prompt to see the
+	available options.</para>
 
       <para>A sample database creation session is shown below:</para>
 
@@ -1570,12 +1537,12 @@ Attributes []:
 Password: <userinput>xxxxxxxx</userinput>
 Verifying password - Password: <userinput>xxxxxxxx</userinput></screen>
 
-      <para>Next, start the <acronym>KDC</acronym>
-	services.  Run <command>service kerberos start</command> and
+      <para>Next, start the <acronym>KDC</acronym> services.  Run
+	<command>service kerberos start</command> and
 	<command>service kadmind start</command> to bring up the
 	services.  While there will not be any kerberized daemons
-	running at this point, it is possible to confirm that
-	the <acronym>KDC</acronym> is functioning by obtaining and
+	running at this point, it is possible to confirm that the
+	<acronym>KDC</acronym> is functioning by obtaining and
 	listing a ticket for the principal (user) that was just
 	created from the command-line of the <acronym>KDC</acronym>
 	itself:</para>
@@ -1611,9 +1578,9 @@ Aug 27 15:37:58  Aug 28 01:37:58  krbtgt
 	media.</para>
 
       <para>Next, create <filename>/etc/krb5.keytab</filename>.
-	This is the major difference between a server
-	providing <application>Kerberos</application> enabled
-	daemons and a workstation:  the server must have a
+	This is the major difference between a server providing
+	<application>Kerberos</application> enabled daemons and a
+	workstation:  the server must have a
 	<filename>keytab</filename>.  This file contains the
 	server's host key, which allows it and the
 	<acronym>KDC</acronym> to verify each others identity.  It
@@ -1622,31 +1589,28 @@ Aug 27 15:37:58  Aug 28 01:37:58  krbtgt
 	public.</para>
 
       <para>Typically, the <filename>keytab</filename> is transferred
-	to the server using &man.kadmin.8;.
-	This is handy because the host principal, the
-	<acronym>KDC</acronym> end of the
+	to the server using &man.kadmin.8;.  This is handy because the
+	host principal, the <acronym>KDC</acronym> end of the
 	<filename>krb5.keytab</filename>, is also created using
 	&man.kadmin.8;.</para>
 
-      <para>A ticket must already be obtained and
-	this ticket must be allowed to use the
-	&man.kadmin.8; interface in the
+      <para>A ticket must already be obtained and this ticket must be
+	allowed to use the &man.kadmin.8; interface in the
 	<filename>kadmind.acl</filename>.  See the section titled
 	<quote>Remote administration</quote> in<command>info
 	  heimdal</command> for details on designing access control
-	lists.  Instead of enabling remote &man.kadmin.8;
-	access, the administrator can
-	securely connect to the <acronym>KDC</acronym> via the
-	local console or &man.ssh.1;, and
-	perform administration locally using
+	lists.  Instead of enabling remote &man.kadmin.8; access, the
+	administrator can securely connect to the
+	<acronym>KDC</acronym> via the local console or &man.ssh.1;,
+	and perform administration locally using
 	<command>kadmin -l</command>.</para>
 
       <para>After installing <filename>/etc/krb5.conf</filename>,
 	use <command>add --random-key</command> from the
 	<application>Kerberos</application> server.  This adds
 	the server's host principal.  Then, use <command>ext</command>
-	to extract the server's host
-	principal to its own keytab.  For example:</para>
+	to extract the server's host principal to its own keytab.  For
+	example:</para>
 
       <screen>&prompt.root; <userinput>kadmin</userinput>
 kadmin><userinput> add --random-key host/myserver.example.org</userinput>
@@ -1659,8 +1623,8 @@ kadmin><userinput> exit</userinput></scr
       <para>Note that <command>ext</command> stores the extracted key
 	in <filename>/etc/krb5.keytab</filename> by default.</para>
 
-      <para>If &man.kadmind.8; is not running on
-	the <acronym>KDC</acronym> and there is no access to
+      <para>If &man.kadmind.8; is not running on the
+	<acronym>KDC</acronym> and there is no access to
 	&man.kadmin.8; remotely, add the host principal
 	(<username>host/myserver.EXAMPLE.ORG</username>) directly on
 	the <acronym>KDC</acronym> and then extract it to a
@@ -1673,18 +1637,16 @@ kadmin><userinput> ext --keytab=/tmp/exa
 kadmin><userinput> exit</userinput></screen>
 
       <para>The keytab can then be securely copied to the server
-	using &man.scp.1; or a removable media.
-	Be sure to specify a non-default keytab name to
-	avoid overwriting the keytab on the
+	using &man.scp.1; or a removable media.  Be sure to specify a
+	non-default keytab name to avoid overwriting the keytab on the
 	<acronym>KDC</acronym>.</para>
 
       <para>At this point, the server can communicate with the
 	<acronym>KDC</acronym> using
 	<filename>krb5.conf</filename> and it can prove its
-	own identity with <filename>krb5.keytab</filename>.
-	It is now ready for the
-	<application>Kerberos</application> services to be enabled. 
-	For this example, the &man.telnetd.8; service
+	own identity with <filename>krb5.keytab</filename>.  It is now
+	ready for the <application>Kerberos</application> services to
+	be enabled.  For this example, the &man.telnetd.8; service
 	is enabled in <filename>/etc/inetd.conf</filename> and
 	&man.inetd.8; has been restarted with <command>service inetd
 	  restart</command>:</para>
@@ -1692,8 +1654,8 @@ kadmin><userinput> exit</userinput></scr
       <programlisting>telnet    stream  tcp     nowait  root    /usr/libexec/telnetd  telnetd -a user</programlisting>
 
       <para>The critical change is that the <option>-a</option>
-	authentication type is set to user.  Refer to
-	&man.telnetd.8; for more details.</para>
+	authentication type is set to user.  Refer to &man.telnetd.8;
+	for more details.</para>
     </sect2>
 
     <sect2>
@@ -1710,16 +1672,15 @@ kadmin><userinput> exit</userinput></scr
 	this file over to the client computer from the
 	<acronym>KDC</acronym>.</para>
 
-      <para>Test the client by attempting to use
-	&man.kinit.1;, &man.klist.1;, and
-	&man.kdestroy.1; from the client to obtain, show,
-	and then delete a ticket for the principal created
+      <para>Test the client by attempting to use &man.kinit.1;,
+	&man.klist.1;, and &man.kdestroy.1; from the client to obtain,
+	show, and then delete a ticket for the principal created
 	above.  <application>Kerberos</application> applications
-	should also be able to connect
-	to <application>Kerberos</application> enabled servers.
-	If that does not work but obtaining a ticket does, the
-	problem is likely with the server and not with the client or
-	the <acronym>KDC</acronym>.</para>
+	should also be able to connect to
+	<application>Kerberos</application> enabled servers.  If that
+	does not work but obtaining a ticket does, the problem is
+	likely with the server and not with the client or the
+	<acronym>KDC</acronym>.</para>
 
       <para>When testing a Kerberized application, try using a packet
 	sniffer such as &man.tcpdump.1; to confirm that the password
@@ -1727,16 +1688,14 @@ kadmin><userinput> exit</userinput></scr
 
       <para>Various non-core <application>Kerberos</application>
 	client applications are available.  The <quote>minimal</quote>
-	installation in &os; installs &man.telnetd.8; as the
-	only <application>Kerberos</application> enabled
-	service.</para>
+	installation in &os; installs &man.telnetd.8; as the only
+	<application>Kerberos</application> enabled service.</para>
 
       <para>The Heimdal port installs
-	<application>Kerberos</application> enabled
-	versions of &man.ftpd.8;, &man.rshd.8;,
-	&man.rcp.1;, &man.rlogind.8;, and a few
-	other less common programs.  The <acronym>MIT</acronym> port
-	also contains a full suite of
+	<application>Kerberos</application> enabled versions of
+	&man.ftpd.8;, &man.rshd.8;, &man.rcp.1;, &man.rlogind.8;, and
+	a few other less common programs.  The <acronym>MIT</acronym>
+	port also contains a full suite of
 	<application>Kerberos</application> client
 	applications.</para>
     </sect2>
@@ -1755,29 +1714,28 @@ kadmin><userinput> exit</userinput></scr
 
       <para>Users within a realm typically have their
 	<application>Kerberos</application> principal mapped to a
-	local user account.  Occasionally, one needs to grant
-	access to a
-	local user account to someone who does not have a matching
-	<application>Kerberos</application> principal.  For example,
-	<username>tillman@EXAMPLE.ORG</username> may need access to
-	the local user account <username>webdevelopers</username>.
-	Other principals may also need access to that local
-	account.</para>

*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***