diff --git a/daemon/main.cpp b/daemon/main.cpp
index 4ff0264..5fd159f 100644
--- a/daemon/main.cpp
+++ b/daemon/main.cpp
@@ -37,7 +37,7 @@
 
 namespace nfd {
 
-NFD_LOG_INIT("Main");
+NFD_LOG_INIT("NFD");
 
 struct ProgramOptions
 {
@@ -199,7 +199,7 @@
         signalNo == SIGTERM)
       {
         getGlobalIoService().stop();
-        std::cout << "Caught signal '" << strsignal(signalNo) << "', exiting..." << std::endl;
+        NFD_LOG_INFO("Caught signal '" << strsignal(signalNo) << "', exiting...");
       }
     else
       {
@@ -227,6 +227,7 @@
     "log",
     "face_system",
     "authorizations",
+    "rib_security",
   };
 
 const size_t Nfd::N_SUPPORTED_CONFIG_SECTIONS =
diff --git a/nfd.conf.sample.in b/nfd.conf.sample.in
index ace10e1..b0288e4 100644
--- a/nfd.conf.sample.in
+++ b/nfd.conf.sample.in
@@ -26,6 +26,7 @@
   ;
   ; Run:
   ;   nfd --modules
+  ;   nrd --modules
   ;
   ; Or look for NFD_LOG_INIT(<module name>) statements in .cpp files
   ;
@@ -160,3 +161,77 @@
   ;   }
   ; }
 }
+
+rib_security
+{
+  ; This section defines the trust model for NFD RIB Management. It consists of rules and
+  ; trust-anchors, which are briefly defined in this file.  For more information refer to
+  ; manpage of ndn-validator.conf:
+  ;
+  ;     man ndn-validator.conf
+  ;
+  ; A trust-anchor is a pre-trusted certificate.  This can be any certificate that is the
+  ; root of certification chain (e.g., NDN testbed root certificate) or an existing
+  ; default system certificate `default.ndncert`.
+  ;
+  ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the
+  ; rules defined here. A rule can be broken into two parts: matching & checking. A packet
+  ; will be matched against rules from the first to the last until a matched rule is
+  ; encountered. The matched rule will be used to check the packet. If a packet does not
+  ; match any rule, it will be treated as invalid.  The matching part of a rule consists
+  ; of `for` and `filter` sections. They collectively define which packets can be checked
+  ; with this rule. `for` defines packet type (data or interest) and `filter` defines
+  ; conditions on other properties of a packet. Right now, you can only define conditions
+  ; on packet name, and you can only specify ONLY ONE filter for packet name.  The
+  ; checking part of a rule consists of `checker`, which defines the conditions that a
+  ; VALID packet MUST have. See comments in checker section for more details.
+
+  rule
+  {
+    id "NRD Prefix Registration Command Rule"
+    for interest                              ; rule for Interests (to validate CommandInterests)
+    filter
+    {
+      type name                               ; condition on interest name (w/o signature)
+      regex ^[<localhop><localhost>]<nrd>[<register><unregister>]<>{3}$
+    }
+    checker
+    {
+      type customized
+      sig-type rsa-sha256                     ; interest must have a rsa-sha256 signature
+      key-locator
+      {
+        type name                             ; key locator must be the certificate name of
+                                              ; the signing key
+        regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
+      }
+    }
+  }
+  rule
+  {
+    id "NDN Testbed Hierarchy Rule"
+    for data                                  ; rule for Data (to validate NDN certificates)
+    filter
+    {
+      type name                               ; condition on data name
+      regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
+    }
+    checker
+    {
+      type hierarchical                       ; the certificate name of the signing key and
+                                              ; the data name must follow the hierarchical model
+      sig-type rsa-sha256                     ; data must have a rsa-sha256 signature
+    }
+  }
+  trust-anchor
+  {
+    type file
+    file-name keys/default.ndncert ; the file name, by default this file should be placed in the
+                                  ; same folder as this config file.
+  }
+  ; trust-anchor ; Can be repeated multiple times to specify multiple trust anchors
+  ; {
+  ;   type file
+  ;   file-name keys/ndn-testbed.ndncert
+  ; }
+}
diff --git a/nrd.conf.sample b/nrd.conf.sample
deleted file mode 100644
index 35b162f..0000000
--- a/nrd.conf.sample
+++ /dev/null
@@ -1,70 +0,0 @@
-security
-{
-  ; Security section defines the trust model that NRD should use. It consists of rules and
-  ; trust-anchors, which are briefly defined in this file. For more details please see the
-  ; following wiki:
-  ; http://redmine.named-data.net/projects/ndn-cpp-dev/wiki/CommandValidatorConf
-  ;
-  ; A trust-anchor is a pre-trusted certificate. It is usually stored in a file in the
-  ; same directory as this config file. You can download the NDN testbed root certificate as the
-  ; trust anchor, or you can dump an existing certificate from your system as a trust anchor:
-  ;   $ ndnsec cert-dump /example/certificate/name > trust-anchor.cert
-  ; or you can generate a self-signed certificate as a trust anchor:
-  ;   $ ndnsec key-gen /example/identity/name > trust-anchor.cert
-  ; See comments in trust-anchor section for configuration details.
-  ;
-  ; A rule defines conditions a valid packet MUST have. A packet must satisfy one of the rules defined
-  ; here. A rule can be broken into two parts: matching & checking. A packet will be matched against
-  ; rules from the first to the last until a matched rule is encountered. The matched rule will be
-  ; used to check the packet. If a packet does not match any rule, it will be treated as invalid.
-  ; The matching part of a rule consists of `for` and `filter` sections. They collectively define
-  ; which packets can be checked with this rule. `for` defines packet type (data or interest),
-  ; while `filter` defines conditions on other properties of a packet. Right now, you can only
-  ; define conditions on packet name, and you can only specify ONLY ONE filter for packet name.
-  ; The checking part of a rule consists of `checker`, which defines the conditions that a VALID
-  ; packet MUST have. See comments in checker section for more details.
-
-  rule
-  {
-    id "NRD Prefix Registration Command Rule" ; rule id
-    for interest                              ; this rule is used to validate interests
-    filter
-    {
-      type name                               ; condition on interest name (w/o signature)
-      regex ^[<localhop><localhost>]<nrd>[<register><unregister>]<>{3}$
-    }
-    checker
-    {
-      type customized
-      sig-type rsa-sha256                     ; interest must have a rsa-sha256 signature
-      key-locator
-      {
-        type name                             ; key locator must be the certificate name of
-                                              ; the signing key
-        regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
-      }
-    }
-  }
-  rule
-  {
-    id "Testbed Hierarchy Rule"               ; rule id
-    for data                                  ; this rule is used to validate data
-    filter
-    {
-      type name                               ; condition on data name
-      regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
-    }
-    checker
-    {
-      type hierarchical                       ; the certificate name of the signing key and
-                                              ; the data name must follow the hierarchical model
-      sig-type rsa-sha256                     ; data must have a rsa-sha256 signature
-    }
-  }
-  trust-anchor
-  {
-    type file                     ; trust anchor is stored in a file
-    file-name "trust-anchor.cert" ; the file name, by default this file should be placed in the
-                                  ; same folder as this config file.
-  }
-}
diff --git a/rib/.gitignore b/rib/.gitignore
deleted file mode 100644
index d26fa7d..0000000
--- a/rib/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-.DS*
-.waf-1*
-.lock*
-**/*.pyc
-build/
diff --git a/rib/.waf-tools/boost.py b/rib/.waf-tools/boost.py
deleted file mode 100644
index ffcfbae..0000000
--- a/rib/.waf-tools/boost.py
+++ /dev/null
@@ -1,376 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-#
-# partially based on boost.py written by Gernot Vormayr
-# written by Ruediger Sonderfeld <ruediger@c-plusplus.de>, 2008
-# modified by Bjoern Michaelsen, 2008
-# modified by Luca Fossati, 2008
-# rewritten for waf 1.5.1, Thomas Nagy, 2008
-# rewritten for waf 1.6.2, Sylvain Rouquette, 2011
-
-'''
-
-This is an extra tool, not bundled with the default waf binary.
-To add the boost tool to the waf file:
-$ ./waf-light --tools=compat15,boost
-	or, if you have waf >= 1.6.2
-$ ./waf update --files=boost
-
-When using this tool, the wscript will look like:
-
-	def options(opt):
-		opt.load('compiler_cxx boost')
-
-	def configure(conf):
-		conf.load('compiler_cxx boost')
-		conf.check_boost(lib='system filesystem')
-
-	def build(bld):
-		bld(source='main.cpp', target='app', use='BOOST')
-
-Options are generated, in order to specify the location of boost includes/libraries.
-The `check_boost` configuration function allows to specify the used boost libraries.
-It can also provide default arguments to the --boost-static and --boost-mt command-line arguments.
-Everything will be packaged together in a BOOST component that you can use.
-
-When using MSVC, a lot of compilation flags need to match your BOOST build configuration:
- - you may have to add /EHsc to your CXXFLAGS or define boost::throw_exception if BOOST_NO_EXCEPTIONS is defined.
-   Errors: C4530
- - boost libraries will try to be smart and use the (pretty but often not useful) auto-linking feature of MSVC
-   So before calling `conf.check_boost` you might want to disabling by adding:
-       conf.env.DEFINES_BOOST += ['BOOST_ALL_NO_LIB']
-   Errors:
- - boost might also be compiled with /MT, which links the runtime statically.
-   If you have problems with redefined symbols,
-		self.env['DEFINES_%s' % var] += ['BOOST_ALL_NO_LIB']
-		self.env['CXXFLAGS_%s' % var] += ['/MD', '/EHsc']
-Passing `--boost-linkage_autodetect` might help ensuring having a correct linkage in some basic cases.
-
-'''
-
-import sys
-import re
-from waflib import Utils, Logs, Errors
-from waflib.Configure import conf
-
-BOOST_LIBS = ['/usr/lib', '/usr/local/lib', '/opt/local/lib', '/sw/lib', '/lib', '/usr/lib/x86_64-linux-gnu', '/usr/lib/i386-linux-gnu', '/usr/local/ndn/lib']
-BOOST_INCLUDES = ['/usr/include', '/usr/local/include', '/opt/local/include', '/sw/include', '/usr/local/ndn/include']
-BOOST_VERSION_FILE = 'boost/version.hpp'
-BOOST_VERSION_CODE = '''
-#include <iostream>
-#include <boost/version.hpp>
-int main() { std::cout << BOOST_LIB_VERSION << ":" << BOOST_VERSION << std::endl; }
-'''
-
-# toolsets from {boost_dir}/tools/build/v2/tools/common.jam
-PLATFORM = Utils.unversioned_sys_platform()
-detect_intel = lambda env: (PLATFORM == 'win32') and 'iw' or 'il'
-detect_clang = lambda env: (PLATFORM == 'darwin') and 'clang-darwin' or 'clang'
-detect_mingw = lambda env: (re.search('MinGW', env.CXX[0])) and 'mgw' or 'gcc'
-BOOST_TOOLSETS = {
-	'borland':  'bcb',
-	'clang':	detect_clang,
-	'como':	 'como',
-	'cw':	   'cw',
-	'darwin':   'xgcc',
-	'edg':	  'edg',
-	'g++':	  detect_mingw,
-	'gcc':	  detect_mingw,
-	'icpc':	 detect_intel,
-	'intel':	detect_intel,
-	'kcc':	  'kcc',
-	'kylix':	'bck',
-	'mipspro':  'mp',
-	'mingw':	'mgw',
-	'msvc':	 'vc',
-	'qcc':	  'qcc',
-	'sun':	  'sw',
-	'sunc++':   'sw',
-	'tru64cxx': 'tru',
-	'vacpp':	'xlc'
-}
-
-
-def options(opt):
-	opt = opt.add_option_group('Boost Options')
-
-	opt.add_option('--boost-includes', type='string',
-				   default='', dest='boost_includes',
-				   help='''path to the directory where the boost includes are, e.g., /path/to/boost_1_47_0/stage/include''')
-	opt.add_option('--boost-libs', type='string',
-				   default='', dest='boost_libs',
-				   help='''path to the directory where the boost libs are, e.g., /path/to/boost_1_47_0/stage/lib''')
-	opt.add_option('--boost-static', action='store_true',
-				   default=False, dest='boost_static',
-				   help='link with static boost libraries (.lib/.a)')
-	opt.add_option('--boost-mt', action='store_true',
-				   default=False, dest='boost_mt',
-				   help='select multi-threaded libraries')
-	opt.add_option('--boost-abi', type='string', default='', dest='boost_abi',
-				   help='''select libraries with tags (dgsyp, d for debug), see doc Boost, Getting Started, chapter 6.1''')
-	opt.add_option('--boost-linkage_autodetect', action="store_true", dest='boost_linkage_autodetect',
-				   help="auto-detect boost linkage options (don't get used to it / might break other stuff)")
-	opt.add_option('--boost-toolset', type='string',
-				   default='', dest='boost_toolset',
-				   help='force a toolset e.g. msvc, vc90, gcc, mingw, mgw45 (default: auto)')
-	py_version = '%d%d' % (sys.version_info[0], sys.version_info[1])
-	opt.add_option('--boost-python', type='string',
-				   default=py_version, dest='boost_python',
-				   help='select the lib python with this version (default: %s)' % py_version)
-
-
-@conf
-def __boost_get_version_file(self, d):
-	dnode = self.root.find_dir(d)
-	if dnode:
-		return dnode.find_node(BOOST_VERSION_FILE)
-	return None
-
-@conf
-def boost_get_version(self, d):
-	"""silently retrieve the boost version number"""
-	node = self.__boost_get_version_file(d)
-	if node:
-		try:
-			txt = node.read()
-		except (OSError, IOError):
-			Logs.error("Could not read the file %r" % node.abspath())
-		else:
-			re_but1 = re.compile('^#define\\s+BOOST_LIB_VERSION\\s+"(.*)"', re.M)
-			m1 = re_but1.search(txt)
-
-			re_but2 = re.compile('^#define\\s+BOOST_VERSION\\s+"(.*)"', re.M)
-			m2 = re_but2.search(txt)
-
-			if m1 and m2:
-				return (m1.group(1), m2.group(1))
-
-	return self.check_cxx(fragment=BOOST_VERSION_CODE, includes=[d], execute=True, define_ret=True).split(":")
-
-@conf
-def boost_get_includes(self, *k, **kw):
-	includes = k and k[0] or kw.get('includes', None)
-	if includes and self.__boost_get_version_file(includes):
-		return includes
-	for d in Utils.to_list(self.environ.get('INCLUDE', '')) + BOOST_INCLUDES:
-		if self.__boost_get_version_file(d):
-			return d
-	if includes:
-		self.end_msg('headers not found in %s' % includes)
-		self.fatal('The configuration failed')
-	else:
-		self.end_msg('headers not found, please provide a --boost-includes argument (see help)')
-		self.fatal('The configuration failed')
-
-
-@conf
-def boost_get_toolset(self, cc):
-	toolset = cc
-	if not cc:
-		build_platform = Utils.unversioned_sys_platform()
-		if build_platform in BOOST_TOOLSETS:
-			cc = build_platform
-		else:
-			cc = self.env.CXX_NAME
-	if cc in BOOST_TOOLSETS:
-		toolset = BOOST_TOOLSETS[cc]
-	return isinstance(toolset, str) and toolset or toolset(self.env)
-
-
-@conf
-def __boost_get_libs_path(self, *k, **kw):
-	''' return the lib path and all the files in it '''
-	if 'files' in kw:
-		return self.root.find_dir('.'), Utils.to_list(kw['files'])
-	libs = k and k[0] or kw.get('libs', None)
-	if libs:
-		path = self.root.find_dir(libs)
-		files = path.ant_glob('*boost_*')
-	if not libs or not files:
-		for d in Utils.to_list(self.environ.get('LIB', [])) + BOOST_LIBS:
-			path = self.root.find_dir(d)
-			if path:
-				files = path.ant_glob('*boost_*')
-				if files:
-					break
-			path = self.root.find_dir(d + '64')
-			if path:
-				files = path.ant_glob('*boost_*')
-				if files:
-					break
-	if not path:
-		if libs:
-			self.end_msg('libs not found in %s' % libs)
-			self.fatal('The configuration failed')
-		else:
-			self.end_msg('libs not found, please provide a --boost-libs argument (see help)')
-			self.fatal('The configuration failed')
-
-	self.to_log('Found the boost path in %r with the libraries:' % path)
-	for x in files:
-		self.to_log('    %r' % x)
-	return path, files
-
-@conf
-def boost_get_libs(self, *k, **kw):
-	'''
-	return the lib path and the required libs
-	according to the parameters
-	'''
-	path, files = self.__boost_get_libs_path(**kw)
-	t = []
-	if kw.get('mt', False):
-		t.append('mt')
-	if kw.get('abi', None):
-		t.append(kw['abi'])
-	tags = t and '(-%s)+' % '-'.join(t) or ''
-	toolset = self.boost_get_toolset(kw.get('toolset', ''))
-	toolset_pat = '(-%s[0-9]{0,3})+' % toolset
-	version = '(-%s)+' % self.env.BOOST_VERSION
-
-	def find_lib(re_lib, files):
-		for file in files:
-			if re_lib.search(file.name):
-				self.to_log('Found boost lib %s' % file)
-				return file
-		return None
-
-	def format_lib_name(name):
-		if name.startswith('lib') and self.env.CC_NAME != 'msvc':
-			name = name[3:]
-		return name[:name.rfind('.')]
-
-	libs = []
-	for lib in Utils.to_list(k and k[0] or kw.get('lib', None)):
-		py = (lib == 'python') and '(-py%s)+' % kw['python'] or ''
-		# Trying libraries, from most strict match to least one
-		for pattern in ['boost_%s%s%s%s%s' % (lib, toolset_pat, tags, py, version),
-						'boost_%s%s%s%s' % (lib, tags, py, version),
-						'boost_%s%s%s' % (lib, tags, version),
-						# Give up trying to find the right version
-						'boost_%s%s%s%s' % (lib, toolset_pat, tags, py),
-						'boost_%s%s%s' % (lib, tags, py),
-						'boost_%s%s' % (lib, tags)]:
-			self.to_log('Trying pattern %s' % pattern)
-			file = find_lib(re.compile(pattern), files)
-			if file:
-				libs.append(format_lib_name(file.name))
-				break
-		else:
-			self.end_msg('lib %s not found in %s' % (lib, path.abspath()))
-			self.fatal('The configuration failed')
-
-	return path.abspath(), libs
-
-
-@conf
-def check_boost(self, *k, **kw):
-	"""
-	Initialize boost libraries to be used.
-
-	Keywords: you can pass the same parameters as with the command line (without "--boost-").
-	Note that the command line has the priority, and should preferably be used.
-	"""
-	if not self.env['CXX']:
-		self.fatal('load a c++ compiler first, conf.load("compiler_cxx")')
-
-	params = {'lib': k and k[0] or kw.get('lib', None)}
-	for key, value in self.options.__dict__.items():
-		if not key.startswith('boost_'):
-			continue
-		key = key[len('boost_'):]
-		params[key] = value and value or kw.get(key, '')
-
-	var = kw.get('uselib_store', 'BOOST')
-
-	self.start_msg('Checking boost includes')
-	self.env['INCLUDES_%s' % var] = inc = self.boost_get_includes(**params)
-	versions = self.boost_get_version(inc)
-	self.env.BOOST_VERSION = versions[0]
-	self.env.BOOST_VERSION_NUMBER = int(versions[1])
-	self.end_msg("%d.%d.%d" % (int(versions[1]) / 100000,
-				   int(versions[1]) / 100 % 1000,
-				   int(versions[1]) % 100))
-	if Logs.verbose:
-		Logs.pprint('CYAN', '	path : %s' % self.env['INCLUDES_%s' % var])
-
-	if not params['lib']:
-		return
-	self.start_msg('Checking boost libs')
-	suffix = params.get('static', None) and 'ST' or ''
-	path, libs = self.boost_get_libs(**params)
-	self.env['%sLIBPATH_%s' % (suffix, var)] = [path]
-	self.env['%sLIB_%s' % (suffix, var)] = libs
-	self.end_msg('ok')
-	if Logs.verbose:
-		Logs.pprint('CYAN', '	path : %s' % path)
-		Logs.pprint('CYAN', '	libs : %s' % libs)
-
-
-	def try_link():
-		if 'system' in params['lib']:
-			self.check_cxx(
-			 fragment="\n".join([
-			  '#include <boost/system/error_code.hpp>',
-			  'int main() { boost::system::error_code c; }',
-			 ]),
-			 use=var,
-			 execute=False,
-			)
-		if 'thread' in params['lib']:
-			self.check_cxx(
-			 fragment="\n".join([
-			  '#include <boost/thread.hpp>',
-			  'int main() { boost::thread t; }',
-			 ]),
-			 use=var,
-			 execute=False,
-			)
-
-	if params.get('linkage_autodetect', False):
-		self.start_msg("Attempting to detect boost linkage flags")
-		toolset = self.boost_get_toolset(kw.get('toolset', ''))
-		if toolset in ['vc']:
-			# disable auto-linking feature, causing error LNK1181
-			# because the code wants to be linked against
-			self.env['DEFINES_%s' % var] += ['BOOST_ALL_NO_LIB']
-
-			# if no dlls are present, we guess the .lib files are not stubs
-			has_dlls = False
-			for x in Utils.listdir(path):
-				if x.endswith(self.env.cxxshlib_PATTERN % ''):
-					has_dlls = True
-					break
-			if not has_dlls:
-				self.env['STLIBPATH_%s' % var] = [path]
-				self.env['STLIB_%s' % var] = libs
-				del self.env['LIB_%s' % var]
-				del self.env['LIBPATH_%s' % var]
-
-			# we attempt to play with some known-to-work CXXFLAGS combinations
-			for cxxflags in (['/MD', '/EHsc'], []):
-				self.env.stash()
-				self.env["CXXFLAGS_%s" % var] += cxxflags
-				try:
-					try_link()
-					self.end_msg("ok: winning cxxflags combination: %s" % (self.env["CXXFLAGS_%s" % var]))
-					e = None
-					break
-				except Errors.ConfigurationError as exc:
-					self.env.revert()
-					e = exc
-
-			if e is not None:
-				self.end_msg("Could not auto-detect boost linking flags combination, you may report it to boost.py author", ex=e)
-				self.fatal('The configuration failed')
-		else:
-			self.end_msg("Boost linkage flags auto-detection not implemented (needed ?) for this toolchain")
-			self.fatal('The configuration failed')
-	else:
-		self.start_msg('Checking for boost linkage')
-		try:
-			try_link()
-		except Errors.ConfigurationError as e:
-			self.end_msg("Could not link against boost libraries using supplied options")
-			self.fatal('The configuration failed')
-		self.end_msg('ok')
diff --git a/rib/.waf-tools/coverage.py b/rib/.waf-tools/coverage.py
deleted file mode 100644
index eac7608..0000000
--- a/rib/.waf-tools/coverage.py
+++ /dev/null
@@ -1,20 +0,0 @@
-# -*- Mode: python; py-indent-offset: 4; indent-tabs-mode: nil; coding: utf-8; -*-
-
-from waflib import TaskGen
-
-def options(opt):
-    opt.add_option('--with-coverage',action='store_true',default=False,dest='with_coverage',
-                   help='''Set compiler flags for gcc to enable code coverage information''')
-
-def configure(conf):
-    if conf.options.with_coverage:
-        conf.check_cxx(cxxflags=['-fprofile-arcs', '-ftest-coverage', '-fPIC'],
-                       linkflags=['-fprofile-arcs'], uselib_store='GCOV', mandatory=True)
-
-@TaskGen.feature('cxx','cc')
-@TaskGen.after('process_source')
-def add_coverage(self):
-    if getattr(self, 'use', ''):
-        self.use += ' GCOV'
-    else:
-        self.use = 'GCOV'
diff --git a/rib/.waf-tools/doxygen.py b/rib/.waf-tools/doxygen.py
deleted file mode 100644
index aebb511..0000000
--- a/rib/.waf-tools/doxygen.py
+++ /dev/null
@@ -1,204 +0,0 @@
-#! /usr/bin/env python
-# encoding: UTF-8
-# Thomas Nagy 2008-2010 (ita)
-
-"""
-
-Doxygen support
-
-Variables passed to bld():
-* doxyfile -- the Doxyfile to use
-
-When using this tool, the wscript will look like:
-
-	def options(opt):
-		opt.load('doxygen')
-
-	def configure(conf):
-		conf.load('doxygen')
-		# check conf.env.DOXYGEN, if it is mandatory
-
-	def build(bld):
-		if bld.env.DOXYGEN:
-			bld(features="doxygen", doxyfile='Doxyfile', ...)
-"""
-
-from fnmatch import fnmatchcase
-import os, os.path, re, stat
-from waflib import Task, Utils, Node, Logs, Errors
-from waflib.TaskGen import feature
-
-DOXY_STR = '"${DOXYGEN}" - '
-DOXY_FMTS = 'html latex man rft xml'.split()
-DOXY_FILE_PATTERNS = '*.' + ' *.'.join('''
-c cc cxx cpp c++ java ii ixx ipp i++ inl h hh hxx hpp h++ idl odl cs php php3
-inc m mm py f90c cc cxx cpp c++ java ii ixx ipp i++ inl h hh hxx
-'''.split())
-
-re_rl = re.compile('\\\\\r*\n', re.MULTILINE)
-re_nl = re.compile('\r*\n', re.M)
-def parse_doxy(txt):
-	tbl = {}
-	txt   = re_rl.sub('', txt)
-	lines = re_nl.split(txt)
-	for x in lines:
-		x = x.strip()
-		if not x or x.startswith('#') or x.find('=') < 0:
-			continue
-		if x.find('+=') >= 0:
-			tmp = x.split('+=')
-			key = tmp[0].strip()
-			if key in tbl:
-				tbl[key] += ' ' + '+='.join(tmp[1:]).strip()
-			else:
-				tbl[key] = '+='.join(tmp[1:]).strip()
-		else:
-			tmp = x.split('=')
-			tbl[tmp[0].strip()] = '='.join(tmp[1:]).strip()
-	return tbl
-
-class doxygen(Task.Task):
-	vars  = ['DOXYGEN', 'DOXYFLAGS']
-	color = 'BLUE'
-
-	def runnable_status(self):
-		'''
-		self.pars are populated in runnable_status - because this function is being
-		run *before* both self.pars "consumers" - scan() and run()
-
-		set output_dir (node) for the output
-		'''
-
-		for x in self.run_after:
-			if not x.hasrun:
-				return Task.ASK_LATER
-
-		if not getattr(self, 'pars', None):
-			txt = self.inputs[0].read()
-			self.pars = parse_doxy(txt)
-			if not self.pars.get('OUTPUT_DIRECTORY'):
-				self.pars['OUTPUT_DIRECTORY'] = self.inputs[0].parent.get_bld().abspath()
-
-			# Override with any parameters passed to the task generator
-			if getattr(self.generator, 'pars', None):
-				for k, v in self.generator.pars.iteritems():
-					self.pars[k] = v
-
-			self.doxy_inputs = getattr(self, 'doxy_inputs', [])
-			if not self.pars.get('INPUT'):
-				self.doxy_inputs.append(self.inputs[0].parent)
-			else:
-				for i in self.pars.get('INPUT').split():
-					if os.path.isabs(i):
-						node = self.generator.bld.root.find_node(i)
-					else:
-						node = self.generator.path.find_node(i)
-					if not node:
-						self.generator.bld.fatal('Could not find the doxygen input %r' % i)
-					self.doxy_inputs.append(node)
-
-		if not getattr(self, 'output_dir', None):
-			bld = self.generator.bld
-			# First try to find an absolute path, then find or declare a relative path
-			self.output_dir = bld.root.find_dir(self.pars['OUTPUT_DIRECTORY'])
-			if not self.output_dir:
-				self.output_dir = bld.path.find_or_declare(self.pars['OUTPUT_DIRECTORY'])
-
-		self.signature()
-		return Task.Task.runnable_status(self)
-
-	def scan(self):
-		exclude_patterns = self.pars.get('EXCLUDE_PATTERNS','').split()
-		file_patterns = self.pars.get('FILE_PATTERNS','').split()
-		if not file_patterns:
-			file_patterns = DOXY_FILE_PATTERNS
-		if self.pars.get('RECURSIVE') == 'YES':
-			file_patterns = ["**/%s" % pattern for pattern in file_patterns]
-		nodes = []
-		names = []
-		for node in self.doxy_inputs:
-			if os.path.isdir(node.abspath()):
-				for m in node.ant_glob(incl=file_patterns, excl=exclude_patterns):
-					nodes.append(m)
-			else:
-				nodes.append(node)
-		return (nodes, names)
-
-	def run(self):
-		dct = self.pars.copy()
-		dct['INPUT'] = ' '.join(['"%s"' % x.abspath() for x in self.doxy_inputs])
-		code = '\n'.join(['%s = %s' % (x, dct[x]) for x in self.pars])
-		code = code.encode() # for python 3
-		#fmt = DOXY_STR % (self.inputs[0].parent.abspath())
-		cmd = Utils.subst_vars(DOXY_STR, self.env)
-		env = self.env.env or None
-		proc = Utils.subprocess.Popen(cmd, shell=True, stdin=Utils.subprocess.PIPE, env=env, cwd=self.generator.bld.path.get_bld().abspath())
-		proc.communicate(code)
-		return proc.returncode
-
-	def post_run(self):
-		nodes = self.output_dir.ant_glob('**/*', quiet=True)
-		for x in nodes:
-			x.sig = Utils.h_file(x.abspath())
-		self.outputs += nodes
-		return Task.Task.post_run(self)
-
-class tar(Task.Task):
-	"quick tar creation"
-	run_str = '${TAR} ${TAROPTS} ${TGT} ${SRC}'
-	color   = 'RED'
-	after   = ['doxygen']
-	def runnable_status(self):
-		for x in getattr(self, 'input_tasks', []):
-			if not x.hasrun:
-				return Task.ASK_LATER
-
-		if not getattr(self, 'tar_done_adding', None):
-			# execute this only once
-			self.tar_done_adding = True
-			for x in getattr(self, 'input_tasks', []):
-				self.set_inputs(x.outputs)
-			if not self.inputs:
-				return Task.SKIP_ME
-		return Task.Task.runnable_status(self)
-
-	def __str__(self):
-		tgt_str = ' '.join([a.nice_path(self.env) for a in self.outputs])
-		return '%s: %s\n' % (self.__class__.__name__, tgt_str)
-
-@feature('doxygen')
-def process_doxy(self):
-	if not getattr(self, 'doxyfile', None):
-		self.generator.bld.fatal('no doxyfile??')
-
-	node = self.doxyfile
-	if not isinstance(node, Node.Node):
-		node = self.path.find_resource(node)
-	if not node:
-		raise ValueError('doxygen file not found')
-
-	# the task instance
-	dsk = self.create_task('doxygen', node)
-
-	if getattr(self, 'doxy_tar', None):
-		tsk = self.create_task('tar')
-		tsk.input_tasks = [dsk]
-		tsk.set_outputs(self.path.find_or_declare(self.doxy_tar))
-		if self.doxy_tar.endswith('bz2'):
-			tsk.env['TAROPTS'] = ['cjf']
-		elif self.doxy_tar.endswith('gz'):
-			tsk.env['TAROPTS'] = ['czf']
-		else:
-			tsk.env['TAROPTS'] = ['cf']
-
-def configure(conf):
-	'''
-	Check if doxygen and tar commands are present in the system
-
-	If the commands are present, then conf.env.DOXYGEN and conf.env.TAR
-	variables will be set. Detection can be controlled by setting DOXYGEN and
-	TAR environmental variables.
-	'''
-
-	conf.find_program('doxygen', var='DOXYGEN', mandatory=False)
-	conf.find_program('tar', var='TAR', mandatory=False)
diff --git a/rib/main.cpp b/rib/main.cpp
index 7eddfdd..7598d6c 100644
--- a/rib/main.cpp
+++ b/rib/main.cpp
@@ -33,7 +33,7 @@
 namespace nfd {
 namespace rib {
 
-NFD_LOG_INIT("nrd.Main");
+NFD_LOG_INIT("NRD");
 
 struct ProgramOptions
 {
@@ -54,7 +54,15 @@
 
     ConfigFile config;
     m_ribManager->setConfigFile(config);
-    config.addSectionHandler("log", bind(std::plus<int>(), 0, 0)); // no-op
+
+    for (size_t i = 0; i < N_SUPPORTED_CONFIG_SECTIONS; ++i)
+      {
+        if (SUPPORTED_CONFIG_SECTIONS[i] != "rib_security")
+          {
+            config.addSectionHandler(SUPPORTED_CONFIG_SECTIONS[i],
+                                     bind(std::plus<int>(), 0, 0)); // no-op.
+          }
+      }
 
     // parse config file
     config.parse(configFile, true);
@@ -99,7 +107,7 @@
        << "\n"
        << "Options:\n"
        << "  [--help]   - print this help message\n"
-       << "  [--config /path/to/nrd.conf] - path to configuration file "
+       << "  [--config /path/to/nfd.conf] - path to configuration file "
        << "(default: " << DEFAULT_CONFIG_FILE << ")\n"
       ;
   }
@@ -122,12 +130,14 @@
   parseCommandLine(int argc, char** argv, ProgramOptions& options)
   {
     options.showUsage = false;
+    options.showModules = false;
     options.config = DEFAULT_CONFIG_FILE;
 
     while (true) {
       int optionIndex = 0;
       static ::option longOptions[] = {
         { "help"   , no_argument      , 0, 0 },
+        { "modules", no_argument      , 0, 0 },
         { "config" , required_argument, 0, 0 },
         { 0        , 0                , 0, 0 }
       };
@@ -136,18 +146,21 @@
         break;
 
       switch (c) {
-      case 0:
-        switch (optionIndex) {
-        case 0: // help
-          options.showUsage = true;
+        case 0:
+          switch (optionIndex) {
+            case 0: // help
+              options.showUsage = true;
+              break;
+            case 1: // modules
+              options.showModules = true;
+              break;
+            case 2: // config
+              options.config = ::optarg;
+              break;
+            default:
+              return false;
+          }
           break;
-        case 1: // config
-          options.config = ::optarg;
-          break;
-        default:
-          return false;
-        }
-        break;
       }
     }
     return true;
@@ -166,11 +179,11 @@
         signalNo == SIGTERM)
       {
         getIoService().stop();
-        std::cout << "Caught signal '" << strsignal(signalNo) << "', exiting..." << std::endl;
+        NFD_LOG_INFO("Caught signal '" << strsignal(signalNo) << "', exiting...");
       }
     else
       {
-        /// \todo May be try to reload config file (at least security section)
+        /// \todo May be try to reload config file
         signalSet.async_wait(bind(&Nrd::terminate, this, _1, _2,
                                   boost::ref(signalSet)));
       }
@@ -186,7 +199,9 @@
 const std::string Nrd::SUPPORTED_CONFIG_SECTIONS[] =
   {
     "log",
-    "security",
+    "face_system",
+    "authorizations",
+    "rib_security",
   };
 
 const size_t Nrd::N_SUPPORTED_CONFIG_SECTIONS =
diff --git a/rib/rib-manager.cpp b/rib/rib-manager.cpp
index 1a3e41f..d5f26f2 100644
--- a/rib/rib-manager.cpp
+++ b/rib/rib-manager.cpp
@@ -24,10 +24,13 @@
  **/
 
 #include "rib-manager.hpp"
+#include "core/logger.hpp"
 
 namespace nfd {
 namespace rib {
 
+NFD_LOG_INIT("RibManager");
+
 const Name RibManager::COMMAND_PREFIX = "/localhost/nrd";
 const Name RibManager::REMOTE_COMMAND_PREFIX = "/localhop/nrd";
 
@@ -69,18 +72,18 @@
   //check whether the components of localhop and localhost prefixes are same
   BOOST_ASSERT(COMMAND_PREFIX.size() == REMOTE_COMMAND_PREFIX.size());
 
-  std::cerr << "Setting interest filter on: " << COMMAND_PREFIX.toUri() << std::endl;
+  NFD_LOG_INFO("Setting interest filter on: " << COMMAND_PREFIX.toUri());
   m_face->setController(m_nfdController);
   m_face->setInterestFilter(COMMAND_PREFIX.toUri(),
                             bind(&RibManager::onRibRequest, this, _2),
                             bind(&RibManager::setInterestFilterFailed, this, _1, _2));
 
-  std::cerr << "Setting interest filter on: " << REMOTE_COMMAND_PREFIX.toUri() << std::endl;
+  NFD_LOG_INFO("Setting interest filter on: " << REMOTE_COMMAND_PREFIX.toUri());
   m_face->setInterestFilter(REMOTE_COMMAND_PREFIX.toUri(),
                             bind(&RibManager::onRibRequest, this, _2),
                             bind(&RibManager::setInterestFilterFailed, this, _1, _2));
 
-  std::cerr << "Monitoring faces" << std::endl;
+  NFD_LOG_INFO("Start monitoring face create/destroy events");
   m_faceMonitor.addSubscriber(boost::bind(&RibManager::onNotification, this, _1));
   m_faceMonitor.startNotifications();
 }
@@ -105,7 +108,7 @@
 void
 RibManager::setInterestFilterFailed(const Name& name, const std::string& msg)
 {
-  std::cerr << "Error in setting interest filter (" << name << "): " << msg << std::endl;
+  NFD_LOG_ERROR("Error in setting interest filter (" << name << "): " << msg);
   m_face->shutdown();
 }
 
@@ -151,29 +154,25 @@
 
   if (verbProcessor != m_verbDispatch.end())
     {
+      NFD_LOG_TRACE("Processing '" << verb << "' verb");
+
       PrefixRegOptions options;
       if (!extractOptions(*request, options))
         {
+          NFD_LOG_DEBUG("Error while extracting options, returning malformed command");
           sendResponse(command, 400, "Malformed command");
           return;
         }
 
-      /// \todo authorize command
-      if (false)
-        {
-          sendResponse(request->getName(), 403, "Unauthorized command");
-          return;
-        }
-
-      // \todo add proper log support
-      std::cout << "Received options (name, faceid, cost): " << options.getName() <<
-        ", " << options.getFaceId() << ", "  << options.getCost() << std::endl;
+      NFD_LOG_DEBUG("Received options (name, faceid, cost): " << options.getName()
+                    << ", " << options.getFaceId() << ", "  << options.getCost());
 
       ControlResponse response;
       (verbProcessor->second)(this, *request, options);
     }
   else
     {
+      NFD_LOG_DEBUG("Unsupported command: " << verb);
       sendResponse(request->getName(), 501, "Unsupported command");
     }
 }
@@ -182,6 +181,7 @@
 RibManager::onRibRequestValidationFailed(const shared_ptr<const Interest>& request,
                                          const std::string& failureInfo)
 {
+  NFD_LOG_DEBUG("RibRequestValidationFailed: " << failureInfo);
   sendResponse(request->getName(), 403, failureInfo);
 }
 
@@ -206,7 +206,7 @@
 
   if (extractedOptions.getFaceId() == 0)
     {
-      std::cout <<"IncomingFaceId: " << request.getIncomingFaceId() << std::endl;
+      NFD_LOG_TRACE("IncomingFaceId: " << request.getIncomingFaceId());
       extractedOptions.setFaceId(request.getIncomingFaceId());
     }
   return true;
@@ -217,7 +217,7 @@
                            const Interest& request,
                            const PrefixRegOptions& options)
 {
-  std::cout << "NFD Error: " << error << " (code: " << code << ")" << std::endl;
+  NFD_LOG_ERROR("NFD returned an error: " << error << " (code: " << code << ")");
 
   ControlResponse response;
 
@@ -247,9 +247,9 @@
   response.setText("Success");
   response.setBody(options.wireEncode());
 
-  std::cout << "Success: Name unregistered (" <<
-    options.getName() << ", " <<
-    options.getFaceId() << ")" << std::endl;
+  NFD_LOG_DEBUG("onUnRegSuccess: Name unregistered (" << options.getName()
+                << ", " << options.getFaceId() << ")");
+
   sendResponse(request.getName(), response);
   m_managedRib.erase(options);
 }
@@ -263,8 +263,8 @@
   response.setText("Success");
   response.setBody(options.wireEncode());
 
-  std::cout << "Success: Name registered (" << options.getName() << ", " <<
-    options.getFaceId() << ")" << std::endl;
+  NFD_LOG_DEBUG("onRegSuccess: Name registered (" << options.getName() << ", "
+                << options.getFaceId() << ")");
   sendResponse(request.getName(), response);
 }
 
@@ -306,14 +306,14 @@
 void
 RibManager::onControlHeaderSuccess()
 {
-  std::cout << "Local control header enabled" << std::endl;
+  NFD_LOG_DEBUG("Local control header enabled");
 }
 
 void
 RibManager::onControlHeaderError(uint32_t code, const std::string& reason)
 {
-  std::cout << "Error: couldn't enable local control header "
-            << "(code: " << code << ", info: " << reason << ")" << std::endl;
+  NFD_LOG_ERROR("Error: couldn't enable local control header "
+                << "(code: " << code << ", info: " << reason << ")");
   m_face->shutdown();
 }
 
@@ -331,7 +331,7 @@
 RibManager::onNotification(const FaceEventNotification& notification)
 {
   /// \todo A notification can be missed, in this case check Facelist
-  std::cerr << "Notification Rcvd: " << notification << std::endl;
+  NFD_LOG_TRACE("onNotification: " << notification);
   if (notification.getKind() == ndn::nfd::FACE_EVENT_DESTROYED) { //face destroyed
     m_managedRib.erase(notification.getFaceId());
   }
diff --git a/wscript b/wscript
index a476ee4..1a2bdb3 100644
--- a/wscript
+++ b/wscript
@@ -168,9 +168,6 @@
         install_path="${SYSCONFDIR}/ndn",
         IF_HAVE_LIBPCAP="" if bld.env['HAVE_LIBPCAP'] else "; ")
 
-    # @todo Merge with nfd.conf
-    bld.install_files('${SYSCONFDIR}/ndn', 'nrd.conf.sample')
-
     bld(features='subst',
         source='tools/nfd-status-http-server.py',
         target='nfd-status-http-server',