harden-doc 3.19 - en to zh_CN translation catalogue (112 entries)

en: Securing services running on your system
zh_CN: 增强系统上运行服务的安全性

en: Services can be secured in a running system in two ways:
zh_CN: 有两种方式来增强系统中运行的服务的安全性:

en: Making them only accessible at the access points (interfaces) they need to be in.
zh_CN: 使其只能通过它们应当所在的访问点(接口)访问.

en: Configuring them properly so that they can only be used by legitimate users in an authorized manner.
zh_CN: 正确配置, 使其只能由合法的用户使用授权方式访问.

en: The following sections detail how specific individual services can be configured properly depending on their intended use.
zh_CN: 以下部分将详细介绍如何根据其用途正确的配置各项服务.

en: Securing ssh
zh_CN: ssh 安全化

en: If you are still running telnet instead of ssh, you should take a break from this manual and change this. Ssh should be used for all remote logins instead of telnet. In an age where it is easy to sniff Internet traffic and get clear-text passwords, you should use only protocols which use cryptography. So, perform an <literal>apt-get install ssh</literal> on your system now.
zh_CN: 如果您仍然使用 telnet, 而不是 ssh, 则需要改变对本手册的阅读方式. 应当用 ssh 来取代所有的 telnet 远程登录. 任何时候通过嗅探互联网通讯来获取明文密码都是相当简单的, 您应该采用使用加密算法的协议. 那么, 现在在你的系统上执行 <literal>apt-get install ssh</literal> .

en: Encourage all the users on your system to use ssh instead of telnet, or even better, uninstall telnet/telnetd. In addition you should avoid logging into the system using ssh as root and use alternative methods to become root instead, like <command>su</command> or <command>sudo</command>. Finally, the <filename>sshd_config</filename> file, in <filename>/etc/ssh</filename>, should be modified to increase security as well:
zh_CN: 鼓励您系统上的所有用户使用 ssh 取代 telnet, 或者更进一步, 卸载 telnet/telnetd. 另外您应该避免使用 ssh 以 root 身份登录, 其替代的方法是使用 <command>su</command> 或 <command>sudo</command> 转换成 root 用户. 最后, <filename>/etc/ssh</filename> 目录下的 <filename>sshd_config</filename> 文件, 应当作如下修改, 以增强安全性:

en: As a final note, be aware that these directives are from a OpenSSH configuration file. Right now, there are three commonly used SSH daemons, ssh1, ssh2, and OpenSSH by the OpenBSD people. Ssh1 was the first ssh daemon available and it is still the most commonly used (there are rumors that there is even a Windows port). Ssh2 has many advantages over ssh1 except it is released under a closed-source license. OpenSSH is completely free ssh daemon, which supports both ssh1 and ssh2. OpenSSH is the version installed on Debian when the package <application>ssh</application> is chosen.
zh_CN: 最后, 应当注意那些存放 OpenSSH 配置文件的目录. 现在, 有三种常用的 SSH 守护进程, ssh1, ssh2, 和 OpenBSD 用户使用的 OpenSSH. ssh1 是第一个可以使用的 ssh 守护进程, 并且仍然有很大的用户群(甚至谣传有windows版本). ssh2 和 ssh1 相比有更多高级特性, 但是它是基于保留源代码协议的. OpenSSH 是完全自由的 ssh 守护进程, 它支持 ssh1, 和 ssh2. OpenSSH 是在 Debian 系统中选择安装的 <application>ssh</application> 软件包.

en: Currently OpenSSH does not provide a way to chroot automatically users upon connection (the commercial version does provide this functionality). However there is a project to provide this functionality for OpenSSH too, see <ulink url="http://chrootssh.sourceforge.net" />, it is not currently packaged for Debian, though. You could use, however, the <filename>pam_chroot</filename> module as described in <xref linkend="user-restrict" />.
zh_CN: 当前的 OpenSSH 没有提供用户连接后自动完成 chroot 的方法(商业版本提供这种功能). 但是有个项目为 OpenSSH 提供这种功能，参见<ulink url="http://chrootssh.sourceforge.net" />, 尽管它不在当前 Debian 的软件包中. 然而, 您可以使用 <filename>pam_chroot</filename> 模块，如 <xref linkend="user-restrict" /> 所述.

en: Ssh clients
zh_CN: ssh 客户端

en: If you are using an SSH client against the SSH server you must make sure that it supports the same protocols that are enforced on the server. For example, if you use the <application>mindterm</application> package, it only supports protocol version 1. However, the sshd server is, by default, configured to only accept version 2 (for security reasons).
zh_CN: 如果您使用的 SSH 客户端不能访问 SSH 服务器, 则需要确认是否支持在服务器端被强制执行的协议. 例如, 如果您使用了只支持 version 1 协议的 <application>mindterm</application> 软件包. 但是 sshd 服务器默认配置为只接受 version 2 协议(基于安全的原因).

en: Disallowing file transfers
zh_CN: 禁止文件传送

en: disallow users from login to the ssh server (as described above either through the configuration file or PAM configuration).
zh_CN: 禁止用户通过 login 登录 ssh 服务器(如上所述或通过配置文件或PAM 配置).

en: Securing Squid
zh_CN: Squid 安全化

en: 
    acl all src 0.0.0.0/0.0.0.0
    acl manager proto cache_object
    acl localhost src 127.0.0.1/255.255.255.255
    acl SSL_ports port 443 563
    acl Safe_ports port 80          # http
    acl Safe_ports port 21          # ftp
    acl Safe_ports port 443 563     # https, snews
    acl Safe_ports port 70          # gopher
    acl Safe_ports port 210         # wais
    acl Safe_ports port 1025-65535  # unregistered ports
    acl Safe_ports port 280         # http-mgmt
    acl Safe_ports port 488         # gss-http
    acl Safe_ports port 591         # filemaker
    acl Safe_ports port 777         # multiling http
    acl Safe_ports port 901         # SWAT
    acl purge method PURGE
    acl CONNECT method CONNECT
    (...)
    # Only allow cachemgr access from localhost
    http_access allow manager localhost
    http_access deny manager
    # Only allow purge requests from localhost
    http_access allow purge localhost
    http_access deny purge
    # Deny requests to unknown ports
    http_access deny !Safe_ports
    # Deny CONNECT to other than SSL ports
    http_access deny CONNECT !SSL_ports
    #
    # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
    #
    http_access allow localhost
    # And finally deny all other access to this proxy
    http_access deny all
    #Default:
    # icp_access deny all
    #
    #Allow ICP queries from everyone
    icp_access allow all
zh_CN: 
    acl all src 0.0.0.0/0.0.0.0
    acl manager proto cache_object
    acl localhost src 127.0.0.1/255.255.255.255
    acl SSL_ports port 443 563
    acl Safe_ports port 80          # http
    acl Safe_ports port 21          # ftp
    acl Safe_ports port 443 563     # https, snews
    acl Safe_ports port 70          # gopher
    acl Safe_ports port 210         # wais
    acl Safe_ports port 1025-65535  # unregistered ports
    acl Safe_ports port 280         # http-mgmt
    acl Safe_ports port 488         # gss-http
    acl Safe_ports port 591         # filemaker
    acl Safe_ports port 777         # multiling http
    acl Safe_ports port 901         # SWAT
    acl purge method PURGE
    acl CONNECT method CONNECT
    (...)
    # Only allow cachemgr access from localhost
    http_access allow manager localhost
    http_access deny manager
    # Only allow purge requests from localhost
    http_access allow purge localhost
    http_access deny purge
    # Deny requests to unknown ports
    http_access deny !Safe_ports
    # Deny CONNECT to other than SSL ports
    http_access deny CONNECT !SSL_ports
    #
    # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
    #
    http_access allow localhost
    # And finally deny all other access to this proxy
    http_access deny all
    #Default:
    # icp_access deny all
    #
    #Allow ICP queries from eveyone
    icp_access allow all

en: You should also configure Squid based on your system resources, including cache memory (option <literal>cache_mem</literal>), location of the cached files and the amount of space they will take up on disk (option <literal>cache_dir</literal>).
zh_CN: 您还应当基于系统资源来配置 Squid, 包括高速缓存(<literal>cache_mem</literal>项), 本地缓存文件, 及其占用的空间大小(<literal>cache_dir</literal>项).

en: Notice that, if not properly configured, someone may relay a mail message through Squid, since the HTTP and SMTP protocols are designed similarly. Squid's default configuration file denies access to port 25. If you wish to allow connections to port 25 just add it to Safe_ports lists. However, this is <emphasis>NOT</emphasis> recommended.
zh_CN: 注意, 如果配置不当, 某些人也许可以通过 Squid 传递邮件消息, 因为HTTP和SMTP协议设计的非常相似. Squid 的默认配置文件拒绝访问 25 端口. 如果您希望允许连接 25 端口, 仅需要将其加入 Safe_ports 列表即可. 但是, 这里推荐 <emphasis>NOT</emphasis>.

en: <application>calamaris</application> - Log analyzer for Squid or Oops proxy log files.
zh_CN: <application>calamaris</application> - Squid 或 Oops 代理的日志分析工具.

en: <application>modlogan</application> - A modular logfile analyzer.
zh_CN: <application>modlogan</application> - 日志分析工具组件.

en: <application>squidtaild</application> - Squid log monitoring program.
zh_CN: <application>squidtaild</application> - Squid 日志监控程序.

en: Securing FTP
zh_CN: FTP 安全化

en: If you really have to use FTP (without wrapping it with sslwrap or inside a SSL or SSH tunnel), you should chroot ftp into the ftp users' home directory, so that the user is unable to see anything else than their own directory. Otherwise they could traverse your root file system just like if they had a shell in it. You can add the following line in your <filename>proftpd.conf</filename> in your global section to enable this chroot feature:
zh_CN: 如果您真的必须使用 FTP(没有使用 sslwarp 或插入 SSL 或使用 SSH 通道), 则应当 chroot ftp 为 ftp 用户的主目录, 这样用户就不会看到其目录以外的东西. 否则他们就可以遍历您的文件系统, 就象他们拥有这样的 shell 一样. 您应当在 <filename>proftpd.conf</filename> 中的global 部分增加以下行以启用 chroot 的这个特点:

en: Securing access to the X Window System
zh_CN: 对 X 窗口系统的安全访问

en: Today, X terminals are used by more and more companies where one server is needed for a lot of workstations. This can be dangerous, because you need to allow the file server to connect to the clients (X server from the X point of view. X switches the definition of client and server). If you follow the (very bad) suggestion of many docs, you type <literal>xhost +</literal> on your machine. This allows any X client to connect to your system. For slightly better security, you can use the command <literal>xhost +hostname</literal> instead to only allow access from specific hosts.
zh_CN: 今天, 越来越多的使用一台服务器带多台工作站的公司会使用 X 终端. 这可能是很危险的, 因为您需要允许文件服务器连接到客户端(从 X 的观点来看就是 X 服务器. X 的关键词是客户和服务器). 如果听从大多数(糟糕的)文档的建议, 在您的机器上键入 <literal>xhost +</literal>. 这将允许任何 X 客户端连接您的机器. 基于安全的考虑, 您则应当使用 <literal>xhost +hostname</literal> 命令, 仅允许指定的主机连接.

en: You can also set the default's system timeout for <command>xscreensaver</command> locks. Even if the user can override it, you should edit the <filename>/etc/X11/app-defaults/XScreenSaver</filename> configuration file and change the lock line:
zh_CN: 您还可以为<command>xscreensaver</command>锁设置默认系统超时. 既使用户能忽略它, 您应该编辑 <filename>/etc/X11/app-defaults/XScreenSaver</filename> 配置文件, 修改锁定行:

en: (which is the default in Debian) to:
zh_CN: (在Debian中是默认设置) 为:

en: FIXME: Add info on thread of debian-security on how to change config files of XFree 3.3.6 to do this.
zh_CN: FIXME: 增加debian-security 线程关于修改 XFree 3.3.6 的配置文件信息.

en: Check your display manager
zh_CN: 检查您的显示管理器

en: If you only want to have a display manager installed for local usage (having a nice graphical login, that is), make sure the XDMCP (X Display Manager Control Protocol) stuff is disabled. In XDM you can do this with this line in <literal>/etc/X11/xdm/xdm-config</literal>:
zh_CN: 如果您只想安装一个用于本地应用的显示管理器(拥有友好的图形登录界面), 应确保 XDMCP (X管理控制协议)被禁用. 在XDM中您可以在 <literal>/etc/X11/xdm/xdm-config</literal> 中加入如下行:

en: Normally, all display managers are configured not to start XDMCP services per default in Debian.
zh_CN: 通常, 在 Debian 中所有显示管理器缺省被配置成不启用始XDMCP.

en: Imagine, you arrive at work, and the printer is spitting out endless amounts of paper because someone is DoSing your line printer daemon. Nasty, isn't it?
zh_CN: 想象一下, 您刚开始工作, 打印机就开始无休止的往外吐纸, 这是因为某些人控制了打印守护进程. 很讨厌，不是吗?

en: However, even if you do this, the <command>lpr</command> daemon accepts incoming connections on port 515 of any interface. You should consider firewalling connections from networks/hosts which are not allowed printing (the <command>lpr</command> daemon cannot be limited to listen only on a given IP address).
zh_CN: 但是, 即便如此, <command>lpr</command> 守护进程仍会接收任何对 515 端口的连接. 您应当考虑屏蔽来自 networks/hosts 的连接, 他们是不允许使用打印服务的(<command>lpr</command> 守护进程不能设定为只监听指定 IP 地址).

en: <command>Lprng</command> should be preferred over <command>lpr</command> since it can be configured to do IP access control. And you can specify which interface to bind to (although somewhat weirdly).
zh_CN: 和<command>lpr</command>相比, <command>Lprng</command> 应当是更好的选择，因为它可以配置为遵从IP存取控制. 并且可以指定绑定端口(虽然有些古怪).

en: However, if you want to use <command>cups</command>, but only locally, you can configure it to bind to the loopback interface by changing <filename>/etc/cups/cupsd.conf</filename>:
zh_CN: 但是, 如果您仅希望在本地使用 <command>cups</command>, 则可以通过修改<filename>/etc/cups/cupsd.conf</filename> 以将其绑定到回送端口:

en: There are many other security options like allowing or denying networks and hosts in this config file. However, if you do not need them you might be better off just limiting the listening port. <command>Cups</command> also serves documentation through the HTTP port, if you do not want to disclose potential useful information to outside attackers (and the port is open) add also:
zh_CN: 此配置文件有许多诸如允许或禁止网络和主机的其他安全选项. 然而, 如果您并不需要这些, 则仅需要限制监听端口即可. <command>Cups</command> 也是通过 HTTP 端口来传送文档数据, 如果您不想对外部攻击者透露潜在有用信息的话(端口是开放的), 可以增加如下行:

en: 
    &lt;Location /&gt;
     Order Deny,Allow
     Deny From All
     Allow From 127.0.0.1
    &lt;/Location&gt;
zh_CN: 
    &lt;Location /&gt;
      Order Deny,Allow
      Deny From All
      Allow From 127.0.0.1
    &lt;/Location&gt;

en: FIXME: Check if PDG is available in Debian, and if so, suggest this as the preferred printing system.
zh_CN: FIXME: 检查在 Debian 中 PDG 的可用性, 如果可以, 建议其做好更好的打印系统.

en: FIXME: Check if Farmer/Wietse has a replacement for printer daemon and if it's available in Debian.
zh_CN: FIXME: 检查 Farmer/Wietse 是否可以作为打印守护进程的替代, 以及其是否在 Debian 系统中可用.

en: Securing the mail service
zh_CN: 邮件服务的安全化

en: If your server is not a mailing system, you do not really need to have a mail daemon listening for incoming connections, but you might want local mail delivered in order, for example, to receive mail for the root user from any alert systems you have in place.
zh_CN: 如果您的服务器并不是一个邮件系统, 那么您并不需要一个邮件守护进程监听传入连接, 但是也许您希望本地邮件能够有序的分发，比如，为 root 用户接收从报警系统传来的邮件.

en: If you have <command>exim</command> you do not need the daemon to be working in order to do this since the standard <command>cron</command> job flushes the mail queue. See <xref linkend="disableserv" /> on how to do this.
zh_CN: 如果您安装了<command>exim</command>, 并不需要其作为守护进程, 因为标准 <command>cron</command> 任务可以刷新邮件队列. 配置方法, 参阅<xref linkend="disableserv" />.

en: Configuring a Nullmailer
zh_CN: 配置 Nullmailer

en: You might want to have a local mailer daemon so that it can relay the mails sent locally to another system. This is common when you have to administer a number of systems and do not want to connect to each of them to read the mail sent locally. Just as all logging of each individual system can be centralized by using a central syslog server, mail can be sent to a central mailserver.
zh_CN: 也许您需要一个本地邮件守护进程, 以便可以将本地邮件发送到其他系统. 当您管理几个系统, 并且不想连到每个系统去阅读本地邮件时, 那么这是很普通的需求. 所有单个系统的登录可以通过一台中央 syslog 服务器集中起来, 邮件被发送到一台中央邮件服务器.

en: Such a <emphasis>relay-only</emphasis> system should be configured properly for this. The daemon could, as well, be configured to only listen on the loopback address.
zh_CN: 这就需要正确的配置一个<emphasis>只读</emphasis>系统. 守护进程配置为仅监听回送地址.

en: and configure the mailer daemon to only listen on the loopback interface. In <command>exim</command> (the default MTA) you can do this by editing the file <filename>/etc/exim.conf</filename> and adding the following line:
zh_CN: 并将邮件守护进程配置为仅监听回送接口. 在 <command>exim</command> 中(缺省的MTA) 您可以通过编辑 <filename>/etc/exim.conf</filename> 加入如下行来完成配置:

en: Restart both daemons (inetd and exim) and you will have exim listening on the 127.0.0.1:25 socket only. Be careful, and first disable inetd, otherwise, exim will not start since the inetd daemon is already handling incoming connections.
zh_CN: 重起两个守护进程(inetd 和 exim)后, exim 将只对 127.0.0.1:25 监听. 注意, 要首先禁用 inted, 否则 exim 将不能启用, 因为 inetd 守护进程仍然处理传入连接.

en: For <command>postfix</command> edit <filename>/etc/postfix/main.conf</filename>:
zh_CN: 对于 <command>postfix</command> 来说应当编辑 <filename>/etc/postfix/main.conf</filename>:

en: If you only want local mail, this approach is better than tcp-wrapping the mailer daemon or adding firewalling rules to limit anybody accessing it. However, if you do need it to listen on other interfaces, you might consider launching it from inetd and adding a tcp wrapper so incoming connections are checked against <filename>/etc/hosts.allow</filename> and <filename>/etc/hosts.deny</filename>. Also, you will be aware of when an unauthorized access is attempted against your mailer daemon, if you set up proper logging for any of the methods above.
zh_CN: 如果您只是希望处理本地邮件, 这种方法比 tcp-wrapping 邮件或增加防火墙规则来限制访问更好. 但是, 如果您仍需要监听其他接口, 则应当考虑由 inetd 装载并增加一个 tcp wrapper, 并用 <filename>/etc/hosts.allow</filename> 和 <filename>/etc/hosts.deny</filename> 来限制访问. 并且, 如果你正确的设置了日志纪录, 则当未被授权的访问试图攻击您的邮件守护进程时，将会被告知.

en: In any case, to reject mail relay attempts at the SMTP level, you can change <filename>/etc/exim/exim.conf</filename> to include:
zh_CN: 无论如何, 在 SMTP 级别拒绝邮件转发, 您应当编辑 <filename>/etc/exim/exim.conf</filename> 加入如下行:

en: Even if your mail server will not relay the message, this kind of configuration is needed for the relay tester at <ulink url="http://www.abuse.net/relay.html" /> to determine that your server is <emphasis>not</emphasis> relay capable.
zh_CN: 既使您的邮件服务器不会转发信息, 这种配置对于中转测试器来说也是必须的, 可以通过 <ulink url="http://www.abuse.net/relay.html" /> 来检测您的服务器有无中转能力.

en: Providing secure access to mailboxes
zh_CN: 提供对邮箱的安全访问

en: Try, for example, to configure as your inbox path <literal>{server.com}/etc/passwd</literal> if it succeeds your IMAP daemon is not properly configured to prevent this kind of access.
zh_CN: 例如, 可以尝试配置您的 inbox 路径为 {server.com}/etc/passwd, 如果可以成功, 则说明您的 IMAP 守护进程没有正确的配置以阻止此类访问.

en: Receiving mail securely
zh_CN: 安全的接收邮件

en: If you want to provide encrypted mail services like POP and IMAP, <literal>apt-get install stunnel</literal> and start your daemons this way:
zh_CN: 如果您想象 POP 和 IMAP 一样提供加密邮件, <literal>apt-get install stunnel</literal>, 然后用如下方式启动您的守护进程:

en: Securing BIND
zh_CN: 增强 BIND 的安全性

en: There are different issues that can be tackled in order to secure the Domain server daemon, which are similar to the ones considered when securing any given service:
zh_CN: 有很多不同的方式用于完成域名服务器守护进程的安全化, 这仅与考虑方式有关:

en: Bind configuration to avoid misuse
zh_CN: 配置Bind以防误用

en: Imagine that your server is connected to the Internet and to your internal (your internal IP is 192.168.1.2) network (a basic multi-homed server), you do not want to give any service to the Internet and you just want to enable DNS lookups from your internal hosts. You could restrict it by including in <filename>/etc/bind/named.conf</filename>:
zh_CN: 设想一下, 您的服务器同时与互联网和您的内部(您的内部IP是192.168.1.2)网(一台基本的 multi-homed 服务器)相连, 您不想为互联网提供任何服务, 而只是为内部主机提供 DNS 查询服务. 您可以在 <filename>/etc/bind/named.conf</filename> 中加入如下内容, 以实现这种限制:

en: The <emphasis>listen-on</emphasis> option makes the DNS bind to only the interface that has the internal address, but, even if this interface is the same as the interface that connects to the Internet (if you are using NAT, for example), queries will only be accepted if coming from your internal hosts. If the system has multiple interfaces and the <emphasis>listen-on</emphasis> is not present, only internal users could query, but, since the port would be accessible to outside attackers, they could try to crash (or exploit buffer overflow attacks) on the DNS server. You could even make it listen only on 127.0.0.1 if you are not giving DNS service for any other systems than yourself.
zh_CN: <emphasis>listen-on</emphasis> 选项使 DNS 仅绑定到内部地址接口, 但即使此接口和与互联网相连的相同(例如, 您正在使用 NAT), 也只会接收源自您的内部网络的主机的查询. 如果系统有多个接口, 并且没有指定<emphasis>listen-on</emphasis>项, 以确保只有内部用户可以查询, 那么因为此端口外部攻击者也可以访问，所以他们将设法对 DNS 服务器攻击(或利用缓冲溢出攻击). 因此如果 DNS 服务器只为自身提供服务, 则应当配置其只监听 127.0.0.1.

en: Changing the version.bind record does not provide actual protection against attacks, but it might be considered a useful safeguard.
zh_CN: 改变 version.bind 的记录并不能对避免攻击提供实质性的保护. 但是可以被认为是一个有用的保障.

en: A sample <filename>named.conf</filename> configuration file might be the following:
zh_CN: 下边是一个 <filename>named.conf</filename> 配置文件的例子:

en: Changing BIND's user
zh_CN: 管理 BIND 用户

en: To run BIND under a different user, first create a separate user and group for it (it is <emphasis>not</emphasis> a good idea to use nobody or nogroup for every service not running as root). In this example, the user and group <literal>named</literal> will be used. You can do this by entering:
zh_CN: 为了可以使用其它用户来运行 BIND, 首先应为此创建一个单独的用户和组 (每个非root运行的服务都使用 nobody 或 bogroup <emphasis>不</emphasis>是一个好主意). 在下边的例子中, 将会使用<literal>named</literal>这个用户和组. 键入如下内容:

en: Notice that the user <literal>named</literal> will be quite restricted. If you want, for whatever reason, to have a less restrictive setup use:
zh_CN: 注意, 用户 named 将会是一个限制. 如果您需要, 或者其它的原因, 有一个较少的限制的设定:

en: Change the permissions of files that are used by Bind, including <filename>/etc/bind/rndc.key</filename>:
zh_CN: 修改 Bind 所使用文件的权限, 这包括 <filename>/etc/bind/rndc.key</filename>:

en: and where bind creates its pidfile, using, for example, <filename>/var/run/named</filename> instead of <filename>/var/run</filename>:
zh_CN: 在 bind 创建 pidfile 的地方,使用, 例如 <filename>/var/run/named</filename> 来替代 <filename>/var/run</filename>:

en: Note: Depending on your Debian version you might have to change the <literal>restart</literal> line too. This was fixed in Debian's bind version <literal>1:8.3.1-2</literal>.
zh_CN: 注意: 您也许还需要修改 <literal>restart</literal> 行, 这与您的 Debian 的版本有关. 这在 Debian 的 bind <literal>1:8.3.1-2</literal> 版中对此做了修正.

en: Chrooting the name server
zh_CN: 使名称服务器运行于 chroot 环境

en: In order for your Bind daemon to work properly it needs permission in the named files. This is an easy task since the configuration files are always at <literal>/etc/named/</literal>. Take into account that it only needs read-only access to the zone files, unless it is a secondary or cache name server. If this is your case you will have to give read-write permissions to the necessary zones (so that zone transfers from the primary server work).
zh_CN: Bind 守护进程必须对 named 文件有访问权限才能正常运行. 因为这些配置文件通常都在 <literal>/etc/named/</literal> 目录下, 所以这很容易办到. 应当考虑到，对于区域文件只需要有只读权限，除非这是第二或缓存名称服务器. 如果是这样，您则需要给必要的区域以写权限(以便从主服务器进行区域转换).

en: If you want to avoid problems with dynamic libraries, you can compile bind statically. You can use <command>apt-get</command> for this, with the <literal>source</literal> option. It can even download the packages you need to properly compile it. You would need to do something similar to:
zh_CN: 如果您想避免动态链接库的问题, 您可以静态编译 bind. 可以使用 <command>apt-get</command> 带 <literal>source</literal> 选项下载. 这样可以下载所需正确编译的软件包. 您需要做类似如下操作:

en: For more information on how to set up chroots see <xref linkend="chroot" />.
zh_CN: 有关如何设定chroot的更多信息，参见 <xref linkend="chroot" />.

en: Securing Apache
zh_CN: 增加 Apache 的安全性

en: FIXME: Add content: modules provided with the normal Apache installation (under /usr/lib/apache/X.X/mod_*) and modules that can be installed separately in libapache-mod-XXX packages.
zh_CN: FIXME: 增加内容: 有关 Apache 正常安装时提供的模块(在 /usr/lib/apache/X.X/mod_* 处) 和可能被安装的在 ibapache-mod-XXX 软件包中的模块.

en: Using Listen:
zh_CN: 使用监听:

en: Using BindAddress:
zh_CN: 使用地址绑定:

en: Then restart apache with <literal>/etc/init.d/apache restart</literal> and you will see that it is only listening on the loopback interface.
zh_CN: 然后通过 <literal>/etc/init.d/apache restart</literal> 重启 Apache, 您会发现它只监听回送接口.

en: In any case, if you are not using all the functionality provided by Apache, you might want to take a look at other web servers provided in Debian like <application>dhttpd</application>.
zh_CN: 无论如何, 如果您并不使用 Apache 提供的全部功能, 您可以考虑一下 Debian 中提供的其它 web 服务器, 如<application>dhttpd</application>.

en: More information on further restricting Apache by setting up a chroot jail is provided in <xref linkend="chroot-apache-env" />.
zh_CN: <xref linkend="chroot-apache-env" /> 提供了更多的有关设置 chroot jail 以对 Apache 实现更多限制的信息.

en: Disabling users from publishing web contents
zh_CN: 禁止用户发布 web 内容

en: The default Apache installation in Debian permits users to publish content under the <filename>$HOME/public_html</filename>. This content can be retrieved remotely using an URL such as: http://your_apache_server/~user.
zh_CN: 在 Debian 中缺省的 Apache 安装允许用户在 <filename>$HOME/public_html</filename> 目录下发布 web 内容. 此内容可以远程通过形如 http://your_apache_server/~user 的 URL 检索到.

en: Logfiles permissions
zh_CN: 日志文件权限

en: Published web files
zh_CN: 发布 web 文件

en: Securing finger
zh_CN: 增强 finger 的安全性

en: If you want to run the finger service first ask yourself if you need to do so. If you do, you will find out that Debian provides many finger daemons (output from <command>apt-cache search fingerd</command>):
zh_CN: 如果您想要运行finger服务, 首先考虑一下这是不是必须的. 检查一下, 您会发现 Debian 提供了很多 finger 守护进程 (主要源自 <command>apt-cache search fingerd</command> 的输出):

en: cfingerd - Configurable finger daemon
zh_CN: cfingerd - 可配置的 finger 守护进程

en: efingerd - Another finger daemon for unix, capable of fine-tuning your output.
zh_CN: efingerd - unix 下的另一个 finger守护进程, 对输出做了优化.

en: ffingerd - a secure finger daemon
zh_CN: ffingerd - 一个安全的 finger 守护进程

en: fingerd - Remote user information server.
zh_CN: fingerd - 远程用户信息服务器.

en: <application>ffingerd</application> is the recommended finger daemon if you are going to use it for a public service. In any case, you are encouraged to, when setting it up through inetd, xinetd or tcpserver to: limit the number of processes that will be running at the same time, limit access to the finger daemon from a given number of hosts (using tcp wrappers) and having it only listening to the interface you need it to be in.
zh_CN: 如果您打算将 finger 守护进程用于公共服务, 推荐使用 <application>ffingerd</application>. 无论如何, 当您通过 inetd, xinetd 或 tcpserver 配置它时, 建议您: 限制同时运行进程数, 限制指定主机(使用 tcp wrappers)对 finger 守护进程的访问, 使它只监听您需要的接口.

en: General chroot and suid paranoia
zh_CN: 常用 chroot 和 suid

en: However, Debian does provide some software that can help set up <command>chroot</command> environments. See <xref linkend="auto-chroot" />.
zh_CN: 但是, Debian 确实提供了一些用于设置 <command>chroot</command> 环境的软件, 参阅 <xref linkend="auto-chroot" />.

en: Anyway, if you run any service on your system, you should consider running them as secure as possible. This includes: revoking root privileges, running in a restricted environment (such as a chroot jail) or replacing them with a more secure equivalent.
zh_CN: 无论如何, 如果您在您的系统上运行一项服务, 都需要尽可能的保证其安全性, 这包括取消其 root 权限, 在限制的环境下运行(如 chroot jail)或者用更安全的方法.

en: However, be forewarned that a <command>chroot</command> jail can be broken if the user running in it is the superuser. So, you need to make the service run as a non-privileged user. By limiting its environment you are limiting the world readable/executable files the service can access, thus, you limit the possibilities of a privilege escalation by use of local system security vulnerabilities. Even in this situation you cannot be completely sure that there is no way for a clever attacker to somehow break out of the jail. Using only server programs which have a reputation for being secure is a good additional safety measure. Even minuscule holes like open file handles can be used by a skilled attacker for breaking into the system. After all, <command>chroot</command> was not designed as a security tool but as a testing tool.
zh_CN: 但是, 应当注意的是, 以root用户运行的 <command>chroot</command> jail 是有可能被破坏的. 因此, 应当确保服务以非特权用户运行. 通过限制其环境, 您可以限制服务可访问文件的读/执行权限, 因此您也就限制了利用本地系统的漏洞提升权限的可能性. 即使如此您也无法确保一个聪明的攻击者以某种方法突破 chroot jail. 只有使用公认的安全性好的服务器, 才是增加安全性的很好的手段. 即使一个很小的漏洞, 如开放文件句柄, 也可能被熟练的攻击者利用来攻破系统. 最后, <command>chroot</command> 并不是设计作为一个安全工具, 而是一个测试工具.

en: Making chrooted environments automatically
zh_CN: 自动配置 chroot 环境

en: General cleartext password paranoia
zh_CN: 明文密码

en: You should try to avoid any network service which sends and receives passwords in cleartext over a net like FTP/Telnet/NIS/RPC. The author recommends the use of ssh instead of telnet and ftp to everybody.
zh_CN: 您应当设法避免在网络中象 FTP/Telnet/NIS/RPC 一样接收和发送明文密码. 作者建议大家使用 ssh 代替 telnet 和 ftp.

en: Keep in mind that migrating from telnet to ssh, but using other cleartext protocols does not increase your security in ANY way! Best would be to remove ftp, telnet, pop, imap, http and to supersede them with their respective encrypted services. You should consider moving from these services to their SSL versions, ftp-ssl, telnet-ssl, pop-ssl, https ...
zh_CN: 记住, 从 telnet 转到 ssh, 但是仍然使用其它的明文协议并不能为您增加任何安全性! 最好的办法是删除 ftp, telnet, pop, imap, http, 而是用他们各自的使用加密的服务. 您可以考虑将它们删除, 而使用它们的 SSL 版本, ftp-ssl, telnet-ssl, pop-ssl, https ...

en: Most of these above listed hints apply to every Unix system (you will find them if reading any other hardening-related document related to Linux and other Unices).
zh_CN: 以上的大多数提示适用于每个 unix 系统(您会在阅读其它的 Linux 和类 Unix 的安全文档时发现您会发现这些提示).

en: Disabling NIS
zh_CN: 禁用 NIS

en: Securing RPC services
zh_CN: 增强 RPC 服务的安全性

en: Adding firewall capabilities
zh_CN: 增加防火墙

en: Firewalling the local system
zh_CN: 为本地系统构建放火墙

en: However, this step is presented last in this manual basically because it is <emphasis>much</emphasis> better not to depend solely on firewalling capabilities in order to protect a given system. Security in a system is made up of layers, firewalling should be the last to include, once all services have been hardened. You can easily imagine a setup in which the system is solely protected by a built-in firewall and an administrator blissfully removes the firewall rules for whatever reason (problems with the setup, annoyance, human error...), this system would be wide open to an attack if there were no other hardening in the system to protect from it.
zh_CN: 然而, 本手册中, 此方法的提出, 主要是因为其保护一个系统并不<emphasis>仅仅</emphasis>是基于防火墙的性能, 一个系统的安全源于多个层面, 一旦所有的服务完成安全化设置, 防火墙应该是最后一层. 您应该很容易的设想, 如果一个系统的保护仅仅基于一个内置防火墙, 一旦管理员不管出于什么原因, 删除了防火墙规则(可能因为设置, 喜好, 人为错误), 如果在此系统中没有其它保护措施的话, 这个系统将完全对攻击者敞开.

en: On the other hand, having firewall rules on the local system also prevents some bad things from happening. Even if the services provided are configured securely, a firewall can protect from misconfigurations or from fresh installed services that have not yet been properly configured. Also, a tight configuration will prevent trojans <emphasis>calling home</emphasis> from working unless the firewalling code is removed. Note that an intruder does <emphasis>not</emphasis> need superuser access to install a trojan locally that could be remotely controlled (since binding on ports is allowed if they are not priviledged ports and capabilities have not been removed).
zh_CN: 另一方面, 本地系统拥有防火墙规则还能防止其它一些破坏性事情发生. 即使提供的服务做了安全化配置, 一个防火墙也能为错误的配置或者新安装的 还未来得及配置的服务提供保护, 并且一个紧凑的配置, 除非防火墙的代码被删除, 将会防止木马侵害. 注意, 入侵者并不一定要超级用户权限才能控制装有木马的系统(因为对于绑定端口, 如果它不是私有端口, 并且没有被禁用, 这将是允许的.

en: Thus, a proper firewall setup would be one with a default deny policy, that is:
zh_CN: 因而，一个合适的防火墙设置应该带有默认的拒绝策略,即:

en: incoming connections are allowed only to local services by allowed machines.
zh_CN: 只允许许可的机器访问本地许可的服务.

en: the forward rule denies everything (unless you are protecting other systems, see below).
zh_CN: forward 规则设为拒绝(除非您有其它系统的保护, 参阅下边).

en: all other incoming or outgoing connections are denied.
zh_CN: 其它的连入连出都是禁止的.

en: Using a firewall to protect other systems
zh_CN: 使用防火墙保护其它系统

en: Remember this: just installing the <application>iptables</application> (or the older firewalling code) does not give you any protection, just provides the software. In order to have a firewall you need to <emphasis>configure</emphasis> it!
zh_CN: 记住: 仅仅安装 <application>iptables</application>(或者旧版的防火墙代码)并不能给您任何保护, 只不过是提供了一个软件. 要想拥有一个防火墙, 您就必须<emphasis>配置</emphasis>它!

en: Some software that can be used to set up firewall rules in a Debian system is:
zh_CN: Debian 系统中可用于设定防火墙规则的一些软件:
