0 - en to zh-CN translation catalogue (548 entries)

en: NFS
zh-CN: NFS（网络文件系统）

en: OpenLDAP
zh-CN: OpenLDAP（开源轻型目录访问协议）

en: SIP
zh-CN: SIP（会话发起协议）

en: SSL
zh-CN: SSL（安全套接字层）

en: SPF
zh-CN: SPF（发件人策略框架）

en: Network Services: Postfix, Apache, NFS, Samba, Squid, LDAP, SIP, XMPP, TURN
zh-CN: 网络服务：Postfix、Apache、NFS、Samba、Squid、LDAP、SIP、XMPP、TURN

en: Network services are the programs that users interact with directly in their daily work. They are the tip of the information system iceberg, and this chapter focuses on them; the hidden parts they rely on are the infrastructure we already described. They usually require the encryption technology described in <xref linkend="sect.x509-cert" />.
zh-CN: 网络服务是用户在日常工作中直接与之互动的程序。它们是信息系统的冰山一角，这一章节将集中阐释；它们所依赖而对用户不可见的部分就是我们已经描述过的基础架构。它们通常需要涉及 <xref linkend="sect.x509-cert" /> 中所描述的加密技术。

en: Mail Server
zh-CN: 邮件服务器

en: The Falcot Corp administrators selected Postfix for the electronic mail server, due to its reliability and its ease of configuration. Indeed, its design enforces that each task is implemented in a process with the minimum set of required permissions, which is a great mitigation measure against security problems.
zh-CN: Falcot 公司的管理员选择 Postfix 作为电子邮件服务器，理由是它可靠且易于配置。的确，它的设计强制每个任务以所需要最小的权限在进程中实施，这是针对安全问题的巨大的缓解措施。

en: <primary>email</primary><secondary>server</secondary>
zh-CN: <primary>电子邮件</primary><secondary>服务器</secondary>

en: <primary>email</primary><secondary>Postfix</secondary>
zh-CN: <primary>电子邮件</primary><secondary>Postfix</secondary>

en: <primary>server</primary><secondary>email</secondary>
zh-CN: <primary>服务器</primary><secondary>电子邮件</secondary>

en: <primary>server</primary><secondary>SMTP</secondary>
zh-CN: <primary>服务器</primary><secondary>SMTP</secondary>

en: <primary>mail server</primary>
zh-CN: <primary>邮件服务器</primary>

en: <emphasis>ALTERNATIVE</emphasis> The Exim4 server
zh-CN: <emphasis>替代</emphasis> Exim4 服务器

en: <primary>email</primary><secondary>Exim</secondary>
zh-CN: <primary>电子邮件</primary><secondary>Exim</secondary>

en: Debian uses Exim4 as the default email server (which is why the initial installation includes Exim4). The configuration is provided by a separate package, <emphasis role="pkg">exim4-config</emphasis>, and automatically customized based on the answers to a set of Debconf questions very similar to the questions asked by the <emphasis role="pkg">postfix</emphasis> package.
zh-CN: Debian 使用 Exim4 作为默认的邮件服务器（这就是为何初始安装中包括 Exim4）。配置工作由另外的软件包 <emphasis role="pkg">exim4-config</emphasis> 来提供，自动化配置依赖于对 Debconf 的几个问题的回答，这些问题类似于 <emphasis role="pkg">postfix</emphasis> 软件包所询问的问题。

en: The configuration can be either in one single file (<filename>/etc/exim4/exim4.conf.template</filename>) or split across a number of configuration snippets stored under <filename>/etc/exim4/conf.d/</filename>. In both cases, the files are used by <command>update-exim4.conf</command> as templates to generate <filename>/var/lib/exim4/config.autogenerated</filename>. The latter is the file used by Exim4. Thanks to this mechanism, values obtained through Exim's debconf configuration — which are stored in <filename>/etc/exim4/update-exim4.conf.conf</filename> — can be injected in Exim's configuration file, even when the administrator or another package has altered the default Exim configuration.
zh-CN: 配置可以是单独一个文件（如 <filename>/etc/exim4/exim4.conf.template</filename> ），或者分割成几个代码段，存储在 <filename>/etc/exim4/conf.d/</filename> 之下。在以上两个情况中，文件由 <command>update-exim4.conf</command> 作为模板来使用，从而创建 <filename>/var/lib/exim4/config.autogenerated</filename>。后者由 Exim4 使用。由于这样的机制，通过 Exim 的 debconf 配置获得的配置值，甚至在管理员或者其包它改变了默认的 Exim 配置的情况下，也可以被注入到 Exim 的配置文件中，其中上述 Exim 的 debconf 配置，存储在 <filename>/etc/exim4/update-exim4.conf.conf</filename> 中。

en: The Exim4 configuration file syntax has its peculiarities and its learning curve; however, once these peculiarities are understood, Exim4 is a very complete and powerful email server, as evidenced by the tens of pages of documentation. <ulink type="block" url="https://www.exim.org/docs.html" />
zh-CN: Exim4 配置文件的语法有其特殊性和学习曲线；然而一旦理解其特性，Exim4 将会是一个非常完善并且强大的邮件服务器，如其几十页文档所证实的。<ulink type="block" url="https://www.exim.org/docs.html" />

en: Installing Postfix
zh-CN: 安装 Postfix

en: <primary>Postfix</primary><secondary>installation</secondary>
zh-CN: <primary>Postfix</primary><secondary>安装</secondary>

en: The <emphasis role="pkg">postfix</emphasis> package includes the main <acronym>SMTP</acronym> daemon. Other packages (such as <emphasis role="pkg">postfix-ldap</emphasis> and <emphasis role="pkg">postfix-pgsql</emphasis>) add extra functionality to Postfix, including access to mapping databases. You should only install them if you know that you need them.
zh-CN: <emphasis role="pkg">postfix</emphasis> 软件包包含主要的 <acronym>SMTP</acronym> 守护进程。其它软件包（如<emphasis role="pkg">postfix-ldap</emphasis> 和 <emphasis role="pkg">postfix-pgsql</emphasis>）为 Postfix 添加了额外的功能，包括访问映射数据库。如果您知道自己需要它们，那么应该安装它们。

en: <emphasis>BACK TO BASICS</emphasis> SMTP
zh-CN: <emphasis>基本知识</emphasis> SMTP

en: <acronym>SMTP</acronym> (<emphasis>Simple Mail Transfer Protocol</emphasis>, RFC 5321) is the protocol used by mail servers to exchange and route emails.
zh-CN: <acronym>SMTP</acronym> (<emphasis>简单邮件传输协议</emphasis>，RFC 5321) ，是邮件服务器用来交换和传输电子邮件的协议。

en: Several Debconf questions are asked during the installation of the package. The answers allow generating a first version of the <filename>/etc/postfix/main.cf</filename> configuration file.
zh-CN: 一些 Debconf 问题在包安装时会被问到，相关回答允许生成 <filename>/etc/postfix/main.cf</filename> 配置文件的首个版本。

en: The first question deals with the type of setup. Only two of the proposed answers are relevant in case of an Internet-connected server, “Internet site” and “Internet with smarthost”. The former is appropriate for a server that receives incoming email and sends outgoing email directly to its recipients, and is therefore well-adapted to the Falcot Corp case. The latter is appropriate for a server receiving incoming email normally, but that sends outgoing email through an intermediate SMTP server — the “smarthost” — rather than directly to the recipient's server. This is mostly useful for individuals with a dynamic IP address, since many email servers reject messages coming straight from such an IP address. In this case, the smarthost will usually be the ISP's SMTP server, which is always configured to accept email coming from the ISP's customers and forward it appropriately. This setup (with a smarthost) is also relevant for servers that are not permanently connected to the internet, since it avoids having to manage a queue of undeliverable messages that need to be retried later.
zh-CN: 第一个问题处理设置的类型。在服务器连接到因特网上的情况下，只有两个建议的回答是相关的，即“Internet site”和“Internet with smarthost”。前者适用于接收到来的电子邮件并直接向收件人发送外发邮件的服务器，因此很适合Falcot公司的情况。后者适用于正常接收到来的电子邮件的服务器，但通过中间的 SMTP 服务器——“smarthost”发送外发邮件，而不是直接发送到收件人的服务器。这对于使用动态 IP 地址的个人来说非常有用，因为许多电子邮件服务器拒绝直接从这样的 IP 地址发送的消息。在这种情况下，smarthost 通常是 ISP 的 SMTP 服务器，它总是被配置为接受来自 ISP 客户的电子邮件，并适当地转发。这种设置（使用 smarthost）对于那些不是永久地连接到因特网上的服务器也是相关的，因为它避免了要管理一个无法投递的邮件队列，而这些邮件需要在以后重新尝试。

en: <emphasis>VOCABULARY</emphasis> ISP
zh-CN: <emphasis>关键词</emphasis> ISP

en: <acronym>ISP</acronym> is the acronym for “Internet Service Provider”. It covers an entity, often a commercial company, that provides Internet connections and the associated basic services (email, news and so on).
zh-CN: <acronym>ISP</acronym> 是“Internet Service Provider”（因特网服务提供商）的首字母缩写。它涵盖了提供因特网连接和相关基础服务（电子邮件、新闻以及等等诸如此类）的实体，通常是商业公司。

en: The second question deals with the full name of the machine, used to generate email addresses from a local user name; the full name of the machine ends up as the part after the at-sign (“@”). In the case of Falcot, the answer should be <literal>mail.falcot.com</literal>. This is the only question asked by default, but the configuration it leads to is not complete enough for the needs of Falcot, which is why the administrators run <command>dpkg-reconfigure postfix</command> so as to be able to customize more parameters.
zh-CN: 第二个问题处理机器的全名，用于从本地用户名生成电子邮件地址；机器的全名最终作为 "@" 之后的部分。在 Falcot 公司的情况下，回答应该是 <literal>mail.falcot.com</literal> 。这是默认询问的唯一问题，但它所导致的配置还不够完整，无法满足 Falcot 公司的需求，这就是为什么管理员运行 <command>dpkg-reconfigure postfix</command> ，以便能够定制更多参数。

en: One of the extra questions asks for all the domain names related to this machine. The default list includes its full name as well as a few synonyms for <literal>localhost</literal>, but the main <literal>falcot.com</literal> domain needs to be added by hand. More generally, this question should usually be answered with all the domain names for which this machine should serve as an MX server; in other words, all the domain names for which the DNS says that this machine will accept email. This information ends up in the <literal>mydestination</literal> variable of the main Postfix configuration file — <filename>/etc/postfix/main.cf</filename>.
zh-CN: 其中一个额外的问题是询问与这台机器相关的所有域名。默认列表包括其全名以及 <literal>localhost</literal> 的一些同义词，但主要的 <literal>falcot.com</literal> 域名需要手动添加。更一般的是，这个问题通常应该用这台机器作为 MX 服务器的所有域名来回答，换句话说，就是 DNS 所说的这台机器可以接受电子邮件的所有域名。这些信息最终会出现在 Postfix 主配置文件 <filename>/etc/postfix/main.cf</filename> 的 <literal>mydestination</literal> 变量中。

en: <primary>server</primary><secondary>MX</secondary>
zh-CN: <primary>服务器</primary><secondary>MX</secondary>

en: <primary>MX</primary><secondary>server</secondary>
zh-CN: <primary>MX</primary><secondary>服务器</secondary>

en: Role of the DNS <emphasis>MX</emphasis> record while sending a mail
zh-CN: 发送邮件时 DNS <emphasis>MX</emphasis> 记录的角色

en: <emphasis>EXTRA</emphasis> Querying the MX records
zh-CN: <emphasis>扩展</emphasis> 查询 MX 记录

en: When the DNS does not have an MX record for a domain, the email server will try sending the messages to the host itself, by using the matching A record (or AAAA in IPv6).
zh-CN: 当 DNS 中没有域的 MX 记录时，电子邮件服务器将尝试使用匹配的 A 记录（或 IPv6 中的 AAAA），将消息发送到主机本身。

en: In some cases, the installation can also ask what networks should be allowed to send email via the machine. In its default configuration, Postfix only accepts emails coming from the machine itself; the local network will usually be added. The Falcot Corp administrators added <literal>192.168.0.0/16</literal> to the default answer. If the question is not asked, the relevant variable in the configuration file is <literal>mynetworks</literal>, as seen in the example below.
zh-CN: 在某些情况下，安装过程中还可以询问应该允许哪些网络通过机器发送电子邮件。在其默认配置中，Postfix 只接受来自机器本身的电子邮件；通常会添加本地网络。Falcot 公司的管理员将 <literal>192.168.0.0/16</literal> 添加到默认回答中。如果不询问问题，那么配置文件中的相关变量是 <literal>mynetworks</literal> ，如下面的示例所示。

en: Local email can also be delivered through <command>procmail</command>. This tool allows users to sort their incoming email according to rules stored in their <filename>~/.procmailrc</filename> file. Both Postfix and Exim4 suggest <emphasis role="pkg">procmail</emphasis> by default, but there are alternatives like <emphasis role="pkg">maildrop</emphasis> or Sieve filters.
zh-CN: 本地邮件也可以通过 <command>procmail</command> 来传递。这个工具允许用户根据存储在 <filename>~/.procmailrc</filename> 文件中的规则，对到来的电子邮件进行排序。Postfix 和 Exim4 都建议默认使用 <emphasis role="pkg">procmail</emphasis> ，但也有其它选择，如 <emphasis role="pkg">maildrop</emphasis> 或 Sieve 筛选程序。

en: <primary>email</primary><secondary>filtering</secondary>
zh-CN: <primary>电子邮件</primary><secondary>筛选</secondary>

en: <primary>filtering email</primary>
zh-CN: <primary>筛选电子邮件</primary>

en: After this first step, the administrators got the following configuration file; it will be used as a starting point for adding some extra functionality in the next sections.
zh-CN: 完成第一步后，管理员获得以下配置文件；它将用作下一节中添加一些额外功能的起点。

en: Initial <filename>/etc/postfix/main.cf</filename> file
zh-CN: 初始 <filename>/etc/postfix/main.cf</filename> 文件

en: <emphasis>SECURITY</emphasis> <emphasis>Snake oil</emphasis> SSL certificates
zh-CN: <emphasis>安全</emphasis> <emphasis>Snake oil</emphasis> SSL 证书

en: The <emphasis>snake oil</emphasis> certificates, like the <emphasis>snake oil</emphasis> “medicine” sold by unscrupulous quacks in old times, have absolutely no value: you cannot rely on them to authenticate the server since they are automatically generated self-signed certificates. However, they are useful to improve the privacy of the exchanges.
zh-CN: <emphasis>snake oil</emphasis> 证书，像旧时代不道德的江湖郎中贩卖的<emphasis>蛇油</emphasis> “药物”一样，绝对是没有价值的：不能依赖它们来认证服务器，因为它们是自动生成的自签名证书。然而，它们用于改进交换的私密性。

en: In general they should only be used for testing purposes, and normal service must use real certificates. The <link linkend="sidebar.letsencrypt">Let's encrypt</link> initiative offers free and trusted SSL/TLS certificates, which can be generated using the <emphasis role="pkg">certbot</emphasis> package as described in <xref linkend="sect.apache-ssl" /> and then used in <command>postfix</command> like this:
zh-CN: 通常它们只用于测试的目的，并且正常的服务必须使用真正的证书。<link linkend="sidebar.letsencrypt">Let's encrypt（让我们加密）</link> 方案提供了免费和可信任的 SSL/TLS 证书，可以使用 <xref linkend="sect.apache-ssl" /> 中描述的 <emphasis role="pkg">certbot</emphasis> 软件包来生成，然后在 <command>postfix</command> 中使用，像这样：

en: <primary>Postfix</primary><secondary>trusted certificates</secondary>
zh-CN: <primary>Postfix</primary><secondary>受信任的证书</secondary>

en: Configuring Virtual Domains
zh-CN: 配置虚拟域

en: <primary>Postfix</primary><secondary>virtual domain</secondary>
zh-CN: <primary>Postfix</primary><secondary>虚拟域</secondary>

en: <primary>domain</primary><secondary>virtual</secondary>
zh-CN: <primary>域</primary><secondary>虚拟</secondary>

en: <emphasis>CAUTION</emphasis> Virtual domains and canonical domains
zh-CN: <emphasis>警告</emphasis> 虚拟域和规范域

en: None of the virtual domains must be referenced in the <literal>mydestination</literal> variable; this variable only contains the names of the “canonical” domains directly associated to the machine and its local users.
zh-CN: 虚拟域不是必须在 <literal>mydestination</literal> 变量中引用；这个变量只包含直接与机器及其本地用户相联系的“规范”域。

en: Virtual Alias Domains
zh-CN: 虚拟别名域

en: <primary>alias</primary><secondary>virtual alias domain</secondary>
zh-CN: <primary>别名</primary><secondary>虚拟别名域</secondary>

en: A virtual alias domain only contains aliases, i.e. addresses that only forward emails to other addresses.
zh-CN: 虚拟别名域只包含别名，也就是只将电子邮件转发给其它地址的地址。

en: Such a domain is enabled by adding its name to the <literal>virtual_alias_domains</literal> variable, and referencing an address mapping file in the <literal>virtual_alias_maps</literal> variable.
zh-CN: 通过将其名称添加到 <literal>virtual_alias_domains</literal> 变量中，并引用 <literal>virtual_alias_maps</literal> 变量中的地址映射文件，来启用这样的域。

en: The <filename>/etc/postfix/virtual</filename> file describes a mapping with a rather straightforward syntax: each line contains two fields separated by whitespace; the first field is the alias name, the second field is a list of email addresses where it redirects. The special <literal>@domain.com</literal> syntax covers all remaining aliases in a domain.
zh-CN: <filename>/etc/postfix/virtual</filename> 文件以相当直接的语法来描述映射：每行包含两个由空白字符分开的字段；第一字段是别名，第二个字段是重定向的电子邮件地址列表。特殊的 <literal>@domain.com</literal> 语法涵盖了域中所有其余的别名。

en: After changing <filename>/etc/postfix/virtual</filename> the postfix table <filename>/etc/postfix/virtual.db</filename> needs to be updated using <command>sudo postmap /etc/postfix/virtual</command>.
zh-CN: 在更改 <filename>/etc/postfix/virtual</filename>后，postfix 表格 <filename>/etc/postfix/virtual.db</filename> 需要使用 <command>sudo postmap /etc/postfix/virtual</command> 来更新。

en: Virtual Mailbox Domains
zh-CN: 虚拟邮箱域

en: <primary>mailbox, virtual domain</primary>
zh-CN: <primary>邮箱，虚拟域</primary>

en: <emphasis>CAUTION</emphasis> Combined virtual domain?
zh-CN: <emphasis>警告</emphasis> 组合虚拟域吗？

en: Postfix does not allow using the same domain in both <literal>virtual_alias_domains</literal> and <literal>virtual_mailbox_domains</literal>. However, every domain of <literal>virtual_mailbox_domains</literal> is implicitly included in <literal>virtual_alias_domains</literal>, which makes it possible to mix aliases and mailboxes within a virtual domain.
zh-CN: Postfix 不允许在 <literal>virtual_alias_domains</literal> 和 <literal>virtual_mailbox_domains</literal> 中使用相同的域。然而， <literal>virtual_mailbox_domains</literal> 的每个域隐性地包含在 <literal>virtual_alias_domains</literal> 中，它能够在虚拟域中混合别名和邮箱。

en: Messages addressed to a virtual mailbox domain are stored in mailboxes not assigned to a local system user.
zh-CN: 发给虚拟邮箱域的消息，存储在没有指定给本地系统用户的邮箱中。

en: Enabling a virtual mailbox domain requires naming this domain in the <literal>virtual_mailbox_domains</literal> variable, and referencing a mailbox mapping file in <literal>virtual_mailbox_maps</literal>. The <literal>virtual_mailbox_base</literal> parameter contains the directory under which the mailboxes will be stored.
zh-CN: 启用虚拟邮箱域需要在 <literal>virtual_mailbox_domains</literal> 变量中命名这个域，并且引用 <literal>virtual_mailbox_maps</literal> 中的邮箱映射文件。<literal>virtual_mailbox_base</literal> 参数包含目录，邮箱存储在其中。

en: The <literal>virtual_uid_maps</literal> parameter (respectively <literal>virtual_gid_maps</literal>) references the file containing the mapping between the email address and the system user (respectively group) that “owns” the corresponding mailbox. To get all mailboxes owned by the same owner/group, the <literal>static:5000</literal> syntax assigns a fixed UID/GID (of value 5000 here).
zh-CN: <literal>virtual_uid_maps</literal> 参数（各自的 <literal>virtual_gid_maps</literal>）引用包含映射的文件，其中映射联系了邮件地址与“拥有”相应邮箱的系统用户（各自的用户组）。为了得到由相同的用户/用户组所拥有的所有邮箱，<literal>static:5000</literal> 语法指定了固定的 UID/GID （在这里，其值为 5000）。

en: Again, the syntax of the <filename>/etc/postfix/vmailbox</filename> file is quite straightforward: two fields separated with whitespace. The first field is an email address within one of the virtual domains, and the second field is the location of the associated mailbox (relative to the directory specified in <emphasis>virtual_mailbox_base</emphasis>). If the mailbox name ends with a slash (<literal>/</literal>), the emails will be stored in the <emphasis>maildir</emphasis> format; otherwise, the traditional <emphasis>mbox</emphasis> format will be used. The <emphasis>maildir</emphasis> format uses a whole directory to store a mailbox, each individual message being stored in a separate file. In the <emphasis>mbox</emphasis> format, on the other hand, the whole mailbox is stored in one file, and each line starting with “<literal>From </literal>” (<literal>From</literal> followed by a space) signals the start of a new message.
zh-CN: 再一次，<filename>/etc/postfix/vmailbox</filename> 文件的语法非常直接：两个字段由空白字符分开。第一个字段是虚拟域之一的电子邮件地址，而第二个字段是与之相联系的电子邮箱（相对于 <emphasis>virtual_mailbox_base</emphasis> 中指定的目录）。如果邮箱名称以斜杠（<literal>/</literal>）结尾，那么电子邮件会存储为 <emphasis>maildir</emphasis> 格式；否则，会使用传统的 <emphasis>mbox</emphasis> 格式。<emphasis>maildir</emphasis> 格式使用整个目录来存储邮箱，每个单独的消息存储为单独的文件。另一方面，在 <emphasis>mbox</emphasis> 格式中，整个邮箱存储为一个文件，并且以“<literal>From</literal>”（“来自”）开始的每一行（<literal>From</literal> 后面跟着一个空格）表示新消息的开始。

en: Restrictions for Receiving and Sending
zh-CN: 接收邮件和发送邮件的限制

en: The growing number of unsolicited bulk emails (<emphasis>spam</emphasis>) requires being increasingly strict when deciding which emails a server should accept. This section presents some of the strategies included in Postfix.
zh-CN: 数量增长的主动巨量（<emphasis>垃圾</emphasis>) 电子邮件需要更加严格地确定服务器接受哪些电子邮件。这一节展现了 Postfix 中包含的一些策略。

en: If the reject-rules are too strict, it may happen that even legitimate email traffic gets locked out. It is therefor a good habit to test restrictions and prevent the permanent rejection of requests during this time using the <literal>soft_bounce = yes</literal> directive. By prepending a reject-type directive with <literal>warn_if_reject</literal> only a log message will be recorded instead of rejecting the request.
zh-CN: 如果拒绝法则太过严格，那么会发生即使是合法的电子邮件交流也会被封锁在外面的情况。这样，好的习惯是测试严格程度，并在这时直接使用 <literal>soft_bounce = yes</literal> 指令，来防止请求被永久拒绝。通过<literal>warn_if_reject</literal> 来预置拒绝类型的指令，只有日志消息被记录，不是去拒绝请求。

en: <emphasis>CULTURE</emphasis> The spam problem
zh-CN: <emphasis>CULTURE</emphasis> 垃圾邮件问题

en: <primary>spam</primary>
zh-CN: <primary>垃圾邮件</primary>

en: <primary>unsolicited commercial email</primary><see>spam</see>
zh-CN: <primary>主动的商业电子邮件</primary><see>垃圾邮件</see>

en: “Spam” is a generic term used to designate all the unsolicited commercial emails (also known as UCEs) that flood our electronic mailboxes; the unscrupulous individuals sending them are known as spammers. They care little about the nuisance they cause, since sending an email costs very little, and only a very small percentage of recipients need to be attracted by the offers for the spamming operation to make more money than it costs. The process is mostly automated, and any email address made public (for instance, on a web forum, or on the archives of a mailing list, or on a blog, and so on) will be likely discovered by the spammers' robots, and subjected to a never-ending stream of unsolicited messages. Also every contact found at a compromised system is targeted.
zh-CN: “垃圾邮件”是个通用术语，用于指示在我们的电子邮箱中泛滥的所有主动的商业电子邮件（被称为 UCEs）；发送它们的不道德的个人被称为垃圾邮件发件人。他们不关心他们造成的麻烦，因为发送电子邮件花费很少，而只有很小比例的收件人需要被发送垃圾邮件的操作所吸引，来获得比成本更多的钱。这个过程多数是自动的，并且任何被公开的电子邮件地址（例如，在网页论坛上，或者在电子邮件列表的档案上，或者在 blog 上，以及等等诸如此类）会被垃圾邮件发件人的机器人发现，并收到无休止的主动消息。同样，受损系统上发现的每个联系人也会被盯上。

en: All system administrators try to face this nuisance with spam filters, but of course spammers keep adjusting to try to work around these filters. Some even rent networks of machines compromised by a worm from various crime syndicates. Recent statistics estimate that up to 95% of all emails circulating on the Internet are spam!
zh-CN: 所有系统管理员试图使用垃圾邮件筛选程序来面对这个麻烦，但垃圾邮件发件人当然一直在调整，试图绕过这些筛选程序。一些甚至租用的网络机器也被来自各种犯罪集团的蠕虫所损害。最近的统计数据估计，因特网上交流的所有电子邮件中多达 95% 是垃圾邮件！

en: IP-Based Access Restrictions
zh-CN: 基于 IP 的访问限制

en: <primary>email</primary><secondary>filtering on the client host</secondary>
zh-CN: <primary>电子邮件</primary><secondary>在客户端主机上筛选</secondary>

en: The <literal>smtpd_client_restrictions</literal> directive controls which machines are allowed to communicate with the email server.
zh-CN: <literal>smtpd_client_restrictions</literal> 指令控制哪些机器被允许与电子邮件服务器通信。

en: When a variable contains a list of rules, as in the example below, these rules are evaluated in order, from the first to the last. Each rule can accept the message, reject it, or leave the decision to a following rule. As a consequence, order matters, and simply switching two rules can lead to a widely different behavior.
zh-CN: 当变量包含规则列表时，如在下面的示例中，这些规则被顺序评价，从第一个到最后一个，每条规则可以接受消息，拒绝消息，或将决定权留给后面的规则。结果，顺序很重要，而简单地交换两条规则可以导致非常不同的行为。

en: Restrictions Based on Client Address
zh-CN: 基于客户端地址的限制

en: The <literal>permit_mynetworks</literal> directive, used as the first rule, accepts all emails coming from a machine in the local network (as defined by the <literal>mynetworks</literal> configuration variable).
zh-CN: <literal>permit_mynetworks</literal>指令用作第一条规则，接受来自本地网络中的机器的所有电子邮件（如由 <literal>mynetworks</literal> 配置变量所定义的）。

en: The second directive would normally reject emails coming from machines without a completely valid DNS configuration. Such a valid configuration means that the IP address can be resolved to a name, and that this name, in turn, resolves to the IP address. This restriction is often too strict, since many email servers do not have a reverse DNS for their IP address. This explains why the Falcot administrators prepended the <literal>warn_if_reject</literal> modifier to the <literal>reject_unknown_client</literal> directive: this modifier <link linkend="postfix-safety-net">turns the rejection into a simple warning recorded in the logs</link>. The administrators can then keep an eye on the number of messages that would be rejected if the rule were actually enforced, and make an informed decision later if they wish to enable such enforcement.
zh-CN: 第二条指令通常拒绝来自没有完全合法 DNS 配置的机器的邮件。这样的合法配置意味着 IP 地址可以被解析为名称，而这个名称可以反过来解析为 IP 地址。这个限制通常太严格，因为很多电子邮件服务器不具有它们 IP 地址的反向 DNS。这解释了为什么 Falcot 公司的管理员为 <literal>reject_unknown_client</literal> 指令预置了 <literal>warn_if_reject</literal> 修饰符：这个修饰符 <link linkend="postfix-safety-net"> 将拒绝行为转换为日志中记录的简单警告</link>。然后如果规则被实际强制执行的话，管理员可以关注被拒绝的消息数量，并且如果他们想要启用这样的强制执行的话，就可以在后面做出决定。

en: <emphasis>TIP</emphasis> <emphasis>access</emphasis> tables
zh-CN: <emphasis>技巧</emphasis> <emphasis>访问</emphasis> 表格

en: The <filename>/etc/postfix/access_clientip</filename> table lists IP addresses and networks; <filename>/etc/postfix/access_helo</filename> lists domain names; <filename>/etc/postfix/access_sender</filename> contains sender email addresses. All these files need to be turned into hash-tables (a format optimized for fast access) after each change, with the <command>sudo postmap /etc/postfix/<replaceable>file</replaceable></command> command.
zh-CN: <filename>/etc/postfix/access_clientip</filename> 表格列出了 IP 地址和网络；<filename>/etc/postfix/access_helo</filename> 列出了域名；<filename>/etc/postfix/access_sender</filename> 包含发件人电子邮件地址。所有这些文件需要在每次更改后，通过<command>sudo postmap /etc/postfix/<replaceable>file</replaceable></command>命令转换成哈希表（为快速访问而优化的格式）。

en: The last four rules reject any message coming from a server listed in one of the indicated blacklists. <acronym>RBL</acronym> is an acronym for <emphasis>Remote Black List</emphasis>, and <acronym>RHSBL</acronym> stands for <emphasis>Right-Hand Side Black List</emphasis>. The difference is that the former lists IP addresses, whereas the latter lists domain names. There are several such services. They list domains and IP addresses with poor reputation, badly configured servers that spammers use to relay their emails, as well as unexpected mail relays such as machines infected with worms or viruses.
zh-CN: 后四条规则拒绝来自其中一个黑名单中列出的服务器的任何消息。<acronym>RBL</acronym> 是 <emphasis>Remote Black List（远程黑名单）</emphasis>的缩写，而 <acronym>RHSBL</acronym> 的意思是 <emphasis>Right-Hand Side Black List（右手侧黑名单）</emphasis>。差异是前面的黑名单列出了 IP 地址，而后面的黑名单列出了域名。有几个这样的服务，列出了名声不好的、配置很差的服务器的域和 IP 地址，垃圾邮件发件人使用这些服务器作为他们电子邮件的中继，同样那些不想要的邮件也依赖这样被蠕虫或病毒感染的机器。

en: <emphasis>TIP</emphasis> White list and RBLs
zh-CN: <emphasis>技巧</emphasis> 白名单和 RBLs

en: Blacklists sometimes include a legitimate server that has been suffering an incident. In these situations, all emails coming from one of these servers would be rejected unless the server is listed in a whitelist defined by <filename>/etc/postfix/access_clientip</filename>.
zh-CN: 黑名单有时包括遭遇故障的合法服务器。在这些情况下，来自这些服务器之一的所有电子邮件都会被拒绝，除非这些服务器在 <filename>/etc/postfix/access_clientip</filename> 定义的白名单中列出。

en: Prudence therefore recommends including in the whitelist(s) all the trusted servers from which many emails are usually received.
zh-CN: 这样，谨慎推荐将通常从中接收很多电子邮件的所有受信任的服务器包含在白名单中。

en: Checking the Validity of the <literal>EHLO</literal> or <literal>HELO</literal> Commands
zh-CN: 检查 <literal>EHLO</literal> 或 <literal>HELO</literal> 命令的合法性

en: <primary>email</primary><secondary>filtering on the mail host</secondary>
zh-CN: <primary>电子邮件</primary><secondary>在电子邮件主机上筛选</secondary>

en: Each SMTP exchange starts with a <literal>HELO</literal> (or <literal>EHLO</literal>) command, followed by the name of the sending email server. Checking the validity of this name can be interesting. To fully enforce the restrictions listed in <literal>smtpd_helo_restrictions</literal> the <literal>smtpd_helo_required</literal> option needs to be enabled. Otherwise clients could skip the restrictions by not sending any <literal>HELO</literal>/<literal>EHLO</literal> command.
zh-CN: 每个 SMTP 交换从<literal>HELO</literal>（或 <literal>EHLO</literal>）命令开始，然后是发送电子邮件服务器的名称。检查这个名称的合法性会很有趣。为了完全强制执行 <literal>smtpd_helo_restrictions</literal> 中列出的限制，需要启用 <literal>smtpd_helo_required</literal> 选项。否则客户端会通过不发送任何 <literal>HELO</literal>/<literal>EHLO</literal> 命令来跳过限制。

en: Restrictions on the name announced in <literal>EHLO</literal>
zh-CN: 对 <literal>EHLO</literal> 中宣称的名称的限制

en: The first <literal>permit_mynetworks</literal> directive allows all machines on the local network to introduce themselves freely. This is important, because some email programs do not respect this part of the SMTP protocol adequately enough, and they can introduce themselves with nonsensical names.
zh-CN: 第一条 <literal>permit_mynetworks</literal> 指令允许本地网络上的所有机器自由地引入它们自身。这是很重要的，因为一些电子邮件程序没有足够充分地尊重这部分 SMTP 协议，并且它们可以通过一些无意义的名称来引入自身。

en: The <literal>reject_rhsbl_helo</literal> allows to specify a black list to check the hostname against an RHSBL.
zh-CN: <literal>reject_rhsbl_helo</literal> 允许指定黑名单，针对 RHSBL 来检查主机名。

en: Using <literal>permit_mynetworks</literal> as the first rule has an interesting side effect: the following rules only apply to hosts outside the local network. This allows blacklisting all hosts that announce themselves as part of the <literal>falcot.com</literal> network, for instance by adding a <literal>falcot.com REJECT You are not in our network!</literal> line to the <filename>/etc/postfix/access_helo</filename> file.
zh-CN: 使用 <literal>permit_mynetworks</literal> 作为第一条规则有个有趣的副作用：后面的规则只应用于本地网络以外的主机。这允许将那些宣称自己为 <literal>falcot.com</literal> 网络的一部分的主机列入黑名单，例如，通过将 <literal>falcot.com 拒绝，你不再我们的网络中！</literal> 这一行添加到 <filename>/etc/postfix/access_helo</filename> 文件中。

en: <primary>email</primary><secondary>filtering on the sender</secondary>
zh-CN: <primary>电子邮件</primary><secondary>根据发件人来筛选</secondary>

en: Every message has a sender, announced by the <literal>MAIL FROM</literal> command of the SMTP protocol; again, this information can be validated in several different ways.
zh-CN: 每条消息都有一位发件人，由STMP 协议的 <literal>MAIL FROM（邮件来自）</literal> 命令宣布；再一次，这个信息能够以几种不同的方式验证。

en: <primary><literal>MAIL FROM</literal></primary>
zh-CN: <primary><literal>MAIL FROM（邮件来自）</literal></primary>

en: <primary><literal>SMTP</literal></primary><secondary>MAIL FROM</secondary>
zh-CN: <primary><literal>SMTP</literal></primary><secondary>MAIL FROM（邮件来自）</secondary>

en: Sender checks
zh-CN: 发件人检查

en: The <filename>/etc/postfix/access_sender</filename> table maps some special treatment to some senders. This usually means listing some senders into a white list or a black list.
zh-CN: <filename>/etc/postfix/access_sender</filename> 表格将一些特殊处理映射到一些发件人。这通常意味着将一些发件人列入白名单或黑名单。

en: Finally, the <literal>reject_non_fqdn_sender</literal> rule rejects emails purporting to come from addresses without a fully-qualified domain name. In practice, this means rejecting emails coming from <literal>user@machine</literal>: the address must be announced as either <literal>user@machine.example.com</literal> or <literal>user@example.com</literal>.
zh-CN: 最后，<literal>reject_non_fqdn_sender</literal> 规则拒绝那些自称来自没有完全合格域名的地址的电子邮件。实际上，这意味着拒绝来自 <literal>user@machine</literal> 的电子邮件：地址必须宣布为 <literal>user@machine.example.com</literal> 或 <literal>user@example.com</literal>。

en: The <literal>reject_rhsbl_sender</literal> rule reject senders based on a (domain-based) RHSBL service.
zh-CN: <literal>reject_rhsbl_sender</literal> 规则根据（基于域的）RHSBL 服务来拒绝发件人。

en: <primary>email</primary><secondary>filtering on the recipient</secondary>
zh-CN: <primary>电子邮件</primary><secondary>根据收件人筛选</secondary>

en: Each email has at least one recipient, announced with the <literal>RCPT TO</literal> command in the SMTP protocol. These addresses also warrant validation, even if that may be less relevant than the checks made on the sender address.
zh-CN: 每封电子邮件具有至少一名收件人，由 SMTP 协议中的 <literal>RCPT TO</literal> 命令来宣布。即使与发件人地址进行的检查不那么相关，这些地址保证了合法性。

en: Recipient checks
zh-CN: 收件人检查

en: <literal>reject_unauth_destination</literal> is the basic rule that requires outside messages to be addressed to us; messages sent to an address not served by this server are rejected. Without this rule, a server becomes an open relay that allows spammers to send unsolicited emails; this rule is therefore mandatory, and it will be best included near the beginning of the list, so that no other rules may authorize the message before its destination has been checked.
zh-CN: <literal>reject_unauth_destination</literal> 是基本的规则，需要外部消息写给我们；向这台服务器不服务的地址发送的消息被拒绝。没有这条规则的话，服务器会变成开放中继，允许所有的垃圾邮件发件人发送自主邮件；由此这条规则是强制的，它最好包含在接近列表的开始部分，从而没有其它规则能够在检查目的地之前对消息进行授权。

en: The <literal>reject_unlisted_recipient</literal> rule rejects messages sent to non-existing local users, which makes sense. Finally, the <literal>reject_non_fqdn_recipient</literal> rule rejects non-fully-qualified addresses; this makes it impossible to send an email to <literal>jean</literal> or <literal>jean@machine</literal>, and requires using the full address instead, such as <literal>jean@machine.falcot.com</literal> or <literal>jean@falcot.com</literal>.
zh-CN: <literal>reject_unlisted_recipient</literal> 规则拒绝将消息发送给不存在的本地用户，这容易理解。最后，<literal>reject_non_fqdn_recipient</literal> 规则拒绝非完全合格的地址；从而不能将邮件发送给 <literal>jean</literal> 或 <literal>jean@machine</literal>，并且需要替代使用完整地址，如 <literal>jean@machine.falcot.com</literal> 或 <literal>jean@falcot.com</literal>。

en: The <literal>permit</literal> directive at the end is not necessary. But it can be useful at the end of a restriction list to make the default policy explicit.
zh-CN: 在结尾的 <literal>permit</literal> 指令不是必要的。但它用于在限制列表的末端使默认策略显性化。

en: Restrictions Associated with the <literal>DATA</literal> Command
zh-CN: 与 <literal>DATA（数据）</literal> 命令相关的限制

en: <primary>email</primary><secondary>filtering on SMTP commands</secondary>
zh-CN: <primary>电子邮件</primary><secondary>在 SMTP 命令上筛选</secondary>

en: The <literal>DATA</literal> command of SMTP is emitted before the contents of the message. It doesn't provide any information per se, apart from announcing what comes next. It can still be subjected to checks.
zh-CN: SMTP的 <literal>DATA（数据）</literal> 命令在消息内容之前发出。它本质上不提供任何信息，除了宣布下面的是什么。它仍然可以受到检查。

en: <primary><literal>DATA</literal></primary>
zh-CN: <primary><literal>DATA（数据）</literal></primary>

en: <primary><literal>SMTP</literal></primary><secondary>DATA</secondary>
zh-CN: <primary><literal>SMTP</literal></primary><secondary>DATA（数据）</secondary>

en: <literal>DATA</literal> checks
zh-CN: <literal>DATA（数据）</literal> 检查

en: The <literal>reject_unauth_pipelining</literal> directives causes the message to be rejected if the sending party sends a command before the reply to the previous command has been sent. This guards against a common optimization used by spammer robots, since they usually don't care a fig about replies and only focus on sending as many emails as possible in as short a time as possible.
zh-CN: 如果在对之前的命令回复被发送前，发送部分就发送了命令的话，那么 <literal>reject_unauth_pipelining</literal> 指令促使消息被拒绝。这针对垃圾邮件机器人使用的一般优化进行保护，因为它们通常毫不在乎回复，并且只聚焦在尽可能短的时间发送尽可能多的电子邮件。

en: Applying Restrictions
zh-CN: 应用限制

en: Although the above commands validate information at various stages of the SMTP exchange, Postfix sends the actual rejection as a reply to the <literal>RCPT TO</literal> command by default.
zh-CN: 尽管上面的命令在 SMTP 交换的各个阶段验证信息，Postfix 默认发送真正的拒绝作为对 <literal>RCPT TO</literal> 命令的回应。

en: This means that even if the message is rejected due to an invalid <literal>EHLO</literal> command, Postfix knows the sender and the recipient when announcing the rejection. It can then log a more explicit message than it could if the transaction had been interrupted from the start. In addition, a number of SMTP clients do not expect failures on the early SMTP commands, and these clients will be less disturbed by this late rejection.
zh-CN: 这意味着即使消息由于非法的 <literal>EHLO</literal> 命令被拒绝，当宣布拒绝的时候 Postfix 也知道发件人和收件人。相比交流一开始就中断了，它可以将更显性的消息记入日志。此外，很多 SMTP 客户端在 SMTP 命令的早期都不希望失败，这些客户端通过这样较晚的拒绝而较少受到困扰。

en: A final advantage to this choice is that the rules can accumulate information during the various stages of the SMTP exchange; this allows defining more fine-grained permissions, such as rejecting a non-local connection if it announces itself with a local sender.
zh-CN: 这个选择的最后一个优点是在 STMP 交换的各个阶段规则都会聚集信息；这允许确定更精细粒度的许可，如拒绝那些宣布自己是本地发件人的非本地连接。

en: The default behavior is controlled by the <literal>smtpd_delay_reject</literal> rule.
zh-CN: 默认行为由 <literal>smtpd_delay_reject</literal> 规则来控制。

en: Filtering Based on the Message Contents
zh-CN: 根据消息内容来筛选

en: <primary>email</primary><secondary>filtering on content inspection</secondary>
zh-CN: <primary>电子邮件</primary><secondary>在内容检查上筛选</secondary>

en: <primary>email</primary><secondary>filtering on contents</secondary>
zh-CN: <primary>电子邮件</primary><secondary>在内容上筛选</secondary>

en: The validation and restriction system would not be complete without a way to apply checks to the message contents. Postfix differentiates the checks applying to the email headers from those applying to the email body.
zh-CN: 如果没有一种方式对信息内容进行检查的话，验证与限制系统将是不完整的。Postfix 将应用于电子邮件头的检查从那些应用于电子邮件主体的检查中区别出来。

en: Enabling content-based filters
zh-CN: 启用基于内容的筛选

en: Both files contain a list of regular expressions (commonly known as <emphasis>regexps</emphasis> or <emphasis>regexes</emphasis>) and associated actions to be triggered when the email headers (or body) match the expression.
zh-CN: 这些文件都含有正则表达式（一般被称为 <emphasis>regexps</emphasis> 或 <emphasis>regexes</emphasis>）的列表，以及当电子邮件头（或主体）与表达式匹配时触发的相关动作。

en: <emphasis>QUICK LOOK</emphasis> Regexp tables
zh-CN: <emphasis>速览</emphasis> Regexp 表格

en: Example <filename>/etc/postfix/header_checks</filename> file
zh-CN: 示例 <filename>/etc/postfix/header_checks</filename> 文件

en: <emphasis>BACK TO BASICS</emphasis> Regular expression
zh-CN: <emphasis>基本知识</emphasis> 正则表达式

en: The <emphasis>regular expression</emphasis> term (shortened to <emphasis>regexp</emphasis> or <emphasis>regex</emphasis>) references a generic notation for expressing a description of the contents and/or structure of a string of characters. Certain special characters allow defining alternatives (for instance, <literal>foo|bar</literal> matches either “foo” or “bar”), sets of allowed characters (for instance, <literal>[0-9]</literal> means "any digit", and <literal>.</literal> — a dot — means "any character"), quantification (<literal>s?</literal> matches either <literal>s</literal> or the empty string, in other words 0 or 1 occurrence of <literal>s</literal>; <literal>s+</literal> matches one or more consecutive <literal>s</literal> characters; and so on). Parentheses allow grouping search results.
zh-CN: <emphasis>正则表达式</emphasis> 这个术语（缩写为 <emphasis>regexp</emphasis> 或 <emphasis>regex</emphasis>）引用了用于表达对字符串内容和/或结构进行描述的通用符号。某个特定字符允许定义替代（例如，<literal>foo|bar</literal> 与 “foo” 或 “bar”匹配）， 允许的字符组（例如，<literal>[0-9]</literal> 意味着“任何数字”，而 <literal>.</literal> ——点号——意味着“任何字符”），定量（<literal>s?</literal> 与 <literal>s</literal> 或空字符串匹配，换句话说，<literal>s</literal> 发生 0 次 或1 次；<literal>s+</literal> 与一个或更多个连续的 <literal>s</literal> 字符匹配；以及等等诸如此类）。括号允许将搜索结果分组。

en: The precise syntax of these expressions varies across the tools using them, but the basic features are similar. <ulink type="block" url="https://en.wikipedia.org/wiki/Regular_expression" />
zh-CN: 这些表达式的精确语法在使用它们的工具之间变化，但基本特性是相似的。<ulink type="block" url="https://en.wikipedia.org/wiki/Regular_expression" />

en: The first one checks the header mentioning the email software; if <literal>GOTO Sarbacane</literal> (a bulk email software) is found, the message is rejected. The second expression controls the message subject; if it mentions a virus notification, we can decide not to reject the message but to discard it immediately instead.
zh-CN: 第一个是检查提到电子邮件软件的标头；如果发现 <literal>GOTO Sarbacane</literal>（一个批量电子邮件软件），则拒绝消息。第二个表达式控制消息的主题；如果提到病毒通知，那么我们可以决定不拒绝消息，而是立即丢弃它。

en: Using these filters is a double-edged sword, because it is easy to make the rules too generic and to lose legitimate emails as a consequence. In these cases, not only the messages will be lost, but their senders will get unwanted (and annoying) error messages.
zh-CN: 这些筛选的使用是把双刃剑，因为容易使规则太过一般化，并且结果容易丢失合法的电子邮件。在这些情况下，不仅丢失消息，它们的发件人也会得到不需要的（令人困扰的）错误消息。

en: Setting Up <foreignphrase>greylisting</foreignphrase>
zh-CN: 设置 <foreignphrase>灰名单</foreignphrase>

en: <primary>greylisting</primary>
zh-CN: <primary>灰名单</primary>

en: <primary>email</primary><secondary>greylisting</secondary>
zh-CN: <primary>电子邮件</primary><secondary>灰名单</secondary>

en: Postfix doesn't provide greylisting natively, but there is a feature by which the decision to accept or reject a given message can be delegated to an external program. The <emphasis role="pkg">postgrey</emphasis> package contains just such a program, designed to interface with this access policy delegation service.
zh-CN: Postfix 本身不提供灰名单，但它有个特性，接受还是拒绝给定消息的决定可以委托给外部程序。<emphasis role="pkg">postgrey</emphasis> 软件包刚好包含这样的程序，它被设计与这个访问策略委托服务来对接。

en: Once <emphasis role="pkg">postgrey</emphasis> is installed, it runs as a daemon and listens on port 10023. Postfix can then be configured to use it, by adding the <literal>check_policy_service</literal> parameter as an extra restriction:
zh-CN: 一旦安装了 <emphasis role="pkg">postgrey</emphasis>，它就作为守护进程运行，并且监听 10023 端口。Postfix 然后可以配置来使用它，通过添加 <literal>check_policy_service</literal> 参数作为外部限制：

en: The main disadvantage of greylisting is that legitimate messages get delayed, which is not always acceptable. It also increases the burden on servers that send many legitimate emails.
zh-CN: 灰名单的主要缺点是合法消息会延迟，也不会总是被接受。它还增加了服务器发送很多合法电子邮件的负担。

en: <emphasis>IN PRACTICE</emphasis> Shortcomings of greylisting
zh-CN: <emphasis>实践</emphasis> 灰名单的缺点

en: Theoretically, greylisting should only delay the first mail from a given sender to a given recipient, and the typical delay is in the order of minutes. Reality, however, can differ slightly. Some large ISPs use clusters of SMTP servers, and when a message is initially rejected, the server that retries the transmission may not be the same as the initial one. When that happens, the second server gets a temporary error message due to greylisting too, and so on; it may take several hours until transmission is attempted by a server that has already been involved, since SMTP servers usually increase the delay between retries at each failure.
zh-CN: 理论上，灰名单应该只延迟从给定发件人到给定收件人的第一封邮件，并且典型的延迟是分钟级的。然而实际上会有略微的不同。一些大的 ISPs 使用 SMTP 服务器集群，并且当消息被初始拒绝时，再次尝试传送的服务器可能与初始的那个不同。当这种情况发生时，第二台服务器也因为灰名单而得到临时错误消息，以及等等诸如此类；这会花费几个小时直到尝试传送由曾经被使用过的服务器来进行，因为 SMTP 服务器通常在每次失败的尝试之间增加延迟时间。

en: As a consequence, the incoming IP address may vary in time even for a single sender. But it goes further: even the sender address can change. For instance, many mailing-list servers encode extra information in the sender address so as to be able to handle error messages (known as <emphasis>bounces</emphasis>). Each new message sent to a mailing-list may then need to go through greylisting, which means it has to be stored (temporarily) on the sender's server. For very large mailing-lists (with tens of thousands of subscribers), this can soon become a problem.
zh-CN: 结果，即使是单一的发件人，到来的 IP 地址也会不时变化。而更进一步：甚至发件人的地址会变化。例如，很多邮件列表服务器将发件人地址中的更多信息编码，从而能够处理错误消息（被称为 <emphasis>bounces，弹跳</emphasis>）。发送给邮件列表服务器的每条新消息然后会需要经过灰名单来筛选，这意味着必须（临时）存储在发件人的服务器上。对于非常大的邮件列表（有上万个订阅者），这会很快变成问题。

en: To mitigate these drawbacks, Postgrey manages a whitelist of such sites, and messages emanating from them are immediately accepted without going through greylisting. This list can easily be adapted to local needs, since it is stored in the <filename>/etc/postgrey/whitelist_clients</filename> file.
zh-CN: 为了减轻这些缺点，Postgrey 管理这样网站的白名单，并且由它们产生的消息被立即接受，而不经过灰名单去筛选。这个列表可以容易地适应本地需求，因为它存储在 <filename>/etc/postgrey/whitelist_clients</filename> 文件中。

en: <emphasis>GOING FURTHER</emphasis> Selective greylisting with <emphasis role="pkg">milter-greylist</emphasis>
zh-CN: <emphasis>进阶阅读</emphasis> 使用<emphasis role="pkg">milter-greylist</emphasis> 进行选择性灰名单的筛选

en: The drawbacks of greylisting can be mitigated by only using greylisting on the subset of clients that are already considered as probable sources of spam (because they are listed in a DNS blacklist). This is not possible with <emphasis role="pkg">postgrey</emphasis> but <emphasis role="pkg">milter-greylist</emphasis> can be used in such a way.
zh-CN: 可以在已经被认为可能是垃圾邮件源头的客户端子组中只使用灰名单（因为它们被列在 DNS 黑名单中），来减轻灰名单的缺点。这对于 <emphasis role="pkg">postgrey</emphasis> 是不可能的，但可以以这样的方式来使用 <emphasis role="pkg">milter-greylist</emphasis> 。

en: In that scenario, since DNS blacklists never triggers a definitive rejection, it becomes reasonable to use aggressive blacklists, including those listing all dynamic IP addresses from ISP clients (such as <literal>pbl.spamhaus.org</literal> or <literal>dul.dnsbl.sorbs.net</literal>).
zh-CN: 在这种情形下，由于 DNS 黑名单永远不会触发已确定的拒绝，于是能够合理地使用激进的黑名单，包括从 ISP 客户端列出所有动态 IP 地址的那些（如 <literal>pbl.spamhaus.org</literal> 或 <literal>dul.dnsbl.sorbs.net</literal>）。

en: Since <emphasis role="pkg">milter-greylist</emphasis> uses Sendmail's milter interface, the postfix side of its configuration is limited to “<literal>smtpd_milters = unix:/var/run/milter-greylist/milter-greylist.sock</literal>”. The <citerefentry><refentrytitle>greylist.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> manual page documents <filename>/etc/milter-greylist/greylist.conf</filename> and the numerous ways to configure milter-greylist. You will also have to edit <filename>/etc/default/milter-greylist</filename> to actually enable the service.
zh-CN: 由于 <emphasis role="pkg">milter-greylist</emphasis> 使用 Sendmail 的 milter 接口，其配置的 postfix 侧被限制为 “<literal>smtpd_milters = unix:/var/run/milter-greylist/milter-greylist.sock</literal>”。 <citerefentry><refentrytitle>greylist.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> 手册页将 <filename>/etc/milter-greylist/greylist.conf</filename> 和配置 milter-greylist 的几种方式进行了存档。还必须编辑 <filename>/etc/default/milter-greylist</filename> 来实际启用这项服务。

en: Customizing Filters Based On the Recipient
zh-CN: 根据收件人定制筛选程序

en: <primary>email</primary><secondary>custom restriction classes</secondary>
zh-CN: <primary>电子邮件</primary><secondary>客户限制类</secondary>

en: <xref linkend="sect.restrictions-for-receiving-and-sending" /> and <xref linkend="sect.setting-up-greylisting" /> reviewed many of the possible restrictions. They all have their use in limiting the amount of received spam, but they also all have their drawbacks. It is therefore more and more common to customize the set of filters depending on the recipient. At Falcot Corp, greylisting is interesting for most users, but it hinders the work of some users who need low latency in their emails (such as the technical support service). Similarly, the commercial service sometimes has problems receiving emails from some Asian providers who may be listed in blacklists; this service asked for a non-filtered address so as to be able to correspond.
zh-CN: <xref linkend="sect.restrictions-for-receiving-and-sending" /> 和 <xref linkend="sect.setting-up-greylisting" /> 回顾了很多可能的限制。在限制接收到垃圾邮件的量方面它们都有自己的作用，但它们也有自己的缺点。这样，根据收件人来定制一组筛选程序会越来越常见。在 Falcot 公司，灰名单吸引了多数用户，但它阻碍了需要低延迟电子邮件的一些用户（如技术支持服务）的工作。相似地，从会被列入黑名单的一些亚洲提供商那里接收电子邮件的商务服务有时也会有问题；这项服务要求非筛选的地址，从而能够响应。

en: Postfix provides such a customization of filters with a “restriction class” concept. The classes are declared in the <literal>smtpd_restriction_classes</literal> parameter, and defined the same way as <literal>smtpd_recipient_restrictions</literal>. The <literal>check_recipient_access</literal> directive then defines a table mapping a given recipient to the appropriate set of restrictions.
zh-CN: Postfix 通过“restriction class（限制类）”的概念来提供筛选服务的定制。类在 <literal>smtpd_restriction_classes</literal> 参数中声明，并且以 <literal>smtpd_recipient_restrictions</literal> 的相同方式定义。<literal>check_recipient_access</literal> 指令然后定义表格，将给定的收件人映射到适当的限制组。

en: Defining restriction classes in <filename>main.cf</filename>
zh-CN: 在 <filename>main.cf</filename> 中定义限制类

en: The <filename>/etc/postfix/recipient_access</filename> file
zh-CN: <filename>/etc/postfix/recipient_access</filename> 文件

en: <primary>antivirus</primary>
zh-CN: <primary>防病毒</primary>

en: <primary>email</primary><secondary>virus scanning</secondary>
zh-CN: <primary>电子邮件</primary><secondary>病毒扫描</secondary>

en: <emphasis>SECURITY</emphasis> Controversial Discussion of Anti-Virus Software
zh-CN: <emphasis>安全</emphasis> 防病毒软件的有争议的讨论

en: The usage of virus scanners, or so called antivirus software, is controversial. There is usually a gap between the release of some piece of malware and the addition of detection rules to the antivirus database. During this gap, there is no software-based protection. Further, the usage often requires to run additional software, for example, to uncompress archives and scan all kinds of executables, which drastically increases the exploit potential of the antivirus software itself. Usage of such software solutions can therefor never replace awareness campaigns and simple behavioral rules (never open unsolicited sent attachments, etc.).
zh-CN: 病毒扫描软件，或者所谓防病毒软件的使用是有争议的。一些恶意软件的发行与检测规则添加到防病毒数据库之间通常有时间间隔。在这个间隔中，没有基于软件的保护。进一步，病毒扫描软件的使用通常需要运行另外的软件，例如，解压缩档案并扫描所有类型的可执行文件，这彻底增加了防病毒软件自身的利用潜力。由此，使用这样软件的解决方案永远也不能代替对斗争的了解与简单的行为规则（永远不要打开自主发送附件，等等）。

en: <primary>antivirus</primary><secondary>controversy</secondary>
zh-CN: <primary>防病毒</primary><secondary>争议</secondary>

en: The task of interfacing between antivirus and the email server goes to <command>clamav-milter</command>. A <emphasis>milter</emphasis> (short for <emphasis>mail filter</emphasis>) is a filtering program specially designed to interface with email servers. A milter uses a standard application programming interface (API) that provides much better performance than filters external to the email servers. Milters were initially introduced by <emphasis>Sendmail</emphasis>, but <emphasis>Postfix</emphasis> soon followed suit.
zh-CN: 防病毒软件与电子邮件服务器之间的接口任务由 <command>clamav-milter</command> 执行。<emphasis>milter</emphasis> （<emphasis>mail filter</emphasis>，邮件筛选程序的缩写）是特别设计与电子邮件服务器来接口的筛选程序。milter 使用标准的应用程序接口（API），来提供比电子邮件服务器之外的筛选程序更好的性能。Milters 最初由 <emphasis>Sendmail</emphasis> 引入，但 <emphasis>Postfix</emphasis> 很快就效仿了。

en: <emphasis>QUICK LOOK</emphasis> A milter for Spamassassin
zh-CN: <emphasis>速览</emphasis>用于 Spamassassin 的 milter

en: The <emphasis role="pkg">spamass-milter</emphasis> package provides a milter based on <emphasis>SpamAssassin</emphasis>, the famous unsolicited email detector. It can be used to flag messages as probable spams (by adding an extra header) and/or to reject the messages altogether if their “spamminess” score goes beyond a given threshold.
zh-CN: <emphasis role="pkg">spamass-milter</emphasis> 软件包根据 <emphasis>SpamAssassin</emphasis>这个著名的自发电子邮件检测程序来提供milter。它可以用于将消息标记为可能的垃圾邮件（通过添加另外的标头），并且/或者拒绝消息，如果其“垃圾邮件特性”得分超过给定阈值的话。

en: Once the <emphasis role="pkg">clamav-milter</emphasis> package is installed, the milter should be reconfigured to run on a TCP port rather than on the default named socket. This can be achieved with <command>dpkg-reconfigure clamav-milter</command>. When prompted for the “Communication interface with Sendmail”, answer “<literal>inet:10002@127.0.0.1</literal>”.
zh-CN: 一旦安装了 <emphasis role="pkg">clamav-milter</emphasis> 软件包，就应该重新配置 milter 来运行在 TCP 端口上，而不是在默认命名套接字上。这可以通过 <command>dpkg-reconfigure clamav-milter</command> 来实现。当提示“Communication interface with Sendmail”（ Sendmail 的通讯接口）时，回答 “<literal>inet:10002@127.0.0.1</literal>”。

en: <emphasis>NOTE</emphasis> Real TCP port vs named socket
zh-CN: <emphasis>注解</emphasis> 真正的 TCP 端口 vs 命名套接字

en: The reason why we use a real TCP port rather than the named socket is that the postfix daemons often run chrooted and do not have access to the directory hosting the named socket. You could also decide to keep using a named socket and pick a location within the chroot (<filename>/var/spool/postfix/</filename>).
zh-CN: 我们使用真实的 TCP 端口而不是命名套接字的原因是，postfix 守护进程通常运行 chrooted， 而不能访问作为命名套接字主机的目录。还应该决定一直使用命名套接字，并在 chroot 内选择一个位置（<filename>/var/spool/postfix/</filename>）。

en: The standard ClamAV configuration fits most situations, but some important parameters can still be customized with <command>dpkg-reconfigure clamav-base</command>.
zh-CN: 标准的 ClamAV 配置适应多数情况，但一些重要的参数仍然需要用 <command>dpkg-reconfigure clamav-base</command> 来定制。

en: The last step involves telling Postfix to use the recently-configured filter. This is a simple matter of adding the following directive to <filename>/etc/postfix/main.cf</filename>:
zh-CN: 最后一步包括告诉 Postfix 使用最近配置的筛选程序。这是件简单的事，将后面的指令添加到 <filename>/etc/postfix/main.cf</filename>中：

en: If the antivirus causes problems, this line can be commented out, and <command>systemctl reload postfix</command> should be run so that this change is taken into account.
zh-CN: 如果防病毒软件发生问题，这一行可以被注释掉，并且应该运行 <command>systemctl reload postfix</command>，使这项更改被接受。

en: <emphasis>IN PRACTICE</emphasis> Testing the antivirus
zh-CN: <emphasis>实践</emphasis> 测试防病毒软件

en: Once the antivirus is set up, its correct behavior should be tested. The simplest way to do that is to send a test email with an attachment containing the <filename>eicar.com</filename> (or <filename>eicar.com.zip</filename>) file, which can be downloaded online: <ulink type="block" url="https://2016.eicar.org/86-0-Intended-use.html" />
zh-CN: 一旦设置好防病毒，就可以测试它的正确行为了。测试的最简单方式是发送测试电子邮件，包含<filename>eicar.com</filename> （或 <filename>eicar.com.zip</filename>）文件的附件，它可以在线下载：<ulink type="block" url="https://2016.eicar.org/86-0-Intended-use.html" />

en: This file is not a true virus, but a test file that all antivirus software on the market diagnose as a virus to allow checking installations.
zh-CN: 这个文件不是真实的病毒，但市场上的所有防病毒软件将这个测试文件诊断文病毒，这样允许检查防病毒软件的安装。

en: All messages handled by Postfix now go through the antivirus filter.
zh-CN: 由 Postfix 处理的所有消息现在经过防病毒软件删选程序。

en: Fighting Spam with SPF, DKIM and DMARC
zh-CN: 用 SPF、DKIM 和 DMARC 应对垃圾邮件

en: The high number of unsolicited email sent every day led to the creation of several standards, which aim at validating that the sending host of an email is authorized and that the email has not been tampered with. The following systems are all DNS-based and require the administrators to not only have control over the mail server, but over the DNS for the domain in question too.
zh-CN: 每天大量发送的自发电子邮件导致建立了几条标准，目的在于验证授权的电子邮件的发送主机被授权，以及没有关联的电子邮件是否合法。后面的系统都是基于 DNS 的，并且需要管理员不仅控制邮件服务器，而且还要控制有问题的域的 DNS。

en: <emphasis>CAUTION</emphasis> Controversial Discussion
zh-CN: <emphasis>警告</emphasis> 有争议的讨论

en: Integrating the Sender Policy Framework (SPF)
zh-CN: 集成发件人策略框架（Sender Policy Framework，即SPF）

en: The Sender Policy Framework (<acronym>SPF</acronym>) is used to validate if a certain mail server is allowed to send emails for a given domain. It is mostly configured through DNS. The syntax for the entry to make is explained in detail at: <ulink type="block" url="http://www.open-spf.org/SPF_Record_Syntax" /> <ulink type="block" url="https://tools.ietf.org/html/rfc7208" /> <ulink type="block" url="https://en.wikipedia.org/wiki/Sender_Policy_Framework" />
zh-CN: 发件人策略框架（Sender Policy Framework，即<acronym>SPF</acronym>）用于验证对于给定的域，某个邮件服务器是否允许合法地发送电子邮件。它主要通过 DNS 来配置。配置入口的语法在：<ulink type="block" url="http://www.open-spf.org/SPF_Record_Syntax" /> <ulink type="block" url="https://tools.ietf.org/html/rfc7208" /> <ulink type="block" url="https://en.wikipedia.org/wiki/Sender_Policy_Framework" /> 中具体解释

en: Let's take a quick look at the <literal>falcot.org</literal> entry.
zh-CN: 让我们快速浏览一下 <literal>falcot.org</literal> 入口。

en: It states that the IP of the sender must match the A record for the sending domain, or must be listed as one of the Mail Exchange Resource Records for the current domain, or must be one of the three mentioned IP4 addresses. All other hosts should be marked as not being allowed to send email for the sender domain. The latter is called a "soft fail" and is intended to mark the email accordingly, but still accept it.
zh-CN: 它声明发件人的 IP 必须与发送域的记录匹配，或者必须作为当前域的一个电子邮件交换资源记录（Mail Exchange Resource Records）列出，或者必须是三个提到的 IP4 地址之一。所有其它主机应该被标记为不允许对那些发件人域发送电子邮件。后者被称为“软失败”，并且要由此标记电子邮件，但仍可以接受它。

en: The <command>postfix</command> mail server can check the SPF record for incoming emails using the <emphasis role="pkg">postfix-policyd-spf-python</emphasis> package, a policy agent written in Python. The file <filename>/usr/share/doc/postfix-policyd-spf-python/README.Debian</filename> describes the necessary steps to integrate the agent into postfix, so we won't repeat it here.
zh-CN: <command>postfix</command> 邮件服务器可以使用 <emphasis role="pkg">postfix-policyd-spf-python</emphasis> 软件包，对到来的电子邮件来检查 SPF 记录，这个软件包是用 Python 写的策略代理。文件 <filename>/usr/share/doc/postfix-policyd-spf-python/README.Debian</filename> 描述了将代理集成进 postfix 的必要步骤，因此不在这里重复。

en: The configuration is done in the file <filename>/etc/postfix-policyd-spf-python/policyd-spf.conf</filename>, which is fully documented in <citerefentry><refentrytitle>policyd-spf.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> and <filename>/usr/share/doc/postfix-policyd-spf-python/policyd-spf.conf.commented.gz</filename>. The main configuration parameters are <literal>HELO_reject</literal> and <literal>Mail_From_reject</literal>, which configure if emails should be rejected (<literal>Fail</literal>) or accepted with a header being appended (<literal>False</literal>), if checks fail. The latter is often useful, when the message is further processed by a spam filter.
zh-CN: 配置在文件 <filename>/etc/postfix-policyd-spf-python/policyd-spf.conf</filename> 中完成，它完全存档在 <citerefentry><refentrytitle>policyd-spf.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 和 <filename>/usr/share/doc/postfix-policyd-spf-python/policyd-spf.conf.commented.gz</filename>中。主要配置参数是 <literal>HELO_reject</literal> 和 <literal>Mail_From_reject</literal>，如果检查失败的话，它们将通过将追加标头（<literal>False</literal>），来配置电子邮件应该被拒绝（<literal>Fail</literal>）还是应该被接受。当消息被垃圾邮件筛选程序进一步处理时，后者通常很有用。

en: If the result is intended to be used by <emphasis role="pkg">opendmarc</emphasis> (<xref linkend="sect.dmarc" />), then <literal>Header_Type</literal> must be set to <literal>AR</literal>.
zh-CN: 如果结果要由 <emphasis role="pkg">opendmarc</emphasis>（<xref linkend="sect.dmarc" />）使用，那么 <literal>Header_Type</literal> 必须设置为 <literal>AR</literal>。

en: Note that <emphasis role="pkg">spamassassin</emphasis> contains a plugin to check the SPF record.
zh-CN: 注意 <emphasis role="pkg">spamassassin</emphasis> 包含插件来检查 SPF 记录。

en: Integrating DomainKeys (DKIM) Signing and Checking
zh-CN: 和集成 DomainKeys (DKIM) 签名与检查

en: The Domain Keys Identified Mail (<acronym>DKIM</acronym>) standard is a sender authentication system. The mail transport agent, here <command>postfix</command>, adds a digital signature associated with the domain name to the header of outgoing emails. The receiving party can validate the message body and header fields by checking the signature against a public key, which is retrieved from the senders DNS records. <ulink type="block" url="http://dkim.org/" />
zh-CN: 域密钥识别邮件（Domain Keys Identified Mail，缩写为<acronym>DKIM</acronym>）标准是发件人认证系统。邮件传输代理，这里是 <command>postfix</command>，将与域名相联系的数字签名添加到外发电子邮件的标头中。接收部分可以通过相对于发件人 DNS 记录中下载的公钥来检查签名，从而验证消息本体和标头字段。<ulink type="block" url="http://dkim.org/" />

en: The necessary tools are shipped with the <emphasis role="pkg">opendkim</emphasis> and <emphasis role="pkg">opendkim-tools</emphasis> packages.
zh-CN: 必要的工具与软件包<emphasis role="pkg">opendkim</emphasis> 和 <emphasis role="pkg">opendkim-tools</emphasis> 一起上市。

en: <emphasis>CAUTION</emphasis> Mailing List Software and DKIM
zh-CN: <emphasis>警告</emphasis> 邮件列表软件和 DKIM

en: Mailing list managers often rewrite some email headers, thus leading to invalid DKIM signatures. Even using a <literal>relaxed</literal> canonicalization does not always prevent this from happening. So the administrators must pay close attention to the mail severs log files to identify such issues. Otherwise such emails might be flagged as spam and might get rejected.
zh-CN: 邮件列表管理器通常重写一些电子邮件的标头，这样导致非法的 DKIM 签名。即使使用 <literal>relaxed（放松的）</literal> 规范，也不能总是防止发生这个问题。于是管理员必须密切注意邮件服务器的日志文件，来识别这样的问题。否则这样的电子邮件会被标记为垃圾邮件并会被拒绝。

en: First the private key must be created using the command <command>opendkim-genkey -s <replaceable>SELECTOR</replaceable> -d <replaceable>DOMAIN</replaceable></command>. <replaceable>SELECTOR</replaceable> must be a unique name for the key. It can be as simple as "mail" or the date of creation, if you plan to rotate keys.
zh-CN: 第一个私钥必须使用命令 <command>opendkim-genkey -s <replaceable>SELECTOR</replaceable> -d <replaceable>DOMAIN</replaceable></command>来创建。 <replaceable>SELECTOR</replaceable> 必须是密钥的唯一名称。如果计划旋转密钥的话，它可以像 “mail”或创建日期那样简单。

en: Create a private key for signing E-Mails from falcot.com
zh-CN: 创建私钥用于为来自 falcot.com 的电子邮件签名

en: This will create the files <filename>/etc/dkimkeys/mail.private</filename> and <filename>/etc/dkimkeys/mail.txt</filename> and set the appropriate ownership. The first file contains the private key, and the latter the public key that needs to be added to the DNS:
zh-CN: 这将创建文件 <filename>/etc/dkimkeys/mail.private</filename> 和 <filename>/etc/dkimkeys/mail.txt</filename>，并设置适当的所有权。第一个文件包含私钥，而后一个文件包含需要添加到 DNS 中的公钥：

en: The <emphasis role="pkg">opendkim</emphasis> package in Debian defaults to a keysize of 2048 bit. Unfortunately some DNS servers can only handle text entries with a maximum length of 255 characters, which is exceeded by the chosen default keysize. In this case use the option <command>-b 1024</command> to chose a smaller keysize. If <command>opendkim-testkey</command> succeeds, the entry has been successfully set up. The syntax of the entry is explained here: <ulink type="block" url="https://tools.ietf.org/html/rfc6376" /> <ulink type="block" url="https://en.wikipedia.org/wiki/DKIM" />
zh-CN: Debian 中的 <emphasis role="pkg">opendkim</emphasis> 软件包默认为 2048 字节。不幸的是一些 DNS 服务器只能处理最大 255 个字符的文本入口，这超过了所选择的默认尺寸。在这种情况下，使用 <command>-b 1024</command> 选项来选择较小的密钥尺寸。如果 <command>opendkim-testkey</command> 成功的话，入口就会被成功设置。入口的语法在这里解释：<ulink type="block" url="https://tools.ietf.org/html/rfc6376" /> <ulink type="block" url="https://en.wikipedia.org/wiki/DKIM" />

en: To configure <emphasis role="pkg">opendkim</emphasis>, <literal>SOCKET</literal> and <literal>RUNDIR</literal> must be chosen in <filename>/etc/default/opendkim</filename>. Please note that <literal>SOCKET</literal> must be accessible from <literal>postfix</literal> in its chrooted environment. The further configuration is done in <filename>/etc/opendkim.conf</filename>. The following is a configuration excerpt, which makes sure that the <literal>Domain</literal> "falcot.com" and all subdomains (<literal>SubDomain</literal>) are signed by the <literal>Selector</literal> "mail" and the single private key (<literal>KeyFile</literal>) <filename>/etc/dkimkeys/mail.private</filename>. The "relaxed" <literal>Canonicalization</literal> for both the header and the body tolerates mild modification (by a mailing list software, for example). The filter runs both in signing ("s") and verification ("v") <literal>Mode</literal>. If a signature fails to validate (<literal>On-BadSignature</literal>), the mail should be quarantined ("q").
zh-CN: 为了配置 <emphasis role="pkg">opendkim</emphasis>，必须在 <filename>/etc/default/opendkim</filename> 中选择 <literal>SOCKET</literal> 和 <literal>RUNDIR</literal>。请注意，必须在 chrooted 环境下从 <literal>postfix</literal> 中访问 <literal>SOCKET</literal> 。进一步的配置在 <filename>/etc/opendkim.conf</filename> 中完成。后面是配置节选，它确定 <literal>Domain（域）</literal> "falcot.com" 和所有子域 （<literal>SubDomain</literal>）由 <literal>Selector（选择器）</literal>"mail"和单独的私钥 (<literal>KeyFile</literal>) <filename>/etc/dkimkeys/mail.private</filename> 来签名。对于标头和本体 “放松的”<literal>Canonicalization（规范）</literal>能够容忍温和的修改（例如由邮件列表软件）。筛选程序在签名（"s"）和确认（"v"）<literal>Mode（模式）</literal>中运行。如果签名验证失败（<literal>On-BadSignature</literal>），那么邮件应该被隔离（"q"）。

en: It is also possible to use multiple selectors/keys (<literal>KeyTable</literal>), domains (<literal>SigningTable</literal>) and to specify internal or trusted hosts (<literal>InternalHosts</literal>, <literal>ExternalIgnoreList</literal>), which may send mail through the server as one of the signing domains without credentials.
zh-CN: 还能够使用多个选择器/密钥（<literal>KeyTable</literal>）、域（<literal>SigningTable</literal>）并指定内部或可信任的主机（<literal>InternalHosts</literal>、<literal>ExternalIgnoreList</literal>），它们可以通过服务器作为签名的主机之一发送邮件，而无需证书。

en: The following directives in <filename>/etc/postfix/main.cf</filename> make <literal>postfix</literal> use the filter:
zh-CN: 后面在 <filename>/etc/postfix/main.cf</filename> 中的指令使 <literal>postfix</literal> 使用筛选程序：

en: To differentiate signing and verification it is sometimes more useful to add the directives to the services in <filename>/etc/postfix/master.cf</filename> instead.
zh-CN: 为了区别签名与核实，有时将指令替代添加到 <filename>/etc/postfix/master.cf</filename> 的服务中更有用。

en: More information is available in the <filename>/usr/share/doc/opendkim/</filename> directory and the manual pages <citerefentry><refentrytitle>opendkim</refentrytitle> <manvolnum>8</manvolnum></citerefentry> and <citerefentry><refentrytitle>opendkim.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry>.
zh-CN: 更多信息可以在 <filename>/usr/share/doc/opendkim/</filename> 目录和手册页 <citerefentry><refentrytitle>opendkim</refentrytitle> <manvolnum>8</manvolnum></citerefentry> 与 <citerefentry><refentrytitle>opendkim.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 中获得。

en: Note that <emphasis role="pkg">spamassassin</emphasis> contains a plugin to check the DKIM record.
zh-CN: 注意 <emphasis role="pkg">spamassassin</emphasis> 包含插件来检查 DKIM 记录。

en: Integrating Domain-based Message Authentication, Reporting and Conformance (DMARC)
zh-CN: 集成基于域的消息认证、报告与一致性（DMARC）

en: The Domain-based Message Authentication, Reporting and Conformance (<acronym>DMARC</acronym>) standard can be used to define a DNS TXT entry with the name <literal>_dmarc</literal> and the action that should be taken when emails that contain your domain as the sending host fail to validate using DKIM and SPF. <ulink type="block" url="https://dmarc.org/overview/" />
zh-CN: 基于域的消息认证、报告与一致性（<acronym>DMARC</acronym>）标准，可以通过<literal>_dmarc</literal>名称来确定 DNS TXT 入口，以及当包含您的域作为发送主机的电子邮件使用 DKIM 和 SPF 验证失败时应该执行的动作。<ulink type="block" url="https://dmarc.org/overview/" />

en: Let's have a look at the entries of two large providers:
zh-CN: 让我们看看两个大提供商的条目：

en: Yahoo has a strict policy to <literal>reject</literal> all emails pretending to be sent from a Yahoo account but missing or failing DKIM and SPF checks. Google Mail (Gmail) propagates a very relaxed policy, in which such messages from the main domain should still be accepted (<literal>p=none</literal>). For subdomains they should be marked as spam (<literal>sp=quarantine</literal>). The addresses given in the <literal>rua</literal> key can be used to send aggregated DMARC reports to. The full syntax is explained here: <ulink type="block" url="https://tools.ietf.org/html/rfc7489" /> <ulink type="block" url="https://en.wikipedia.org/wiki/DMARC" />
zh-CN: Yahoo 具有严格的策略来<literal>rejec（拒绝）t</literal>所有的电子邮件，防止它们从 Yahoo 账户发送，但没有 DKIM 和 SPF 检查或检查失败。Google Mail （Gmail）传播非常放松的策略，其中来自主域的消息仍然应该被接受（<literal>p=none</literal>）。对于子域，它们应该被标记为垃圾邮件（<literal>sp=quarantine</literal>）。在 <literal>rua</literal> 密钥中给出的地址可以用于将汇总的 DMARC 报告发送给它。完整语法在这里解释：<ulink type="block" url="https://tools.ietf.org/html/rfc7489" /> <ulink type="block" url="https://en.wikipedia.org/wiki/DMARC" />

en: The <command>postfix</command> mail server can use this information too. The <emphasis role="pkg">opendmarc</emphasis> package contains the necessary milter. Similar to <emphasis role="pkg">opendkim</emphasis> <literal>SOCKET</literal> and <literal>RUNDIR</literal> must be chosen in <filename>/etc/default/opendmarc</filename> (for Unix sockets you must make sure that they are inside the postfix chroot to be found). The configuration file <filename>/etc/opendmarc.conf</filename> contains detailed comments and is also explained in <citerefentry><refentrytitle>opendmarc.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry>. By default, emails failing the DMARC validation are not rejected but flagged, by adding an appropriate header field. To change this, use <literal>RejectFailures true</literal>.
zh-CN: <command>postfix</command> 邮件服务器也可以使用这个信息。<emphasis role="pkg">opendmarc</emphasis> 软件包包含必要的 milter 。与 <emphasis role="pkg">opendkim</emphasis> 相似，<literal>SOCKET</literal> 和 <literal>RUNDIR</literal> 必须在 <filename>/etc/default/opendmarc</filename> 中选择（对于 Unix 套接字，必须确认它们能够在 postfix chroot 内找到）。配置文件<filename>/etc/opendmarc.conf</filename> 包含具体的注释，并且还在 <citerefentry><refentrytitle>opendmarc.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 中解释。DMARC 验证失败的电子邮件默认被拒绝，但通过添加适当的标头字段而被标记。要更改的话，需使用 <literal>RejectFailures true</literal>。

en: The milter is then added to <literal>smtpd_milters</literal> and <literal>non_smtpd_milters</literal>. If we configured the opendkim and opendmarc milters to run on ports 12345 and 54321, the entry in <filename>/etc/postfix/main.cf</filename> looks like this:
zh-CN: 然后 milter 添加到 <literal>smtpd_milters</literal> 和 <literal>non_smtpd_milters</literal> 中。如果我们配置 opendkim 和 opendmarc milters 在端口 12345 和 54321 上运行，那么 <filename>/etc/postfix/main.cf</filename> 中的入口看起来像这样：

en: The milter can also be selectively applied to a service in <filename>/etc/postfix/master.cf</filename> instead.
zh-CN: milter 还可以可选择地替代应用于 <filename>/etc/postfix/master.cf</filename> 中。

en: Authenticated SMTP
zh-CN: 认证的 SMTP

en: Being able to send emails requires an SMTP server to be reachable; it also requires said SMTP server to send emails through it. For roaming users, this may need regularly changing the configuration of the SMTP client, since Falcot's SMTP server rejects messages coming from IP addresses apparently not belonging to the company. Two solutions exist: either the roaming user installs an SMTP server on their computer, or they still use the company server with some means of authenticating as an employee. The former solution is not recommended since the computer won't be permanently connected, and it won't be able to retry sending messages in case of problems; we will focus on the latter solution.
zh-CN: 能够发送电子邮件需要能够访问到 SMTP 服务器；还需要所谓的 SMTP 服务器，通过它来发送电子邮件。对于漫游用户，这会需要定期更改 SMTP 客户端的配置，因为 falcot 公司的 SMTP 服务器拒绝来自明显不属于公司 IP 地址的邮件。有两个解决方案：漫游用户在他们的计算机上安装 SMTP 服务器，或者他们通过一些方式被认证为雇员，从而仍然使用公司的服务器。不推荐前面的解决方案，因为计算机不会永远地连接，并且在出现问题时不能重复尝试发送消息；我们将聚焦于后一个解决方案。

en: SMTP authentication in Postfix relies on SASL (<emphasis>Simple Authentication and Security Layer</emphasis>). It requires installing the <emphasis role="pkg">libsasl2-modules</emphasis> and <emphasis role="pkg">sasl2-bin</emphasis> packages, then registering a password in the SASL database for each user that needs authenticating on the SMTP server. This is done with the <command>saslpasswd2</command> command, which takes several parameters. The <literal>-u</literal> option defines the authentication domain, which must match the <literal>smtpd_sasl_local_domain</literal> parameter in the Postfix configuration. The <literal>-c</literal> option allows creating a user, and <literal>-f</literal> allows specifying the file to use if the SASL database needs to be stored at a different location than the default (<filename>/etc/sasldb2</filename>).
zh-CN: Postfix 中的 SMTP 认证依赖于 SASL（<emphasis>Simple Authentication and Security Layer，简单认证与安全层</emphasis>）。它需要安装 <emphasis role="pkg">libsasl2-modules</emphasis> 和 <emphasis role="pkg">sasl2-bin</emphasis> 软件包，然后在 SASL 数据库中为 SMTP 服务器上需要认证的每位用户注册密码。这通过 <command>saslpasswd2</command> 命令完成，它使用几个参数。<literal>-u</literal> 选项确定认证域，必须与 Postfix 配置中的 <literal>smtpd_sasl_local_domain</literal> 参数匹配。<literal>-c</literal> 选项允许创建用户，而在 SASL 数据库需要存储在默认位置（<filename>/etc/sasldb2</filename>）以外的不同位置的情况下，<literal>-f</literal>允许指定要使用的文件。

en: Note that the SASL database was created in Postfix's directory. In order to ensure consistency, we also turn <filename>/etc/sasldb2</filename> into a symbolic link pointing at the database used by Postfix, with the <command>ln -sf /var/spool/postfix/etc/sasldb2 /etc/sasldb2</command> command.
zh-CN: 注意 SASL 数据库创建在 Postfix 的目录下。为了确保一致性，还使用 <command>ln -sf /var/spool/postfix/etc/sasldb2 /etc/sasldb2</command> 命令，将 <filename>/etc/sasldb2</filename> 转变成指向由 Postfix 使用的数据库的符号链接。

en: Now we need to configure Postfix to use SASL. First the <literal>postfix</literal> user needs to be added to the <literal>sasl</literal> group, so that it can access the SASL account database. A few new parameters are also needed to enable SASL, and the <literal>smtpd_recipient_restrictions</literal> parameter needs to be configured to allow SASL-authenticated clients to send emails freely.
zh-CN: 现在需要配置 Postfix 来使用 SASL。首先 <literal>postfix</literal> 用户需要被添加到 <literal>sasl</literal> 群组中，从而可以访问 SASL 账户数据库。还需要一些新的参数来启用 SASL，并且需要配置 <literal>smtpd_recipient_restrictions</literal> 参数来允许 SASL 认证的客户端自由发送电子邮件。

en: Enabling SASL in <filename>/etc/postfix/main.cf</filename>
zh-CN: 在 <filename>/etc/postfix/main.cf</filename> 中启用 SASL

en: It is usually a good idea to not send passwords over an unencrypted connection. <emphasis>Postfix</emphasis> allows to use different configurations for each port (service) it runs on. All these can be configured with different rules and directives in the <filename>/etc/postfix/master.cf</filename> file. To turn off authentication at all for port 25 (<literal>smtpd</literal> service) add the following directive:
zh-CN: 不通过未加密的连接发送密码通常是好的主意。<emphasis>Postfix</emphasis> 允许为它运行其上的每个端口（服务）使用不同的配置。所有这些可以在 <filename>/etc/postfix/master.cf</filename> 文件中以不同的规则和指令来配置。为了完全关闭对端口 25（<literal>smtpd</literal> 服务）的认证，要添加后面的指令：

en: If for some reason clients use an outdated <literal>AUTH</literal> command (some very old mail clients do), interoperability with them can be enabled using the <literal>broken_sasl_auth_clients</literal> directive.
zh-CN: 如果由于一些原因，客户端使用了过期的 <literal>AUTH</literal> 命令（一些非常老的客户端会这样），那么可以使用 <literal>broken_sasl_auth_clients</literal> 指令来启用与它们的互操作性。

en: <emphasis>EXTRA</emphasis> Authenticated SMTP client
zh-CN: <emphasis>补充</emphasis> 认证的 SMTP 客户端

en: Most email clients are able to authenticate to an SMTP server before sending outgoing messages, and using that feature is a simple matter of configuring the appropriate parameters. If the client in use does not provide that feature, the workaround is to use a local Postfix server and configure it to relay email via the remote SMTP server. In this case, the local Postfix itself will be the client that authenticates with SASL. Here are the required parameters:
zh-CN: 多数电子邮件客户端能够在发送外发的消息前对 SMTP 服务器认证，对这个特性的使用不过是简单的配置适当参数的事。如果使用的客户端不提供这样的特性，那么变通方法是使用本地 Postfix 服务器，并配置它通过远程 SMTP 服务器来中继电子邮件。在这种情况下，本地 Postfix 本身将会是用 SASL 验证的客户端。这里是需要的参数：

en: The <filename>/etc/postfix/sasl_passwd</filename> file needs to contain the username and password to use for authenticating on the <literal>mail.falcot.com</literal> server. Here is an example:
zh-CN: <filename>/etc/postfix/sasl_passwd</filename> 文件需要包含用户名和密码，用于在 <literal>mail.falcot.com</literal> 服务器上验证。这里是示例：

en: As for all Postfix maps, this file must be turned into <filename>/etc/postfix/sasl_passwd.db</filename> with the <command>postmap</command> command.
zh-CN: 对于所有的 Postfix 映射，这个文件必须用 <command>postmap</command> 命令转换为 <filename>/etc/postfix/sasl_passwd.db</filename>。

en: Web Server (HTTP)
zh-CN: Web 服务器（HTTP）

en: <primary>server</primary><secondary>web</secondary>
zh-CN: <primary>服务器</primary><secondary>web</secondary>

en: <primary>web server</primary><seealso>Apache</seealso>
zh-CN: <primary>Web 服务器</primary><seealso>Apache</seealso>

en: <primary>server</primary><secondary>HTTP</secondary>
zh-CN: <primary>服务器</primary><secondary>HTTP</secondary>

en: <primary>HTTP</primary><secondary>server</secondary><seealso>Apache</seealso>
zh-CN: <primary>HTTP</primary><secondary>服务器</secondary><seealso>Apache</seealso>

en: <emphasis>ALTERNATIVE</emphasis> Other web servers
zh-CN: <emphasis>替代</emphasis> 其它 web 服务器

en: Installing Apache
zh-CN: 安装 Apache

en: Installing the <emphasis role="pkg">apache2</emphasis> package is all that is needed. It contains all the modules, including the <emphasis>Multi-Processing Modules</emphasis> (MPMs) that affect how Apache handles parallel processing of many requests, which used to be provided in separate <emphasis role="pkg">apache2-mpm-*</emphasis> packages. It will also pull <emphasis role="pkg">apache2-utils</emphasis> containing the command line utilities that we will discover later.
zh-CN: 所有需要的只是安装 <emphasis role="pkg">apache2</emphasis> 软件包。它包含所有的模块，包括 <emphasis>Multi-Processing Modules</emphasis> (MPMs) ，它影响 Apache 如何处理很多请求的并行处理，以前这在另外的 <emphasis role="pkg">apache2-mpm-*</emphasis> 软件包中提供。它还拉取 <emphasis role="pkg">apache2-utils</emphasis>，其中包含的命令行应用将在后面讨论。

en: The MPM in use affects significantly the way Apache will handle concurrent requests. With the <emphasis>worker</emphasis> MPM, it uses <emphasis>threads</emphasis> (lightweight processes), whereas with the <emphasis>prefork</emphasis> MPM it uses a pool of processes created in advance. With the <emphasis>event</emphasis> MPM it also uses threads, but the inactive connections (notably those kept open by the HTTP <emphasis>keep-alive</emphasis> feature) are handed back to a dedicated management thread.
zh-CN: 使用 MPM 显著地影响 Apache 处理并发请求的方式。通过 <emphasis>worker</emphasis> MPM，它使用 <emphasis>threads（线程）</emphasis>（轻量进程），而通过 <emphasis>prefork</emphasis> MPM，它使用预先创建的进程池。通过 <emphasis>event（事件）</emphasis> MPM，它也使用线程，但非活动连接（显著地由 HTTP <emphasis>keep-alive</emphasis> 特性保持打开的那些）交回给专用的管理线程。

en: <emphasis>SECURITY</emphasis> Execution under the <literal>www-data</literal> user
zh-CN: <emphasis>安全</emphasis> 在 <literal>www-data</literal> 用户下执行

en: <primary>Apache</primary><secondary><literal>www-data</literal>, user</secondary>
zh-CN: <primary>Apache</primary><secondary><literal>www-data</literal>，用户</secondary>

en: Using the <emphasis>suexec</emphasis> modules, provided by <emphasis role="pkg">apache2-suexec-*</emphasis> packages, allows bypassing this rule so that some CGI scripts are executed under the identity of another user. This is configured with a <literal>SuexecUserGroup <replaceable>user</replaceable><replaceable>group</replaceable></literal> directive in the Apache configuration.
zh-CN: 通过使用由 <emphasis role="pkg">apache2-suexec-*</emphasis> 软件包提供的 <emphasis>suexec</emphasis> 模块，允许避开这条规则，从而一些 CGI 脚本在其它用户的身份下执行。这由 Apache 配置中的 <literal>SuexecUserGroup <replaceable>user</replaceable><replaceable>group</replaceable></literal> 指令来配置。

en: Another possibility is to use a dedicated MPM, such as the one provided by <emphasis role="pkg">libapache2-mpm-itk</emphasis>. This particular one has a slightly different behavior: it allows “isolating” virtual hosts (actually, sets of pages) so that they each run as a different user. A vulnerability in one website therefore cannot compromise files belonging to the owner of another website.
zh-CN: 另一个可能性是使用专用的 MPM，如由 <emphasis role="pkg">libapache2-mpm-itk</emphasis> 提供的一个。特定的这个具有略微不同的行为：它允许 “隔离” 虚拟主机（实际上是一组页面），从而它们每次作为不同用户运行。这样，一个网站中的漏洞不能使属于另一个网站所有者的文件陷入危险。

en: <emphasis>QUICK LOOK</emphasis> List of modules
zh-CN: <emphasis>速览</emphasis> 模块的列表

en: Apache is a modular server, and many features are implemented by external modules that the main program loads during its initialization. The default configuration only enables the most common modules, but enabling new modules is a simple matter of running <command>a2enmod <replaceable>module</replaceable></command>; to disable a module, the command is <command>a2dismod <replaceable>module</replaceable></command>. These programs actually only create (or delete) symbolic links in <filename>/etc/apache2/mods-enabled/</filename>, pointing at the actual files (stored in <filename>/etc/apache2/mods-available/</filename>).
zh-CN: Apache 是模块化的服务器，而它的很多特性由主程序在初始化时装载的外部模块来实施。默认配置只启用最常用的模块，但启用新的模块不过是运行 <command>a2enmod <replaceable>module</replaceable></command>的简单事情；要禁止模块，命令是<command>a2dismod <replaceable>module</replaceable></command>。这些程序实际上只创建（或删除）<filename>/etc/apache2/mods-enabled/</filename>中的符号链接，它们指向真实文件（存储在 <filename>/etc/apache2/mods-available/</filename>中）。

en: <emphasis>IN PRACTICE</emphasis> Checking the configuration
zh-CN: <emphasis>实践</emphasis> 检查配置

en: The <literal>mod_info</literal> module (<command>a2enmod info</command>) allows to access the comprehensive Apache server configuration and information via browser visiting <literal>http://localhost/server-info</literal>. Because it might contain sensitive information, access is only allowed from the local host by default. <ulink type="block" url="https://httpd.apache.org/docs/2.4/mod/mod_info.html" />
zh-CN: <literal>mod_info</literal> 模块（<command>a2enmod info</command>）允许通过浏览器访问<literal>http://localhost/server-info</literal>，来访问所有的 Apache 服务器配置和信息。因为它会包含敏感信息，默认只允许来自本地主机的访问。<ulink type="block" url="https://httpd.apache.org/docs/2.4/mod/mod_info.html" />

en: With its default configuration, the web server listens on port 80 (as configured in <filename>/etc/apache2/ports.conf</filename>), and serves pages from the <filename>/var/www/html/</filename> directory (as configured in <filename>/etc/apache2/sites-enabled/000-default.conf</filename>).
zh-CN: 通过其默认设置，web 服务器监听端口 80 （如在 <filename>/etc/apache2/ports.conf</filename> 中所配置的），并且为来自 <filename>/var/www/html/</filename> 目录的页面提供服务（如在 <filename>/etc/apache2/sites-enabled/000-default.conf</filename>中所配置的）。

en: Adding support for SSL
zh-CN: 为 SSL 添加支持

en: Apache 2.4 includes the SSL module (<literal>mod_ssl</literal>) required for secure HTTP (HTTPS) out of the box. It just needs to be enabled with <command>a2enmod ssl</command>, then the required directives have to be added to the configuration files. A configuration example is provided in <filename>/etc/apache2/sites-available/default-ssl.conf</filename>. <ulink type="block" url="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html" />
zh-CN: Apache 2.4 包括用于保护开箱即用的 HTTP（HTTPS）所需的 SSL 模块（<literal>mod_ssl</literal>）。它只需要用 <command>a2enmod ssl</command> 来启用，然后所需的指令必须添加到配置文件中。配置示例提供在 <filename>/etc/apache2/sites-available/default-ssl.conf</filename> 中。<ulink type="block" url="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html" />

en: If you want to generate trusted certificates, you can follow section <xref linkend="sect.trusted-certs" /> and then adjust the following variables:
zh-CN: 如果想要生成受信任的证书，可以按照 <xref linkend="sect.trusted-certs" /> 这一节，然后调整后面的变量：

en: <primary><emphasis>Perfect Forward Secrecy</emphasis></primary>
zh-CN: <primary><emphasis>Perfect Forward Secrecy（完全正向保密）</emphasis></primary>

en: Configuring Virtual Hosts
zh-CN: 配置虚拟主机

en: A virtual host is an extra identity for the web server.
zh-CN: 虚拟主机是 web 服务器额外的身份。

en: <primary>virtual host</primary>
zh-CN: <primary>virtual host（虚拟主机）</primary>

en: Apache considers two different kinds of virtual hosts: those that are based on the IP address (or the port), and those that rely on the domain name of the web server. The first method requires allocating a different IP address (or port) for each site, whereas the second one can work on a single IP address (and port), and the sites are differentiated by the hostname sent by the HTTP client (which only works in version 1.1 of the HTTP protocol — fortunately that version is old enough that all clients use it already).
zh-CN: Apache 考虑两个不同种类的虚拟主机：基于 IP 地址（或端口）的那些，和依赖于 web 服务器域名的那些。第一种方法需要为每个网站分配不同的 IP 地址（或端口），而第二种可以工作在单一 IP 地址（或端口）上，并且网站由 HTTP 客户端发送的主机名来区分（只工作在 HTTP 协议的 1.1 版本下——幸运的是版本足够老，所有的客户端都已经使用了）。

en: The (increasing) scarcity of IPv4 addresses usually favors the second method; however, it is made more complex if the virtual hosts need to provide HTTPS too, since the SSL protocol hasn't always provided for name-based virtual hosting; the SNI extension (<emphasis>Server Name Indication</emphasis>) that allows such a combination is not handled by all browsers. When several HTTPS sites need to run on the same server, they will usually be differentiated either by running on a different port or on a different IP address (IPv6 can help there).
zh-CN: IPv4 地址（增加的）稀缺性通常偏爱第二种方法；然而虚拟主机也需要提供 HTTPS 的话会变得更复杂，因为 SSL 协议不总是为基于名称的虚拟主机而提供；允许这样组合的 SNI 扩展（<emphasis>Server Name Indication（服务器名称指示）</emphasis>）并不被所有浏览器处理。当几个 HTTPS 网站需要在相同的服务器上运行时，它们通常或者由在不同的端口上，或者在不同的 IP 地址上运行来区分（IPv6 在这里会有帮助）。

en: The default configuration for Apache 2 enables name-based virtual hosts. In addition, a default virtual host is defined in the <literal>/etc/apache2/sites-enabled/000-default.conf</literal> file; this virtual host will be used if no host matching the request sent by the client is found.
zh-CN: Apache 2 的默认配置启用基于名称的虚拟主机。此外，默认虚拟主机在 <literal>/etc/apache2/sites-enabled/000-default.conf</literal> 文件中定义；如果没有发现与客户端发送的请求相匹配的主机的话，这个虚拟主机将被使用。

en: <emphasis>CAUTION</emphasis> First virtual host
zh-CN: <emphasis>警告</emphasis> 第一虚拟主机

en: Requests concerning unknown virtual hosts will always be served by the first defined virtual host, which is why we defined <literal>www.falcot.com</literal> first here.
zh-CN: 关于未知虚拟主机的请求总是由首先定义的虚拟主机来服务，这就是为什么我们首先在这里定义 <literal>www.falcot.com</literal>。

en: <emphasis>QUICK LOOK</emphasis> Apache supports SNI
zh-CN: <emphasis>速览</emphasis> Apache 支持 SNI

en: The Apache server supports an SSL protocol extension called <emphasis>Server Name Indication</emphasis> (SNI). This extension allows the browser to send the hostname of the web server during the establishment of the SSL connection, much earlier than the HTTP request itself, which was previously used to identify the requested virtual host among those hosted on the same server (with the same IP address and port). This allows Apache to select the most appropriate SSL certificate for the transaction to proceed.
zh-CN: Apache 服务器支持 SSL 协议扩展，被称为 <emphasis>Server Name Indication（服务器名称指示）</emphasis> （SNI）。这个扩展允许在建立 SSL 连接的过程中浏览器发送 web 服务器的主机名，比 HTTP 请求本身早得多，这在之前用于识别以相同服务器（具有相同的地址和端口）作为主机的那些请求的虚拟主机。这允许 Apache 选择最适当的 SSL 证书来继续传输。

en: Before SNI, Apache would always use the certificate defined in the default virtual host. Clients trying to access another virtual host would then display warnings, since the certificate they received didn't match the website they were trying to access. Fortunately, most browsers now work with SNI; this includes Microsoft Internet Explorer starting with version 7.0 (starting on Vista), Mozilla Firefox starting with version 2.0, Apple Safari since version 3.2.1, and all versions of Google Chrome.
zh-CN: 在 SNI 之前，Apache 总是使用默认的虚拟主机中定义的证书。试图访问其它虚拟主机的客户端然后显示警告，因为它们接收到的证书与它们试图访问的网站不匹配。幸运的是，多数浏览器现在通过 SNI 来工作；这包括自 7.0 版本开始的微软 IE（从 Vista 开始）、从2.0 版本开始的 Mozilla Firefox和从 3.2.1 版本开始的苹果 Safari，以及所有版本的谷歌 Chrome。

en: The Apache package provided in Debian is built with support for SNI; no particular configuration is therefore needed.
zh-CN: Debian 中提供的 Apache 软件包建有对 SNI 的支持；这样，不需要特别的配置。

en: Each extra virtual host is then described by a file stored in <filename>/etc/apache2/sites-available/</filename>. Setting up a website for the <literal>falcot.org</literal> domain is therefore a simple matter of creating the following file, then enabling the virtual host with <command>a2ensite www.falcot.org</command>.
zh-CN: 每一个额外的虚拟主机都由 <filename>/etc/apache2/sites-available/</filename> 中存储的文件来描述。这样，为 <literal>falcot.org</literal> 域设置网站就是创建后面的文件，然后通过 <command>a2ensite www.falcot.org</command> 启用虚拟主机这样简单的事情。

en: The <filename>/etc/apache2/sites-available/www.falcot.org.conf</filename> file
zh-CN: <filename>/etc/apache2/sites-available/www.falcot.org.conf</filename> 文件

en: The Apache server, as configured so far, uses the same log files for all virtual hosts (although this could be changed by adding <literal>CustomLog</literal> directives in the definitions of the virtual hosts). It therefore makes good sense to customize the format of this log file to have it include the name of the virtual host. This can be done by creating a <filename>/etc/apache2/conf-available/customlog.conf</filename> file that defines a new format for all log files (with the <literal>LogFormat</literal> directive) and by enabling it with <command>a2enconf customlog</command>. The <literal>CustomLog</literal> line must also be removed (or commented out) from the <filename>/etc/apache2/sites-available/000-default.conf</filename> file.
zh-CN: 迄今为止配置的 Apache 服务器对所有虚拟主机使用了相同的日志文件（尽管可以通过在虚拟主机的定义中添加 <literal>CustomLog</literal> 指令来更改）。这样，很好理解去定制这个日志文件的格式来使它包含虚拟主机的名称。这可以通过创建为所有日志文件定义了新格式的 <filename>/etc/apache2/conf-available/customlog.conf</filename> 文件来进行，并通过 <command>a2enconf customlog</command> 来启用。还必须从 <filename>/etc/apache2/sites-available/000-default.conf</filename> 文件中删除（或注释掉） <literal>CustomLog</literal> 行。

en: The <filename>/etc/apache2/conf-available/customlog.conf</filename> file
zh-CN: <filename>/etc/apache2/conf-available/customlog.conf</filename> 文件

en: Common Directives
zh-CN: 常用指令

en: This section briefly reviews some of the commonly-used Apache configuration directives.
zh-CN: 这一节简要地回顾了一些通常使用的 Apache 配置指令。

en: <primary>directives, Apache</primary>
zh-CN: <primary>指令，Apache</primary>

en: <primary>Apache</primary><secondary>directives</secondary>
zh-CN: <primary>Apache</primary><secondary>指令</secondary>

en: The main configuration file usually includes several <literal>Directory</literal> blocks; they allow specifying different behaviors for the server depending on the location of the file being served. Such a block commonly includes <literal>Options</literal> and <literal>AllowOverride</literal> directives.
zh-CN: 主要配置文件通常包括几个 <literal>Directory（目录）</literal> 块；它们允许为依赖于所服务的文件的位置的服务器指定不同行为。这样的块通常包括 <literal>Options</literal> 和 <literal>AllowOverride</literal> 指令。

en: Directory block
zh-CN: 目录块

en: The <literal>DirectoryIndex</literal> directive contains a list of files to try when the client request matches a directory. The first existing file in the list is used and sent as a response.
zh-CN: <literal>DirectoryIndex</literal> 指令包含当客户端请求匹配目录时尝试的文件列表。列表中存在的第一个文件被使用，并作为响应来发送。

en: The <literal>Options</literal> directive is followed by a list of options to enable. The <literal>None</literal> value disables all options; correspondingly, <literal>All</literal> enables them all except <literal>MultiViews</literal>. Available options include:
zh-CN: <literal>Options</literal> 指令后面是被启用的选项列表。<literal>None</literal> 值禁止了所有的选项；相应地，<literal>All</literal> 全部启用它们，除了<literal>MultiViews</literal>。可用选项包括：

en: <literal>ExecCGI</literal> indicates that CGI scripts can be executed.
zh-CN: <literal>ExecCGI</literal> 指示可以执行 CGI 脚本。

en: <literal>FollowSymlinks</literal> tells the server that symbolic links can be followed, and that the response should contain the contents of the target of such links.
zh-CN: <literal>FollowSymlinks</literal> 告诉服务器可以跟随符号链接，并且响应应该包含这个链接目标的内容。

en: <literal>Includes</literal> enables <emphasis>Server Side Includes</emphasis> (<emphasis>SSI</emphasis> for short). These are directives embedded in HTML pages and executed on the fly for each request.
zh-CN: <literal>Includes</literal> 启用 <emphasis>Server Side Includes（服务器一侧包含）</emphasis>（缩写为 <emphasis>SSI</emphasis>）。这些指令嵌入 HTML 页面中，并对每个请求动态执行。

en: <literal>IncludesNOEXEC</literal> allows <emphasis>Server Side Includes</emphasis> (<emphasis>SSI</emphasis>) but disables the <literal>exec</literal> command and limits the <literal>include</literal> directive to text/markup files.
zh-CN: <literal>IncludesNOEXEC</literal> 允许 <emphasis>Server Side Includes（服务器一侧执行）</emphasis>（缩写为 <emphasis>SSI</emphasis>），但禁止 <literal>exec</literal> 命令并对文本/标记文件限制 <literal>include</literal> 指令。

en: <literal>Indexes</literal> tells the server to list the contents of a directory if the HTTP request sent by the client points at a directory without an index file (i.e., when no files mentioned by the <literal>DirectoryIndex</literal> directive exists in this directory).
zh-CN: <literal>Indexes</literal> 告诉服务器如果由客户端发送的 HTTP 请求指向没有索引文件的目录（也就是<literal>DirectoryIndex</literal> 指令提到的文件不存在于这个目录中时），那么列出目录的内容。

en: <literal>MultiViews</literal> enables content negotiation; this can be used by the server to return a web page matching the preferred language as configured in the browser.
zh-CN: <literal>MultiViews</literal> 启用了内容协商；这可以被服务器使用，来返回与浏览器中配置的所需语言相匹配的 web 页面。

en: <emphasis>BACK TO BASICS</emphasis> <filename>.htaccess</filename> file
zh-CN: <emphasis>基本知识</emphasis> <filename>.htaccess</filename> 文件

en: The <filename>.htaccess</filename> file contains Apache configuration directives enforced each time a request concerns an element of the directory where it is stored. The scope of these directives also recurses to all the subdirectories within.
zh-CN: <filename>.htaccess</filename> 文件包含 Apache 配置指令，每次请求涉及其所存储的目录中的元素时会强制执行配置指令。这些指令的范围还递归到其中所有的子目录。

en: Most of the directives that can occur in a <literal>Directory</literal> block are also legal in a <filename>.htaccess</filename> file.
zh-CN: 在 <literal>Directory</literal> 块中能够发生的多数指令在 <filename>.htaccess</filename> 文件中也是合法的。

en: The <literal>AllowOverride</literal> directive lists all the options that can be enabled or disabled by way of a <filename>.htaccess</filename> file. A common use of this option is to restrict <literal>ExecCGI</literal>, so that the administrator chooses which users are allowed to run programs under the web server's identity (the <literal>www-data</literal> user).
zh-CN: <literal>AllowOverride</literal> 指令列出可以由 <filename>.htaccess</filename> 文件的方式启用或禁止的所有选项。这个选项通常用于限制 <literal>ExecCGI</literal>，从而管理员选择哪些用户在 web 服务器身份（<literal>www-data</literal> 用户）下允许运行程序。

en: Requiring Authentication
zh-CN: 需要身份认证

en: <primary>web authentication</primary>
zh-CN: <primary>web 认证</primary>

en: <primary>Apache</primary><secondary>password-based authentication</secondary>
zh-CN: <primary>Apache</primary><secondary>基于密码的认证</secondary>

en: <filename>.htaccess</filename> file requiring authentication
zh-CN: <filename>.htaccess</filename> 文件需要授权

en: <emphasis>SECURITY</emphasis> No security
zh-CN: <emphasis>安全</emphasis> 无安全问题

en: The authentication system used in the above example (<literal>Basic</literal>) has minimal security as the password is sent in clear text (it is only encoded as <emphasis>base64</emphasis>, which is a simple encoding rather than an encryption method). It should also be noted that the documents “protected” by this mechanism also go over the network in the clear. If security is important, the whole HTTP connection should be encrypted with SSL.
zh-CN: 上面的示例中使用的认证系统（<literal>Basic</literal>）具有最低的安全性，因为密码以明文发送（只加密为<emphasis>base64</emphasis>，这只是简单的编码而不是加密方法）。还应该注意，由这种机制“保护”的文件在网络上同样清楚地交流。如果安全性是重要的，那么整个 HTTP 连接应该由 SSL 加密。

en: The <filename>/etc/apache2/authfiles/htpasswd-private</filename> file contains a list of users and passwords; it is commonly manipulated with the <command>htpasswd</command> command. For example, the following command is used to add a user or change their password:
zh-CN: <filename>/etc/apache2/authfiles/htpasswd-private</filename> 文件包含用户和密码的列表；它通常由 <command>htpasswd</command> 命令来操作。例如后面的命令用于添加用户或更改他们的密码：

en: Restricting Access
zh-CN: 限制访问

en: <primary>web access restriction</primary>
zh-CN: <primary>web 访问限制</primary>

en: <primary>Apache</primary><secondary>IP-based authentication</secondary>
zh-CN: <primary>Apache</primary><secondary>基于 IP 的认证</secondary>

en: The <literal>Require</literal> directive controls access restrictions for a directory (and its subdirectories, recursively). <ulink type="block" url="https://httpd.apache.org/docs/2.4/howto/access.html" />
zh-CN: <literal>Require</literal> 指令控制对目录（递归地，及其子目录）的访问限制。<ulink type="block" url="https://httpd.apache.org/docs/2.4/howto/access.html" />

en: It can be used to restrict access based on many criteria; we will stop at describing access restriction based on the IP address of the client, but it can be made much more powerful than that, especially when several <literal>Require</literal> directives are combined within a <literal>RequireAll</literal> block.
zh-CN: 它可以基于很多标准用来限制访问；我们会停在描述根据客户端的 IP 地址来限制访问上，但它的功能比这个更强大，特别是在 <literal>RequireAll</literal> 块中组合几个 <literal>Require</literal> 指令的时候。

en: Only allow from the local network
zh-CN: 只允许来自本地网络

en: Require ip 192.168.0.0/16
zh-CN: 需要 ip 192.168.0.0/16

en: <emphasis>ALTERNATIVE</emphasis> Old syntax
zh-CN: <emphasis>替代</emphasis> 旧的语法

en: The <literal>Require</literal> syntax is only available in Apache 2.4 (the version shipped since <emphasis role="distribution">Jessie</emphasis>). For users of <emphasis role="distribution">Wheezy</emphasis>, the Apache 2.2 syntax is different, and we describe it here mainly for reference, although it can also be made available in Apache 2.4 using the <literal>mod_access_compat</literal> module.
zh-CN: <literal>Require</literal> 语法只在 Apache 2.4 中可用（从 <emphasis role="distribution">Jessie</emphasis> 开始上市的版本）。对于 <emphasis role="distribution">Wheezy</emphasis> 的用户， Apache 2.2 的语法不同，我们在这里描述主要用于参考，尽管可以使用 <literal>mod_access_compat</literal> 模块在 Apache 2.4 中得到。

en: The <literal>Allow from</literal> and <literal>Deny from</literal> directives control access restrictions for a directory (and its subdirectories, recursively).
zh-CN: <literal>Allow from</literal> 和 <literal>Deny from</literal> 指令控制对目录（及其子目录，递归地）的访问限制。

en: The <literal>Order</literal> directive tells the server of the order in which the <literal>Allow from</literal> and <literal>Deny from</literal> directives are applied; the last one that matches takes precedence. In concrete terms, <literal>Order deny,allow</literal> allows access if no <literal>Deny from</literal> applies, or if an <literal>Allow from</literal> directive does. Conversely, <literal>Order allow,deny</literal> rejects access if no <literal>Allow from</literal> directive matches (or if a <literal>Deny from</literal> directive applies).
zh-CN: <literal>Order</literal> 指令告诉服务器 <literal>Allow from</literal> 和 <literal>Deny from</literal> 指令应用的顺序；匹配的最后一个获得优先权。具体来说，如果不应用 <literal>Deny from</literal> 的话，或者如果 <literal>Allow from</literal> 指令执行的话，则 <literal>Order deny,allow</literal> 允许访问。相反，如果 <literal>Allow from</literal> 指令不匹配（或者如果应用 <literal>Deny from</literal> 指令），那么<literal>Order allow,deny</literal> 拒绝访问。

en: The <literal>Allow from</literal> and <literal>Deny from</literal> directives can be followed by an IP address, a network (such as <literal>192.168.0.0/255.255.255.0</literal>, <literal>192.168.0.0/24</literal> or even <literal>192.168.0</literal>), a hostname or a domain name, or the <literal>all</literal> keyword, designating everyone.
zh-CN: <literal>Allow from</literal> 和 <literal>Deny from</literal> 指令可以在后面跟 IP 地址、网络（如 <literal>192.168.0.0/255.255.255.0</literal>、<literal>192.168.0.0/24</literal> 或者甚至 <literal>192.168.0</literal>）、主机名或域名、或者 <literal>all</literal> 关键字来指定每个人。

en: For instance, to reject connections by default but allow them from the local network, you could use this:
zh-CN: 例如，要默认拒绝连接但允许连接来自本地网络的链接，可以使用这个：

en: Log Analyzers
zh-CN: 日志分析程序

en: A log analyzer is frequently installed on a web server; since the former provides the administrators with a precise idea of the usage patterns of the latter.
zh-CN: 日志分析程序频繁地安装在 web 服务器上；因为前者为管理员提供了后者使用方式的精确概念。

en: The Falcot Corp administrators selected <emphasis>AWStats</emphasis> (<emphasis>Advanced Web Statistics</emphasis>) to analyze their Apache log files.
zh-CN: Falcot 公司的管理员选择 <emphasis>AWStats</emphasis>（<emphasis>Advanced Web Statistics</emphasis>）来分析他们的 Apache 日志文件。

en: <primary>web logs analyzer</primary>
zh-CN: <primary>web 日志分析程序</primary>

en: <primary>Apache</primary><secondary>log analyzer</secondary>
zh-CN: <primary>Apache</primary><secondary>日志分析程序</secondary>

en: The first configuration step is the customization of the <filename>/etc/awstats/awstats.conf</filename> file. The Falcot administrators keep it unchanged apart from the following parameters:
zh-CN: 第一个配置步骤是定制 <filename>/etc/awstats/awstats.conf</filename> 文件。Falcot 公司的管理员只更改后面的参数，而保持其它不变：

en: All these parameters are documented by comments in the template file. In particular, the <varname>LogFile</varname> and <varname>LogFormat</varname> parameters describe the location and format of the log file and the information it contains; <varname>SiteDomain</varname> and <varname>HostAliases</varname> list the various names under which the main web site is known.
zh-CN: 所有这些参数由模板文件中的注释来存档。特别是，<varname>LogFile</varname> 和 <varname>LogFormat</varname> 参数描述了日志文件以及其包含的信息；<varname>SiteDomain</varname> 和 <varname>HostAliases</varname> 列出了获知主网站的各个名称。

en: For high traffic sites, <varname>DNSLookup</varname> should usually not be set to <literal>1</literal>; for smaller sites, such as the Falcot one described above, this setting allows getting more readable reports that include full machine names instead of raw IP addresses.
zh-CN: 对于高流量网站，<varname>DNSLookup</varname> 通常应该不设置为 <literal>1</literal>；对于较小的网站，如上面描述的 Falcot 公司的网站，这个设置允许得到可读性更好的报告，它除了包括原始 IP 地址，还包括全部的机器名称。

en: <emphasis>SECURITY</emphasis> Access to statistics
zh-CN: <emphasis>安全</emphasis> 对统计数据的访问

en: AWStats makes its statistics available on the website with no restrictions by default, but restrictions can be set up so that only a few (probably internal) IP addresses can access them; the list of allowed IP addresses needs to be defined in the <varname>AllowAccessFromWebToFollowingIPAddresses</varname> parameter
zh-CN: AWStats 默认使其统计数据在网络上可被获取而不被限制，但限制可以被设置，从而只有很少的（可能是内部的） IP 地址可以访问它们；允许的 IP 地址列表需要在 <varname>AllowAccessFromWebToFollowingIPAddresses</varname> 参数中确定

en: AWStats will also be enabled for other virtual hosts; each virtual host needs its own configuration file, such as <filename>/etc/awstats/awstats.www.falcot.org.conf</filename>.
zh-CN: AWStats 还启用其它虚拟主机；每台虚拟主机需要自己的配置文件，如<filename>/etc/awstats/awstats.www.falcot.org.conf</filename>。

en: AWStats configuration file for a virtual host
zh-CN: 用于虚拟主机的 AWStats 配置文件

en: After a few minutes (and once the script has been run a few times), the results are available online: <ulink type="block" url="http://www.falcot.com/cgi-bin/awstats.pl" /><ulink type="block" url="http://www.falcot.org/cgi-bin/awstats.pl" />
zh-CN: 几分钟后（并且一旦脚本运行了几次），结果会在线可用：<ulink type="block" url="http://www.falcot.com/cgi-bin/awstats.pl" /><ulink type="block" url="http://www.falcot.org/cgi-bin/awstats.pl" />

en: <emphasis>CAUTION</emphasis> Log file rotation
zh-CN: <emphasis>警告</emphasis> 日志文件轮替

en: FTP File Server
zh-CN: FTP文件服务器

en: <primary>FTP</primary><see>File Transfer Protocol</see>
zh-CN: <primary>FTP</primary><see>文件传输协议</see>

en: <primary>File Transfer Protocol</primary>
zh-CN: <primary>文件传输协议</primary>

en: <primary>server</primary><secondary>file</secondary>
zh-CN: <primary>服务器</primary><secondary>文件</secondary>

en: <primary>server</primary><secondary>FTP</secondary>
zh-CN: <primary>服务器</primary><secondary>FTP</secondary>

en: FTP (<emphasis>File Transfer Protocol</emphasis>) is one of the first protocols of the Internet (RFC 959 was issued in 1985!). It was used to distribute files before the Web was even born (the HTTP protocol was created in 1990, and formally defined in its 1.0 version by RFC 1945, issued in 1996).
zh-CN: FTP （<emphasis>File Transfer Protocol——文件传输协议</emphasis>）是因特网的第一批协议之一。（RFC 959 在 1985 年发行！）甚至在 Web 诞生之前就用于分发文件（HTTP 协议创建于 1990年，并由 RFC 1945 正式在其 1.0 版本中定义，在 1996 年发行）。

en: Other FTP servers are mainly used to distribute files for public downloading; Debian packages are a good example. The contents of these servers is fetched from other, geographically remote, servers; it is then made available to less distant users. This means that client authentication is not required; as a consequence, this operating mode is known as “anonymous FTP”. To be perfectly correct, the clients do authenticate with the <literal>anonymous</literal> username; the password is often, by convention, the user's email address, but the server ignores it.
zh-CN: 其它 FTP 服务器主要用于发布文件供公众下载；Debian 软件包就是个好的示例。这些服务器的内容取自其它地理上的远程服务器；然后供不那么远的用户来获取。这意味着不需要客户端认证；结果，这个操作模式被称为“匿名 FTP”。非常正确的是，客户端以 用户名 <literal>anonymous</literal>来认证；密码为了方便起见通常是用户的电子邮件地址，但服务器会忽略掉。

en: Installing the package creates an <literal>ftp</literal> system user. This account is always used for anonymous FTP connections, and its home directory (<filename>/srv/ftp/</filename>) is the root of the tree made available to users connecting to this service. The default configuration (in <filename>/etc/vsftpd.conf</filename>) requires some changes to cater to the simple need of making big files available for public downloads: anonymous access needs to be enabled (<literal>anonymous_enable=YES</literal>) and read-only access of local users needs to be disabled (<literal>local_enable=NO</literal>). The latter is particularly important since the FTP protocol doesn't use any form of encryption and the user password could be intercepted over the wire.
zh-CN: 安装软件包会创建 <literal>ftp</literal> 系统用户。这个账户总是用于匿名 FTP 连接，并且其家目录（<filename>/srv/ftp/</filename>）就是连接到这个服务上的用户可使用的树的根。默认配置（在 <filename>/etc/vsftpd.conf</filename> 中）需要一些更改，以迎合使大文件可供公众下载的简单需要：匿名王文需要启用（<literal>anonymous_enable=YES</literal>）并且对本地用户的只读访问需要被禁止（<literal>local_enable=NO</literal>）。后者非常重要，因为 FTP 协议不使用任何形式的加密，并且用户密码能够通过网络来翻译。

en: NFS File Server
zh-CN: NFS 文件服务器

en: <primary>server</primary><secondary>NFS</secondary>
zh-CN: <primary>服务器</primary><secondary>NFS</secondary>

en: NFS (<emphasis>Network File System</emphasis>) is a protocol allowing remote access to a filesystem through the network. All Unix systems can work with this protocol.
zh-CN: NFS （<emphasis>Network File System——网络文件系统</emphasis>）是允许通过网络远程访问文件系统的协议。所有的 Unix 系统可以通过这个协议工作。

en: <emphasis>SPECIFIC CASE</emphasis> Microsoft Windows and NFS Shares
zh-CN: <emphasis>特例</emphasis> Microsoft Windows 和 NFS 共享

en: When older or (so called) "Home" variants of Windows are involved, usually Samba (<xref linkend="sect.windows-file-server-with-samba" />) must be used instead of NFS. Modern Windows Server and "Pro" or "Enterprise" Desktop solutions however have built-in support for NFS. After installation of the "Services for NFS" components NFS shares can be accessed and temporarily or permanently mounted like any other network share. Be aware of possible encoding issues in file names.
zh-CN: 当包括 Windows 较老的或（所谓的）“家庭版”变体时，通常必须使用 Samba (<xref linkend="sect.windows-file-server-with-samba" />) 而不是 NFS。然而现代的 Windows Server 和“专业版”或“企业版”桌面方案具有对 NFS 内建的支持。在安装“NFS 服务”组件后，可以访问 NFS 共享，并且像任何其它网络共享一样临时或永久挂载。要注意文件名中可能的编码问题。

en: <primary>Network File System</primary><secondary>Windows client</secondary>
zh-CN: <primary>网络文件系统</primary><secondary>Windows 客户端</secondary>

en: <primary>filesystem</primary><secondary>network</secondary>
zh-CN: <primary>文件系统</primary><secondary>网络</secondary>

en: <primary>file</primary><secondary>server</secondary>
zh-CN: <primary>文件</primary><secondary>服务器</secondary>

en: NFS is a very useful tool but, historically, it has suffered from many limitations, most of which have been addressed with version 4 of the protocol. The downside is that the latest version of NFS is harder to configure when you want to make use of basic security features such as authentication and encryption since it relies on Kerberos for those parts. And without those, the NFS protocol must be restricted to a trusted local network since data goes over the network unencrypted (a <emphasis>sniffer</emphasis> can intercept it) and access rights are granted based on the client's IP address (which can be spoofed).
zh-CN: NFS 是非常有用的工具，但历史上它受到了很多限制，多数限制已经在第 4 版协议中处理了。缺点是当使用基本的安全特性如认证和加密时，最新版的 NFS 难于配置，因为它对那些部分依赖于 Kerboreos。没有的话，NFS 协议必须限制为受信任的本地网络，因为数据在网络上不加密（<emphasis>嗅探程序</emphasis>可以拦截到）地传递，并且基于客户端的 IP 地址（可以被欺骗）来授予访问权限。

en: <emphasis>DOCUMENTATION</emphasis> NFS HOWTO
zh-CN: <emphasis>文档</emphasis> NFS HOWTO

en: Good documentation to deploy NFSv4 is rather scarce. Here are some pointers with content of varying quality but that should at least give some hints on what should be done. <ulink type="block" url="https://help.ubuntu.com/community/NFSv4Howto" /> <ulink type="block" url="https://wiki.linux-nfs.org/wiki/index.php/Nfsv4_configuration" />
zh-CN: 部署 NFSv4 的良好文档非常缺乏。这里是内容质量各异的一些要点，但至少对应该做什么有一些提示。<ulink type="block" url="https://help.ubuntu.com/community/NFSv4Howto" /> <ulink type="block" url="https://wiki.linux-nfs.org/wiki/index.php/Nfsv4_configuration" />

en: Securing NFS
zh-CN: 使 NFS 安全

en: <primary>NFS</primary><secondary>security</secondary>
zh-CN: <primary>NFS</primary><secondary>安全</secondary>

en: If you don't use the Kerberos-based security features, it is vital to ensure that only the machines allowed to use NFS can connect to the various required RPC servers, because the basic protocol trusts the data received from the network. The firewall must also block <emphasis>IP spoofing</emphasis> so as to prevent an outside machine from acting as an inside one, and access to the appropriate ports must be restricted to the machines meant to access the NFS shares.
zh-CN: 如果不使用基于 Kerberos 的安全特性，那么确保只允许使用 NFS 的机器可以连接到各种所需的 RPC 服务器上是至关重要的，因为基本协议信任从网络接收到的数据。防火墙也必需阻挡 <emphasis>IP 嗅探</emphasis>，从而防止外部机器作为内部的机器工作，并且对适当端口的访问必须被限制给有意访问 NFS 共享的机器。

en: <emphasis>BACK TO BASICS</emphasis> RPC
zh-CN: <emphasis>基本知识</emphasis> RPC

en: RPC (<emphasis>Remote Procedure Call</emphasis>) is a Unix standard for remote services. NFS is one such service.
zh-CN: RPC（<emphasis>Remote Procedure Call——远程过程调用</emphasis>）是用于远程服务的 Unix 标准。NFS 是一种这样的服务。

en: RPC services register to a directory known as the <emphasis>portmapper</emphasis>. A client wishing to perform an NFS query first addresses the <emphasis>portmapper</emphasis> (on port 111, either TCP or UDP), and asks for the NFS server; the reply usually mentions port 2049 (the default for NFS). Not all RPC services necessarily use a fixed port.
zh-CN: RPC 服务注册到一个被称为 <emphasis>portmapper</emphasis> 的目录。想要执行 NFS 查询的客户端首先处理 <emphasis>portmapper</emphasis>（在端口 111，TCP 或 UDP），并查询 NFS 服务器；回复通常提到端口 2049 (NFS 默认的）。不是所有的 RPC 服务有必要使用固定的端口。

en: Older versions of the protocol required other RPC services which used dynamically assigned ports. Fortunately, with NFS version 4, only port 2049 (for NFS) and 111 (for the portmapper) are needed and they are thus easy to firewall.
zh-CN: 较老版本的协议需要其它动态指定端口的 RPC 服务。幸运的是通过第 4 版的NFS，只需要端口 2049 （用于 NFS）和 111 （用于 portmapper），这样对于防火墙很容易处理。

en: NFS Server
zh-CN: NFS 服务器

en: <primary>NFS</primary><secondary>server</secondary>
zh-CN: <primary>NFS</primary><secondary>服务器</secondary>

en: The NFS server is part of the Linux kernel; in kernels provided by Debian it is built as a kernel module. If the NFS server is to be run automatically on boot, the <emphasis role="pkg">nfs-kernel-server</emphasis> package should be installed; it contains the relevant start-up scripts.
zh-CN: NFS 服务器是 Linux 内核的一部分；在 Debian 提供的内核中，它构建为内核模块。如果 NFS 服务器在引导时自动运行，那么应该安装 <emphasis role="pkg">nfs-kernel-server</emphasis> 软件包；它包含相关的启动脚本。

en: Note that with NFSv4, all exported directories must be part of a single hierarchy and that the root directory of that hierarchy must be exported and identified with the option <literal>fsid=0</literal> or <literal>fsid=root</literal>.
zh-CN: 注意，通过 NFSv4，所有的导出目录必须是单一层次结构的一部分，并且层次结构的根目录必须被导出，并用选项<literal>fsid=0</literal> 或 <literal>fsid=root</literal> 来识别。

en: Each machine can be identified either by its DNS name or its IP address. Whole sets of machines can also be specified using either a syntax such as <literal>*.falcot.com</literal> or an IP address range such as <literal>192.168.0.0/255.255.255.0</literal> or <literal>192.168.0.0/24</literal>.
zh-CN: 每台机器可以由其 DNS 名称或其 IP 地址来识别。整组的机器也可以使用如 <literal>*.falcot.com</literal> 这样的语法，或如 <literal>192.168.0.0/255.255.255.0</literal> 或 <literal>192.168.0.0/24</literal> 这样的 IP 地址来指定。

en: Directories are made available as read-only by default (or with the <literal>ro</literal> option). The <literal>rw</literal> option allows read-write access. NFS clients typically connect from a port restricted to root (in other words, below 1024); this restriction can be lifted by the <literal>insecure</literal> option (the <literal>secure</literal> option is implicit, but it can be made explicit if needed for clarity).
zh-CN: 目录默认（或者通过 <literal>ro</literal> 选项）作为只读可用。 <literal>rw</literal> 选项允许读写访问。NFS 客户端典型地从限制为 root 的端口连接（换句话说，低于 1024）；这个限制可以由 <literal>insecure</literal> 选项提升（<literal>secure</literal> 选项是隐性的，但如果需要清晰的话可以显性）。

en: <primary>NFS</primary><secondary>options</secondary>
zh-CN: <primary>NFS</primary><secondary>选项</secondary>

en: By default, the server only answers an NFS query when the current disk operation is complete (<literal>sync</literal> option); this can be disabled with the <literal>async</literal> option. Asynchronous writes increase performance a bit, but they decrease reliability since there is a data loss risk in case of the server crashing between the acknowledgment of the write and the actual write on disk. Since the default value changed recently (as compared to the historical value of NFS), an explicit setting is recommended.
zh-CN: 在当前磁盘操作完成时（<literal>sync</literal> 选项），服务器默认只回答 NFS 查询；这可以通过 <literal>async</literal>选项来禁止。异步写入提高了一点性能，但降低了可靠性，因为在通知写入与真实写到磁盘上之间在服务器崩溃的情况下，存在数据丢失的风险。由于最近更改的默认值（与 NFS 的历史值相比），推荐显性的设置。

en: In order to not give root access to the filesystem to any NFS client, all queries appearing to come from a root user are considered by the server as coming from the <literal>nobody</literal> user. This behavior corresponds to the <literal>root_squash</literal> option, and is enabled by default. The <literal>no_root_squash</literal> option, which disables this behavior, is risky and should only be used in controlled environments. If all users should be mapped to the user <literal>nobody</literal>, use <literal>all_squash</literal>. The <literal>anonuid=<replaceable>uid</replaceable></literal> and <literal>anongid=<replaceable>gid</replaceable></literal> options allow specifying another fake user to be used instead of UID/GID 65534 (which corresponds to user <literal>nobody</literal> and group <literal>nogroup</literal>).
zh-CN: 为了避免给予 NFS 客户端对文件系统的根访问权限，看起来来自根用户的所有查询都被服务器认为是来自 <literal>nobody</literal> 用户。这个行为符合 <literal>root_squash</literal> 选项，并且默认启用。禁止这个行为的 <literal>no_root_squash</literal> 选项是有风险的，并且应该只在受控的环境下使用。如果所有用户应该被映射到 <literal>nobody</literal> 用户上，那么使用 <literal>all_squash</literal>。<literal>anonuid=<replaceable>uid</replaceable></literal> 和 <literal>anongid=<replaceable>gid</replaceable></literal> 选项允许指定另一个伪用户来使用，取代 UID/GID 65534 （这符合<literal>nobody</literal> 用户和 <literal>nogroup</literal> 组）。

en: With NFSv4, you can add a <literal>sec</literal> option to indicate the security level that you want: <literal>sec=sys</literal> is the default with no special security features, <literal>sec=krb5</literal> enables authentication only, <literal>sec=krb5i</literal> adds integrity protection, and <literal>sec=krb5p</literal> is the most complete level which includes privacy protection (with data encryption). For this to work you need a working Kerberos setup (that service is not covered by this book).
zh-CN: 通过 NFSv4，可以添加 <literal>sec</literal> 选项来指定想要的安全等级：<literal>sec=sys</literal> 是默认的，没有特定的安全特性，<literal>sec=krb5</literal> 只启用认证，<literal>sec=krb5i</literal> 添加了整体保护，而 <literal>sec=krb5p</literal> 是最完全的等级，包括隐私保护（带有数据加密）。为了让它工作，需要进行 Kerberos 设置（那个服务不包括在本书的范围内）。

en: Other options are available; they are documented in the <citerefentry><refentrytitle>exports</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page.
zh-CN: 还有其它选项可用；它们归档在 <citerefentry><refentrytitle>exports</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册页面中。

en: <emphasis>CAUTION</emphasis> First installation
zh-CN: <emphasis>警告</emphasis> 第一次安装

en: NFS Client
zh-CN: NFS 客户端

en: <primary>client</primary><secondary>NFS</secondary>
zh-CN: <primary>客户端</primary><secondary>NFS</secondary>

en: <primary>NFS</primary><secondary>client</secondary>
zh-CN: <primary>NFS</primary><secondary>客户端</secondary>

en: Manually mounting with the <command>mount</command> command
zh-CN: 用 <command>mount</command> 命令来手动挂载

en: NFS entry in the <filename>/etc/fstab</filename> file
zh-CN: 在 <filename>/etc/fstab</filename> 文件中的 NFS 入口

en: The entry described above mounts, at system startup, the NFS directory <filename>/shared/</filename> from the <literal>arrakis</literal> server into the local <filename>/srv/shared/</filename> directory. Read-write access is requested (hence the <literal>rw</literal> parameter). The <literal>nosuid</literal> option is a protection measure that wipes any <literal>setuid</literal> or <literal>setgid</literal> bit from programs stored on the share. If the NFS share is only meant to store documents, another recommended option is <literal>noexec</literal>, which prevents executing programs stored on the share. Note that on the server, the <filename>shared</filename> directory is below the NFSv4 root export (for example <filename>/export/shared</filename>), it is not a top-level directory.
zh-CN: 上面描述的入口在系统启动时将 NFS 目录 <filename>/shared/</filename> 从 <literal>arrakis</literal> 服务器挂载到本地 <filename>/srv/shared/</filename> 目录中。这会需要读写访问（这样需要 <literal>rw</literal> 参数）。<literal>nosuid</literal> 选项是保护措施，从共享上存储的程序中擦除了任何 <literal>setuid</literal> 或 <literal>setgid</literal> 位。如果 NFS 共享只意味着存储文档，那么另一个推荐的选项是 <literal>noexec</literal>，它防止执行共享上存储的程序。注意，在服务器上 <filename>shared</filename> 目录在 NFSv4 root export 之下（例如 <filename>/export/shared</filename>），它不是顶层目录。

en: The <citerefentry><refentrytitle>nfs</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page describes all the options in some detail.
zh-CN: <citerefentry><refentrytitle>nfs</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册页面在某种程度上具体地描述了所有的选项。

en: Setting Up Windows Shares with Samba
zh-CN: 用 Samba 设置 Windows 共享

en: <primary>Windows share</primary>
zh-CN: <primary>Windows 共享</primary>

en: <primary>server</primary><secondary>SMB</secondary>
zh-CN: <primary>服务器</primary><secondary>SMB</secondary>

en: <primary>server</primary><secondary>CIFS</secondary>
zh-CN: <primary>服务器</primary><secondary>CIFS</secondary>

en: Samba is a suite of tools handling the SMB protocol (also known as “CIFS”) on Linux. This protocol is used by Windows for network shares and shared printers.
zh-CN: Samba 是 Linux 上处理 SMB 协议的一套工具（也被称为“CIFS”）。这个协议由 Windows 使用用于网络共享和共享打印机。

en: Samba can also act as a Windows domain controller. This is an outstanding tool for ensuring seamless integration of Linux servers and the office desktop machines still running Windows.
zh-CN: Samba 还可以用作 Windows 域控制器。这是一种出众的工具，来确保无缝整合 Linux 服务器和仍然运行 Windows 的办公桌面机器。

en: Samba Server
zh-CN: Samba 服务器

en: <primary>server</primary><secondary>Samba</secondary>
zh-CN: <primary>服务器</primary><secondary>Samba</secondary>

en: <primary>Samba</primary><secondary>installation</secondary>
zh-CN: <primary>Samba</primary><secondary>安装</secondary>

en: <primary>Samba</primary><secondary>server</secondary>
zh-CN: <primary>Samba</primary><secondary>服务器</secondary>

en: The <emphasis role="pkg">samba</emphasis> package contains the main two servers of Samba 4, <command>smbd</command> and <command>nmbd</command>.
zh-CN: <emphasis role="pkg">samba</emphasis> 软件包包括 Samba 4 的两个主要服务器，<command>smbd</command> 和 <command>nmbd</command>。

en: <emphasis>DOCUMENTATION</emphasis> Going further
zh-CN: <emphasis>文档</emphasis> 进阶阅读

en: <primary>domain controller</primary>
zh-CN: <primary>域控制器</primary>

en: <primary>Windows domain</primary>
zh-CN: <primary>Windows 域</primary>

en: <primary>Samba</primary><secondary>domain controller</secondary>
zh-CN: <primary>Samba</primary><secondary>域控制器</secondary>

en: The <emphasis role="pkg">samba</emphasis> package contains all the necessary manual pages and in <filename>/usr/share/doc/samba/examples/</filename> a wealth of commented example files. If you are looking for a more comprehensive documentation, you may check the <emphasis>Samba</emphasis> website. <ulink type="block" url="https://www.samba.org/samba/docs/" />
zh-CN: <emphasis role="pkg">samba</emphasis> 软件包包括所有必须的手册页面，并在 <filename>/usr/share/doc/samba/examples/</filename> 中包含丰富的带有注释的示例文件。如果要查找更详细的文档，可以查看 <emphasis>Samba</emphasis> 网站。<ulink type="block" url="https://www.samba.org/samba/docs/" />

en: <emphasis>TOOL</emphasis> Authenticating with a Windows Server
zh-CN: <emphasis>工具</emphasis> 使用 Windows Server 认证

en: Winbind gives system administrators the option of using a Windows server as an authentication server. Winbind also integrates cleanly with PAM and NSS. This allows setting up Linux machines where all users of a Windows domain automatically get an account.
zh-CN: Winbind 给予系统管理员使用 Windows Server 作为认证服务器的选项。Winbind 还与 PAM 和 NSS 利落地集成。这允许设置 Linux 机器使 Windows 域的所有用户自动得到账户。

en: More information can be found in the <filename>/usr/share/doc/libpam-winbind/examples/pam_winbind/</filename> directory of the <emphasis role="pkg">libpam-winbind</emphasis> package.
zh-CN: 更多信息可以在 <emphasis role="pkg">libpam-winbind</emphasis> 软件包的 <filename>/usr/share/doc/libpam-winbind/examples/pam_winbind/</filename> 目录中找到。

en: Configuring with <command>debconf</command>
zh-CN: 使用 <command>debconf</command> 来配置

en: <primary>Samba</primary><secondary>configuration</secondary>
zh-CN: <primary>Samba</primary><secondary>配置</secondary>

en: On first installation the only piece of required information is the name of the workgroup where the Samba server will belong (the answer is <literal>FALCOTNET</literal> in our case).
zh-CN: 在首次安装时，唯一需要的信息是 Samba 服务器所属的工作组的名称（在我们的情况下是 <literal>FALCOTNET</literal>）。

en: In case of a package update (from the old stable Debian version) or if the SMB server has already been configured to use a WINS server (<literal>wins server</literal>), the package also proposes identifying the WINS server from the information provided by the DHCP daemon. The Falcot Corp administrators rejected this option, since they intend to use the Samba server itself as the WINS server.
zh-CN: 在软件包（从旧的稳定 Debian 版本）更新的情况下，或者如果 SMB 服务器已经配置来使用 WINS 服务器（<literal>wins server</literal>），那么软件包还打算从 DHCP 守护进程提供的信息中识别 WINS 服务器。Falcot 公司的管理员拒绝这个选项，因为他们想要使用 Samba 服务器本身作为 WINS 服务器。

en: Configuring Manually
zh-CN: 手动配置

en: Changes to <filename>smb.conf</filename>
zh-CN: 更改为 <filename>smb.conf</filename>

en: The requirements at Falcot require other options to be modified in the <filename>/etc/samba/smb.conf</filename> configuration file. The following excerpts summarize the changes that were effected in the <literal>[global]</literal> section.
zh-CN: Falcot 公司的要求需要在 <filename>/etc/samba/smb.conf</filename> 配置文件中修改其它选项。后面的节选概括地总结了在所做的更改，在 <literal>[global]</literal> 部分中生效。

en: This is the default value for this parameter; however, since it is central to the Samba configuration, filling it explicitly is recommended. Each user must authenticate before accessing any share.
zh-CN: 这是这个参数的默认值；然而由于它对 Samba配置至关重要，推荐显性地填写。每个用户在访问任何共享前必须认证。

en: Adding Users
zh-CN: 添加用户

en: <primary>Samba</primary><secondary>add users</secondary>
zh-CN: <primary>Samba</primary><secondary>添加用户</secondary>

en: Each Samba user needs an account on the server; the Unix accounts must be created first, then the user needs to be registered in Samba's database. The Unix step is done quite normally (using <command>adduser</command> for instance).
zh-CN: 每名 Samba 用户在服务器上需要账户；必须首先创建 Unix 账户，然后用户需要在 Samba 的数据库中注册。Unix 的步骤非常正常地完成（例如使用 <command>adduser</command> ）。

en: Adding an existing user to the Samba database is a matter of running the <command>smbpasswd -a <replaceable>user</replaceable></command> command; this command asks for the password interactively.
zh-CN: 将现有用户添加到 Samba 数据库中不过是运行 <command>smbpasswd -a <replaceable>user</replaceable></command> 命令的事；这个命令交互地询问密码。

en: A user can be deleted with the <command>smbpasswd -x <replaceable>user</replaceable></command> command. A Samba account can also be temporarily disabled (with <command>smbpasswd -d <replaceable>user</replaceable></command>) and re-enabled later (with <command>smbpasswd -e <replaceable>user</replaceable></command>).
zh-CN: 可以通过 <command>smbpasswd -x <replaceable>user</replaceable></command> 命令来删除用户。Samba 账户还能够（通过 <command>smbpasswd -d <replaceable>user</replaceable></command>）被临时禁止，并且后面（通过 <command>smbpasswd -e <replaceable>user</replaceable></command>）再次启用。

en: Samba Client
zh-CN: Samba 客户端

en: <primary>Samba</primary><secondary>client</secondary>
zh-CN: <primary>Samba</primary><secondary>客户端</secondary>

en: The client features in Samba allow a Linux machine to access Windows shares and shared printers. The required programs are available in the <emphasis role="pkg">cifs-utils</emphasis> and <emphasis role="pkg">smbclient</emphasis> packages.
zh-CN: Samba 的客户端特性允许 Linux 机器访问 Windows 共享和共享打印机。所需程序在 <emphasis role="pkg">cifs-utils</emphasis> 和 <emphasis role="pkg">smbclient</emphasis> 软件包中得到。

en: The <command>smbclient</command> Program
zh-CN: <command>smbclient</command> 程序

en: The <command>smbclient</command> program queries SMB servers. It accepts a <literal>-U <replaceable>user</replaceable></literal> option, for connecting to the server under a specific identity. <command>smbclient //<replaceable>server</replaceable>/<replaceable>share</replaceable></command> accesses the share in an interactive way similar to the command-line FTP client. <command>smbclient -L <replaceable>server</replaceable></command> lists all available (and visible) shares on a server.
zh-CN: <command>smbclient</command> 程序需要 SMB 服务器。它接受 <literal>-U <replaceable>user</replaceable></literal> 选项，用于在特定的身份下连接到服务器上。 <command>smbclient //<replaceable>server</replaceable>/<replaceable>share</replaceable></command> 与命令行 FTP 客户端相似，以交互的方式访问共享。 <command>smbclient -L <replaceable>server</replaceable></command> 列出服务器上所有可用（并且可见）的共享。

en: Mounting Windows Shares
zh-CN: 挂载 Windows 共享

en: The <command>mount</command> command allows mounting a Windows share into the Linux filesystem hierarchy (with the help of <command>mount.cifs</command> provided by <emphasis role="pkg">cifs-utils</emphasis>).
zh-CN: <command>mount</command> 命令允许将 Windows 共享挂载到 Linux 文件系统层次结构中（在<emphasis role="pkg">cifs-utils</emphasis> 提供的 <command>mount.cifs</command>的帮助下）。

en: Mounting a Windows share
zh-CN: 挂载 Windows 共享

en: <primary>Samba</primary><secondary>mount</secondary>
zh-CN: <primary>Samba</primary><secondary>挂载</secondary>

en: The <filename>/etc/smb-credentials</filename> file (which must not be readable by users) has the following format:
zh-CN: <filename>/etc/smb-credentials</filename> 文件（必须不能被用户读取）具有后面的格式：

en: <primary>Samba</primary><secondary>credentials</secondary>
zh-CN: <primary>Samba</primary><secondary>证书</secondary>

en: Other options can be specified on the command-line; their full list is available in the <citerefentry><refentrytitle>mount.cifs</refentrytitle> <manvolnum>1</manvolnum></citerefentry> manual page. Two options in particular can be interesting: <literal>uid</literal> and <literal>gid</literal> allow forcing the owner and group of files available on the mount, so as not to restrict access to root.
zh-CN: 可以在命令行指定其它选项；它们的完整列表可以在手册页面 <citerefentry><refentrytitle>mount.cifs</refentrytitle> <manvolnum>1</manvolnum></citerefentry> 中得到。特别是两个选项令人感兴趣：<literal>uid</literal> 和 <literal>gid</literal> 允许文件的用户和用户组强制在挂载时得到，从而不限制对根的访问。

en: A mount of a Windows share can also be configured in <filename>/etc/fstab</filename>:
zh-CN: Windows 共享的挂载也可以在 <filename>/etc/fstab</filename> 中配置：

en: Printing on a Shared Printer
zh-CN: 在共享打印机上打印

en: CUPS is an elegant solution for printing from a Linux workstation to a printer shared by a Windows machine. When the <emphasis role="pkg">smbclient</emphasis> is installed, CUPS allows installing Windows shared printers automatically.
zh-CN: CUPS 是从 Linux 工作站打印到 Windows 机器共享打印机的优雅解决方案。当安装 <emphasis role="pkg">smbclient</emphasis> 时，CUPS 允许自动安装 Windows 共享打印机。

en: <primary>printing</primary><secondary>network</secondary>
zh-CN: <primary>打印</primary><secondary>网络</secondary>

en: <primary>Samba</primary><secondary>shared printers</secondary>
zh-CN: <primary>Samba</primary><secondary>共享打印机</secondary>

en: Here are the required steps:
zh-CN: 这里是所需的步骤：

en: Enter the CUPS configuration interface: <literal>http://localhost:631/admin</literal>
zh-CN: 进入 CUPS 配置界面：<literal>http://localhost:631/admin</literal>

en: Click on “Add Printer”.
zh-CN: 点击“添加打印机”。

en: Choose the printer device, pick “Windows Printer via SAMBA”.
zh-CN: 选择打印机设备，选择“经由 SAMBA 的 Windows 打印机”。

en: Enter the connection URI for the network printer. It should look like the following:
zh-CN: 输入网络打印机的连接 URI。它看起来应该像这样：

en: Enter the name that will uniquely identify this printer. Then enter the description and location of the printer. Those are the strings that will be shown to end users to help them identify the printers.
zh-CN: 输入唯一识别这台打印机的名称。然后输入打印机的描述与位置。这些会是对终端用户显示的字符串，帮助他们识别打印机。

en: Indicate the manufacturer/model of the printer, or directly provide a working printer description file (PPD).
zh-CN: 指示了打印机的生产商/型号，或者直接提供网络打印机的描述文件（PPD）。

en: Voilà, the printer is operational!
zh-CN: 看，打印机工作了！

en: HTTP/FTP Proxy
zh-CN: HTTP/FTP 代理

en: An HTTP/FTP proxy acts as an intermediary for HTTP and/or FTP connections. Its role is twofold:
zh-CN: HTTP/FTP 代理作为 HTTP 和/或 FTP 连接的中介工作。它的角色是双重的：

en: Caching: recently downloaded documents are copied locally, which avoids multiple downloads.
zh-CN: 缓存：最近下载的文档在本地复制，避免了多次下载。

en: Filtering server: if use of the proxy is mandated (and outgoing connections are blocked unless they go through the proxy), then the proxy can determine whether or not the request is to be granted.
zh-CN: 筛选服务器：如果代理的使用是强制的（并且外发的连接被阻止，除非它们通过代理），那么代理可以确定请求是否被授权。

en: <primary>HTTP/FTP proxy</primary>
zh-CN: <primary>HTTP/FTP 代理</primary>

en: <primary>proxy cache</primary>
zh-CN: <primary>缓存代理</primary>

en: Falcot Corp selected Squid as their proxy server.
zh-CN: Falcot 公司选择 Squid 作为其代理服务器。

en: Installing
zh-CN: 安装

en: <primary>Squid</primary><secondary>installation</secondary>
zh-CN: <primary>Squid</primary><secondary>安装</secondary>

en: Prior to installing, care should be taken to check that the system can identify its own complete name: the <command>hostname -f</command> must return a fully-qualified name (including a domain). If it does not, then the <filename>/etc/hosts</filename> file should be edited to contain the full name of the system (for instance, <literal>arrakis.falcot.com</literal>). The official computer name should be validated with the network administrator in order to avoid potential name conflicts.
zh-CN: 去安装前必须小心地检查，系统要可以识别它的全名：<command>hostname -f</command> 必须返回完全合格的名称（包括域名）。如果没有的话，那么应该编辑 <filename>/etc/hosts</filename> 文件来包含系统的全名（例如，<literal>arrakis.falcot.com</literal>）。官方的计算机名称对网络管理员应该是合法的，来避免可能的名称冲突。

en: Configuring a Cache
zh-CN: 配置缓存

en: Enabling the caching server feature is a simple matter of editing the <filename>/etc/squid/squid.conf</filename> configuration file and allowing machines from the local network to run queries through the proxy. The following example shows the modifications made by the Falcot Corp administrators:
zh-CN: 允许将服务器特性缓存，是编辑 <filename>/etc/squid/squid.conf</filename> 配置文件并允许本地网络商的机器通过代理来运行查询的简单事情。后面的示例显示了 Falcot 公司的管理员所做的修改：

en: The <filename>/etc/squid/squid.conf</filename> file (excerpts)
zh-CN: <filename>/etc/squid/squid.conf</filename> 文件（节选）

en: Configuring a Filter
zh-CN: 配置筛选程序

en: <command>squid</command> itself does not perform the filtering; this action is delegated to <command>squidGuard</command>. The former must then be configured to interact with the latter. This involves adding the following directive to the <filename>/etc/squid/squid.conf</filename> file:
zh-CN: <command>squid</command> 本身不执行筛选；这个动作委托给 <command>squidGuard</command>。然后前者必须配置与后者交互。这包括将后面的指令添加到 <filename>/etc/squid/squid.conf</filename> 文件：

en: The working database must be regenerated with <command>update-squidguard</command> after each change of the <command>squidGuard</command> configuration file (or one of the lists of domains or URLs it mentions). The configuration file syntax is documented on the following website: <ulink type="block" url="http://www.squidguard.org/Doc/configure.html" />
zh-CN: 在配置文件 <command>squidGuard</command> （或者它提到的域名或 URL 列表之一）的每次更改后，必须用 <command>update-squidguard</command> 重新生成工作数据库。 配置文件的语法归档在后面的网站中：<ulink type="block" url="http://www.squidguard.org/Doc/configure.html" />

en: <emphasis>ALTERNATIVE</emphasis> E2guardian (a DansGuardian Fork)
zh-CN: 替代<emphasis>替代</emphasis> E2guardian（DansGuardian 叉子）

en: LDAP Directory
zh-CN: LDAP 目录

en: <primary>directory, LDAP</primary>
zh-CN: <primary>目录，LDAP</primary>

en: OpenLDAP is an implementation of the LDAP protocol; in other words, it is a special-purpose database designed for storing directories. In the most common use case, using an LDAP server allows centralizing management of user accounts and the related permissions. Moreover, an LDAP database is easily replicated, which allows setting up multiple synchronized LDAP servers. When the network and the user base grows quickly, the load can then be balanced across several servers.
zh-CN: OpenLDAP 是 LDAP 协议的应用；换句话说，它是设计来存储目录的特定功能数据库。在最通常的使用情况下，使用 LDAP 服务器允许集中管理用户账户和相关的权限。而且，LDAP 数据库复制容易，这允许设置多个同步的 LDAP 服务器。当网络和用户基础迅速增长时，负载然后会在几台服务器之间平衡。

en: LDAP data is structured and hierarchical. The structure is defined by “schemas” which describe the kind of objects that the database can store, with a list of all their possible attributes. The syntax used to refer to a particular object in the database is based on this structure, which explains its complexity.
zh-CN: LDAP 数据是结构化的并且分层级的。结构由“schemas（架构）”来确定，它使用了所有可能的属性列表，来描述数据库可以存储的对象的种类。用于指示数据库中特定对象的语法基于这个结构，它解释了其复杂性。

en: The <emphasis role="pkg">slapd</emphasis> package contains the OpenLDAP server. The <emphasis role="pkg">ldap-utils</emphasis> package includes command-line tools for interacting with LDAP servers.
zh-CN: <emphasis role="pkg">slapd</emphasis> 软件包包含 OpenLDAP 服务器。<emphasis role="pkg">ldap-utils</emphasis> 软件包包括了与 LDAP 服务器交互的命令行工具。

en: Installing <emphasis role="pkg">slapd</emphasis> usually asks only for the administrator's password and the resulting database is unlikely to suit your needs. Fortunately a simple <command>dpkg-reconfigure slapd</command> will let you reconfigure the LDAP database with more details:
zh-CN: 安装 <emphasis role="pkg">slapd</emphasis> 通常只询问管理员的密码，并且产生的数据库可能并不适合您的需求。幸运的是，简单的 <command>dpkg-reconfigure slapd</command> 将让您更具体地重新配置 LDAP 数据库：

en: Omit OpenLDAP server configuration? No, of course, we want to configure this service.
zh-CN: 省略 OpenLDAP 服务器的配置？不，当然不，我们想要配置这个服务。

en: DNS domain name: “<literal>falcot.com</literal>”.
zh-CN: DNS 域名：“<literal>falcot.com</literal>”。

en: Organization name: “Falcot Corp”.
zh-CN: 组织名称：“Falcot Corp”。

en: An administrative passwords needs to be typed in.
zh-CN: 管理密码需要键入。

en: Database backend to use: “MDB”.
zh-CN: 数据库后端要使用：“MDB”。

en: Do you want the database to be removed when <emphasis role="pkg">slapd</emphasis> is purged? No. No point in risking losing the database in case of a mistake.
zh-CN: 当清除 <emphasis role="pkg">slapd</emphasis> 时想要删除数据库吗？不，没有必要在犯错误的情况下冒丢失数据库的风险。

en: Move old database? This question is only asked when the configuration is attempted while a database already exists. Only answer “yes” if you actually want to start again from a clean database, for instance if you run <command>dpkg-reconfigure slapd</command> right after the initial installation.
zh-CN: 移动旧的数据库吗？只有在数据库已经存在而尝试进行配置的情况下才询问这个问题。如果真的想从干净的数据库重新开始时才能回答“是”，例如，如果刚好在初始安装后运行 <command>dpkg-reconfigure slapd</command> 的情况下。

en: <emphasis>BACK TO BASICS</emphasis> LDIF format
zh-CN: <emphasis>基本知识</emphasis> LDIF 格式

en: An LDIF file (<emphasis>LDAP Data Interchange Format</emphasis>) is a portable text file describing the contents of an LDAP database (or a portion thereof); this can then be used to inject the data into any other LDAP server.
zh-CN: LDIF 文件（<emphasis>LDAP Data Interchange Format——LDAP 数据交换格式</emphasis>）是可移植文本文件，描述了 LDAP 数据库的内容（或其一部分）；然后这能够用于将数据注入任何其它 LDAP 服务器。

en: A minimal database is now configured, as demonstrated by the following query:
zh-CN: 现在配置了最小数据库，如后面的查询所说明的：

en: The query returned two objects: the organization itself, and the administrative user.
zh-CN: 请求返回两个对象：组织自身和管理用户。

en: Filling in the Directory
zh-CN: 填入目录

en: Since an empty database is not particularly useful, we are going to inject into it all the existing directories; this includes the users, groups, services and hosts databases.
zh-CN: 由于空数据库不特别有用，我们将所有现有目录注入其中；这包括用户、用户组、服务和主机数据库。

en: The <emphasis role="pkg">migrationtools</emphasis> package provides a set of scripts dedicated to extract data from the standard Unix directories (<filename>/etc/passwd</filename>, <filename>/etc/group</filename>, <filename>/etc/services</filename>, <filename>/etc/hosts</filename> and so on), convert this data, and inject it into the LDAP database.
zh-CN: <emphasis role="pkg">migrationtools</emphasis> 软件包提供一组脚本，专门用于从标准 Unix 目录中提取数据（<filename>/etc/passwd</filename>、<filename>/etc/group</filename>、<filename>/etc/services</filename>、<filename>/etc/hosts</filename> 以及等等诸如此类），转换这个数据，并将其注入 LDAP 数据库中。

en: Once the package is installed, the <filename>/etc/migrationtools/migrate_common.ph</filename> must be edited; the <varname>IGNORE_UID_BELOW</varname> and <varname>IGNORE_GID_BELOW</varname> options need to be enabled (uncommenting them is enough), and <varname>DEFAULT_MAIL_DOMAIN</varname>/<varname>DEFAULT_BASE</varname> need to be updated.
zh-CN: 一旦安装了软件包，就必须编辑 <filename>/etc/migrationtools/migrate_common.ph</filename>；需要启用 <varname>IGNORE_UID_BELOW</varname> 和 <varname>IGNORE_GID_BELOW</varname> 选项（将其取消注释就足够了），并且需要更新 <varname>DEFAULT_MAIL_DOMAIN</varname>/<varname>DEFAULT_BASE</varname>。

en: The actual migration operation is handled by the <command>migrate_all_online.sh</command> command, as follows:
zh-CN: 真正的迁移操作由 <command>migrate_all_online.sh</command> 命令来处理，如下：

en: The <command>migrate_all_online.sh</command> asks a few questions about the LDAP database into which the data is to be migrated. <xref linkend="tab-migrate-all" xrefstyle="select: label nopage" /> summarizes the answers given in the Falcot use-case.
zh-CN: <command>migrate_all_online.sh</command> 询问一些关于数据迁移到 LDAP 数据库的问题。<xref linkend="tab-migrate-all" xrefstyle="select: label nopage" /> 概括了 Falcot 公司的使用案例中给出回答。

en: Answers to questions asked by the <command>migrate_all_online.sh</command> script
zh-CN: 对 <command>migrate_all_online.sh</command> 脚本询问的问题的回答

en: Question
zh-CN: 问题

en: Answer
zh-CN: 回答

en: X.500 naming context
zh-CN: X.500 命名文本

en: LDAP server hostname
zh-CN: LDAP 服务器主机名

en: Manager DN
zh-CN: 管理者 DN

en: Bind credentials
zh-CN: 绑定证明

en: the administrative password
zh-CN: 管理员密码

en: Create DUAConfigProfile
zh-CN: 创建 DUAConfigProfile

en: no
zh-CN: 否

en: <emphasis>TOOL</emphasis> Browsing an LDAP directory
zh-CN: <emphasis>工具</emphasis> 浏览 LDAP 目录

en: The <command>jxplorer</command> command (in the package of the same name) is a graphical tool allowing to browse and edit an LDAP database. It is an interesting tool that provides an administrator with a good overview of the hierarchical structure of the LDAP data.
zh-CN: <command>jxplorer</command> 命令（在同名软件包中）是图形化的工具，允许浏览并编辑 LDAP 数据库。这是个有趣的工具，为管理员提供了 LDAP 数据分层级结构的良好概况。

en: Also note the use of the <literal>-c</literal> option to the <command>ldapadd</command> command; this option requests that processing doesn't stop in case of error. Using this option is required because converting the <filename>/etc/services</filename> often generates a few errors that can safely be ignored.
zh-CN: 还要注意 <literal>-c</literal> 选项在 <command>ldapadd</command> 命令中的使用；这个选项需要在错误的情况下不将处理停止下来。使用这个选项的使用是需要的，因为 <filename>/etc/services</filename> 的转换通常产生一些可以被安全地忽略的错误。

en: Managing Accounts with LDAP
zh-CN: 使用 LDAP 管理账户

en: Now the LDAP database contains some useful information, the time has come to make use of this data. This section focuses on how to configure a Linux system so that the various system directories use the LDAP database.
zh-CN: 现在 LDAP 数据库包含了一些有用的信息，是时候使用这些数据了。这一节聚焦于如何配置 Linux 系统，从而各个系统目录可以使用 LDAP 数据库。

en: Configuring NSS
zh-CN: 配置 NSS

en: The NSS system (Name Service Switch, see sidebar <xref linkend="sidebar.intro-nss" />) is a modular system designed to define or fetch information for system directories. Using LDAP as a source of data for NSS requires installing the <emphasis role="pkg">libnss-ldap</emphasis> package. Its installation asks a few questions; the answers are summarized in <xref linkend="tab-libnss-ldap" xrefstyle="select: label nopage" />.
zh-CN: NSS 系统（Name Service Switch——名称服务交换，请参见边栏 <xref linkend="sidebar.intro-nss" />）是个模块化的系统，设计来为系统目录确定或取回信息。使用 LDAP 作为 NSS 的数据源需要安装 <emphasis role="pkg">libnss-ldap</emphasis> 软件包。它的安装会询问一些问题；回答概括在 <xref linkend="tab-libnss-ldap" xrefstyle="select: label nopage" /> 中。

en: Distinguished name of the search base
zh-CN: 搜索基础的区分名称

en: LDAP version to use
zh-CN: 使用的 LDAP 版本

en: LDAP account for root
zh-CN: 根的 LDAP 账户

en: LDAP root account password
zh-CN: LDAP 根账户密码

en: Allow LDAP admin account behave like local root?
zh-CN: 允许 LDAP 管理账户的行为像本地根用户一样吗？

en: <literal>yes</literal>
zh-CN: <literal>是</literal>

en: Does the LDAP database require login?
zh-CN: LDAP 数据库需要登录吗？

en: The <filename>/etc/nsswitch.conf</filename> file then needs to be modified, so as to configure NSS to use the freshly-installed <command>ldap</command> module. You can use the example provided in <filename>/usr/share/doc/libnss-ldap/examples/nsswitch.ldap</filename> or edit your existing configuration.
zh-CN: 然后需要修改 <filename>/etc/nsswitch.conf</filename> 文件，从而配置 NSS 来使用刚刚安装的 <command>ldap</command> 模块。可以使用 <filename>/usr/share/doc/libnss-ldap/examples/nsswitch.ldap</filename> 中提供的示例，或者编辑现有的配置。

en: The <command>ldap</command> module is usually inserted before others, and it will therefore be queried first. The notable exception is the <literal>hosts</literal> service since contacting the LDAP server requires consulting DNS first (to resolve <literal>ldap.falcot.com</literal>). Without this exception, a hostname query would try to ask the LDAP server; this would trigger a name resolution for the LDAP server, and so on in an infinite loop.
zh-CN: <command>ldap</command> 模块通常插在其它之前，这样会被首先询问。显著的例外是 <literal>hosts</literal> 服务，因为联系 LDAP 服务器需要首先咨询 DNS （来解析 <literal>ldap.falcot.com</literal>）。没有这个例外的话，主机名查询将试图询问 LDAP 服务器；这会触发对 LDAP 服务器的名称解析，于是进入死循环。

en: If the LDAP server should be considered authoritative (and the local files used by the <command>files</command> module disregarded), services can be configured with the following syntax:
zh-CN: 如果 LDAP 服务器被认为是权威的（并且不理会 <command>files</command> 模块使用的本地文件），那么服务可以使用后面的语法来配置：

en: <literal><replaceable>service</replaceable>: ldap [NOTFOUND=return] files</literal>.
zh-CN: <literal><replaceable>服务</replaceable>: ldap [NOTFOUND=return] files</literal>.

en: If the requested entry does not exist in the LDAP database, the query will return a “not existing” reply even if the resource does exist in one of the local files; these local files will only be used when the LDAP service is down.
zh-CN: 如果请求的入口在 LDAP 数据库中不存在，那么即使资源真实存在于一个本地文件中，查询也会返回“不存在”的回复；这些本地文件只当 LDAP 服务关闭时才会使用。

en: Configuring PAM
zh-CN: 配置 PAM

en: This section describes a PAM configuration (see sidebar <xref linkend="sidebar.intro-pam" />) that will allow applications to perform the required authentications against the LDAP database.
zh-CN: 本节描述了 PAM 配置（请参见边栏 <xref linkend="sidebar.intro-pam" />），它允许应用针对 LDAP 数据库来执行所需要的授权。

en: <emphasis>CAUTION</emphasis> Broken authentication
zh-CN: <emphasis>警告</emphasis> 失效的认证

en: Changing the standard PAM configuration used by various programs is a sensitive operation. A mistake can lead to broken authentication, which could prevent logging in. Keeping a root shell open is therefore a good precaution. If configuration errors occur, they can be then fixed and the services restarted with minimal effort.
zh-CN: 更改各个程序使用的标准 PAM 配置是敏感的操作。错误可以导致失效的认证，这会阻碍登录。这样，保持 root shell 打开是个好的预防方式。如果发生配置错误，然后可以修复它们，并且以最小的努力来重启服务。

en: The LDAP module for PAM is provided by the <emphasis role="pkg">libpam-ldap</emphasis> package. Installing this package asks a few questions very similar to those in <emphasis role="pkg">libnss-ldap</emphasis>; some configuration parameters (such as the URI for the LDAP server) are even actually shared with the <emphasis role="pkg">libnss-ldap</emphasis> package. Answers are summarized in <xref linkend="tab-libpam-ldap" xrefstyle="select: label nopage" />.
zh-CN: 用于 PAM 的 LDAP 模块由 <emphasis role="pkg">libpam-ldap</emphasis> 软件包提供。安装这个软件包会询问一些问题，与 <emphasis role="pkg">libnss-ldap</emphasis> 中的那些问题非常相似；一些配置参数（如 LDAP 服务器的 URI）甚至被 <emphasis role="pkg">libnss-ldap</emphasis> 软件包真正共享。 回答概括在 <xref linkend="tab-libpam-ldap" xrefstyle="select: label nopage" /> 中。

en: Configuration of <emphasis>libpam-ldap</emphasis>
zh-CN: <emphasis>libpam-ldap</emphasis> 的配置

en: Allow LDAP admin account to behave like local root?
zh-CN: 允许 LDAP 管理账户的行为像本地根用户一样吗？

en: Yes. This allows using the usual <command>passwd</command> command for changing passwords stored in the LDAP database.
zh-CN: 是。这允许使用通常的 <command>passwd</command> 命令来更改存储在 LDAP 数据库中的密码。

en: Does the LDAP database require logging in?
zh-CN: LDAP 数据库需要登录吗？

en: the LDAP database administrative password
zh-CN: LDAP 数据库管理密码

en: Installing <emphasis role="pkg">libpam-ldap</emphasis> automatically adapts the default PAM configuration defined in the <filename>/etc/pam.d/common-auth</filename>, <filename>/etc/pam.d/common-password</filename> and <filename>/etc/pam.d/common-account</filename> files. This mechanism uses the dedicated <command>pam-auth-update</command> tool (provided by the <emphasis role="pkg">libpam-runtime</emphasis> package). This tool can also be run by the administrator should they wish to enable or disable PAM modules.
zh-CN: 安装 <emphasis role="pkg">libpam-ldap</emphasis> 会自动适应 <filename>/etc/pam.d/common-auth</filename>、<filename>/etc/pam.d/common-password</filename> 和 <filename>/etc/pam.d/common-account</filename> 文件中的默认 PAM 配置。这个机制使用专用的 <command>pam-auth-update</command> 工具（由 <emphasis role="pkg">libpam-runtime</emphasis> 软件包提供）。这个工具还可以由管理员运行，如果他们想要启用或禁止 PAM 模块的话。

en: Securing LDAP Data Exchanges
zh-CN: 保护 LDAP 数据交换

en: By default, the LDAP protocol transits on the network as cleartext; this includes the (encrypted) passwords. Since the encrypted passwords can be extracted from the network, they can be vulnerable to dictionary-type attacks. This can be avoided by using an extra encryption layer; enabling this layer is the topic of this section.
zh-CN: LDAP 协议默认在网络上明文传输；这包括（加密的）密码。由于加密的密码可以从网络上提取，它们对字典类型的攻击会是脆弱的。这可以通过使用另外的加密层来避免；启用这层是本节的主题。

en: Configuring the Server
zh-CN: 配置服务器

en: <primary><foreignphrase>OpenSSL</foreignphrase></primary><secondary>creating keys</secondary>
zh-CN: <primary><foreignphrase>OpenSSL</foreignphrase></primary><secondary>生成密钥</secondary>

en: <primary>key pair</primary>
zh-CN: <primary>密钥对</primary>

en: The first step is to create a key pair (comprising a public key and a private key) for the LDAP server. The Falcot administrators reuse <emphasis>easy-rsa</emphasis> to generate it (see <xref linkend="sect.easy-rsa" />). Running <command>./easyrsa build-server-full ldap.falcot.com nopass</command> will ask you about the “common name”. The answer to that question <emphasis>must</emphasis> be the fully-qualified hostname for the LDAP server; in our case, <literal>ldap.falcot.com</literal>.
zh-CN: 第一步是为 LDAP 服务器创建密钥对（包括公钥和私钥）。Falcot 公司的管理员重复使用 <emphasis>easy-rsa</emphasis> 来生成它（请参见 <xref linkend="sect.easy-rsa" />）。运行 <command>./easyrsa build-server-full ldap.falcot.com nopass</command> 会询问有关“通用名称”。对问题的回答<emphasis>必须</emphasis>是 LDAP 服务器完全合格的主机名；在我们的例子中是 <literal>ldap.falcot.com</literal>。

en: This command creates a certificate in the <filename>pki/issued/ldap.falcot.com.crt</filename> file; the corresponding private key is stored in <filename>pki/private/ldap.falcot.com.key</filename>.
zh-CN: 这个命令在 <filename>pki/issued/ldap.falcot.com.crt</filename> 文件中创建了证书；相应的私钥存储在 <filename>pki/private/ldap.falcot.com.key</filename> 中。

en: Now these keys have to be installed in their standard location, and we must make sure that the private file is readable by the LDAP server which runs under the <literal>openldap</literal> user identity:
zh-CN: 现在这些密钥必须安装到其标准位置上，并且我们必须确定私有文件可以被<literal>openldap</literal>身份下运行的 LDAP 服务器读取：

en: The <command>slapd</command> daemon also needs to be told to use these keys for encryption. The LDAP server configuration is managed dynamically: the configuration can be updated with normal LDAP operations on the <literal>cn=config</literal> object hierarchy, and the server updates <filename>/etc/ldap/slapd.d</filename> in real time to make the configuration persistent. <command>ldapmodify</command> is thus the right tool to update the configuration:
zh-CN: 还需要告知 <command>slapd</command> 守护进程使用这些密钥来加密。LDAP 服务器的配置被动态地管理：可以在 <literal>cn=config</literal> 对象层次结构上通过正常的 LDAP 操做来更新配置；并且服务器实时更新 <filename>/etc/ldap/slapd.d</filename> 而使配置持续。这样 <command>ldapmodify</command> 就是更新配置的合适工具了：

en: Configuring <command>slapd</command> for encryption
zh-CN: 配置 <command>slapd</command> 来加密

en: <emphasis>TOOL</emphasis> <command>ldapvi</command> to edit an LDAP directory
zh-CN: <emphasis>工具</emphasis> <command>ldapvi</command> 来编辑 LDAP 目录

en: It is thus a convenient way to update the configuration of the LDAP server, simply by editing the <literal>cn=config</literal> hierarchy.
zh-CN: 这样是更新 LDAP 服务器配置的方便的方式，通过简单地编辑 <literal>cn=config</literal> 层次结构来完成。

en: The last step for enabling encryption involves changing the <varname>SLAPD_SERVICES</varname> variable in the <filename>/etc/default/slapd</filename> file. We'll play it safe and disable unsecured LDAP altogether.
zh-CN: 启用加密的最后一步包括更改 <filename>/etc/default/slapd</filename> 文件中的 <varname>SLAPD_SERVICES</varname> 变量。我们将同时安全地运行并禁止不安全 LDAP。

en: The <filename>/etc/default/slapd</filename> file
zh-CN: <filename>/etc/default/slapd</filename> 文件

en: Configuring the Client
zh-CN: 配置客户端

en: On the client side, the configuration for the <emphasis>libpam-ldap</emphasis> and <emphasis>libnss-ldap</emphasis> modules needs to be modified to use an <literal>ldaps://</literal> URI.
zh-CN: 在客户端一侧，需要修改用于 <emphasis>libpam-ldap</emphasis> 和 <emphasis>libnss-ldap</emphasis> 模块的配置，来使用 <literal>ldaps://</literal> URI。

en: Last but not least, the default LDAP URI and default base DN used by the various command line tools can be modified in <filename>/etc/ldap/ldap.conf</filename>. This will save quite some typing.
zh-CN: 最后但不是最重要的，各种命令行工具使用的默认 LDAP URI 和默认基础 DN可以在 <filename>/etc/ldap/ldap.conf</filename> 中修改。这会节省一些输入工作。

en: The <filename>/etc/ldap/ldap.conf</filename> file
zh-CN: <filename>/etc/ldap/ldap.conf</filename> 文件

en: Real-Time Communication Services
zh-CN: 实时通信服务

en: Real-Time Communication (RTC) services include voice, video/webcam, instant messaging (IM) and desktop sharing. This chapter gives a brief introduction to three of the services required to operate RTC, including a TURN server, SIP server and XMPP server. Comprehensive details of how to plan, install and manage these services are available in the Real-Time Communications Quick Start Guide which includes examples specific to Debian. <ulink type="block" url="https://rtcquickstart.org" />
zh-CN: 实时通信（Real-Time Communication，RTC）服务包括语音、视频/网络摄像头即时通信（instant messaging，IM）和共享桌面。这章对需要操作 RTC 的三种服务给出了简要介绍，包括 TURN 服务器、 SIP 服务器和 XMPP 服务器。如何规划、安装并管理这些服务的深入细节可以在《实时通信的快速开始指南》中得到，它包括 Debian 特定的一些示例。<ulink type="block" url="https://rtcquickstart.org" />

en: Both SIP and XMPP can provide the same functionality. SIP is slightly more well known for voice and video while XMPP is traditionally regarded as an IM protocol. In fact, they can both be used for any of these purposes. To maximize connectivity options, it is recommended to run both in parallel.
zh-CN: SIP 和 XMPP 可以提供相同的功能。SIP 在语音和视频上略微知名一些，而 XMPP 在传统上被认为是 IM 协议。实际上，它们都可以用于这些之中的任何目的。为了使连接选项最大化，推荐并行运行它们。

en: These services rely on X.509 certificates both for authentication and confidentiality purposes. See <xref linkend="sect.x509-cert" /> for more information.
zh-CN: 这些服务在认证和保密目的上都依赖于 X.509 证书。更多信息请参见 <xref linkend="sect.x509-cert" />。

en: DNS settings for RTC services
zh-CN: RTC 服务的 DNS 设置

en: TURN Server
zh-CN: TURN 服务器

en: TURN is a service that helps clients behind NAT routers and firewalls to discover the most efficient way to communicate with other clients and to relay the media streams if no direct media path can be found. It is highly recommended that the TURN server is installed before any of the other RTC services are offered to end users.
zh-CN: TURN 是一种服务，它帮助 NAT 路由器和防火墙后面的客户端发现最有效的方式，来与其他客户端通信，并且如果没有发现直接媒体路径的话会依赖媒体流。强烈推荐在其它 RTC 服务提供给终端用户之前安装 TURN 服务器。

en: <primary>TURN</primary><secondary>server</secondary>
zh-CN: <primary>TURN</primary><secondary>服务器</secondary>

en: TURN and the related ICE protocol are open standards. To benefit from these protocols, maximizing connectivity and minimizing user frustration, it is important to ensure that all client software supports ICE and TURN.
zh-CN: TURN 和相关的 ICE 协议是开放的标准。为了从这些协议中获益，将连接最大化并将用户的挫败感最小化，重要的是确保所有的客户端软件支持 ICE 和 TURN。

en: For the ICE algorithm to work effectively, the server must have two public IPv4 addresses.
zh-CN: 对于有效工作的 ICE 算法，服务器必须具有两个公共的 IPV4 地址。

en: Install the <emphasis role="pkg">coturn</emphasis> package and edit the <filename>/etc/turnserver.conf</filename> configuration file. By default, a SQLite database is configured in <filename>/var/db/turndb</filename> for user account settings, but PostgreSQL, MySQL or Redis can be set up instead if preferred. The most important thing to do is insert the IP addresses of the server.
zh-CN: 安装 <emphasis role="pkg">coturn</emphasis> 软件包并编辑 <filename>/etc/turnserver.conf</filename> 配置文件。SQLite 数据库默认在 <filename>/var/db/turndb</filename> 中配置用户账户设置，而如果需要的话可以替代设置 PostgreSQL、MySQL 或 Redis。 要做的最重要的事情是插入服务器的 IP 地址。

en: By default, the TURN server uses anonymous access. We have to add the users we want to use:
zh-CN: TURN 服务器默认使用匿名访问。我们必须添加我们想要使用的用户：

en: We use the argument <literal>-a</literal> to add a normal user and <literal>-A</literal> to add an admin user.
zh-CN: 我们使用 <literal>-a</literal> 参数来添加普通用户，而用 <literal>-A</literal> 来添加管理用户。

en: SIP Proxy Server
zh-CN: SIP 代理服务器

en: A SIP proxy server manages the incoming and outgoing SIP connections between other organizations, SIP trunking providers, SIP PBXes such as Asterisk, SIP phones, SIP-based softphones and WebRTC applications.
zh-CN: SIP 代理服务器管理其他组织、SIP 中继提供商、SIP PBXes 如 Asterisk、SIP 电话、基于 SIP 的软件电话与 WebRTC应用之间的到来的与外发的 SIP 链接。

en: <primary>SIP</primary><secondary>server</secondary>
zh-CN: <primary>SIP</primary><secondary>服务器</secondary>

en: <primary>SIP</primary><secondary>proxy</secondary>
zh-CN: <primary>SIP</primary><secondary>代理</secondary>

en: <primary>SIP</primary><secondary>trunk</secondary>
zh-CN: <primary>SIP</primary><secondary>中继</secondary>

en: It is strongly recommended to install and configure the SIP proxy before attempting a SIP PBX setup. The SIP proxy normalizes a lot of the traffic reaching the PBX and provides greater connectivity and resilience.
zh-CN: 强烈推荐在尝试设置 SIP PBX 之前安装并配置 SIP 代理。SIP 代理使到达 PBX 的大量流量正常化，并提供更大的连接与恢复能力。

en: Install the SIP proxy
zh-CN: 安装 SIP 代理

en: Now we focus on the configuration file <filename>/etc/kamailio/kamailio.cfg</filename>. Falcot needs user authentication and persistent user location, so they add the following <literal>#!define</literal> directives at the top of that file:
zh-CN: 现在我们聚焦在配置文件 <filename>/etc/kamailio/kamailio.cfg</filename> 上。Falcot 公司需要用户认证和持续的用户位置，所以他们在文件的顶部添加了后面的指令 <literal>#!define</literal>：

en: XMPP Server
zh-CN: XMPP 服务器

en: An XMPP server manages connectivity between local XMPP users and XMPP users in other domains on the public Internet.
zh-CN: XMPP 服务器管理本地 XMPP 用户与公共因特网上其它域的XMPP 用户之间的连接。

en: <emphasis>VOCABULARY</emphasis> XMPP or Jabber?
zh-CN: <emphasis>关键词</emphasis> XMPP 还是 Jabber？

en: XMPP is sometimes referred to as Jabber. In fact, Jabber is a trademark and XMPP is the official name of the standard.
zh-CN: XMPP 有时被称为 Jabber。实际上，Jabber 是个商标，而 XMPP 是这种标准的官方名称。

en: Install the XMPP server
zh-CN: 安装 XMPP 服务器

en: Install the <emphasis role="pkg">prosody</emphasis> package.
zh-CN: 安装 <emphasis role="pkg">prosody</emphasis> 软件包。

en: Review the <filename>/etc/prosody/prosody.cfg.lua</filename> configuration file. The most important thing to do is insert JIDs of the users who are permitted to manage the server.
zh-CN: 复查 <filename>/etc/prosody/prosody.cfg.lua</filename> 配置文件。要做的最重要的事情是插入被允许管理这台服务器的用户的 JID。

en: An individual configuration file is also needed for each domain. Copy the sample from <filename>/etc/prosody/conf.avail/example.com.cfg.lua</filename> and use it as a starting point. Here is <literal>falcot.com.cfg.lua</literal>:
zh-CN: 每个域还需要独立的配置文件。复制来自 <filename>/etc/prosody/conf.avail/example.com.cfg.lua</filename> 的示例，并用它作为起点，这里是 <literal>falcot.com.cfg.lua</literal>：

en: To enable the domain, there must be a symlink from <filename>/etc/prosody/conf.d/</filename>. Create it that way:
zh-CN: 为了启用域，必须有个来自 <filename>/etc/prosody/conf.d/</filename> 的符号链接。以这样的方式来创建：

en: Restart the service to use the new configuration.
zh-CN: 重新启动服务来使用新的配置。

en: Managing the XMPP server
zh-CN: 管理 XMPP 服务器

en: See the <ulink url="https://prosody.im/doc/configure"> Prosody online documentation</ulink> for more details about how to customize the configuration.
zh-CN: 关于如何定制配置的更多细节请参见 <ulink url="https://prosody.im/doc/configure"> Prosody online documentation</ulink>。

en: Running services on port 443
zh-CN: 在端口 443 运行服务

en: Some administrators prefer to run all of their RTC services on port 443. This helps users to connect from remote locations such as hotels and airports where other ports may be blocked or Internet traffic is routed through HTTP proxy servers.
zh-CN: 一些管理员倾向在端口 443 运行所有的 RTC 服务。这帮助用户从饭店或机场那样的远程位置连接，在那里其它端口可能会被阻塞，或者因特网通信量会经由 HTTP 代理服务器。

en: To use this strategy, each service (SIP, XMPP and TURN) needs a different IP address. All the services can still be on the same host as Linux supports multiple IP addresses on a single host. The port number, 443, must be specified in the configuration files for each process and also in the DNS SRV records.
zh-CN: 为了使用这个策略，每项服务（SIP、XMPP 和 TURN）需要不同的 IP 地址。所有的服务仍然可以在相同的主机上，因为 Linux 在单一主机上支持多个 IP 地址。对于每个进程的配置文件中，还要在 DNS SRV 记录中指定端口号，即443。

en: Adding WebRTC
zh-CN: 添加 WebRTC

en: Falcot wants to let customers make phone calls directly from the web site. The Falcot administrators also want to use WebRTC as part of their disaster recovery plan, so staff can use web browsers at home to log in to the company phone system and work normally in an emergency.
zh-CN: Falcot 公司想要让客户直接从网站上打电话。Falcot 公司的管理员还想要使用 WebRTC 作为其灾难恢复计划的一部分，这样员工可以在家使用 web 浏览器登录公司电话系统上，并在紧急情况下正常工作。

en: <emphasis>IN PRACTICE</emphasis> Try WebRTC
zh-CN: <emphasis>实践</emphasis> 尝试 WebRTC

en: <primary>WebRTC</primary><secondary>demonstration</secondary>
zh-CN: <primary>WebRTC</primary><secondary>说明</secondary>

en: WebRTC is a rapidly evolving technology and it is essential to use packages from the <emphasis role="distribution">Testing</emphasis> distribution. Another option is to compile the software.
zh-CN: WebRTC 是快速进化的技术，它本质上使用来自 <emphasis role="distribution">Testing（测试）</emphasis> 发布版本的软件包。其他选项用于编译软件。

en: WebRTC uses a simple API to provide browsers and mobile applications with RTC, it is free software and it is being developed by Google. <ulink type="block" url="https://webrtc.org" />
zh-CN: WebRTC 使用简单的 API 来提供带有 RTC 的浏览器和移动应用，它是自由软件，正在由 Google 开发。<ulink type="block" url="https://webrtc.org" />

en: More advanced click-to-call web sites typically use server-side scripting to generate the <literal>config.js</literal> file dynamically. The <ulink url="https://www.drupal.org/project/drucall">DruCall</ulink> source code demonstrates how to do this with PHP.
zh-CN: 更先进的点击呼叫网站典型地使用服务器一侧的脚本，来动态生成 <literal>config.js</literal> 文件。<ulink url="https://www.drupal.org/project/drucall">DruCall</ulink> 源代码说明了如何使用 PHP 来实现。

en: This chapter sampled only a fraction of the available server software; however, most of the common network services were described. Now it is time for an even more technical chapter: we'll go into deeper detail for some concepts, describe massive deployments and virtualization.
zh-CN: 这一章只举了部分可获得的服务器软件的示例；但描述了最常用的网络服务。现在到了更技术性的章节了：我们将进入一些概念更深入的细节，描述大量部署和虚拟化。
