harden-doc 3.19 - en to zh_CN translation catalogue (164 entries)

en: Before connecting to any network, especially if it's a public one you should, at the very least, execute a security update (see <xref linkend="security-update" />). Optionally, you could take a snapshot of your system (see <xref linkend="snapshot" />).
zh_CN: 在连入任何网络前, 特别是将要连入公网之前, 至少应该执行一次安全更新(参阅 <xref linkend="security-update" />). 最好, 您能对系统进行系统快照(参阅 <xref linkend="snapshot" />).

en: In order to receive information on available security updates you should subscribe yourself to the debian-security-announce mailing list in order to receive the Debian Security Advisories (DSAs). See <xref linkend="debian-sec-team" /> for more information on how the Debian security team works. For information on how to subscribe to the Debian mailing lists read <ulink url="http://lists.debian.org" />.
zh_CN: 您可以通过订阅 debian-security-announce 邮件列表，接收 Debian 的安全公告(DSAs), 关于 Debian 安全小组的更多内容, 参阅 <xref linkend="debian-sec-team" />. 如何订阅邮件列表参见 <ulink url="http://lists.debian.org" />.

en: DSAs are signed with the Debian Security Team's signature which can be retrieved from <ulink url="http://security.debian.org" />.
zh_CN: 由 Debian 安全小组签署的 DSAs 也可以从 <ulink url="http://security.debian.org" /> 处获取.

en: Execute a security update
zh_CN: 进行安全更新

en: If you want to use <application>dselect</application> then first [U]pdate, then [I]nstall and finally, [C]onfigure the installed/upgraded packages.
zh_CN: 如果使用 <application>dselect</application>, 那么, 首先[U]pdate, 然后 [I]nstall 最后, [C]onfigure the installed/upgraded packages.

en: Change the BIOS (again)
zh_CN: 修改 BIOS (再次)

en: Remember <xref linkend="bios-passwd" />? Well, then you should now, once you do not need to boot from removable media, to change the default BIOS setup so that it <emphasis>only</emphasis> boots from the hard drive. Make sure you will not lose the BIOS password, otherwise, in the event of a hard disk failure you will not be able to return to the BIOS and change the setup so you can recover it using, for example, a CD-ROM.
zh_CN: 还记得 <xref linkend="bios-passwd" /> 吗? 很好, 当你不必从可移动介质启动的时候, 应当更改 BIOS 的默认设置，使之<emphasis>只能</emphasis>从硬盘引导. 确保不会丢失 BIOS 密码, 否则, 硬盘启动失败的时候您将不能回到 BIOS 和更改设置, 例如从 CD-ROM 启动.

en: Another less secure but more convenient way is to change the setup to have the system boot up from the hard disk and, if it fails, try removable media. By the way, this is often done because most people don't use the BIOS password that often; it's easily forgotten.
zh_CN: 其它不太安全但很方便的方式是, 设置系统从硬盘引导, 失败后则尝试从可移动介质引导. 通常是这样设置的, 因为 BIOS 密码不常使用, 很容易忘记.

en: Set a LILO or GRUB password
zh_CN: 设置 LILO 或 GRUB 密码

en: To make sure that this cannot happen, you should set a password for the boot loader. You can choose between a global password or a password for a certain image.
zh_CN: 您应该为启动加载器设置一个密码以确保这类事情不会发生. 您可以选择设置全局密码或为某个影像设置密码.

en: Linux 2.6 kernels provide a way to access a root shell while booting which will be presented during loading the initramfs on error. This is helpful to permit the administrator to enter a rescue shell with root permissions. This shell can be used to manually load modules when autodetection fails. This behavior is the default for <command>initramfs-tools</command> generated initramfs. The following message will appear:
zh_CN: Linux2.4 kernel 在加载了 cramfs 文件系统后, 提供一个访问 root shell 的方法, 加载cramf文件系统后, 将要启动的时候, 出现提示信息, 此时允许管理员输入具有 root 权限的可执行 shell 命令, 通常用于自动检测失败后手动装载模块. 缺省为 <command>initrd</command> 的 <filename>linuxrc</filename>. 随后出现如下信息:

en: Remove root prompt on the kernel
zh_CN: 取消 root 的提示等待

en: In order to remove this behavior you need to change <filename>/etc/mkinitrd/mkinitrd.conf</filename> and set:
zh_CN: 可以通过编辑 <filename>/etc/mkinitrd/mkinitrd.conf</filename> 做如下设置, 来修改这一特性:

en: Then regenerate your ramdisk image. You can do this for example with:
zh_CN: 然后重新生成您的 ramdisk image. 例如您可以这样做:

en: or (preferred):
zh_CN: 或 (推荐):

en: Restricting console login access
zh_CN: 限制控制台登录

en: When using PAM, other changes to the login process, which might include restrictions to users and groups at given times, can be configured in <filename>/etc/pam.d/login</filename>. An interesting feature that can be disabled is the possibility to login with null (blank) passwords. This feature can be limited by removing <emphasis>nullok</emphasis> from the line:
zh_CN: 使用 PAM 时, 可以通过配置 <filename>/etc/pam.d/login</filename> 文件来完成对于登录过程的其他更改, 这可能包括用户和组给定时间的约束. 很重要的一个特性是, 可以禁止空密码. 这一特性可以通过把下行中的 <emphasis>nullok</emphasis> 删除来实现:

en: Restricting system reboots through the console
zh_CN: 限制系统通过控制台重起

en: Mounting partitions the right way
zh_CN: 正确的挂接分区

en: can be circumvented easily
zh_CN: 很容易绕过

en: The following is a more thorough example. A note, though: <filename>/var</filename> could be set noexec, but some software <footnote><para>Some of this includes the package manager <application>dpkg</application> since the installation (post,pre) and removal (post,pre) scripts are at <filename>/var/lib/dpkg/</filename> and Smartlist</para></footnote> keeps its programs under in <filename>/var</filename>. The same applies to the nosuid option.
zh_CN: 下边是一个更加详尽的例子. 注意, 虽然: <filename>/var</filename> 可以被设为 noexec, 但一些软件<footnote><para>这包括软件包管理工具 <application>dpkg</application> 因为安装 (post,pre) 和删除 (post,pre) 脚本在 <filename>/var/lib/dpkg/</filename> 下 和 Smartlist</para></footnote>把它们的程序存放在 <filename>/var</filename> 目录下. nosuid 选项也是一样.

en: Setting <filename>/tmp</filename> noexec
zh_CN: 将 <filename>/tmp</filename> 设为 noexec

en: Setting /usr read-only
zh_CN: 设置 /usr 为只读

en: To do this modify <filename>/etc/apt/apt.conf</filename> and add:
zh_CN: 修改 <filename>/etc/apt/apt.conf</filename> 并加入:

en: Providing secure user access
zh_CN: 提供安全的用户访问

en: User authentication: PAM
zh_CN: 用户认证: PAM

en: Each application with PAM support provides a configuration file in <filename>/etc/pam.d/</filename> which can be used to modify its behavior:
zh_CN: 每个带有PAM支持的服务在 <filename>/etc/pam.d/</filename> 下都有一个配置文件, 可以通过修改它来完成配置:

en: what backend is used for authentication.
zh_CN: 认证使用什么样的后端.

en: what backend is used for sessions.
zh_CN: 会话使用什么样的后端.

en: how do password checks behave.
zh_CN: 如何进行密码检测.

en: To make sure that the user root can only log into the system from local terminals, the following line should be enabled in <filename>/etc/pam.d/login</filename>:
zh_CN: 可以在 <filename>/etc/pam.d/login</filename> 中加入一下行, 以确保 root 用户只能从本地终端登录:

en: This makes sure that only people from the group "wheel" can use <command>su</command> to become root. Other users will not be able to become root. In fact they will get a denied message if they try to become root.
zh_CN: 以确保只有组 "wheel" 的用户可以使用 <command>su</command> 成为root. 其它用户不能成为 root. 事实上如果他们试图成为 root 将会得到一条拒绝信息.

en: These lines will provide a good default configuration for all applications that support PAM (access is denied by default).
zh_CN: 这些内容为所有的支持 PAM 的应用程序提供了很不错的默认设置(默认访问拒绝).

en: Limiting resource usage: the <filename>limits.conf</filename> file
zh_CN: 资源的限制使用: <filename>limits.conf</filename> 文件

en: For more information read:
zh_CN: 更多信息请阅读:

en: User login actions: edit <filename>/etc/login.defs</filename>
zh_CN: 用户登录: 编辑 <filename>/etc/login.defs</filename>

en: If you enable this variable, failed logins will be logged. It is important to keep track of them to catch someone who tries a brute force attack.
zh_CN: 如果您使用这个变量, 将会记录失败的登录. 这对跟踪尝试暴力攻击者非常重要.

en: This one enables logging of <command>su</command> attempts to <filename>syslog</filename>. Quite important on serious machines but note that this can create privacy issues as well.
zh_CN: 启用这个参数将在 <filename>syslog</filename> 中记录试图 <command>su</command> 的操作. 对于重要的机器这相当重要, 同时也要注意这可能引起保密性问题.

en: Restricting ftp: editing <filename>/etc/ftpusers</filename>
zh_CN: 限制ftp: 编辑 <filename>/etc/ftpusers</filename>

en: The <filename>/etc/ftpusers</filename> file contains a list of users who are not allowed to log into the host using ftp. Only use this file if you really want to allow ftp (which is not recommended in general, because it uses clear-text passwords). If your daemon supports PAM, you can also use that to allow and deny users for certain services.
zh_CN: 文件 <filename>/etc/ftpusers</filename> 包含不允许使用 ftp 登录主机的用户名单. 如果你真的想允许 ftp 就使用这个文件(通常不推荐使用, 因为它使用明文传送密码). 如果您的守护进程支持 PAM, 您也可用它来定义某些服务对用户的允许和拒绝.

en: FIXME (BUG): Is it a bug that the default <filename>ftpusers</filename> in Debian does <emphasis>not</emphasis> include all the administrative users (in <application>base-passwd</application>).
zh_CN: FIXME(BUG): 这是一个缺陷，Debian 中缺省的 <filename>ftpusers</filename> 不包括所有管理员用户(在 <application>base-passwd</application> 中).

en: Using su
zh_CN: 使用 su

en: If you really need users to become the super user on your system, e.g. for installing packages or adding users, you can use the command <command>su</command> to change your identity. You should try to avoid any login as user root and instead use <command>su</command>. Actually, the best solution is to remove <command>su</command> and switch to the <command>sudo</command> mechanism which has a broader logic and more features than <command>su</command>. However, <command>su</command> is more common as it is used on many other Unices.
zh_CN: 如果您真的需要系统中的用户变为超级用户, 例如, 安装软件包或增加用户, 您可以使用 <command>su</command> 命令来改变身份. 您应该设法避免任何人使用 root 登录系统, 而应当使用su. 实际上, 最好的解决办法是删除 <command>su</command>, 而是使用 <command>sudo</command>, 因为它比 <command>su</command> 有更多特点. 但是, <command>su</command> 在类unix系统上 更具通用性.

en: Using sudo
zh_CN: 使用 sudo

en: Disallow remote administrative access
zh_CN: 禁止管理员远程访问

en: You should also modify <filename>/etc/security/access.conf</filename> to disallow remote logins to administrative accounts. This way users need to invoke <command>su</command> (or <command>sudo</command>) to use any administrative powers and the appropriate audit trace will always be generated.
zh_CN: 您应当修改 <filename>/etc/security/access.conf</filename> 以禁止管理员远程登录. 这样用户就需要使用 <command>su</command> (或 <command>sudo</command>), 无论本地用户什么时候使用管理员权限, 就都可以进行跟踪了.

en: You need to add the following line to <filename>/etc/security/access.conf</filename>, the default Debian configuration file has a sample line commented out:
zh_CN: 您需要在 <filename>/etc/security/access.conf</filename> 中加入如下行, 缺省的 Debian 配置文件中这一行被注释掉了:

en: Restricting users's access
zh_CN: 限制用户访问

en: Sometimes you might think you need to have users created in your local system in order to provide a given service (pop3 mail service or ftp). Before doing so, first remember that the PAM implementation in Debian GNU/Linux allows you to validate users with a wide variety of external directory services (radius, ldap, etc.) provided by the libpam packages.
zh_CN: 有时候您也许认为需要创建本地用户以执行特定的服务(pop3 邮件服务或 ftp). 动手前, 首先记得, Debian GNU/Linux 系统中的 PAM 工具允许使用各种外部地址服务器提供的 libpam 软件包来认证用户(radius, ldap, 等等).

en: If you wish to restrict <emphasis>when</emphasis> users can access the system you will have to customize <filename>/etc/security/access.conf</filename> for your needs.
zh_CN: 如果您要对通过 ssh 访问你的系统的用户有所限制, 可以按照自己的需求来编辑 <filename>/etc/security/access.conf</filename> .

en: Information on how to <command>chroot</command> users accessing the system through the <command>ssh</command> service is described in <xref linkend="chroot-ssh-env" />.
zh_CN: 关于 <command>chroot</command> 用户如何通过 <command>ssh</command> 服务访问系统的内容参见<xref linkend="chroot-ssh-env" />.

en: User auditing
zh_CN: 用户检测

en: If you are really paranoid you might want to add a system-wide configuration to audit what the users are doing in your system. This sections presents some tips using diverse utilities you can use.
zh_CN: 如果您是个偏执狂, 也许希望添加一个系统范围的配置文件来来检测用户在您的系统里所做的操作. 本部分提供一些不同工具使用的小窍门.

en: Input and output audit with script
zh_CN: 输入输出检测脚本

en: You can use the <command>script</command> command to audit both what the users run and what are the results of those commands. You cannot setup <command>script</command> as a shell (even if you add it to <filename>/etc/shells</filename>). But you can have the shell initialization file run the following:
zh_CN: 您可以使用本 <command>script</command> 命令来审核用户运行的命令和这些命令的输出. 您不能把 <command>script</command> 配置为一个 shell(即使您把它添加到 <filename>/etc/shells</filename> 中). 但是您可以配置 shell 的初始化程序运行下边的内容:

en: Of course, if you do this system wide it means that the shell would not continue reading personal initialization files (since the shell gets overwritten by <command>script</command>). An alternative is to do this in the user's initialization files (but then the user could remove this, see the comments about this below)
zh_CN: 当然, 如果您要在系统范围内设置, 那就意味着 shell不嗯个连续的读取个人初始化文件(因为 shell已经被 <command>script</command> 修改). 另一种可用的方法是在用户的初始化文件中完成这一工作(但, 这样的话用户就可能将其删除, 参阅下边的内容)

en: You also need to setup the files in the audit directory (in the example <filename>/var/log/sessions/</filename>) so that users can write to it but cannot remove the file. This could be done, for example, by creating the user session files in advance and setting them with the <emphasis>append-only</emphasis> flag using <command>chattr</command>.
zh_CN: 您还需要在检测目录中(这个例子中是 <filename>/var/log/sessions/</filename>)配置此文件, 这样用户就可写入内容, 但是不能删除. 例如, 可以通过预先创建用户会话文件, 并用 <command>chattr</command> 设置 <emphasis>append-only</emphasis> 标志来完成这一配置.

en: A useful alternative for sysadmins, which includes date information would be:
zh_CN: 另一个对系统管理有用的方案, 其包括日期信息:

en: Using the shell history file
zh_CN: 使用 shell 的历史记录文件

en: Complete user audit with accounting utilities
zh_CN: 使用帐号工具完成用户检测

en: The previous example is a simple way to configure user auditing but might be not useful for complex systems or for those in which users do not run shells at all (or exclusively). If this is your case, you need to look at <application>acct</application>, the accounting utilities. These utilities will log all the commands run by users or processes in the system, at the expense of disk space.
zh_CN: 前边的例子是一个配置用户检测的简单方法, 但是对于复杂系统或用户根本就不(或很少)使用 shell 的系统, 用处不大. 如果碰到这种情况, 您需要求助于<application>acct</application>, 这个帐号检测工具. 这个工具会在空闲磁盘上记录用户或系统进程运行的所有命令.

en: When activating accounting, all the information on processes and users is kept under <filename>/var/account/</filename>, more specifically in the <filename>pacct</filename>. The accounting package includes some tools (<command>sa</command>, <command>ac</command> and <command>lastcomm</command>) to analyse this data.
zh_CN: 当启用的帐号, 所有的有关进程和用的信息保存在 <filename>/var/account/</filename> 目录下, 更确切的是在 <filename>pacct</filename> 中. 这个帐号软件包包括一些分析这些数据的工具(<command>sa</command> 和 <command>ac</command>).

en: Other user auditing methods
zh_CN: 其它的用户检测方法 为 <filename>.profile</filename> 文件设置 <emphasis>inmutable</emphasis> 标志位(同样用到 <command>chattr</command>)是个不错的选择

en: Reviewing user profiles
zh_CN: 检查用户的 profile

en: If you want to <emphasis>see</emphasis> what users are actually doing when they logon to the system you can use the <filename>wtmp</filename> database that includes all login information. This file can be processed with several utilities, amongst them <command>sac</command> which can output a profile on each user showing in which timeframe they usually log on to the system.
zh_CN: 如果您要<emphasis>查看</emphasis>用户通常在做些什么, 可以在用户连入时使用包括所有登录信息的 <filename>wtmp</filename> 数据库. 有几个工具可以处理这个文件, 其中 <command>sac</command> 可以对每个用户产生一个 profile 文件，显示此用户经常登录的时间段.

en: In case you have accounting activated, you can also use the tools provided by it in order to determine when the users access the system and what do they execute.
zh_CN: 如果您启用了记账系统, 您还可以用其提供的工具来确定用户的登录时间和执行的命令.

en: Setting users umasks
zh_CN: 设置用户的 umask

en: Limiting what users can see/access
zh_CN: 限制用户查看/访问的内容

en: If you need to grant users access to the system with a shell think about it very carefully. A user can, by default unless in a severely restricted environment (like a <literal>chroot</literal> jail), retrieve quite a lot of information from your system including:
zh_CN: 如果您需要授予用户通过 shell 访问系统的权限, 应该仔细考虑清楚. 一个用户, 除非是在非常苛刻的环境下(如 <literal>chroot</literal> jail) ，可以查看有关您系统的许多信息，包括:

en: your installed packages, either by looking at the package database, at the <filename>/usr/share/doc</filename> directory or by guessing by looking at the binaries and libraries installed in your system.
zh_CN: 通过查看软件包数据库, 或者查看<filename>/usr/share/doc</filename>目录, 或通过查看您系统中的二进制文件和库, 来猜测您所安装的软件包.

en: What can a user see in your system? Probably quite a lot of things, try this (take a deep breath):
zh_CN: 一个用户在您的系统里可以看到什么? 可能许多东西, 试试这个(先做一下深呼吸):

en: Limiting access to other user's information
zh_CN: 限制用户对于其他用户信息的访问

en: If you still grant shell access to users you might want to limit what information they can view from other users. Users with shell access have a tendency to create quite a number of files under their $HOMEs: mailboxes, personal documents, configuration of X/GNOME/KDE applications...
zh_CN: 如果您允许用户通过 shell 访问, 但是想限制其对于其他用户信息的查看. 用户通过 shell 访问会在其主目录下产生很多文件: 邮箱, 个人文件, X/GNOME/KDE 应用程序的配置文件...

en: In Debian each user is created with one associated group, and no two users belong to the same group. This is the default behavior: when an user account is created, a group of the same name is created too, and the user is assigned to it. This avoids the concept of a common <emphasis>users</emphasis> group which might make it more difficult for users to hide information from other users.
zh_CN: 在Debian中每个用户创建是都产生一个附加组, 并且没有两个用户属于同一个组. 这是缺省设置: 当 userX 创建时, 产生一个他所属的名为 userX 组. 这样可以避免因为<emphasis>用户</emphasis>组的概念, 难以对其他用户隐藏信息.

en: Generating user passwords
zh_CN: 生成用户密码

en: There are many cases when an administrator needs to create many user accounts and provide passwords for all of them. Of course, the administrator could easily just set the password to be the same as the user's account name, but that would not be very sensitive security-wise. A better approach is to use a password generating program. Debian provides <application>makepasswd</application>, <application>apg</application> and <application>pwgen</application> packages which provide programs (the name is the same as the package) that can be used for this purpose. <command>Makepasswd</command> will generate true random passwords with an emphasis on security over pronounceability while <command>pwgen</command> will try to make meaningless but pronounceable passwords (of course this might depend on your mother language). <command>Apg</command> has algorithms to provide for both (there is a client/server version for this program but it is not included in the Debian package).
zh_CN: 很多情况下, 管理员需要创建多个账号, 并为其设置密码. 当然, 管理员可以简单的将其设为与用户账号相同, 但是这是非常不明智的. 一个比较好的办法是使用密码生成程序. Debian提供了 <application>makepasswd</application>, <application>apg</application> 和 <application>pwgen</application> 软件包(程序名与包名相同). <command>Makepasswd</command> 可以产生注重于安全而不是可读性的真正的随机密码, <command>pwgen</command> 则试图产生无意义但具有可读性的密码. <command>apg</command> 则同时提供了这两种算法 (这个程序还有个C/S版本, 但其并不在 Debian 软件包中提供).

en: Checking user passwords
zh_CN: 用户密码检查

en: User passwords can sometimes become the <emphasis>weakest link</emphasis> in the security of a given system. This is due to some users choosing weak passwords for their accounts (and the more of them that have access to it the greater the chances of this happening). Even if you established checks with the cracklib PAM module and password limits as described in <xref linkend="auth-pam" /> users will still be able to use weak passwords. Since user access might include remote shell access (over <command>ssh</command>, hopefully) it's important to make password guessing as hard as possible for the remote attackers, especially if they were somehow able to collect important information such as usernames or even the <filename>passwd</filename> and <filename>shadow</filename> files themselves.
zh_CN: 有时用户密码可能是一个特定系统的安全中<emphasis>最弱的</emphasis>一环. 这归结于一些用户为他们的账户选择了弱密码 (越弱，则被攻击的可能性越大). 既使您创建了使用 cracklib PAM 模块的检测和密码限制，如在 <xref linkend="auth-pam" /> 中所述. 用户仍然可以使用弱密码. 因为访问也许包括远程 shell 访问(<command>ssh</command>, 希望是), 一个远程攻击(在他们用其他的方法做过用户枚举之后)无法猜测用户密码是非常重要的, 特别是如果他们不知什么原因收集到了类似用户名甚至 <filename>passwd</filename> 和 <filename>shadow</filename> 文件本身等重要信息.

en: Logging off idle users
zh_CN: 注销闲置的用户

en: Idle users are usually a security problem, a user might be idle maybe because he's out to lunch or because a remote connection hung and was not re-established. For whatever the reason, idle users might lead to a compromise:
zh_CN: 闲置用户通常是一个安全隐患, 用户闲置, 可能因为他外出午餐, 或远程连接断掉, 但是没有重新建立. 无论什么原因，闲置用户可能导致系统受到威胁:

en: because the user's console might be unlocked and can be accessed by an intruder.
zh_CN: 因为用户的控制台或许没有锁定，可能被入侵者所利用.

en: Some remote systems have even been compromised through an idle (and detached) <command>screen</command>.
zh_CN: 一些远程系统甚至因为闲置的(分离的)<command>屏幕</command>而受到威胁.

en: Automatic disconnection of idle users is usually a part of the local security policy that must be enforced. There are several ways to do this:
zh_CN: 强制断开闲置的用户是本地安全策略的一部分. 有以下几种方式:

en: Install <application>timeoutd</application> and configure <filename>/etc/timeouts</filename> according to your local security policy. The daemon will watch for idle users and time out their shells accordingly.
zh_CN: 安装 <application>timeoutd</application> 并根据您的本地安全策略配置 <filename>/etc/timeouts</filename>. 守护进程将监视闲置用户，在 shell 之外对其记时.

en: Install <application>autolog</application> and configure it to remove idle users.
zh_CN: 安装 <application>autolog</application> 并配置其删除闲置用户.

en: The <command>timeoutd</command> or <command>autolog</command> daemons are the preferred method since, after all, users can change their default shell or can, after running their default shell, switch to another (uncontrolled) shell.
zh_CN: 使用 <command>timeoutd</command> 或 <command>autolog</command> 守护进程是不错的方法, 因为, 终究, 用户可以修改其缺省 shell，或运行默认 shell 以后，切换到其他的(未受控制的) shell.

en: Using tcpwrappers
zh_CN: 使用 tcpwrappers

en: Many services installed in Debian are either:
zh_CN: Debian 中安装的很多服务可以:

en: launched through the tcpwrapper service (<filename>tcpd</filename>)
zh_CN: 通过 tcpwrapper(<filename>tcpd</filename>)服务加载

en: compiled with libwrapper support built-in.
zh_CN: 通过编入libwrapper 来内建支持.

en: Take this into account when running <command>tcpdchk</command> (a very useful TCP wrappers config file rule and syntax checker). When you add stand-alone services (that are directly linked with the wrapper library) into the <filename>hosts.deny</filename> and <filename>hosts.allow</filename> files, <command>tcpdchk</command> will warn you that it is not able to find the mentioned services since it only looks for them in <filename>/etc/inetd.conf</filename> (the manpage is not totally accurate here).
zh_CN: 考虑到 <command>tcpchk</command>(非常有用的 CP wrappers 配置文件规则和符号检查器)的运行. 当您在 <filename>hosts.deny</filename> 和 <filename>hosts.allow</filename> 文件中添加独立的服务时(它们时 wrapper 库的符号连接), <command>tcpdchk</command>会因找不到那些服务而发出警告, 因为它通过 <filename>/etc/inetd.conf</filename> 查找(联机手册 不是很准确).

en: <emphasis>Beware</emphasis>: The above printed example is open to a DoS attack by making many connections in a short period of time. Many emails mean a lot of file I/O by sending only a few packets.
zh_CN: <emphasis>当心</emphasis>: 上边的例子对于短时间内建立许多连接的 Dos 攻击是开放的. 很多邮件就意味着很少的数据包就会浪费大量的文件 I/O.

en: The importance of logs and alerts
zh_CN: 日志与警告的重要性

en: It is easy to see that the treatment of logs and alerts is an important issue in a secure system. Suppose a system is perfectly configured and 99% secure. If the 1% attack occurs, and there are no security measures in place to, first, detect this and, second, raise alarms, the system is not secure at all.
zh_CN: 显而易见, 日志和警告对于一个安全的系统非常重要. 假设一个系统配置的非常完美并且 99% 的安全, 当 1% 的攻击发生时, 如果没有到位的安全工具, 首先, 检测到, 其次, 发出警告, 那么这个系统根本就不安全.

en: Using and customizing <command>logcheck</command>
zh_CN: 使用和定制 <command>logcheck</command>

en: The <command>logcheck</command> package in Debian is divided into the three packages <application>logcheck</application> (the main program), <application>logcheck-database</application> (a database of regular expressions for the program) and <application>logtail</application> (prints loglines that have not yet been read). The Debian default (in <filename>/etc/cron.d/logcheck</filename>) is that <command>logcheck</command> is run every hour and after reboots.
zh_CN: 在 Debian中, <command>logcheck</command> 分为三部分, <application>logcheck</application>(主程序), <application>logcheck-database</application>(程序的正则表达式库)和 <application>logtail</application> (打印未读的日志内容). 在 Debian 中缺省(<filename>/etc/cron.d/logcheck</filename>)<command>logcheck</command> 系统空闲时每小说运行一次和系统重起时运行一次.

en: This tool can be quite useful if properly customized to alert the administrator of unusual system events. <command>Logcheck</command> can be fully customized so that it sends mails based on events found in the logs and worthy of attention. The default installation includes profiles for ignored events and policy violations for three different setups (workstation, server and paranoid). The Debian package includes a configuration file <filename>/etc/logcheck/logcheck.conf</filename>, sourced by the program, that defines which user the checks are sent to. It also provides a way for packages that provide services to implement new policies in the directories: <filename>/etc/logcheck/cracking.d/_packagename_</filename>, <filename>/etc/logcheck/violations.d/_packagename_</filename>, <filename>/etc/logcheck/violations.ignore.d/_packagename_</filename>, <filename>/etc/logcheck/ignore.d.paranoid/_packagename_</filename>, <filename>/etc/logcheck/ignore.d.server/_packagename_</filename>, and <filename>/etc/logcheck/ignore.d.workstation/_packagename_</filename>. However, not many packages currently do so. If you have a policy that can be useful for other users, please send it as a bug report for the appropriate package (as a <emphasis>wishlist</emphasis> bug). For more information read <filename>/usr/share/doc/logcheck/README.Debian</filename>.
zh_CN: 如果配置合适, 这个工具可能对于管理员发现系统的异常事件相当有用. <command>Logcheck</command> 可以设置为, 从日志中发现值得注意的事件, 并发送邮件. 默认安装的profile忽略事件和违规策略, 分为三种不同的设定 (workstation, server, paranoid). Debian的软件包包括一个<filename>/etc/logcheck/logcheck.conf</filename>, 源自程序,用于定义检查给哪些用户发送邮件. 它还为软件包在以下目录下实现新的策略提供了一种方法: <filename>/etc/logcheck/cracking.d/_packagename_</filename>, <filename>/etc/logcheck/violations.d/_packagename_</filename>, <filename>/etc/logcheck/violations.ignore.d/_packagename_</filename>, <filename>/etc/logcheck/ignore.d.paranoid/_packagename_</filename>, <filename>/etc/logcheck/ignore.d.server/_packagename_</filename>, 和 <filename>/etc/logcheck/ignore.d.workstation/_packagename_</filename>. 但是, 并非当前的包都是如此. 如果您有一种对其他用户有用的策略. 请将其作为对应软件包的一个问题报告提交 (作为一个<emphasis>wishlist</emphasis>问题). 更多信息请参阅<filename>/usr/share/doc/logcheck/README.Debian</filename>.

en: The best way to configure <command>logcheck</command> is to edit its main configuration file <filename>/etc/logcheck/logcheck.conf</filename> after installation. Change the default user (root) to whom reports should be mailed. You should set the reportlevel in there, too. <application>logcheck-database</application> has three report levels of increasing verbosity: workstation, server, paranoid. "server" being the default level, paranoid is only recommended for high-security machines running as few services as possible and workstation for relatively sheltered, non-critical machines. If you wish to add new log files just add them to <filename>/etc/logcheck/logcheck.logfiles</filename>. It is tuned for default syslog install.
zh_CN: 最佳的配置 <command>logcheck</command> 的方式是安装后, 编辑其配置文件 <filename>/etc/logcheck/logcheck.conf</filename> 将缺省用户(root)修改为邮件接收者. 您还需要设置报告级别:<application>logcheck-database</application>有三种报告级别: workstation, server, paranoid. "server" 为缺省级别, paranoid 只有在运行着尽可能少的服务的高安全性机器上才需要, workstation 使用于, 受保护的安全性不高的机器. 如果您想补充日志文件, 将其加入<filename>/etc/logcheck/logcheck.logfiles</filename>即可. 这对于默认的 syslog 安装来说是适宜的.

en: Configuring where alerts are sent
zh_CN: 配置警告发送地

en: For example, sending messages to the console also is an interesting setup useful for many production-level systems. But for many such systems it is also important to add a new machine that will serve as loghost (i.e. it receives logs from all other systems).
zh_CN: 例如, 发送信息至控制台就是一个很棒的设定, 对生产系统很有用. 但是为多个这种系统增加一台设备作为日志主机(即从其他系统接收日志)也是非常重要.

en: Root's mail should be considered also, many security controls (like <application>snort</application>) send alerts to root's mailbox. This mailbox usually points to the first user created in the system (check <filename>/etc/aliases</filename>). Take care to send root's mail to some place where it will be read (either locally or remotely).
zh_CN: 也应当被考虑 root 的邮件, 许多安全控制台(象 <application>snort</application>) 发送警告信息到 root 的邮箱. 这个邮箱通常是指系统创建的第一个用户(检查 <filename>/etc/aliases</filename>). 注意要把 root 的邮件发送到他能接收的地方(本地或远程).

en: There are other role accounts and aliases on your system. On a small system, it's probably simplest to make sure that all such aliases point to the root account, and that mail to root is forwarded to the system administrator's personal mailbox.
zh_CN: 在您的系统里还有其他的角色账号和别名. 在一个小型系统里, 将所有这类别名指向 root 账号并将给 root 的邮件转送的系统管理员的个人邮箱应当非常简单.

en: Using a loghost
zh_CN: 使用日志主机

en: to
zh_CN: 改为

en: Next, configure the other machines to send data to the loghost. Add an entry like the following to <filename>/etc/syslog.conf</filename>:
zh_CN: 其次, 配置其它机器发送数据到日志主机. 在<filename>/etc/syslog.conf</filename> 中增加如下类似内容:

en: See the documentation for what to use in place of <emphasis>facility</emphasis> and <emphasis>level</emphasis> (they should not be entered verbatim like this). If you want to log everything remotely, just write:
zh_CN: 查找文献, 看用什么可以替代 <emphasis>facility</emphasis> 和 <emphasis>level</emphasis> (它们不应当象这样逐字输入). 如果您要纪录远程的所有信息, 仅需这样写:

en: Log file permissions
zh_CN: 日志文件的权限

en: Some log file permissions are not perfect after the installation (but of course this really depends on your local security policy). First <filename>/var/log/lastlog</filename> and <filename>/var/log/faillog</filename> do not need to be readable by normal users. In the <filename>lastlog</filename> file you can see who logged in recently, and in the <filename>faillog</filename> you see a summary of failed logins. The author recommends <command>chmod 660</command> for both. Take a brief look at your log files and decide very carefully which log files to make readable/writable for a user with a UID other than 0 and a group other than 'adm' or 'root'. You can easily check this in your system with:
zh_CN: 系统安装后, 一些日志文件的权限并不理想(但这当然取决于你的本地安全策略). 首先 <filename>/var/log/lastlog</filename> 和 <filename>/var/log/faillog</filename> 对于普通用户不应当是可读的. 在 <filename>lastlog</filename> 文件中您会看到最近谁登录了, 在 <filename>faillog</filename> 中, 您则能看到失败的登录列表. 作者推荐修改两个文件<command>chmod 660</command>. 检查一下您的日志文件，然后谨慎的确定对哪个 UID 不为0且不属于 'adm' 或 'root' 组的用户设置 可读/可写 权限. 您可以简单运行下边的命令, 对您的系统做出检查:

en: To customize how log files are created you will probably have to customize the program that generates them. If the log file gets rotated, however, you can customize the behavior of creation and rotation.
zh_CN: 为了定制日志文件的创建, 您可能需要定制生成它们的程序. 如果日志文件是轮换的, 您则需要定制创建和轮换性能.

en: Adding kernel patches
zh_CN: 增加内核补丁

en: Debian GNU/Linux provides some of the patches for the Linux kernel that enhance its security. These include:
zh_CN: Debian GNU/Linux 为 Linux 内核提供了一些增强其安全性的补丁。 它们包括:

en: Protecting against buffer overflows
zh_CN: 保护免受缓冲溢出

en: There are mainly four methods to protect against buffer overflows:
zh_CN: 主要有四中方法保护免受缓冲溢出:

en: fix the source code by using tools to find fragments of it that might introduce this vulnerability.
zh_CN: 使用工具查找源码中易受攻击的片断, 并修正它.

en: Kernel patch protection for buffer overflows
zh_CN: 内核补丁对缓冲溢出的保护

en: Testing programs for overflows
zh_CN: 程序的溢出测试

en: Secure file transfers
zh_CN: 文件的安全传送

en: Any of these methods need special clients. Debian does provide client software, such as <command>scp</command> from the <application>ssh</application> package, which works like <command>rcp</command> but is encrypted completely, so the <emphasis>bad guys</emphasis> cannot even find out WHAT you copy. There is also a <application>ftp-ssl</application> package for the equivalent server. You can find clients for these software even for other operating systems (non-UNIX), <command>putty</command> and <command>winscp</command> provide secure copy implementations for any version of Microsoft's operating system.
zh_CN: 当然, 这些方法都需要特殊的客户端. Debian 提供了这类客户端，如 <application>ssh</application> 提供了 <command>scp</command>. 其使用如 <command>rcp</command>, 但是是完全加密的, 因此那些<emphasis>坏家伙</emphasis> 甚至不能发现您在复制什么. 还有一个对应的服务器的 <application>ftp-ssl</application> 客户端软件包. 您可以找到这些软件的客户端, 甚至是基于其他操作系统(非Unix), <command>putty</command> 和 <command>winscp</command> 是基于微软操作系统任何版本的安全复制工具.

en: Note that using <command>scp</command> provides access to the users to all the file system unless <command>chroot</command>'ed as described in <xref linkend="ssh-chroot" />. FTP access can be <command>chroot</command>'ed, probably easier depending on you chosen daemon, as described in <xref linkend="ftp-secure" />. If you are worried about users browsing your local files and want to have encrypted communication you can either use an ftp daemon with SSL support or combine clear-text ftp and a VPN setup (see <xref linkend="vpn" />).
zh_CN: 注意, 用户可以使用 <command>scp</command> 对所有文件系统进行访问, 除非使用了如<xref linkend="ssh-chroot" />中描述的 <command>chroot</command>. FTP访问可以设置为 <command>chroot</command>， 基于您选择的守护进程或许更容易，如<xref linkend="ftp-secure" />中所述. 如果担心用户浏览您的本地文件, 并想进行加密通讯, 您可以使用带有 SSL 支持的 ftp 守护进程, 或结合明码通信的 ftp 和 VPN 的设定(参阅 <xref linkend="vpn" />).

en: Using quotas
zh_CN: 使用配额

en: Having a good quota policy is important, as it keeps users from filling up the hard disk(s).
zh_CN: 有一个好的配额策略是很重要的，因为它可以防止用户填满硬盘.

en: You can use two different quota systems: user quota and group quota. As you probably figured out, user quota limits the amount of space a user can take up, group quota does the equivalent for groups. Keep this in mind when you're working out quota sizes.
zh_CN: 您可以使用两个不同的配额系统: 用户配额和组配额. 就象您所猜到的, 用户配额是指限制用户磁盘空间的占用量, 组配额则是限制组的. 在你设置配额时这一点要记清楚.

en: There are a few important points to think about in setting up a quota system:
zh_CN: 在设置配额时有几个需要考虑的关键点:

en: Keep the quotas small enough, so users do not eat up your disk space.
zh_CN: 使得配额尽量小, 防止用户吃光您的硬盘空间.

en: Keep the quotas big enough, so users do not complain or their mail quota keeps them from accepting mail over a longer period.
zh_CN: 使得配额足够大，防止用户抱怨或邮件配额使他们可以长时间的保留邮件.

en: Use quotas on all user-writable areas, on <filename>/home</filename> as well as on <filename>/tmp</filename>.
zh_CN: 在所有用户可写范围内使用配额, <filename>/home</filename> 以及 <filename>/tmp</filename>.

en: Every partition or directory to which users have full write access should be quota enabled. Calculate and assign a workable quota size for those partitions and directories which combines usability and security.
zh_CN: 用户具有完全写权限的每个分区和目录都应该启用配额设置. 结合实用性和安全性, 来计算和分配这些分区和目录的可用配额大小.

en: So, now you want to use quotas. First of all you need to check whether you enabled quota support in your kernel. If not, you will need to recompile it. After this, control whether the package <application>quota</application> is installed. If not you will need this one as well.
zh_CN: 那么, 现在您想使用配额了. 首先, 需要检查您是否在内核中启用配额支持. 如果没有, 您需要重新编译内核. 然后, 是否安装了控制 <application>quota</application> 的软件包. 如果没有请安装.

en: In addition to the usual Unix permissions, the ext2 and ext3 filesystems offer a set of specific attributes that give you more control over the files on your system. Unlike the basic permissions, these attributes are not displayed by the usual <command>ls -l</command> command or changed using <command>chmod</command>, and you need two other utilities, <command>lsattr</command> and <command>chattr</command> (in package <application>e2fsprogs</application>) to manage them. Note that this means that these attributes will usually not be saved when you backup your system, so if you change any of them, it may be worth saving the successive <command>chattr</command> commands in a script so that you can set them again later if you have to restore a backup.
zh_CN: 除了通常Unix的权限, ext2 和 ext3 文件系统还提供了一套特别的属性用于控制您的文件和系统. 不同于基本的权限, 这些属性并不能通过 <command>ls -l</command> 命令显示出来, 也不能使用<command>chmod</command>命令修改, 您需要额外的两个工具 <command>lsattr</command> 和 <command>chattr</command> (在<application>e2fsprogs</application> 包中)来管理它们. 注意, 这意味着, 您在备份系统时, 通常不能保存这些属性, 所以, 如果您对它们做了任何修改, 也许可以将其有价值部分 对应的<command>chattr</command>命令写入脚本, 这样就可以在以后必需恢复系统时重新设置.

en: Among all available attributes, the two that are most important for increasing security are referenced by the letters 'i' and 'a', and they can only be set (or removed) by the superuser:
zh_CN: 在所有的属性中, 对于增强安全性最有价值的是参考字符 'i' 和 'a', 它们只能由超级用户设定(或删除):

en: The 'i' attribute ('immutable'): a file with this attribute can neither be modified nor deleted or renamed and no link can be created to it, even by the superuser.
zh_CN: 'i' 属性 ('immutable'): 带有此属性的文件, 不能被修改, 删除或重命名, 建立连接, 即使是超级用户也不能.

en: The 'a' attribute ('append'): this attribute has the same effect that the immutable attribute, except that you can still open the file in append mode. This means that you can still add more content to it but it is impossible to modify previous content. This attribute is especially useful for the log files stored in <filename>/var/log/</filename>, though you should consider that they get moved sometimes due to the log rotation scripts.
zh_CN: 'a' 属性 ('append'): 除了您能以附加的方式打开此文件外,此属性与 immutable 属性具有同样的效果. 这意味着, 您仍可以在文件中增加更多的内容, 但是不能修改以前的内容. 这个属性对于存储于 <filename>/var/log/</filename> 目录的日志文件特别有用, 尽管应该考虑到有时候根据日志循环脚本, 它们有可能被移动.

en: Set the attributes 'a' and 'i' on any file you want;
zh_CN: 对您选定的文件设置 'a' and 'i' 属性;

en: Set the 'i' attribute on this script and other startup files, as well as on the <command>lcap</command> binary itself;
zh_CN: 为此脚本和其他配置文件设置'i'属性, 包括 <command>lcap</command> 二进制文件本身;

en: Execute the above command manually (or reboot your system to make sure everything works as planned).
zh_CN: 手工执行上述命令(或重新起动您的系统确定一切如设想的一样运行).

en: Checking file system integrity
zh_CN: 文件系统的完整性检查

en: Are you sure <filename>/bin/login</filename> on your hard drive is still the binary you installed there some months ago? What if it is a hacked version, which stores the entered password in a hidden file or mails it in clear-text version all over the Internet?
zh_CN: 几个月后, 您能肯定硬盘上的 <filename>/bin/login</filename> 仍然是您安装的那个吗? 如果是一个被黑的版本, 其将输入的密码存储到隐藏的文件中, 或者以明文方式通过邮件发送到网上呢?

en: Setting up setuid check
zh_CN: 设置 setuid 检查

en: Securing network access
zh_CN: 安全的网络访问

en: Configuring kernel network features
zh_CN: 配置内核的网络特性

en: If you want to prevent you system from answering ICMP echo requests, just enable this configuration option:
zh_CN: 如果您想拦截系统里所有的 ICMP 回送请求, 启用这个配置选项:

en: To log packets with impossible addresses (due to wrong routes) on your network use:
zh_CN: 记录您网络中的地址不可用的数据包(由于错误路由):

en: This option is a double-edged sword. On the one hand it protects your system against syn packet flooding; on the other hand it violates defined standards (RFCs).
zh_CN: 这个选项是一把双刃剑. 一方面它保护您的系统免受 syn 湮灭; 另一方面它违背了定义的标准(RFCs).

en: This option will only be available if the kernel is compiled with the <literal>CONFIG_SYNCOOKIES</literal>. All Debian kernels are compiled with this option builtin but you can verify it running:
zh_CN: 此选项只有编译内核时启用 <literal>CONFIG_SYNCOOKIES</literal> 才会有效. 所有的 Debian 内核都是内置此选项编译的, 您可以运行下边的命令来确认:

en: For more information on TCP syncookies read <ulink url="http://cr.yp.to/syncookies.html" />.
zh_CN: 有关 TCP syncookies 的更多信息, 参阅 <ulink url="http://cr.yp.to/syncookies.html" />.

en: Securing the network on boot-time
zh_CN: 增强启动时网络的安全性

en: When setting configuration options for the kernel networking you need configure it so that it's loaded every time the system is restarted. The following example enables many of the previous options as well as other useful options.
zh_CN: 当设置了您需要的内核网络选项后, 那么每次重起时这些参数都会被加载. 下边的例子启用了很多前边提到的选项和其他有用的选项.

en: Configuring firewall features
zh_CN: 配置防火墙

en: Setting up firewalls in Debian is discussed more thoroughly in <xref linkend="firewall-setup" />.
zh_CN: 在 <xref linkend="firewall-setup" /> 处有关于在 Debian 中配置防火墙的更详细的讨论.

en: Disabling weak-end hosts issues
zh_CN: 禁用弱客户主机问题

en: On 2.2 (and previous) kernels this can be fixed with:
zh_CN: 在 2.2 (和更早)的内核中, 可以做如下修正:

en: On later kernels this can be fixed either with:
zh_CN: 在最新的内核中, 还可以做如下操作:

en: iptables rules.
zh_CN: iptables 规则.

en: FIXME: Submit a bug against netbase so that the routing fix is standard behavior in Debian?
zh_CN: FIXME: 提交一个 netbas 的错误, 使得 routing fix 成为Debian标准的动作?

en: Protecting against ARP attacks
zh_CN: 保护系统免受 ARP 攻击

en: When you don't trust the other boxes on your LAN (which should always be the case, because it's the safest attitude) you should protect yourself from the various existing ARP attacks.
zh_CN: 当您不再信任您的局域网内(经常会出现这种情况, 因为这才是安全的态度)的其他系统时, 您需要保护自己免受各种各样的 ARP 攻击.

en: However, there is always a solution:
zh_CN: 但是, 总有一个解决办法:

en: Implement IP traffic filtering validating the MAC address.
zh_CN: 实行确认主机MAC地址的IP通讯过滤.

en: Taking a snapshot of the system
zh_CN: 生成系统快照

en: The following script creates such a snapshot:
zh_CN: 下边的脚本将创建这样的快照:

en: Once the snapshot is done you should make sure to set the medium read-only. You can then store it for backup or place it in the drive and use it to drive a <command>cron</command> check nightly comparing the original md5sums against those on the snapshot.
zh_CN: 一旦生成了快照完, 您应当确保其被存储于只读介质上. 您也可以存储其备份, 将其置于磁盘上,用于每晚的 <command>cron</command> 检查比较.

en: Other recommendations
zh_CN: 其它建议

en: Do not use software depending on svgalib
zh_CN: 不要使用基于 svgalib 的软件

en: SVGAlib is very nice for console lovers like me, but in the past it has been proven several times that it is very insecure. Exploits against <command>zgv</command> were released, and it was simple to become root. Try to prevent using SVGAlib programs wherever possible.
zh_CN: SVGAlib 非常受控制台爱好者的喜爱, 比如我. 但是, 过去它已被多次证明是不安全的. 发布的基于 <command>zgv</command> 的 Exploits, 很容易获取root权限. 只要可能尽量避免使用 SVGAlib 程序 .
