harden-doc 3.19 - en to zh_CN translation catalogue (38 entries)

en: Debian Security Infrastructure
zh_CN: Debian 的安全机制

en: The Debian Security Team
zh_CN: Debian 安全小组

en: Some other frequently asked questions on the Debian Security Team can be found at <xref linkend="debian-sec-team-faq" />.
zh_CN: 其它有关 Debian 安全小组的常见问题可以参阅<xref linkend="debian-sec-team-faq" />.

en: Debian Security Advisories
zh_CN: Debian 安全公告

en: version number for the fix.
zh_CN: 问题软件的版本号.

en: problem type.
zh_CN: 问题类型.

en: whether it is remote or locally exploitable.
zh_CN: 是会被远程攻击还是本地.

en: short description of the package.
zh_CN: 软件包的简短描述.

en: description of the problem.
zh_CN: 问题描述.

en: description of the exploit.
zh_CN: 攻击描述.

en: description of the fix.
zh_CN: 修复描述.

en: Interested users can, however (and this is done in some Debian-related portals) use the RDF channel to download automatically the DSAs to their desktop. Some applications, such as <command>Evolution</command> (an email client and personal information assistant) and <command>Multiticker</command> (a GNOME applet), can be used to retrieve the advisories automatically. The RDF channel is available at <ulink url="http://www.debian.org/security/dsa.rdf" />.
zh_CN: 然而感兴趣的用户可以, (需要通过一些 Debian 相关端口来完成)使用 RDF 频道去自动下载 DSAs 到他们的计算机. 一些应用程序，譬如 <command>Evolution</command> (电子邮件客户和个人信息助理) 和 <command>Multiticker</command> (一个GNOME附属程序)，可以用来自动获取公告. RDF 频道可以由 <ulink url="http://www.debian.org/security/dsa.rdf" /> 处获得.

en: Vulnerability cross references
zh_CN: 漏洞的交叉参考

en: this information can be used to cross-check output from vulnerability scanners that include references to CVE to remove false positives (see <xref linkend="vulnasses-false-positive" />).
zh_CN: 这些信息也可用于漏洞扫描器的交叉检测输出, 其包括参考 CVE 删除错误信息 (参见 <xref linkend="vulnasses-false-positive" />).

en: CVE compatibility
zh_CN: CVE 兼容性

en: Debian believes that providing users with additional information related to security issues that affect the Debian distribution is extremely important. The inclusion of CVE names in advisories help users associate generic vulnerabilities with specific Debian updates, which reduces the time spent handling vulnerabilities that affect our users. Also, it eases the management of security in an environment where CVE-enabled security tools -such as network or host intrusion detection systems, or vulnerability assessment tools- are already deployed regardless of whether or not they are based on the Debian distribution.
zh_CN: Debian 相信为用户提供影响 Debian 发行版的安全问题的附加信息是非常重要的. 在公告中 CVE 名称有助于用户了解漏洞与某个 Debian 安全更新的关系, 这有助于减少花费在处理影响我们用户的漏洞上的时间. 同时, 也使得对于部署了支持 CVE 的安全工具的环境的安全问题的管理变得简单 - 譬如基于网络或主机的入侵检测系统, 或漏洞评估工具, 不管它是不是基于 Debian 发行版的.

en: Debian Security Build Infrastructure
zh_CN: Debian 安全构建机制

en: Since Debian is currently supported in a large number of architectures, administrators sometimes wonder if a given architecture might take more time to receive security updates than another. As a matter of fact, except for rare circumstances, updates are available to all architectures at the same time.
zh_CN: 因为当前的 Debian 支持大多数的平台, 管理员有时想知道是不是某一平台的安全更新比其它平台需要更多的时间. 事实上除了极罕见的情况外, 所有平台都是同事更新的.

en: Someone finds a security problem.
zh_CN: 有人发现了安全问题.

en: The upload gets checked and processed by a Debian system and moved into queue/accepted, and the buildds are notified. Files in here can be accessed by the security team and (somewhat indirectly) by the buildds.
zh_CN: 提交由一个 Debian 系统完成检查和处理, 然后将其转移到 queue/accepted, 并在 buildds 上通告. 这些文件可由安全小组和(间接的) buildds 访问.

en: Security-enabled buildds pick up the source package (prioritized over normal builds), build it, and send the logs to the security team.
zh_CN: Security-enabled buildds 对源码包进行整理, 打包, 然后将日志发送给安全小组.

en: The security team reply to the logs, and the newly built packages are uploaded to queue/unchecked, where they're processed by a Debian system, and moved into queue/accepted.
zh_CN: 安全小组对日志做出回应, 最新构建的软件包将被上载到 queue/unchecked, 在这里它们由 Debian 系统统一处理, 然后转移到 queue/accepted.

en: When the security team find the source package acceptable (i.e., that it's been correctly built for all applicable architectures and that it fixes the security hole and doesn't introduce new problems of its own) they run a script which:
zh_CN: 当安全小组发现源码包可以接受时(即,它可以在各种平台正确的构建, 并且修复了安全漏洞, 而自身不会产生新的问题), 他们将会运行一个脚本来完成:

en: installs the package into the security archive.
zh_CN: 软件包安装到安全归档区.

en: sets up a template advisory that the security team can finish off.
zh_CN: 设定安全小组完成的模板通告.

en: This procedure, previously done by hand, was tested and put through during the freezing stage of Debian 3.0 woody (July 2002). Thanks to this infrastructure the Security Team was able to have updated packages ready for the apache and OpenSSH issues for all the supported (almost twenty) architectures in less than a day.
zh_CN: 早先由手工完成的这些工作, 被测试后进入处于冻结阶段的 Debian 3.0 woody(2002年7月). 感谢这种机制, 使得安全小组可以在不到一天的时间内为所有的(大约二十种)平台更新 apache 和 OpenSSH.

en: Developer's guide to security updates
zh_CN: 安全更新的开发指南

en: Package signing in Debian
zh_CN: Debian 中对软件包签字

en: The current scheme for package signature checking using <command>apt</command> is:
zh_CN: 当前使用 <command>apt</command> 进行软件包签名检测的计划是:

en: By following the chain of MD5 sums <command>apt</command> is capable of verifying that a package originates from a a specific release. This is less flexible than signing each package one by one, but can be combined with that scheme too (see below).
zh_CN: 下边的 MD5 sums <command>apt</command> 可以完成对于源自某个发行版的单个的软件包的校检. 这与对每个软件包签名相比不太灵活, 也许会与这个计划结合(参见下面).

en: Package signing has been discussed in Debian for quite some time, for more information you can read: <ulink url="http://www.debian.org/News/weekly/2001/8/" /> and <ulink url="http://www.debian.org/News/weekly/2000/11/" />.
zh_CN: 在Debian]中的软件包签名已经被讨论了相当一段时间了, 更多信息参见: <ulink url="http://www.debian.org/News/weekly/2001/8/" /> 和 <ulink url="http://www.debian.org/News/weekly/2000/11/" />.

en: This sample code, renamed as <command>apt-check-sigs</command>, should be used in the following way:
zh_CN: 示例代码，将其命名为 <command>apt-check-sigs</command>, 可以通过下边的方法使用:

en: First you need to:
zh_CN: 首先, 您需要:

en: remove any <filename>/etc/apt/sources.list</filename> lines that don't use the normal "dists" structure, or change the script so that it works with them.
zh_CN: 删除 <filename>/etc/apt/sources.list</filename> 中所有没有正常使用 "dists" 的行, 或者修改脚本,以便对它们有效.

en: be prepared to check that the appropriate sources are signed by the appropriate keys.
zh_CN: 准备用正确的公钥检查对应的源码.

en: Alternative per-package signing scheme
zh_CN: 可供选种的软包签名方案

en: NOTE: Currently <filename>/etc/dpkg/dpkg.cfg</filename> ships with "no-debsig" as per default.
zh_CN: 注: 当前 <filename>/etc/dpkg/dpkg.cfg</filename> 引入 "no-debsig" 为缺省值.

en: NOTE2: Signatures from developers are currently stripped when they enter off the package archive since the currently preferred method is release checks as described previously.
zh_CN: 注2: 来自开发者的签名署名当它们进入软包的时候被剥离, 因为当前首选的方法还是使用前边描述的那种方法.
