0 - en to zh-CN translation catalogue (401 entries)

en: System boot
zh-CN: 系统启动

en: Initscripts
zh-CN: 启动脚本

en: Rights
zh-CN: 权限

en: Permissions
zh-CN: 许可

en: Supervision
zh-CN: 管理

en: Backup
zh-CN: 备份

en: Hotplug
zh-CN: 热插拔

en: PCMCIA
zh-CN: PCMCIA 接口

en: Unix Services
zh-CN: Unix 服务

en: This chapter covers a number of basic services that are common to many Unix systems. All administrators should be familiar with them.
zh-CN: 本章涵盖一些 Unix 系统共通的服务。管理员应当熟悉他们。

en: System Boot
zh-CN: 系统启动

en: <primary>booting</primary><secondary>the system</secondary>
zh-CN: <primary>启动</primary><secondary>系统</secondary>

en: When you boot the computer, the many messages scrolling by on the console display many automatic initializations and configurations that are being executed. Sometimes you may wish to slightly alter how this stage works, which means that you need to understand it well. That is the purpose of this section.
zh-CN: 当启动计算机时，控制台上滚动的大量信息显示许多初始化和配置工作正在自动执行。有时候你可能稍稍的改变这一阶段的操作，就要求你需要很好的理解他们。这正是本章节的目的所在。

en: The systemd init system
zh-CN: Systemd 启动系统

en: The “real init” is currently provided by <emphasis role="pkg">systemd</emphasis> and this section documents this init system.
zh-CN: “真正的启动器”当前是由<emphasis role="pkg">systemd</emphasis> 提供的，本章节讲述该启动系统。

en: <emphasis>CULTURE</emphasis> Before <command>systemd</command>
zh-CN: <emphasis>文化</emphasis> 在 <command>systemd</command> 之前

en: <command>systemd</command> is a relatively recent “init system”, and although it was already available, to a certain extent, in <emphasis role="distribution">Wheezy</emphasis>, it has only become the default in Debian <emphasis role="distribution">Jessie</emphasis>. Previous releases relied, by default, on the “System V init” (in the <emphasis role="pkg">sysv-rc</emphasis> package), a much more traditional system. We describe the System V init later on.
zh-CN: <command>systemd</command> 是相当新的 “启动系统”，虽然在 <emphasis role="distribution">Wheezy</emphasis> 里已经可以使用到某个程度，直到 Debian <emphasis role="distribution">Jessie</emphasis> 才纳入作为默认值。稍早的版本，缺省是 “System V init” (在 <emphasis role="pkg">sysv-rc</emphasis> 软件包内)，算是传统的系统。稍后描述 System V init。

en: <emphasis>ALTERNATIVE</emphasis> Other boot systems
zh-CN: <emphasis>选择</emphasis> 其它启动系统

en: The <command>upstart</command> system is still not perfectly tested on Debian. It is event based: init scripts are no longer executed in a sequential order but in response to events such as the completion of another script upon which they are dependent. This system, started by Ubuntu, was present in Debian <emphasis role="distribution">Jessie</emphasis>, but was not the default; it came, in fact, as a replacement for <emphasis role="pkg">sysvinit</emphasis>, and one of the tasks launched by <command>upstart</command> was to launch the scripts written for traditional systems, especially those from the <emphasis role="pkg">sysv-rc</emphasis> package.
zh-CN: <command>upstart</command> 系统在 Debian 上仍未完整测试。它以事件为基础：不再依序运行 init 脚本，但回应另一个依附的脚本。由 Ubuntu 开始的这个系统，列在 Debian <emphasis role="distribution">Jessie</emphasis> 内，但还不是缺省值；事实上，作为 <emphasis role="pkg">sysvinit</emphasis> 的替代品，由 <command>upstart</command> 启动的工作，系用来启动传统系统而设的，特别是来自 <emphasis role="pkg">sysv-rc</emphasis> 软件包的脚本。

en: Boot sequence of a computer running Linux with systemd
zh-CN: 运行 sytemd 的 Linux 计算机的启动顺序

en: <emphasis>SPECIFIC CASE</emphasis> Booting from the network
zh-CN: <emphasis>特例</emphasis> 从网络启动

en: Booting from the network can be used to launch the <command>debian-installer</command> or FAI (see <xref linkend="sect.installation-methods" />).
zh-CN: 从网络启动可以用于执行 <command>debian-installer</command> or FAI （参考 <xref linkend="sect.installation-methods" />）。

en: <emphasis>BACK TO BASICS</emphasis> The process, a program instance
zh-CN: <emphasis>基础知识</emphasis>进程，一个程序实例

en: <primary>process</primary>
zh-CN: <primary>进程</primary>

en: <emphasis>SECURITY</emphasis> Using a shell as <command>init</command> to gain root rights
zh-CN: <emphasis>安全</emphasis> 使用 shell 作为 <command>init</command> 获取root权限

en: By convention, the first process that is booted is the <command>init</command> program (which is a symbolic link to <filename>/lib/systemd/systemd</filename> by default). However, it is possible to pass an <literal>init</literal> option to the kernel indicating a different program.
zh-CN: 通常，第一个启动的进程是 <command>init</command> 程序（默认是到 <filename>/lib/systemd/systemd</filename> 的符号链接）。然而，也可以通过传递 <literal>init</literal> 选项告诉内核使用其他的程序。

en: Any person who is able to access the computer can press the <keycap>Reset</keycap> button, and thus reboot it. Then, at the bootloader's prompt, it is possible to pass the <literal>init=/bin/sh</literal> option to the kernel to gain root access without knowing the administrator's password.
zh-CN: 任何可以接近电脑的人都能按下<keycap>复位</keycap> 按键，并重新启动。然后，在启动提示下，传递<literal>init=/bin/sh</literal>选项给内核，无需知道密码而获取root权限。

en: To prevent this, you can protect the bootloader itself with a password. You might also think about protecting access to the BIOS (a password protection mechanism is almost always available), without which a malicious intruder could still boot the machine on a removable media containing its own Linux system, which they could then use to access data on the computer's hard drives.
zh-CN: 为了防止此类事件，可以给加载器设定密码。你也许会考虑保护 BIOS （密码保护总是可行的），这样可以防止侵入者使用包含自己的 Linux 系统的移动介质启动电脑，使用该系统可以读取硬盘上的数据。

en: Systemd executes several processes, in charge of setting up the system: keyboard, drivers, filesystems, network, services. It does this while keeping a global view of the system as a whole, and the requirements of the components. Each component is described by a “unit file” (sometimes more); the general syntax is derived from the widely-used “*.ini files“ syntax, with <literal><replaceable>key</replaceable> = <replaceable>value</replaceable></literal> pairs grouped between <literal>[<replaceable>section</replaceable>]</literal> headers. Unit files are stored under <filename>/lib/systemd/system/</filename> and <filename>/etc/systemd/system/</filename>; they come in several flavors, but we will focus on “services” and “targets” here.
zh-CN: Systemd 运行多个进程，设置系统：键盘、驱动程序、文件系统、网络、服务等。同时全面查看系统，以及必要的配件。每个配件都视为一个 “单元文件” (有时为多个)；通用的语法源自于常用的 “*.ini files“ 语法，包括配对的 <literal><replaceable>key</replaceable> = <replaceable>value</replaceable></literal> 列在 <literal>[<replaceable>section</replaceable>]</literal> 标头内。单元文件保存在 <filename>/lib/systemd/system/</filename> 与 <filename>/etc/systemd/system/</filename> 内；以多种方式呈现，目前专注在 “services” 与 “targets”。

en: Since unit files are declarative rather than scripts or programs, they cannot be run directly, and they are only interpreted by systemd; several utilities therefore allow the administrator to interact with systemd and control the state of the system and of each component.
zh-CN: 单元文件是声明性的而不是脚本或程序，不能直接运行，只能被 systemd 解译；因些工具允许管理者与 systemd 交互且控制系统的状态与其组件。

en: The first such utility is <command>systemctl</command>. When run without any arguments, it lists all the unit files known to systemd (except those that have been disabled), as well as their status. <command>systemctl status</command> gives a better view of the services, as well as the related processes. If given the name of a service (as in <command>systemctl status ntp.service</command>), it returns even more details, as well as the last few log lines related to the service (more on that later).
zh-CN: 第一个工具是 <command>systemctl</command>。未使用参数运行时，它列出 systemd 已知的所有单元档 (除了已经停用的)，及其现况。<command>systemctl status</command> 则以更佳的角度查看服务，以及相关的进程。若提供服务的名称 (如 <command>systemctl status ntp.service</command>)，则返回更多详细的数据，以及与该服务有关的最后几个日志档 (还有更多的)。

en: Starting a service by hand is a simple matter of running <command>systemctl start <replaceable>servicename</replaceable>.service</command>. As one can guess, stopping the service is done with <command>systemctl stop <replaceable>servicename</replaceable>.service</command>; other subcommands include <command>reload</command> and <command>restart</command>.
zh-CN: 运行 <command>systemctl start <replaceable>servicename</replaceable>.service</command> 就能以人工方式启动服务。同样的，运行 <command>systemctl stop <replaceable>servicename</replaceable>.service</command> 就能停止已完成的服务；其他的命令包括 <command>reload</command> 与 <command>restart</command>。

en: To control whether a service is active (i.e. whether it will get started automatically on boot), use <command>systemctl enable <replaceable>servicename</replaceable>.service</command> (or <command>disable</command>). <command>is-enabled</command> allows checking the status of the service.
zh-CN: 以 <command>systemctl enable <replaceable>servicename</replaceable>.service</command> (或 <command>disable</command>) 控制启动服务 (即开机后自动启动)。<command>is-enabled</command> 可以检查服务的状态。

en: An interesting feature of systemd is that it includes a logging component named <command>journald</command>. It comes as a complement to more traditional logging systems such as <command>syslogd</command>, but it adds interesting features such as a formal link between a service and the messages it generates, and the ability to capture error messages generated by its initialization sequence. The messages can be displayed later on, with a little help from the <command>journalctl</command> command. Without any arguments, it simply spews all log messages that occurred since system boot; it will rarely be used in such a manner. Most of the time, it will be used with a service identifier:
zh-CN: systemd 重要的功能之一是日志组件 <command>journald</command>。作为 <command>syslogd</command> 之类传统日志系统组件的补充，但加入额外的功能包括在服务与其产生消息间的正式链接，以及捕捉由初始过程产生的错误消息。在 <command>journalctl</command> 命令的协助下，稍后可显示该等消息。不需任何参数，它显示系统启动后发生的所有日志消息；不过很少用到它。多数时间，把它作为服务的辨识器：

en: Another useful command-line flag is <command>-f</command>, which instructs <command>journalctl</command> to keep displaying new messages as they are emitted (much in the manner of <command>tail -f <replaceable>file</replaceable></command>).
zh-CN: 另一个有用的命令行标志是 <command>-f</command>，用于指示 <command>journalctl</command> 继续显示添加的消息 (大部分是在 <command>tail -f <replaceable>file</replaceable></command> 之内)。

en: If a service doesn't seem to be working as expected, the first step to solve the problem is to check that the service is actually running with <command>systemctl status</command>; if it is not, and the messages given by the first command are not enough to diagnose the problem, check the logs gathered by journald about that service. For instance, assume the SSH server doesn't work:
zh-CN: 若服务状况不如预期，第一个步骤是以 <command>systemctl status</command> 检查该服务是否真的已启动；若没有，则第一个命令给的消息就不足以诊断问题之所在，检查 journald 产生的日志档。例如，假设 SSH 服务器未启动时：

en: After checking the status of the service (failed), we went on to check the logs; they indicate an error in the configuration file. After editing the configuration file and fixing the error, we restart the service, then verify that it is indeed running.
zh-CN: 检查服务的状态 (失败) 后，再检查日志档；它们会指出配置的错误。编辑配置档并修正错误后，重启服务，确认运行中。

en: <emphasis>GOING FURTHER</emphasis> Other types of unit files
zh-CN: <emphasis>下一步</emphasis> 其他类型的单元档

en: We have only described the most basic of systemd's capabilities in this section. It offers many other interesting features; we will only list a few here:
zh-CN: 本节只描述 systemd 最基本的功能。其他的功能只能在此列出若干：

en: The System V init system
zh-CN: System V 初始系统

en: Among these, you will find successively programs in charge of:
zh-CN: 其中，你会发现相继的程序会负责：

en: configuring the console's keyboard;
zh-CN: 配置控制台键盘;

en: loading drivers: most of the kernel modules are loaded by the kernel itself as the hardware is detected; extra drivers are then loaded automatically when the corresponding modules are listed in <filename>/etc/modules</filename>;
zh-CN: 加载驱动：当探测到硬件，大部分内核模块通过内核自身加载；然后，自动加载 <filename>/etc/modules</filename> 中列出的模块;

en: checking the integrity of filesystems;
zh-CN: 检查文件系统的完整性;

en: mounting local partitions;
zh-CN: 挂载本地分区;

en: configuring the network;
zh-CN: 配置网络;

en: mounting network filesystems (NFS).
zh-CN: 挂载网络文件系统（NFS）。

en: <emphasis>BACK TO BASICS</emphasis> Kernel modules and options
zh-CN: <emphasis>基础知识</emphasis> 内核模块和选项

en: <primary>modules</primary><secondary>kernel modules</secondary>
zh-CN: <primary>模块</primary><secondary>内核模块</secondary>

en: After this stage, <command>init</command> takes over and starts the programs enabled in the default runlevel (which is usually runlevel 2). It executes <command>/etc/init.d/rc 2</command>, a script that starts all services which are listed in <filename>/etc/rc2.d/</filename> and whose names start with the “S” letter. The two-figures number that follows had historically been used to define the order in which services had to be started, but nowadays the default boot system uses <command>insserv</command>, which schedules everything automatically based on the scripts' dependencies. Each boot script thus declares the conditions that must be met to start or stop the service (for example, if it must start before or after another service); <command>init</command> then launches them in the order that meets these conditions. The static numbering of scripts is therefore no longer taken into consideration (but they must always have a name beginning with “S” followed by two digits and the actual name of the script used for the dependencies). Generally, base services (such as logging with <command>rsyslog</command>, or port assignment with <command>portmap</command>) are started first, followed by standard services and the graphical interface (<command>gdm3</command>).
zh-CN: 到了这个地步，<command>init</command> 接手并启动运行阶段缺省的程序 (通常是运行阶段 2)。它运行 <command>/etc/init.d/rc 2</command>，一个启动列在 <filename>/etc/rc2.d/</filename> 之内的所有服务并命名为 “S” 字母开头。接着的两位数，曾经作为服务启动的顺序，不过现在的缺省启动系统使用 <command>insserv</command>，根据脚本的相依性自动决定其先后顺序。每个启动脚本声明的情况必须符合启动或停止服务 (例如，必须在另个服务之前或之后启动)；<command>init</command> 再依此情况启动它们。不再考虑静态的脚本编号 (但仍需按相依性使用 “S” 及两个数字与实际的脚本名称)。通常，基本的服务 (诸如以 <command>rsyslog</command> 日志，或以 <command>portmap</command> 指定端口口) 先列出来，然后才是标准服务与图形接口 (<command>gdm3</command>)。

en: This dependency-based boot system makes it possible to automate re-numbering, which could be rather tedious if it had to be done manually, and it limits the risks of human error, since scheduling is conducted according to the parameters that are indicated. Another benefit is that services can be started in parallel when they are independent from one another, which can accelerate the boot process.
zh-CN: 这种以依赖为基础的启动系统使自动排序成为可能，这样的排序如果要手工完成则显得冗长乏味。由于调度根据明确给出的参数进行，这样就避免了人为错误。另一个好处是，如果两个服务彼此独立，则可以并行启动，进而加速启动过程。

en: <primary>runlevel</primary>
zh-CN: <primary>运行等级</primary>

en: <primary>level, runlevel</primary>
zh-CN: <primary>等级，运行等级</primary>

en: <command>init</command> distinguishes several runlevels, so it can switch from one to another with the <command>telinit <replaceable>new-level</replaceable></command> command. Immediately, <command>init</command> executes <command>/etc/init.d/rc</command> again with the new runlevel. This script will then start the missing services and stop those that are no longer desired. To do this, it refers to the content of the <filename>/etc/rc<replaceable>X</replaceable>.d</filename> (where <replaceable>X</replaceable> represents the new runlevel). Scripts starting with “S” (as in “Start”) are services to be started; those starting with “K” (as in “Kill”) are the services to be stopped. The script does not start any service that was already active in the previous runlevel.
zh-CN: <command>init</command>分几个运行等级，它可以通过<command>telinit <replaceable>new-level</replaceable></command> 命令，从一个等级切换到另一个等级。马上就会在新等级下重新执行<command>init</command> executes <command>/etc/init.d/rc</command>。这个脚本会启动漏掉的服务并中止不再需要的服务。为了做到这一点，它读取<filename>/etc/rc<replaceable>X</replaceable>.d</filename> 文件的内容（此处 <replaceable>X</replaceable> 代表新的运行等级）。以“S"（Start的首字母）开头的服务脚本要启动；以“K"（Kill的首字母）开头的服务要停止。脚本不会启动在之前运行等级已经生效的服务。

en: By default, System V init in Debian uses four different runlevels:
zh-CN: 默认情况下，Debian 的 System V init 使用四个不同的运行阶层：

en: Level 0 is only used temporarily, while the computer is powering down. As such, it only contains many “K” scripts.
zh-CN: 等级０仅作电脑关机时的临时应用。这样，它只包含多个“K”脚本。

en: Level 1, also known as single-user mode, corresponds to the system in degraded mode; it includes only basic services, and is intended for maintenance operations where interactions with ordinary users are not desired.
zh-CN: 等级１，也被称为单用户模式，对应于降级的系统模式；它仅包含基本服务，用于维护，此时不需要与一般用户交互。

en: Level 2 is the level for normal operation, which includes networking services, a graphical interface, user logins, etc.
zh-CN: 等级２用于正常运行，包含网络服务，图形界面，用户登录，等等。

en: Level 6 is similar to level 0, except that it is used during the shutdown phase that precedes a reboot.
zh-CN: 等级６和等级０类似，不同在于它用于系统重启之前的关机。

en: Other levels exist, especially 3 to 5. By default they are configured to operate the same way as level 2, but the administrator can modify them (by adding or deleting scripts in the corresponding <filename>/etc/rc<replaceable>X</replaceable>.d</filename> directories) to adapt them to particular needs.
zh-CN: 也存在其他等级，从３到５。默认情况，他们配置为和等级２相同，但是管理员可以修改（通过添加和删除对应<filename>/etc/rc<replaceable>X</replaceable>.d</filename>目录下的脚本）它们来适应不同的需求。

en: Boot sequence of a computer running Linux with System V init
zh-CN: 以 System V init 运行 Linux 的启动进程

en: <primary>initialization script</primary>
zh-CN: <primary>初始化脚本</primary>

en: <emphasis>DEBIAN POLICY</emphasis> Restarting services
zh-CN: <emphasis>DEBIAN 策略</emphasis> 重启服务

en: <primary>service</primary><secondary>restart</secondary>
zh-CN: <primary>服务</primary><secondary>重启</secondary>

en: <primary>restarting services</primary>
zh-CN: <primary>重新启动服务</primary>

en: The maintainer scripts for Debian packages will sometimes restart certain services to ensure their availability or get them to take certain options into account. The command that controls a service — <command>service <replaceable>service</replaceable> <replaceable>operation</replaceable></command> — doesn't take runlevel into consideration, assumes (wrongly) that the service is currently being used, and may thus initiate incorrect operations (starting a service that was deliberately stopped, or stopping a service that is already stopped, etc.). Debian therefore introduced the <command>invoke-rc.d</command> program: this program must be used by maintainer scripts to run services initialization scripts and it will only execute the necessary commands. Note that, contrary to common usage, the <filename>.d</filename> suffix is used here in a program name, and not in a directory.
zh-CN: Debian 软件包的维护脚本将不时重新启动特定服务以确保其有效性或取得特定的选项。控制服务的命令 — <command>service <replaceable>service</replaceable> <replaceable>operation</replaceable></command> — 未考量运行层级，假设服务 (错误地) 使用，且可能启动错误的作业 (启动应该停止的服务，或停止已经停止的服务等)。因此，Debian 有个 <command>invoke-rc.d</command> 程序：必须由维护脚本启动，运行服务的初启脚本且只运行必要的命令。注意，不同于常见的用法，在程序名之前使用 <filename>.d</filename> 前置，且不能在文件夹内。

en: Finally, <command>init</command> starts control programs for various virtual consoles (<command>getty</command>). It displays a prompt, waiting for a username, then executes <command>login <replaceable>user</replaceable></command> to initiate a session.
zh-CN: 最后，<command>init</command>启动各种虚拟控制台的控制程序（<command>getty</command>）。显示提示符，等待输入用户名，然后执行<command>login <replaceable>user</replaceable></command>发起会话。

en: <emphasis>VOCABULARY</emphasis> Console and terminal
zh-CN: <emphasis>词汇</emphasis> 控制台和终端

en: The first computers were usually separated into several, very large parts: the storage enclosure and the central processing unit were separate from the peripheral devices used by the operators to control them. These were part of a separate furniture, the “console”. This term was retained, but its meaning has changed. It has become more or less synonymous with “terminal”, being a keyboard and a screen.
zh-CN: 早期的计算机通常被分成几个部分：存储和中央处理单元与外围操作的控制设备相分离。这些部件是单独的装置，即“控制台”。该术语被保留下来，但是其意义改变了。或多或少它已经和“终端”同义，代表键盘和屏幕。

en: With the development of computers, operating systems have offered several virtual consoles to allow for several independent sessions at the same time, even if there is only one keyboard and screen. Most GNU/Linux systems offer six virtual consoles (in text mode), accessible by typing the key combinations <keycombo action="simul"> <keycap>Control</keycap> <keycap>Alt</keycap> <keycap>F1</keycap> </keycombo> through <keycombo action="simul"> <keycap>Control</keycap> <keycap>Alt</keycap> <keycap>F6</keycap> </keycombo>.
zh-CN: 随着计算机的发展，操作系统提供了许多虚拟终端，从而允许同时存在几个独立的会话，即使是只有一套键盘和屏幕。大部分 GNU/Linux 系统提供六个虚拟终端（在文本模式），通过组合键 <keycombo action="simul"> <keycap>Control</keycap> <keycap>Alt</keycap> <keycap>F1</keycap> </keycombo> 到 <keycombo action="simul"> <keycap>Control</keycap> <keycap>Alt</keycap> <keycap>F6</keycap> </keycombo> 开启。

en: Remote Login
zh-CN: 远程登录

en: It is essential for an administrator to be able to connect to a computer remotely. Servers, confined in their own room, are rarely equipped with permanent keyboards and monitors — but they are connected to the network.
zh-CN: 对于管理员来说有必要远程连接电脑。位于单独房间的服务器，很少配置固定的键盘和显示器－但是他们都会连接到网络。

en: <emphasis>BACK TO BASICS</emphasis> Client, server
zh-CN: <emphasis>基础知识</emphasis> 客户端，服务器

en: <primary>client</primary><secondary>client/server architecture</secondary>
zh-CN: <primary>客户端</primary><secondary>客户端/服务器架构</secondary>

en: <primary>server</primary><secondary>client/server architecture</secondary>
zh-CN: <primary>服务器</primary><secondary>客户端/服务器架构</secondary>

en: A system where several processes communicate with each other is often described with the “client/server” metaphor. The server is the program that takes requests coming from a client and executes them. It is the client that controls operations, the server doesn't take any initiative of its own.
zh-CN: 拥有多个相互通信进程的系统常常称为“客户端/服务器”。服务器是获取客户请求并执行的程序。由客户端来控制操作，服务器自身不会发起任何行动。

en: <primary>login</primary><secondary>remote login</secondary>
zh-CN: <primary>登录</primary><secondary>远程登录</secondary>

en: <primary>remote login</primary>
zh-CN: <primary>远程登录</primary>

en: Secure Remote Login: SSH
zh-CN: 安全远程登录：SSH

en: The <emphasis>SSH</emphasis> (Secure SHell) protocol was designed with security and reliability in mind. Connections using SSH are secure: the partner is authenticated and all data exchanges are encrypted.
zh-CN: <emphasis>SSH</emphasis> (Secure SHell) 通信协议以安全与可靠为首要考量。以 SSH 连接是安全的：伙伴需认证且数据交换经过加密。

en: <emphasis>CULTURE</emphasis> Telnet and RSH are obsolete
zh-CN: <emphasis>文化</emphasis> 已过时的 Telnet 与 RSH

en: Before SSH, <emphasis>Telnet</emphasis> and <emphasis>RSH</emphasis> were the main tools used to login remotely. They are now largely obsolete and should no longer be used even if Debian still provides them.
zh-CN: SSH 问世前，<emphasis>Telnet</emphasis> 与 <emphasis>RSH</emphasis> 是远程登录的主要工具。目前已过时，即使 Debian 仍提供此命令，但已没有人使用它们。

en: <emphasis>VOCABULARY</emphasis> Authentication, encryption
zh-CN: <emphasis>词汇</emphasis> 授权，加密

en: Authentication and encryption are often mentioned together, both because they are frequently used together, and because they are usually implemented with similar mathematical concepts.
zh-CN: 授权和加密经常被同时提及，而且也频频同时使用，因为他们通常使用相似的数学算法概念实现。

en: SSH also offers two file transfer services. <command>scp</command> is a command line tool that can be used like <command>cp</command>, except that any path to another machine is prefixed with the machine's name, followed by a colon.
zh-CN: SSH 还涉及两个文件传输服务。 <command>scp</command> 是一个可以像<command>cp</command>命令一样使用的命令行工具，除了指向其他机器的路径需要加机器名冒号前缀。

en: <command>sftp</command> is an interactive command, similar to <command>ftp</command>. In a single session, <command>sftp</command> can transfer several files, and it is possible to manipulate remote files with it (delete, rename, change permissions, etc.).
zh-CN: <command>sftp</command> 是一个交互命令，类似于 <command>ftp</command>。在一个单独会话中， <command>sftp</command> 可以传输多个文件，并且可以远程操作文件（删除，重命名，更改许可，等等）。

en: Debian uses OpenSSH, a free version of SSH maintained by the <command>OpenBSD</command> project (a free operating system based on the BSD kernel, focused on security) and fork of the original SSH software developed by the SSH Communications Security Corp company, of Finland. This company initially developed SSH as free software, but eventually decided to continue its development under a proprietary license. The OpenBSD project then created OpenSSH to maintain a free version of SSH.
zh-CN: Debian 使用 OpenSSH，一个由 <command>OpenBSD</command> 项目（注重安全，基于 BSD 内核的自由操作系统）维护的自由版本，它效仿了芬兰 SSH Communications Security Corp 公司开发的原始 SSH 软件。该公司最初将 SSH 作为自由软件开发，但是最终决定在专有许可下继续开发。然后，OpenBSD 项目创建了 OpenSSH 维护 SSH 的自由版本。

en: <emphasis>BACK TO BASICS</emphasis> <foreignphrase>Fork</foreignphrase>
zh-CN: <emphasis>基础知识</emphasis> <foreignphrase>分支（Fork）</foreignphrase>

en: A “fork”, in the software field, means a new project that starts as a clone of an existing project, and that will compete with it. From there on, both software will usually quickly diverge in terms of new developments. A fork is often the result of disagreements within the development team.
zh-CN: 一个“分支”，在软件领域，意味着克隆已有项目的新项目，并将与之竞争。从此，两个软件通常会迅速发散开发。分支通常由开发团队内部的分歧产生。

en: The option to fork a project is a direct result of the very nature of free software; a fork is a healthy event when it enables the continuation of a project as free software (for example in case of license changes). A fork arising from technical or personal disagreements is often a waste of human resources; another resolution would be preferable. Mergers of two projects that previously went through a prior fork are not unheard of.
zh-CN: 项目分支也是自由软件本身特性产生的结果；如果能使自由软件继续发展，那么分支也是一种好事（例如万一软件许可证变化）。源自技术或者个人意见不统一的分支常常是浪费资源；推荐其他的解决方案。之前分支的项目再次合并也不是未曾听说。

en: Key-Based Authentication
zh-CN: 基于密钥的认证

en: Each time someone logs in over SSH, the remote server asks for a password to authenticate the user. This can be problematic if you want to automate a connection, or if you use a tool that requires frequent connections over SSH. This is why SSH offers a key-based authentication system.
zh-CN: 每次有人通过 SSH 登入，远程服务器询问密码来授权用户。如果想要自动连接或者使用需要频繁通过 SSH 连接的工具，这就会产生问题。这就是为什么 SSH 提供一种基于密钥的认证系统。

en: <emphasis>SECURITY</emphasis> Protection of the private key
zh-CN: <emphasis>安全</emphasis> 保护私有密钥

en: Whoever has the private key can login on the account thus configured. This is why access to the private key is protected by a “passphrase”. Someone who acquires a copy of a private key file (for example, <filename>~/.ssh/id_rsa</filename>) still has to know this phrase in order to be able to use it. This additional protection is not, however, impregnable, and if you think that this file has been compromised, it is best to disable that key on the computers in which it has been installed (by removing it from the <filename>authorized_keys</filename> files) and replacing it with a newly generated key.
zh-CN: 任何拥有私有密钥的人都可以登录已经配置的账户。这是私有密钥要使用“口令密码”保护的原因。某些获得了私有密钥文件（例如 <filename>~/.ssh/id_rsa</filename>）副本的人，要使用这个文件仍然需要密码。然而，这种额外的保护措施并不是万全的，如果觉得文件被破解，最好在所安装的计算机上禁用该密钥（通过从文件 <filename>authorized_keys</filename> 移除）并使用新生成的密钥取代它。

en: <emphasis>CULTURE</emphasis> OpenSSL flaw in Debian <emphasis role="distribution">Etch</emphasis>
zh-CN: <emphasis>文化</emphasis> OpenSSL 在 Debian <emphasis role="distribution">Etch</emphasis>上的缺陷

en: The OpenSSL library, as initially provided in Debian <emphasis role="distribution">Etch</emphasis>, had a serious problem in its random number generator (RNG). Indeed, the Debian maintainer had made a change so that applications using it would no longer generate warnings when analyzed by memory testing tools like <command>valgrind</command>. Unfortunately, this change also meant that the RNG was employing only one source of entropy corresponding to the process number (PID) whose 32,000 possible values do not offer enough randomness. <ulink type="block" url="https://www.debian.org/security/2008/dsa-1571" />
zh-CN: OpenSSL 程序库，首先由 Debian <emphasis role="distribution">Etch</emphasis> 提供，在其随机数值产生器 (random number generator, RNG) 里有重大缺陷。所以，Debian 维护者修改它，使用 <command>valgrind</command> 之类的内存测试工具时，不再产生警示消息。不幸的是，此种改变让 RNG 套用一个熵值对应 32,000 个可能的处理编号 (PID)，不足以称为乱数。<ulink type="block" url="https://www.debian.org/security/2008/dsa-1571" />

en: Specifically, whenever OpenSSL was used to generate a key, it always produced a key within a known set of hundreds of thousands of keys (32,000 multiplied by a small number of key lengths). This affected SSH keys, SSL keys, and X.509 certificates used by numerous applications, such as OpenVPN. A cracker had only to try all of the keys to gain unauthorized access. To reduce the impact of the problem, the SSH daemon was modified to refuse problematic keys that are listed in the <emphasis role="pkg">openssh-blacklist</emphasis> and <emphasis role="pkg">openssh-blacklist-extra</emphasis> packages. Additionally, the <command>ssh-vulnkey</command> command allows identification of possibly compromised keys in the system.
zh-CN: 特别是当OpenSSL 用于产生密钥，它总是生成一个在已知几百万值集合范围内的密钥（32000乘上密钥长度中的小数字）。这会影响SSH 密钥，SSL 密钥，和X.509认证，他们被大量程序使用，例如OpenVPN。骇客只需尝试所有的密钥来取得未授权的读取。为了减小问题的影响，SSH 守护进程会拒绝使用 <emphasis role="pkg">openssh-blacklist</emphasis> 和 <emphasis role="pkg">openssh-blacklist-extra</emphasis> 软件包中列出的有问题密钥。另外， <command>ssh-vulnkey</command> 命令允许在系统中使用某些折中密钥。

en: A more thorough analysis of this incident brings to light that it is the result of multiple (small) problems, both within the OpenSSL project and with the Debian package maintainer. A widely used library like OpenSSL should — without modifications — not generate warnings when tested by <command>valgrind</command>. Furthermore, the code (especially the parts as sensitive as the RNG) should be better commented to prevent such errors. On Debian's side, the maintainer wanted to validate the modifications with the OpenSSL developers, but simply explained the modifications without providing the corresponding patch to review and failed to mention his role within Debian. Finally, the maintenance choices were sub-optimal: the changes made to the original code were not clearly documented; all the modifications were effectively stored in a Subversion repository, but they ended up all lumped into one single patch during creation of the source package.
zh-CN: 进一步分析这个事件，发现影响多个 (小) 问题，包括 OpenSSL 计划内与 Debian 软件包维护者。像 OpenSSL 这种被广泛使用程序库，被 <command>valgrind</command> 测试时，应该 — 未经修改 — 不能产生警示。尤有甚者，其代码 (尤其是像 RNG 这么敏感的部分) 应该有更好的说明以避免这种错误。从 Debian 的角度来看，维护者要向 OpenSSL 开发者认证其修改的部分，但单纯的解说修改而未提供对应的补丁供查看，以致 Debian 发生前述的错误。最后，维护者的选择是次要的原因：源代码的修改没有清楚的文档；所有的修改都保存在Subversion仓库内，但是把所有的修改总结在一个补丁内纳入原始软件包中。

en: It is difficult under such conditions to find the corrective measures to prevent such incidents from recurring. The lesson to be learned here is that every divergence Debian introduces to upstream software must be justified, documented, submitted to the upstream project when possible, and widely publicized. It is from this perspective that the new source package format (“3.0 (quilt)”) and the Debian sources webservice were developed. <ulink type="block" url="https://sources.debian.org" />
zh-CN: 在这种情况下，很难找出正确的方法以避免再发生此类事件。从此得到的教训，让每个发布的 Debian 必须尽可能的大量公开，经过调整过、文档充足后，才能上传软件。经过此事后，发展出新的原始软件包格式 (“3.0 (quilt)”) 与 Debian 原始网页服务。<ulink type="block" url="https://sources.debian.org" />

en: Using Remote X11 Applications
zh-CN: 使用远程 X11 应用程序

en: The SSH protocol allows forwarding of graphical data (“X11” session, from the name of the most widespread graphical system in Unix); the server then keeps a dedicated channel for those data. Specifically, a graphical program executed remotely can be displayed on the X.org server of the local screen, and the whole session (input and display) will be secure. Since this feature allows remote applications to interfere with the local system, it is disabled by default. You can enable it by specifying <literal>X11Forwarding yes</literal> in the server configuration file (<filename>/etc/ssh/sshd_config</filename>). Finally, the user must also request it by adding the <literal>-X</literal> option to the <command>ssh</command> command-line.
zh-CN: SSH 协议允许转发图形数据（“X11”会话，源于最广泛传播Unix图形系统的名字）；然后，服务器为这些数据保留固定通道。特别地，远程执行的图形程序可以在本地系统X.org服务器屏幕上显示，并且整个会话（输入和显示）都是安全的。由于该特性允许远程应用与本地系统交互，因此默认是关闭的。您可以指明<literal>X11Forwarding yes</literal>参数，将其写入服务器配置文件（<filename>/etc/ssh/sshd_config</filename>）以启用该功能。最后，用户必须通过添加 <literal>-X</literal> 选项到 <command>ssh</command> 命令行中以提出功能请求。

en: Creating Encrypted Tunnels with Port Forwarding
zh-CN: 通过端口转发建立加密通道

en: <primary>port forwarding</primary>
zh-CN: <primary>端口转发</primary>

en: Its <literal>-R</literal> and <literal>-L</literal> options allow <command>ssh</command> to create “encrypted tunnels” between two machines, securely forwarding a local TCP port (see sidebar <xref linkend="sidebar.tcp-udp" />) to a remote machine or vice versa.
zh-CN: <literal>-R</literal> 和 <literal>-L</literal> 选项允许 <command>ssh</command> 在两个机器间添加 “加密隧道”，把本地 TCP 端口 (见专栏 <xref linkend="sidebar.tcp-udp" />) 映射至远程机器或反之。

en: <emphasis>VOCABULARY</emphasis> Tunnel
zh-CN: <emphasis>词汇</emphasis> 隧道

en: The Internet, and most LANs that are connected to it, operate in packet mode and not in connected mode, meaning that a packet issued from one computer to another is going to be stopped at several intermediary routers to find its way to its destination. You can still simulate a connected operation where the stream is encapsulated in normal IP packets. These packets follow their usual route, but the stream is reconstructed unchanged at the destination. We call this a “tunnel”, analogous to a road tunnel in which vehicles drive directly from the entrance (input) to the exit (output) without encountering any intersections, as opposed to a path on the surface that would involve intersections and changing direction.
zh-CN: 大多数局域网通过数据包模式而不是连接模式接入互联网，意味着：由一个计算机发送到另一个计算机的数据包要找到目的地会在几个中继路由之间停顿。仍然可以通过数据流IP数据包封装模拟连接操作。这些数据包流过路由，但是数据流在目的地不加改变重新构造。我们称之为“隧道”，类比为机动车从入口（输入）直接开向出口（输出）的公路通道，期间不会碰到任何交汇，与在表面可能交叉和变向的路径相对。

en: You can use this opportunity to add encryption to the tunnel: the stream that flows through it is then unrecognizable from the outside, but it is returned in decrypted form at the exit of the tunnel.
zh-CN: 可以利用这个机会给隧道加密：流过的数据在外面不能被辨认，但是在隧道的出口解密恢复。

en: <command>ssh -L 8000:server:25 intermediary</command> establishes an SSH session with the <replaceable>intermediary</replaceable> host and listens to local port 8000 (see <xref linkend="figure.ssh-L" />). For any connection established on this port, <command>ssh</command> will initiate a connection from the <replaceable>intermediary</replaceable> computer to port 25 on the <replaceable>server</replaceable>, and will bind both connections together.
zh-CN: 运行<command>ssh -L 8000:server:25 intermediary</command> 命令，将会建立同服务器主机<replaceable>intermediary</replaceable> 的SSH 会话，并侦听本地端口8000（参考 <xref linkend="figure.ssh-L" />）。对于任何建立在该端口的连接， <command>ssh</command> 将会发起从电脑<replaceable>intermediary</replaceable> 到 <replaceable>server</replaceable> 端口25 的连接，并将两个连接绑定。

en: <command>ssh -R 8000:server:25 intermediary</command> also establishes an SSH session to the <replaceable>intermediary</replaceable> computer, but it is on this machine that <command>ssh</command> listens to port 8000 (see <xref linkend="figure.ssh-R" />). Any connection established on this port will cause <command>ssh</command> to open a connection from the local machine on to port 25 of the <replaceable>server</replaceable>, and to bind both connections together.
zh-CN: 命令<command>ssh -R 8000:server:25 intermediary</command>也会建立电脑 <replaceable>intermediary</replaceable> 的SSH 会话，但是在本机 <command>ssh</command> 侦听端口8000 （参考 <xref linkend="figure.ssh-R" />）。在该端口建立的连接将<command>ssh</command> 打开本机到 <replaceable>server</replaceable>25 端口的连接，并将两个连接绑定。

en: In both cases, connections are made to port 25 on the <replaceable>server</replaceable> host, which pass through the SSH tunnel established between the local machine and the <replaceable>intermediary</replaceable> machine. In the first case, the entrance to the tunnel is local port 8000, and the data move towards the <replaceable>intermediary</replaceable> machine before being directed to the <replaceable>server</replaceable> on the “public” network. In the second case, the input and output in the tunnel are reversed; the entrance is port 8000 on the <replaceable>intermediary</replaceable> machine, the output is on the local host, and the data are then directed to the <replaceable>server</replaceable>. In practice, the server is usually either the local machine or the intermediary. That way SSH secures the connection from one end to the other.
zh-CN: 两种情况下，连接建立在<replaceable>server</replaceable> 主机的25 端口，它会透过SSH 隧道建立本地机器和中介机器的连接。在前一种情况下，到该隧道的入口是本地端口8000，数据通过 <replaceable>intermediary</replaceable> 定向到公共网络的<replaceable>server</replaceable>。在第二种情况下，隧道输入输出被保留；入口是 <replaceable>intermediary</replaceable> 的8000 端口，输出在本地主机，然后数据被定向到 <replaceable>server</replaceable>。实际上，服务器不是本地机器就是中介机器。这样SSH 保护了一端到另一端的连接。

en: Forwarding a local port with SSH
zh-CN: 使用SSH转发本地端口

en: Forwarding a remote port with SSH
zh-CN: 使用SSH转发远程端口

en: Using Remote Graphical Desktops
zh-CN: 使用远程图形桌面

en: VNC (Virtual Network Computing) allows remote access to graphical desktops.
zh-CN: VNC （Virtual Network Computing）允许远程接入图形桌面。

en: <primary>graphical desktop</primary><secondary>remote</secondary>
zh-CN: <primary>图形桌面</primary><secondary>远程</secondary>

en: <primary>remote graphical desktop</primary>
zh-CN: <primary>远程图形桌面</primary>

en: <primary>desktop, remote graphical desktop</primary>
zh-CN: <primary>桌面，远程图形桌面</primary>

en: This tool is mostly used for technical assistance; the administrator can see the errors that the user is facing, and show them the correct course of action without having to stand by them.
zh-CN: 该工具主要用于技术支持；管理员可以看到用户面临的错误，并演示正确的操作而不必待在他们旁边。

en: <emphasis>SECURITY</emphasis> VNC over SSH
zh-CN: <emphasis>安全</emphasis> 通过SSH使用VNC

en: If you want to connect by VNC, and you don't want your data sent in clear text on the network, it is possible to encapsulate the data in an SSH tunnel (see <xref linkend="sect.ssh-port-forwarding" />). You simply have to know that VNC uses port 5900 by default for the first screen (called “localhost:0”), 5901 for the second (called “localhost:1”), etc.
zh-CN: 想要经由 VNC 链接，但不想在网络传输明文数据，可以把数据打包在 SSH 信道内 (见 <xref linkend="sect.ssh-port-forwarding" />)。只需知道 VNC 缺省在第一个屏幕使用端口号 5900 (称为 “localhost:0”)，端口号 5901 用在第二个端口号 (称为 “localhost:1”)，等等。

en: The <command>ssh -L localhost:5901:localhost:5900 -N -T <replaceable>machine</replaceable></command> command creates a tunnel between local port 5901 in the localhost interface and port 5900 of the <replaceable>machine</replaceable> host. The first “localhost” restricts SSH to listening to only that interface on the local machine. The second “localhost” indicates the interface on the remote machine which will receive the network traffic entering in “localhost:5901”. Thus <command>vncviewer localhost:1</command> will connect the VNC client to the remote screen, even though you indicate the name of the local machine.
zh-CN: <command>ssh -L localhost:5901:localhost:5900 -N -T <replaceable>machine</replaceable></command>命令创建本地端口5901 和 <replaceable>machine</replaceable> 5900 端口的隧道。第一个“localhost”要求SSH 仅侦听本地机器接口。第二个“localhost”指示远程机器上的接口接收进入“localhost:5901”的网络数据。因此， <command>vncviewer localhost:1</command> 会把VNC 客户连到远程屏幕。

en: When the VNC session is closed, remember to close the tunnel by also quitting the corresponding SSH session.
zh-CN: 当VNC 会话关闭时，记得退出相应的SSH 会话来关闭隧道。

en: <emphasis>BACK TO BASICS</emphasis> Display manager
zh-CN: <emphasis>基础知识</emphasis> 显示管理器

en: <primary>manager</primary><secondary>display manager</secondary>
zh-CN: <primary>管理器</primary><secondary>显示管理器</secondary>

en: <primary>display manager</primary>
zh-CN: <primary>显示管理器</primary>

en: Managing Rights
zh-CN: 管理权限

en: <primary>permissions</primary>
zh-CN: <primary>许可</primary>

en: Linux is definitely a multi-user system, so it is necessary to provide a permission system to control the set of authorized operations on files and directories, which includes all the system resources and devices (on a Unix system, any device is represented by a file or directory). This principle is common to all Unix systems, but a reminder is always useful, especially as there are some interesting and relatively unknown advanced uses.
zh-CN: Linux 是一个典型的多用户系统，这就有必要提供许可制度来控制对文件和目录的操作，其中包含了所有的系统资源和设备（在Unix 系统中，任何设备都由文件或目录来表示）。这一原则对所有Unix 系统通用，这里再提醒一下，特别是对一些有趣的相对高级应用。

en: <primary>user</primary><secondary>owner</secondary>
zh-CN: <primary>用户</primary><secondary>所有者</secondary>

en: <primary>group</primary><secondary>owner</secondary>
zh-CN: <primary>群组</primary><secondary>所有者</secondary>

en: <primary>owner</primary><secondary>user</secondary>
zh-CN: <primary>所有者</primary><secondary>用户</secondary>

en: <primary>owner</primary><secondary>group</secondary>
zh-CN: <primary>所有者</primary><secondary>群组</secondary>

en: Each file or directory has specific permissions for three categories of users:
zh-CN: 每个文件和文件夹有三种用户许可类型：

en: its owner (symbolized by <literal>u</literal> as in “user”);
zh-CN: 所有者 （使用符号 <literal>u</literal> “user”首字母）;

en: its owner group (symbolized by <literal>g</literal> as in “group”), representing all the members of the group;
zh-CN: 所有者群组（使用符号 <literal>g</literal> “group”首字母），代表组中的所有成员;

en: the others (symbolized by <literal>o</literal> as in “other”).
zh-CN: 其他（使用符号 <literal>o</literal> “other”的首字母）。

en: reading (symbolized by <literal>r</literal> as in “read”);
zh-CN: 读取（使用符号 <literal>r</literal> “read”的首字母）;

en: writing (or modifying, symbolized by <literal>w</literal> as in “write”);
zh-CN: 写（使用符号 <literal>w</literal> “write”的首字母）;

en: executing (symbolized by <literal>x</literal> as in “eXecute”).
zh-CN: 执行（使用“eXecute”中的符号 <literal>x</literal> ）。

en: <primary>read, right</primary>
zh-CN: <primary>读取权限</primary>

en: <primary>write, right</primary>
zh-CN: <primary>写权限</primary>

en: <primary>modification, right</primary>
zh-CN: <primary>修改权限</primary>

en: <primary>execution, right</primary>
zh-CN: <primary>运行权限</primary>

en: In the case of a file, these rights are easily understood: read access allows reading the content (including copying), write access allows changing it, and execute access allows you to run it (which will only work if it is a program).
zh-CN: 以文件来说，其权限较容易理解：读取就是允许读取其内容 (包括复制)、写入就是允许改变它、而运行就是执行它 (文件本身必须是程序)。

en: <emphasis>SECURITY</emphasis> <literal>setuid</literal> and <literal>setgid</literal> executables
zh-CN: <emphasis>安全</emphasis> 可执行文件的 <literal>setuid</literal> 和 <literal>setgid</literal>

en: <primary><literal>setuid</literal>, right</primary>
zh-CN: <primary><literal>setuid</literal>，权限</primary>

en: <primary><literal>setgid</literal>, right</primary>
zh-CN: <primary><literal>setgid</literal>，权限</primary>

en: Since a <literal>setuid</literal> root program is systematically run under the super-user identity, it is very important to ensure it is secure and reliable. Indeed, a user who would manage to subvert it to call a command of their choice could then impersonate the root user and have all rights on the system.
zh-CN: 由于 <literal>setuid</literal> root程序在系统层以超级用户的身份运行，有必要确定其安全性和可靠性。实际上，如果用户可以侵入该程序并调用自己设定的命令，就有可能伪装成超级用户并获取系统的所有权限。

en: A directory is handled differently. Read access gives the right to consult the list of its entries (files and directories), write access allows creating or deleting files, and execute access allows crossing through it (especially to go there with the <command>cd</command> command). Being able to cross through a directory without being able to read it gives permission to access the entries therein that are known by name, but not to find them if you do not know their existence or their exact name.
zh-CN: 文件夹的处理方式略有不同。读取其条目 (文件及文件夹)、写入包括添加与删除文件、而运行则是进入它 (尤其是使用 <command>cd</command> 命令)。进入文件夹而不必有读取权限，运行已知的文件名，若不知其正确的名称，则无法运行。

en: <emphasis>SECURITY</emphasis> <literal>setgid</literal> directory and <emphasis>sticky bit</emphasis>
zh-CN: <emphasis>安全</emphasis> 文件夹的 <literal>setgid</literal> 和 <emphasis>sticky bit</emphasis>

en: <primary><literal>setgid</literal> directory</primary>
zh-CN: <primary><literal>setgid</literal> 文件夹</primary>

en: The <literal>setgid</literal> bit also applies to directories. Any newly-created item in such directories is automatically assigned the owner group of the parent directory, instead of inheriting the creator's main group as usual. This setup avoids the user having to change its main group (with the <command>newgrp</command> command) when working in a file tree shared between several users of the same dedicated group.
zh-CN: <literal>setgid</literal> 位也适用于目录。在这种目录中新创建的条目会被自动赋予其父目录的所有组，而不是通常情况下那样继承创建者的主用户组。这种设置可以避免几个同组用户在共享文件树中协同工作时（为保持所创建文件的所有组的一致性）而不得不改变自身主用户组的额外工作（使用 <command>newgrp</command> 命令）。

en: The “sticky” bit (symbolized by the letter “t”) is a permission that is only useful in directories. It is especially used for temporary directories where everybody has write access (such as <filename>/tmp/</filename>): it restricts deletion of files so that only their owner (or the owner of the parent directory) can do it. Lacking this, everyone could delete other users' files in <filename>/tmp/</filename>.
zh-CN: “sticky”位（使用符号“t”）是仅用于目录的许可位。专门用于所有人都有写权限的临时目录（例如 <filename>/tmp/</filename>）：它严格限制删除操作，只有所有者（或者父目录的所有者）可以删除。少了它，所有人都能删除其他用户在 <filename>/tmp/</filename>中的文件。

en: Three commands control the permissions associated with a file:
zh-CN: 有三个控制文件许可权限的命令：

en: <command>chown <replaceable>user</replaceable> <replaceable>file</replaceable></command> changes the owner of the file;
zh-CN: <command>chown <replaceable>user</replaceable> <replaceable>file</replaceable></command> 命令更改文件的所有者;

en: <command>chgrp <replaceable>group</replaceable> <replaceable>file</replaceable></command> alters the owner group;
zh-CN: <command>chgrp <replaceable>group</replaceable> <replaceable>file</replaceable></command> 改变所有群组;

en: <command>chmod <replaceable>rights</replaceable> <replaceable>file</replaceable></command> changes the permissions for the file.
zh-CN: <command>chmod <replaceable>rights</replaceable> <replaceable>file</replaceable></command> 改变文件许可权限。

en: There are two ways of presenting rights. Among them, the symbolic representation is probably the easiest to understand and remember. It involves the letter symbols mentioned above. You can define rights for each category of users (<literal>u</literal>/<literal>g</literal>/<literal>o</literal>), by setting them explicitly (with <literal>=</literal>), by adding (<literal>+</literal>), or subtracting (<literal>-</literal>). Thus the <literal>u=rwx,g+rw,o-r</literal> formula gives the owner read, write, and execute rights, adds read and write rights for the owner group, and removes read rights for other users. Rights not altered by the addition or subtraction in such a command remain unmodified. The letter <literal>a</literal>, for “all”, covers all three categories of users, so that <literal>a=rx</literal> grants all three categories the same rights (read and execute, but not write).
zh-CN: 有两种方法表示权限。其中，符号表示是最易于理解和记忆的。它使用前述的符号链接。可以通过显示的设置（<literal>u</literal>/<literal>g</literal>/<literal>o</literal>），通过设置（<literal>=</literal>），加（<literal>+</literal>），或者减（<literal>-</literal>）定义每种用户的权限类型。一个 <literal>u=rwx,g+rw,o-r</literal> 格式的命令会赋予所有者读，写和执行权限，给所有组添加读写权限，移除其他用户的读权限。其他命令中未通过加或者减列出的权限保持不变。字母 <literal>a</literal>是指“所有”，涵盖三种类型的用户，因此 <literal>a=rx</literal> 命令会赋予三种用户相同的权限（读和执行，没有写）。

en: <primary>octal representation of rights</primary>
zh-CN: <primary>权限的八进制表示</primary>

en: <primary>rights</primary><secondary>octal representation</secondary>
zh-CN: <primary>权限</primary><secondary>八进位表示法</secondary>

en: The (octal) numeric representation associates each right with a value: 4 for read, 2 for write, and 1 for execute. We associate each combination of rights with the sum of the figures. Each value is then assigned to different categories of users by putting them end to end in the usual order (owner, group, others).
zh-CN: 与权限相关的（八进制）数字表示：4是读，2是写，1是执行。各种权限组合通过代表的数字求和得到。通过把每个值置于端到端序列不同位置关联不同的用户类型（所有者，所有组，其他用户）。

en: To represent special rights, you can prefix a fourth digit to this number according to the same principle, where the <literal>setuid</literal>, <literal>setgid</literal> and <literal>sticky</literal> bits are 4, 2 and 1, respectively. <command>chmod 4754</command> will associate the <literal>setuid</literal> bit with the previously described rights.
zh-CN: 要表示特殊权限，可以根据同样的原则在数字上加入第四个前缀位，位 <literal>setuid</literal>， <literal>setgid</literal> 和 <literal>sticky</literal> 分别对应4，2，和1。<command>chmod 4754</command> 会设置前面描述的 <literal>setuid</literal> 位权限。

en: Note that the use of octal notation only allows to set all the rights at once on a file; you cannot use it to simply add a new right, such as read access for the group owner, since you must take into account the existing rights and compute the new corresponding numerical value.
zh-CN: 八进位标记只适用于对文件的一次性设置所有权限；不能以它加入新的权限，如群组拥有者的读取，因为必须把现在的权限与计算新的数值。

en: <emphasis>TIP</emphasis> Recursive operation
zh-CN: <emphasis>提示</emphasis> 递归操作

en: Sometimes we have to change rights for an entire file tree. All the commands above have a <literal>-R</literal> option to operate recursively in sub-directories.
zh-CN: 有时需要更改整个文件树的权限。以上所有的命令都有 <literal>-R</literal> 选项来递归操作子目录。

en: <emphasis>GOING FURTHER</emphasis> <command>umask</command>
zh-CN: <emphasis>进阶</emphasis> <command>umask</command>

en: <primary>rights</primary><secondary>mask</secondary>
zh-CN: <primary>权限</primary><secondary>掩码</secondary>

en: <primary>mask</primary><secondary>rights mask</secondary>
zh-CN: <primary>掩码</primary><secondary>权限掩码</secondary>

en: Administration Interfaces
zh-CN: 管理员界面

en: <primary>interface</primary><secondary>administration interface</secondary>
zh-CN: <primary>界面</primary><secondary>管理员界面</secondary>

en: <primary>administration, interfaces</primary>
zh-CN: <primary>管理，界面</primary>

en: Using a graphical interface for administration is interesting in various circumstances. An administrator does not necessarily know all the configuration details for all their services, and doesn't always have the time to go seeking out the documentation on the matter. A graphical interface for administration can thus accelerate the deployment of a new service. It can also simplify the setup of services which are hard to configure.
zh-CN: 在各种情况下，使用图形界面进行管理都很有趣。管理员不必了解所有服务的配置信息，不用翻阅文档。因此，用图形界面进行管理可以加速服务的部署过程。也能简化那些比较难的服务设置过程。

en: Such an interface is only an aid, and not an end in itself. In all cases, the administrator must master its behavior in order to understand and work around any potential problem.
zh-CN: 此类界面只是辅助，它自身并不解决问题。在各种情况下，管理员必须控制它，以便理解并处理各种潜在的问题。

en: Since no interface is perfect, you may be tempted to try several solutions. This is to be avoided as much as possible, since different tools are sometimes incompatible in their work methods. Even if they all aim to be very flexible and try to adopt the configuration file as a single reference, they are not always able to integrate external changes.
zh-CN: 界面不会完美的，总有其他的解决方案。不过，应尽量避免使用多种解决方案，因为不同的工具彼此间不见得兼容。即使宣称极有弹性且以单一模式使用配置档，不见得能够集成所有的外部改变。

en: Administrating on a Web Interface: <command>webmin</command>
zh-CN: 通过网页接口管理：<command>webmin</command>

en: This is, without a doubt, one of the most successful administration interfaces. It is a modular system managed through a web browser, covering a wide array of areas and tools. Furthermore, it is internationalized and available in many languages.
zh-CN: 毋庸置疑，这是最成功的管理界面。它是透过网络浏览器的模块化系统，覆盖了广泛的领域和工具。而且，它是国际化的并且可以在多种语言中使用。

en: Webmin dashboard
zh-CN: Webmin 面板

en: There is, however, an unofficial package distributed on the <literal>webmin.com</literal> website. Contrary to the original Debian packages, this package is monolithic; all of its configuration modules are installed and activated by default, even if the corresponding service is not installed on the machine.
zh-CN: 然而，非官方的软件包可在 <literal>webmin.com</literal> 网站找到。不同于原自于 Debian 的软件包，此软件包有点古老；即使没有安装对应的服务，仍缺省安装与启用其配置模块。

en: <emphasis>SECURITY</emphasis> Changing the root password
zh-CN: <emphasis>安全</emphasis> 更改root用户密码

en: Webmin is used through a web interface, but it does not require Apache to be installed. Essentially, this software has its own integrated mini web server. This server listens by default on port 10000 and accepts secure HTTP connections.
zh-CN: Webmin 通过 web 界面访问，不需要安装 Apache 网络服务器。该软件集成了它自己的微型网络服务器。默认监听10000 端口，等待安全 HTTP 连接。

en: Included modules cover a wide variety of services, among which:
zh-CN: 包括大量服务模块，其中包括：

en: bind: DNS server configuration (name service);
zh-CN: bind：DNS 服务配置（域名服务）;

en: postfix: SMTP server configuration (e-mail);
zh-CN: postfix：SMTP 服务配置（电子邮件）;

en: dhcpd: DHCP server configuration;
zh-CN: dhcpd：DHCP 服务配置;

en: proftpd: FTP server configuration;
zh-CN: proftpd：FTP 服务配置;

en: samba: Samba file server configuration;
zh-CN: samba：Samba 文件服务配置;

en: software: installation or removal of software from Debian packages and system updates.
zh-CN: sodtware：从Debian 安装或者移除软件报和系统更新。

en: The administration interface is available in a web browser at <literal>https://localhost:10000</literal>. Beware! Not all the modules are directly usable. Sometimes they must be configured by specifying the locations of the corresponding configuration files and some executable files (program). Frequently the system will politely prompt you when it fails to activate a requested module.
zh-CN: 管理界面可以通过在网络浏览器中输入地址 <literal>https://localhost:10000</literal>。注意！不是所有的模块都是直接可用的。有些必须通过指定相应的配置文件和可执行文件（程序）。如果未能启动请求的模块，系统往往会给出提示。

en: <emphasis>ALTERNATIVE</emphasis> GNOME control center
zh-CN: <emphasis>其他</emphasis> GNOME 控制中心

en: The GNOME project also provides multiple administration interfaces that are usually accessible via the “Settings” entry in the user menu on the top right. <command>gnome-control-center</command> is the main program that brings them all together but many of the system wide configuration tools are effectively provided by other packages (<emphasis role="pkg">accountsservice</emphasis>, <emphasis role="pkg">system-config-printer</emphasis>, etc.). Although they are easy to use, these applications cover only a limited number of base services: user management, time configuration, network configuration, printer configuration, and so on.
zh-CN: GNOME 项目也提供右上角用户菜单 “设置” 的多管理接口。<command>gnome-control-center</command> 是主程序，还有其他软件包提供的配置工具 (<emphasis role="pkg">accountsservice</emphasis>、<emphasis role="pkg">system-config-printer</emphasis>等)。虽然使用简易，不过只包括有限的基本服务：用户管理、时间配置、网络配置、打印机配置等。

en: Configuring Packages: <command>debconf</command>
zh-CN: 用于管理配置的软件包： <command>debconf</command>

en: For most cases, these settings are very simple; only a few important variables in the configuration file are changed. These variables are often grouped between two “demarcation” lines so that reconfiguration of the package only impacts the enclosed area. In other cases, reconfiguration will not change anything if the script detects a manual modification of the configuration file, in order to preserve these human interventions (because the script can't ensure that its own modifications will not disrupt the existing settings).
zh-CN: 对于大多数情况，设置很简单；只改变配置文件中的几个重要变量。常常把这些变量放在两个分隔行内，重新配置只会影响其内的数据。其他情况下，如果脚本探测到手动更改了配置文件，为了保留这些人为编辑，重新配置什么也不做（因为脚本不能确定它的修改不会弄乱已有的设置）。

en: <emphasis>DEBIAN POLICY</emphasis> Preserving changes
zh-CN: <emphasis>DEBIAN 规则</emphasis> 保留更改

en: The Debian Policy expressly stipulates that everything should be done to preserve manual changes made to a configuration file, so more and more scripts take precautions when editing configuration files. The general principle is simple: the script will only make changes if it knows the status of the configuration file, which is verified by comparing the checksum of the file against that of the last automatically generated file. If they are the same, the script is authorized to change the configuration file. Otherwise, it determines that the file has been changed and asks what action it should take (install the new file, save the old file, or try to integrate the new changes with the existing file). This precautionary principle has long been unique to Debian, but other distributions have gradually begun to embrace it.
zh-CN: Debian 规则明确规定应尽量保留对配置文件的手动更改，这样越来越多的脚本在编辑配置文件时会采取措施。一般原则很简单：只有在理解配置文件的状态下，脚本才会做出更改，通过对比现在的文件和上次自动产生的文件校验和就可以验证文件是否经过人为修改。如果两个校验和相同，授权脚本更改配置文件。否则，文件被改过，询问采取什么行动（安装新文件，保存旧文件，或者尝试把新更改集成到已有文件内）。这种预警原则长久以来是Debian的特性，但是现在其他的发行版也开始渐渐采取这种做法。

en: The <command>ucf</command> program (from the Debian package of the same name) can be used to implement such a behavior.
zh-CN: <command>ucf</command> 程序（在Debian 中拥有同名的软件包）能用于实施这种行为。

en: <command>syslog</command> System Events
zh-CN: <command>syslog</command> 系统事件

en: Principle and Mechanism
zh-CN: 原则与机制

en: The <command>rsyslogd</command> daemon is responsible for collecting service messages coming from applications and the kernel, then dispatching them into log files (usually stored in the <filename>/var/log/</filename> directory). It obeys the <filename>/etc/rsyslog.conf</filename> configuration file.
zh-CN: <command>rsyslogd</command> 后台进程负责搜集来自应用程序与内核的服务消息，然后送至日志档内 (通常保存在 <filename>/var/log/</filename> 文件夹内)。遵守 <filename>/etc/rsyslog.conf</filename> 配置文件的要求。

en: Each log message is associated with an application subsystem (called “facility” in the documentation):
zh-CN: 每个日志信息都和应用子系统相关联（文档中称为“facility”）：

en: <literal>auth</literal> and <literal>authpriv</literal>: for authentication;
zh-CN: <literal>auth</literal> 和 <literal>authpriv</literal>：用于授权;

en: <literal>cron</literal>: comes from task scheduling services, <command>cron</command> and <command>atd</command>;
zh-CN: <literal>cron</literal>：来自任务调度服务， <command>cron</command> 和 <command>atd</command>;

en: <literal>daemon</literal>: affects a daemon without any special classification (DNS, NTP, etc.);
zh-CN: <literal>daemon</literal>：影响未分类的守护进程（DNS， NTP等）;

en: <literal>ftp</literal>: concerns the FTP server;
zh-CN: <literal>ftp</literal>：涉及FTP 服务器;

en: <literal>kern</literal>: message coming from the kernel;
zh-CN: <literal>kern</literal>：源于内核的消息;

en: <literal>lpr</literal>: comes from the printing subsystem;
zh-CN: <literal>lpr</literal>：源于打印子系统;

en: <literal>mail</literal>: comes from the e-mail subsystem;
zh-CN: <literal>mail</literal>：源于电子邮件子系统;

en: <literal>news</literal>: Usenet subsystem message (especially from an NNTP — Network News Transfer Protocol — server that manages newsgroups);
zh-CN: <literal>news</literal>：Usenet 子系统消息（主要源自NNTP －网络消息传输协议－管理新闻组的服务器）;

en: <literal>syslog</literal>: messages from the <command>syslogd</command> server, itself;
zh-CN: <literal>syslog</literal>：源于 <command>syslogd</command> 服务自身的消息;

en: <literal>user</literal>: user messages (generic);
zh-CN: <literal>user</literal>：用户消息（通用）;

en: <literal>uucp</literal>: messages from the UUCP server (Unix to Unix Copy Program, an old protocol notably used to distribute e-mail messages);
zh-CN: <literal>uucp</literal>：源于UUCP（Unix to Unix Copy Program，一种老式的分发电子邮件消息的协议）服务的消息;

en: <literal>local0</literal> to <literal>local7</literal>: reserved for local use.
zh-CN: <literal>local0</literal> 到 <literal>local7</literal>：保留本地使用。

en: Each message is also associated with a priority level. Here is the list in decreasing order:
zh-CN: 每种消息都有其优先级。下面按降序列出：

en: <literal>emerg</literal>: “Help!” There is an emergency, the system is probably unusable.
zh-CN: <literal>emerg</literal>：“救命！” 紧急状态，系统可能已挂了。

en: <literal>alert</literal>: hurry up, any delay can be dangerous, action must be taken immediately;
zh-CN: <literal>alert</literal>：赶快，任何推迟都是危险的，必须马上采取行动;

en: <literal>crit</literal>: conditions are critical;
zh-CN: <literal>crit</literal>：情况很严重;

en: <literal>err</literal>: error;
zh-CN: <literal>err</literal>：错误;

en: <literal>warn</literal>: warning (potential error);
zh-CN: <literal>warn</literal>：警告（潜在的错误）;

en: <literal>notice</literal>: conditions are normal, but the message is important;
zh-CN: <literal>notice</literal>：正常情况，但是该消息很重要;

en: <literal>info</literal>: informative message;
zh-CN: <literal>info</literal>：提供信息;

en: <literal>debug</literal>: debugging message.
zh-CN: <literal>debug</literal>：调试消息。

en: The Configuration File
zh-CN: 配置文件

en: Syntax of the Selector
zh-CN: 选择器语法

en: The selector is a semicolon-separated list of <literal><replaceable>subsystem</replaceable>.<replaceable>priority</replaceable></literal> pairs (example: <literal>auth.notice;mail.info</literal>). An asterisk may represent all subsystems or all priorities (examples: <literal>*.alert</literal> or <literal>mail.*</literal>). Several subsystems can be grouped, by separating them with a comma (example: <literal>auth,mail.info</literal>). The priority indicated also covers messages of equal or higher priority; thus <literal>auth.alert</literal> indicates the <literal>auth</literal> subsystem messages of <literal>alert</literal> or <literal>emerg</literal> priority. Prefixed with an exclamation point (!), it indicates the opposite, in other words the strictly lower priorities; <literal>auth.!notice</literal>, thus, indicates messages issued from <literal>auth</literal>, with <literal>info</literal> or <literal>debug</literal> priority. Prefixed with an equal sign (=), it corresponds to precisely and only the priority indicated (<literal>auth.=notice</literal> only concerns messages from <literal>auth</literal> with <literal>notice</literal> priority).
zh-CN: 选择器是由分号分隔（“;”）的 <literal><replaceable>subsystem</replaceable>清单及配对的<replaceable>priority</replaceable></literal>（例如： <literal>auth.notice;mail.info</literal>）。星号（“*”）代表所有的子系统和优先级（例如： <literal>*.alert</literal> 或者 <literal>mail.*</literal>）。几个子系统可以通过逗号（“,”）合并成组（例如： <literal>auth,mail.info</literal>）。优先级指明相同或更高优先级的消息；因此 <literal>auth.alert</literal> 指具有 <literal>alert</literal> 和 <literal>emerg</literal> 优先级的<literal>auth</literal> 子系统消息。惊叹号（“!”）前缀表示求反，换句话说指低等级的优先级；因此 <literal>auth.!notice</literal>指有 <literal>auth</literal>产生的具有 <literal>info</literal> 或 <literal>debug</literal> 优先级的消息。等号（“=”）前缀表示精确指定某种优先级（<literal>auth.=notice</literal> 只关心具有 <literal>notice</literal> 优先级的 <literal>auth</literal> 消息）。优先级依次为：debug, info, notice, warning/warn, err/error , crit, alert, emerg/panic。

en: Each element in the list on the selector overrides previous elements. It is thus possible to restrict a set or to exclude certain elements from it. For example, <literal>kern.info;kern.!err</literal> means messages from the kernel with priority between <literal>info</literal> and <literal>warn</literal>. The <literal>none</literal> priority indicates the empty set (no priorities), and may serve to exclude a subsystem from a set of messages. Thus, <literal>*.crit;kern.none</literal> indicates all the messages of priority equal to or higher than <literal>crit</literal> not coming from the kernel.
zh-CN: 列在选择器中的元素会覆盖先前的元素。因此可以限定一个集合或者排除一些元素。例如， <literal>kern.info;kern.!err</literal> 表示源于内核优先级在 <literal>info</literal> 和 <literal>warn</literal>之间的消息。 <literal>none</literal> 优先级指示空集（无优先级），可用于从集合中排除一个子系统消息。于是， <literal>*.crit;kern.none</literal> 指所有优先级等于或高于 <literal>crit</literal> 但不是来自内核的消息。

en: Syntax of Actions
zh-CN: 行为的语法

en: <emphasis>BACK TO BASICS</emphasis> The named pipe, a persistent pipe
zh-CN: <emphasis>基础知识</emphasis> 命名管道，持续管道

en: <primary>named pipe</primary>
zh-CN: <primary>命名管道</primary>

en: A named pipe is a particular type of file that operates like a traditional pipe (the pipe that you make with the “|” symbol on the command line), but via a file. This mechanism has the advantage of being able to relate two unrelated processes. Anything written to a named pipe blocks the process that writes until another process attempts to read the data written. This second process reads the data written by the first, which can then resume execution.
zh-CN: 命名管道是一种特殊类型的文件，可以像传统管道一样操作（通过在命令行中使用“|”符号），但是命名管道通过文件。这种机制的优点是可以关联两个不相干的进程。任何对命名管道的写操作会阻塞该进程直到另一个进程试图读数据。第二个进程读出第一个进程写的数据，第一个进程恢复执行。

en: Such a file is created with the <command>mkfifo</command> command.
zh-CN: 这种文件由 <command>mkfifo</command> 命令创建。

en: The various possible actions are:
zh-CN: 各种可能的行为包括：

en: add the message to a file (example: <filename>/var/log/messages</filename>);
zh-CN: 添加信息到文件（例如： <filename>/var/log/messages</filename>）;

en: send the message to a remote <command>syslog</command> server (example: <literal>@log.falcot.com</literal>);
zh-CN: 将消息发送到 <command>syslog</command> 远程服务器（例如： <literal>@log.falcot.com</literal>）;

en: send the message to an existing named pipe (example: <literal>|/dev/xconsole</literal>);
zh-CN: 将消息发送至已有的命名管道（例如： <literal>|/dev/xconsole</literal>）;

en: send the message to one or more users, if they are logged in (example: <literal>root,rhertzog</literal>);
zh-CN: 将消息发给一个或多个已经登录的用户（如： <literal>root,rhertzog</literal>）;

en: send the message to all logged in users (example: <literal>*</literal>);
zh-CN: 将消息发给所有登录用户（如： <literal>*</literal>）;

en: write the message in a text console (example: <literal>/dev/tty8</literal>).
zh-CN: 将消息写入文本控制台（如： <literal>/dev/tty8</literal>）。

en: <emphasis>SECURITY</emphasis> Forwarding logs
zh-CN: <emphasis>安全</emphasis> 转发日志

en: <primary>log</primary><secondary>forwarding</secondary>
zh-CN: <primary>日志</primary><secondary>转发</secondary>

en: It is a good idea to record the most important logs on a separate machine (perhaps dedicated for this purpose), since this will prevent any possible intruder from removing traces of their intrusion (unless, of course, they also compromise this other server). Furthermore, in the event of a major problem (such as a kernel crash), you have the logs available on another machine, which increases your chances of determining the sequence of events that caused the crash.
zh-CN: 将一些重要日志保存在单独的机器（可能是日志专用）是很好的主意，这样可以防止侵入者移除他们的入侵痕迹（除非，他们也入侵了该日志服务器）。另外，碰到一些重要问题（像内核崩溃），日志变量都在另外的机器上，就更有机会确定导致崩溃的事件顺序。

en: To accept log messages sent by other machines, you must reconfigure <emphasis>rsyslog</emphasis>: in practice, it is sufficient to activate the ready-for-use entries in <filename>/etc/rsyslog.conf</filename> (<literal>$ModLoad imudp</literal> and <literal>$UDPServerRun 514</literal>).
zh-CN: 要接受其他机器发来的消息，必须配置 <emphasis>rsyslog</emphasis>：实际上，只要激活 <filename>/etc/rsyslog.conf</filename> 中已有的选项就足够了（<literal>$ModLoad imudp</literal> and <literal>$UDPServerRun 514</literal>）。

en: The <command>inetd</command> Super-Server
zh-CN: <command>inetd</command> 超级服务器

en: Inetd (often called “Internet super-server”) is a server of servers. It executes rarely used servers on demand, so that they do not have to run continuously.
zh-CN: Inetd（常被称为“网络超级服务”）是一个服务器服务。它按需求运行一些不常用的服务，而且不需要连续运行。

en: <primary>super-server</primary>
zh-CN: <primary>超级服务</primary>

en: The <filename>/etc/inetd.conf</filename> file lists these servers and their usual ports. The <command>inetd</command> command listens to all of them; when it detects a connection to any such port, it executes the corresponding server program.
zh-CN: <filename>/etc/inetd.conf</filename> 文件列出服务器及其通用的端口号。<command>inetd</command> 命令侦测它们；若发现任何端口号已被链接，则运行对应的程序。

en: Packages frequently want to register a new server in the <filename>/etc/inetd.conf</filename> file, but Debian Policy prohibits any package from modifying a configuration file that it doesn't own. This is why the <command>update-inetd</command> script (in the package with the same name) was created: It manages the configuration file, and other packages can thus use it to register a new server to the super-server's configuration.
zh-CN: 软件包经常需要在 <filename>/etc/inetd.conf</filename> 文件登录新的服务器，但 Debian 政策禁止任何软件包编辑不属于自身的配置档。所以有 <command>update-inetd</command> 脚本 (在同名软件包内)：管理配置文件以及其他软件包，使其在超级服务器的配置中登录新的服务器。

en: Each significant line of the <filename>/etc/inetd.conf</filename> file describes a server through seven fields (separated by spaces):
zh-CN: <filename>/etc/inetd.conf</filename> 文件中的每列条目以 7 个字段 (以空格区分) 描述服务器：

en: The TCP or UDP port number, or the service name (which is mapped to a standard port number with the information contained in the <filename>/etc/services</filename> file).
zh-CN: TCP 或者UDP 端口号，或者服务名称（用<filename>/etc/services</filename> 文件中包含的信息映射到标准端口号）。

en: The socket type: <literal>stream</literal> for a TCP connection, <literal>dgram</literal> for UDP datagrams.
zh-CN: 套接字类型： <literal>stream</literal> 用于TCP 连接， <literal>dgram</literal> 用于UDP 数据包。

en: The options: two possible values: <literal>wait</literal> or <literal>nowait</literal>, to tell <command>inetd</command> whether it should wait or not for the end of the launched process before accepting another connection. For TCP connections, easily multiplexable, you can usually use <literal>nowait</literal>. For programs responding over UDP, you should use <literal>nowait</literal> only if the server is capable of managing several connections in parallel. You can suffix this field with a period, followed by the maximum number of connections authorized per minute (the default limit is 256).
zh-CN: 选项：两个可能值：<literal>wait</literal> 或 <literal>nowait</literal>，告诉 <command>inetd</command> 在接受另一个链接时，是否等待或终止已启用的进程。对 TCP 链接而言，可使用 <literal>nowait</literal>，进入多任务。对回应 UDP 的程序而言，只在服务器可平行管理多个链接时，才使用 <literal>nowait</literal>。可在这个字段前加上圆点，以及每分钟可以开启的最大链接量 (缺省为 256)。

en: The full path to the server program to execute.
zh-CN: 要执行程序的完整路径。

en: The arguments: this is a complete list of the program's arguments, including its own name (<literal>argv[0]</literal> in C).
zh-CN: 参数：此处是程序的完整参数列表，包括程序名本身（C中的<literal>argv[0]</literal> ）。

en: Excerpt from <filename>/etc/inetd.conf</filename>
zh-CN: 摘自 <filename>/etc/inetd.conf</filename>

en: <emphasis>COMMUNITY</emphasis> Wietse Venema
zh-CN: <emphasis>社区</emphasis> Wietse Venema

en: <emphasis>ALTERNATIVE</emphasis> Other <command>inetd</command> commands
zh-CN: <emphasis>选择</emphasis> 其他 <command>inetd</command> 命令

en: Last but not least, it is even possible to emulate <command>inetd</command>'s behavior with <command>systemd</command>'s socket-activation mechanism (see <xref linkend="sect.systemd" />).
zh-CN: 最后但同样重要的是，甚至可以仿真 <command>inetd</command> 的行为，以 <command>systemd</command> 的插座启用模式运作 (见 <xref linkend="sect.systemd" />)。

en: Scheduling Tasks with <command>cron</command> and <command>atd</command>
zh-CN: 使用 <command>cron</command> 和 <command>atd</command>运行计划任务

en: <primary>scheduled commands</primary>
zh-CN: <primary>调度命令</primary>

en: <primary>command scheduling</primary>
zh-CN: <primary>命令调度</primary>

en: In a Unix system, many tasks are scheduled for regular execution:
zh-CN: 在Unix 系统，许多任务都被周期性的调度：

en: rotating the logs;
zh-CN: 更替日志;

en: updating the database for the <command>locate</command> program;
zh-CN: 更新 <command>locate</command> 程序数据库;

en: back-ups;
zh-CN: 备份;

en: maintenance scripts (such as cleaning out temporary files).
zh-CN: 维护脚本（例如清理临时文件）。

en: By default, all users can schedule the execution of tasks. Each user has thus their own <emphasis>crontab</emphasis> in which they can record scheduled commands. It can be edited by running <command>crontab -e</command> (its content is stored in the <filename>/var/spool/cron/crontabs/<replaceable>user</replaceable></filename> file).
zh-CN: 默认情况下，所有用户都可以运行计划任务。每个用户有他们自己的 <emphasis>crontab</emphasis>，其中记录了要调度的命令。可以运行 <command>crontab -e</command> 编辑（其内容存储在 <filename>/var/spool/cron/crontabs/<replaceable>user</replaceable></filename> 文件中）。

en: <emphasis>SECURITY</emphasis> Restricting <command>cron</command> or <command>atd</command>
zh-CN: <emphasis>安全</emphasis> 限制 <command>cron</command> 或者 <command>atd</command>

en: The root user has their own <emphasis>crontab</emphasis>, but can also use the <filename>/etc/crontab</filename> file, or write additional <emphasis>crontab</emphasis> files in the <filename>/etc/cron.d</filename> directory. These last two solutions have the advantage of being able to specify the user identity to use when executing the command.
zh-CN: root用户有自己的 <emphasis>crontab</emphasis>，但是也可以使用 <filename>/etc/crontab</filename> 文件，或者在 <filename>/etc/cron.d</filename> 目录中写入另外的<emphasis>crontab</emphasis> 文件。这两种方法可以用来指明执行命令时的用户身份。

en: The <emphasis>cron</emphasis> package includes by default some scheduled commands that execute:
zh-CN: <emphasis>cron</emphasis> 软件包默认包含一些可执行的调度命令：

en: programs in the <filename>/etc/cron.hourly/</filename> directory once per hour;
zh-CN: 每小时运行在 <filename>/etc/cron.hourly/</filename> 文件夹内的程序;

en: programs in <filename>/etc/cron.daily/</filename> once per day;
zh-CN: 每天运行在 <filename>/etc/cron.daily/</filename> 文件夹内的程序;

en: programs in <filename>/etc/cron.weekly/</filename> once per week;
zh-CN: 每周运行在 <filename>/etc/cron.weekly/</filename> 文件夹内的程序;

en: programs in <filename>/etc/cron.monthly/</filename> once per month.
zh-CN: 每月运行在 <filename>/etc/cron.monthly/</filename> 文件夹内的程序。

en: Many Debian packages rely on this service: by putting maintenance scripts in these directories, they ensure optimal operation of their services.
zh-CN: 很多 Debian 软件包依赖此服务：把维护脚本置于此文件夹，确保其服务的最佳运作。

en: Format of a <filename>crontab</filename> File
zh-CN: <filename>crontab</filename> 文件的格式

en: <emphasis>TIP</emphasis> Text shortcuts for <command>cron</command>
zh-CN: <emphasis>提示</emphasis> <command>cron</command>中的快捷方式

en: <command>cron</command> recognizes some abbreviations which replace the first five fields in a <filename>crontab</filename> entry. They correspond to the most classic scheduling options:
zh-CN: <command>cron</command> 可以识别一些简写名称用以表示在 <filename>crontab</filename> 中开头的五个时间区段。他们对应最常用的调度选项：

en: <literal>@yearly</literal>: once per year (January 1, at 00:00);
zh-CN: <literal>@yearly</literal>：每年一次（1月1号，00:00）;

en: <literal>@monthly</literal>: once per month (the 1st of the month, at 00:00);
zh-CN: <literal>@monthly</literal>：每月一次（每月1号，00:00）;

en: <literal>@weekly</literal>: once per week (Sunday at 00:00);
zh-CN: <literal>@weekly</literal>：每周一次（周日，00:00）;

en: <literal>@daily</literal>: once per day (at 00:00);
zh-CN: <literal>@daily</literal>：每天一次（00:00）;

en: <literal>@hourly</literal>: once per hour (at the beginning of each hour).
zh-CN: <literal>@hourly</literal>：每小时一次（在每小时开始）。

en: <emphasis>SPECIAL CASE</emphasis> <command>cron</command> and daylight savings time
zh-CN: <emphasis>特例</emphasis> <command>cron</command> 和夏令时

en: In Debian, <command>cron</command> takes the time change (for Daylight Savings Time, or in fact for any significant change in the local time) into account as best as it can. Thus, the commands that should have been executed during an hour that never existed (for example, tasks scheduled at 2:30 am during the Spring time change in France, since at 2:00 am the clock jumps directly to 3:00 am) are executed shortly after the time change (thus around 3:00 am DST). On the other hand, in autumn, when commands would be executed several times (2:30 am DST, then an hour later at 2:30 am standard time, since at 3:00 am DST the clock turns back to 2:00 am) are only executed once.
zh-CN: 在Debian中， <command>cron</command> 尽量考虑时间变更（夏令时，或者本地时间的重大变化）。因此，被安排到不存在时间（例如，安排在法国春季时间 2:30 执行的任务，而时钟在凌晨 2:00 之后会直接跳到凌晨3:00）的命令会在时间改变后马上执行（大概在夏令时 3:00）。另一方面，在秋天，需要多次执行的命令（夏令时凌晨 2:30，标准时间凌晨 2:30 之后一个小时，由于凌晨在 3:00，时钟被回调至凌晨 2:00）只会执行一次。

en: Be careful, however, if the order in which the different scheduled tasks and the delay between their respective executions matters, you should check the compatibility of these constraints with <command>cron</command>'s behavior; if necessary, you can prepare a special schedule for the two problematic nights per year.
zh-CN: 要当心了，如果不同任务的调度顺序和延迟相互关联，就需要检查使用 <command>cron</command> 时，是否兼容一致；如果有必要，为每年可能发生问题的夜晚准备专门的调度程序。

en: the value for the hour (from 0 to 23);
zh-CN: 小时值（从0到23）;

en: the value for the day of the month (from 1 to 31);
zh-CN: 每月的日期值（从1到31）;

en: the value for the month (from 1 to 12);
zh-CN: 月份值（从1到12）;

en: the value for the day of the week (from 0 to 7, 1 corresponding to Monday, Sunday being represented by both 0 and 7; it is also possible to use the first three letters of the name of the day of the week in English, such as <literal>Sun</literal>, <literal>Mon</literal>, etc.);
zh-CN: 星期值（从0到7，1对应星期一，0和7都代表星期日；也可以使用星期英文表示单次的前三个字母，例如 <literal>Sun</literal>， <literal>Mon</literal>等）;

en: the user name under whose identity the command must be executed (in the <filename>/etc/crontab</filename> file and in the fragments located in <filename>/etc/cron.d/</filename>, but not in the users' own crontab files);
zh-CN: 命令将以哪个用户的名义执行（在文件 <filename>/etc/crontab</filename>和 <filename>/etc/cron.d/</filename>中，而不是在用户自己的调度文件中）;

en: the command to execute (when the conditions defined by the first five columns are met).
zh-CN: 要执行的命令（当满足前面５栏定义的条件时）。

en: All these details are documented in the <citerefentry><refentrytitle>crontab</refentrytitle> <manvolnum>5</manvolnum></citerefentry> man page.
zh-CN: 全部的细节记录在 <citerefentry><refentrytitle>crontab</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册中。

en: <emphasis>TIP</emphasis> Executing a command on boot
zh-CN: <emphasis>提示</emphasis> 在启动时运行命令

en: To execute a command a single time, just after booting the computer, you can use the <literal>@reboot</literal> macro (a simple restart of <command>cron</command> does not trigger a command scheduled with <literal>@reboot</literal>). This macro replaces the first five fields of an entry in the <emphasis>crontab</emphasis>.
zh-CN: 只是在系统启动后，单次执行一个命令，可以使用 <literal>@reboot</literal> 宏（仅仅重启 <command>cron</command> 命令不会触发使用<literal>@reboot</literal>调度的命令）。该宏表示了 <emphasis>crontab</emphasis>条目的前五个区段。

en: <emphasis>ALTERNATIVE</emphasis> Emulating <command>cron</command> with <command>systemd</command>
zh-CN: <emphasis>其他</emphasis> 用 <command>systemd</command> 仿真 <command>cron</command>

en: It is possible to emulate part of <command>cron</command>'s behavior with <command>systemd</command>'s timer mechanism (see <xref linkend="sect.systemd" />).
zh-CN: 部分 <command>cron</command> 的行为，可以用 <command>systemd</command> 的时间机制来仿真（请参见 <xref linkend="sect.systemd" />）。

en: Using the <command>at</command> Command
zh-CN: 使用 <command>at</command> 命令

en: An alternative syntax postpones the execution for a given duration: <command>at now + <replaceable>number</replaceable> <replaceable>period</replaceable></command>. The <replaceable>period</replaceable> can be <literal>minutes</literal>, <literal>hours</literal>, <literal>days</literal>, or <literal>weeks</literal>. The <replaceable>number</replaceable> simply indicates the number of said units that must elapse before execution of the command.
zh-CN: 另外一种方法可以向后推迟一段时间执行命令：<command>at now + <replaceable>number</replaceable> <replaceable>period</replaceable></command>。 <replaceable>period</replaceable> 可以是 <literal>minutes</literal>, <literal>hours</literal>, <literal>days</literal>, 或者 <literal>weeks</literal>。 <replaceable>number</replaceable> 指明在命令执行之前消逝时间的单位数量。

en: To cancel a task scheduled by <command>cron</command>, simply run <command>crontab -e</command> and delete the corresponding line in the <emphasis>crontab</emphasis> file. For <command>at</command> tasks, it is almost as easy: run <command>atrm <replaceable>task-number</replaceable></command>. The task number is indicated by the <command>at</command> command when you scheduled it, but you can find it again with the <command>atq</command> command, which gives the current list of scheduled tasks.
zh-CN: 要取消 <command>cron</command>中的计划任务，运行 <command>crontab -e</command> 删除 <emphasis>crontab</emphasis> 文件中的对应行。对于使用 <command>at</command> 命令的任务，同样简单：运行 <command>atrm <replaceable>任务编号</replaceable></command>。任务编号在调度时由 <command>at</command> 命令指定，可以通过 <command>atq</command> 命令查询找到，该命令给出当前计划任务清单。

en: Scheduling Asynchronous Tasks: <command>anacron</command>
zh-CN: 异步调度任务：<command>anacron</command>

en: <command>anacron</command> is the daemon that completes <command>cron</command> for computers that are not on at all times. Since regular tasks are usually scheduled for the middle of the night, they will never be executed if the computer is off at that time. The purpose of <command>anacron</command> is to execute them, taking into account periods in which the computer is not working.
zh-CN: <command>anacron</command> 用于不能全天候开机的电脑，替代完成 <command>cron</command> 命令的守护进程。由于常规的计划任务通常被安排在午夜执行，如果计算机当时没有开机就不会运行这些任务。 <command>anacron</command> 的目的就在于运行这些计划任务，并考虑计算机关机时间。

en: Please note that <command>anacron</command> will frequently execute such activity a few minutes after booting the machine, which can render the computer less responsive. This is why the tasks in the <filename>/etc/anacrontab</filename> file are started with the <command>nice</command> command, which reduces their execution priority and thus limits their impact on the rest of the system. Beware, the format of this file is not the same as that of <filename>/etc/crontab</filename>; if you have particular needs for <command>anacron</command>, see the <citerefentry><refentrytitle>anacrontab</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manual page.
zh-CN: 请注意， <command>anacron</command> 会在启动机器之后，频频执行此类活动，有可能导致计算机反应迟缓。这也正是<filename>/etc/anacrontab</filename> 文件中的任务以 <command>nice</command> 命令开头的原因，这样可以减小它们执行优先级进而限制它们对系统的影响。注意，该文件的格式和 <filename>/etc/crontab</filename>不完全相同；如果对 <command>anacron</command>有特殊需求设定，可参看 <citerefentry><refentrytitle>anacrontab</refentrytitle> <manvolnum>5</manvolnum></citerefentry> 手册。

en: <emphasis>BACK TO BASICS</emphasis> Priorities and <command>nice</command>
zh-CN: <emphasis>基础知识</emphasis> 优先级和 <command>nice</command>

en: <command>nice</command> works with levels of “niceness”: the positive levels (from 1 to 19) progressively lower the priority, while the negative levels (from -1 to -20) will increase it — but only root can use these negative levels. Unless otherwise indicated (see the <citerefentry><refentrytitle>nice</refentrytitle> <manvolnum>1</manvolnum></citerefentry> manual page), <command>nice</command> increases the current level by 10.
zh-CN: <command>nice</command> 会给优先级添加“niceness”：正值优先级（从1到19）逐渐降低优先级，而负值（从 -1 到 -20）增加优先级－但是仅有超级用户可以使用负值优先级。除非特别指明（参看 <citerefentry><refentrytitle>nice</refentrytitle> <manvolnum>1</manvolnum></citerefentry> 手册）， <command>nice</command> 将当前优先级加10。

en: If you discover that an already running task should have been started with <command>nice</command> it is not too late to fix it; the <command>renice</command> command changes the priority of an already running process, in either direction (but reducing the “niceness” of a process is reserved for the root user).
zh-CN: 若发现已运行的工作应以 <command>nice</command> 启动，修正它并不算太迟；<command>renice</command> 命令可改变运行中进程的优先序，增加或减少均可 (但减少 “niceness” 是超级用户的权限)。

en: Installation of the <emphasis role="pkg">anacron</emphasis> package deactivates execution by <command>cron</command> of the scripts in the <filename>/etc/cron.hourly/</filename>, <filename>/etc/cron.daily/</filename>, <filename>/etc/cron.weekly/</filename>, and <filename>/etc/cron.monthly/</filename> directories. This avoids their double execution by <command>anacron</command> and <command>cron</command>. The <command>cron</command> command remains active and will continue to handle the other scheduled tasks (especially those scheduled by users).
zh-CN: 安装 <emphasis role="pkg">anacron</emphasis> 软件包会禁用 <command>cron</command> 在 <filename>/etc/cron.hourly/</filename>, <filename>/etc/cron.daily/</filename>, <filename>/etc/cron.weekly/</filename> 和 <filename>/etc/cron.monthly/</filename>目录中的脚本。避免 <command>anacron</command> 和 <command>cron</command>重复运行这些脚本。 <command>cron</command> 命令仍然可用并处理其他计划任务（特别是用户安排的计划任务）。

en: Quotas
zh-CN: 配额

en: <primary>quota</primary>
zh-CN: <primary>额度</primary>

en: The quota system allows limiting disk space allocated to a user or group of users. To set it up, you must have a kernel that supports it (compiled with the <varname>CONFIG_QUOTA</varname> option) — as is the case with Debian kernels. The quota management software is found in the <emphasis role="pkg">quota</emphasis> Debian package.
zh-CN: 配额系统可以限制用户与群组可用的磁盘空间。设置时，必须内核支持 (以 <varname>CONFIG_QUOTA</varname> 选项编译) — 使用 Debian 内核时。配额管理软件在 <emphasis role="pkg">quota</emphasis> Debian 软件包内。

en: To activate quota in a filesystem, you have to indicate the <literal>usrquota</literal> and <literal>grpquota</literal> options in <filename>/etc/fstab</filename> for the user and group quotas, respectively. Rebooting the computer will then update the quotas in the absence of disk activity (a necessary condition for proper accounting of already used disk space).
zh-CN: 在文件系统内启用配额时，必须在 <filename>/etc/fstab</filename> 中指明 <literal>usrquota</literal> 与 <literal>grpquota</literal> 选项，分别供用户与群组使用。重新启动电脑后，就能在未使用的磁盘空间中更新配额 (必须如此，才能重新计算已使用的磁盘空间)。

en: The <command>edquota <replaceable>user</replaceable></command> (or <command>edquota -g <replaceable>group</replaceable></command>) command allows you to change the limits while examining current disk space usage.
zh-CN: <command>edquota <replaceable>user</replaceable></command> (或 <command>edquota -g <replaceable>group</replaceable></command>) 命令允许在仍有磁盘空间的前提下，改变配额。

en: <emphasis>GOING FURTHER</emphasis> Defining quotas with a script
zh-CN: <emphasis>进阶</emphasis> 使用脚本定义配额

en: The <command>setquota</command> program can be used in a script to automatically change many quotas. Its <citerefentry><refentrytitle>setquota</refentrytitle> <manvolnum>8</manvolnum></citerefentry> manual page details the syntax to use.
zh-CN: 可以在脚本中使用 <command>setquota</command> 程序自动更改配额。<citerefentry><refentrytitle>setquota</refentrytitle> <manvolnum>8</manvolnum></citerefentry> 手册列出了详细的使用语法。

en: The quota system allows you to set four limits:
zh-CN: 配额系统允许设置4个限制：

en: <primary>inode</primary>
zh-CN: <primary>节点</primary>

en: A “soft” limit can be temporarily exceeded; the user will simply be warned that they are exceeding the quota by the <command>warnquota</command> command, which is usually invoked by <command>cron</command>. A “hard” limit can never be exceeded: the system will refuse any operation that will cause a hard quota to be exceeded.
zh-CN: “软”限制可以被临时超越；当用户超过 <command>warnquota</command> 命令指定的配额，只是给出警告，通常由 <command>cron</command>唤起该命令。“硬”限制不允许被超出：系统将会拒绝任何超出硬配额的操作。

en: <emphasis>VOCABULARY</emphasis> Blocks and inodes
zh-CN: <emphasis>词汇</emphasis> 块和节点

en: <primary>block (disk)</primary>
zh-CN: <primary>块（磁盘）</primary>

en: The filesystem divides the hard drive into blocks — small contiguous areas. The size of these blocks is defined during creation of the filesystem, and generally varies between 1 and 8 kibibytes.
zh-CN: 文件系统将硬盘分成块－一些连续的小区域。这些块的大小在创建文件系统时定义，一般在1K到8K字节之间。

en: A block can be used either to store the real data of a file, or for meta-data used by the filesystem. Among this meta-data, you will especially find the inodes. An inode uses a block on the hard drive (but this block is not taken into consideration in the block quota, only in the inode quota), and contains both the information on the file to which it corresponds (name, owner, permissions, etc.) and the pointers to the data blocks that are actually used. For very large files that occupy more blocks than it is possible to reference in a single inode, there is an indirect block system; the inode references a list of blocks that do not directly contain data, but another list of blocks.
zh-CN: 块可用来存储文件中的真实数据，也可用于文件系统的元数据。在元数据中，就会找到节点。一个节点使用硬盘上的一个块（但是该块并不会计入块配额，只用于节点配额），包含了节点对应哪个文件（名称，所有者，许可权限等）和实际使用数据块的指针。对于那些大文件，占用的块数已经超出单个指针的索引范围，还存在一个间接块系统；其中的节点参考一个块列表，该列表中的块不直接包含数据而是包含另一个块列表。

en: With the <command>edquota -t</command> command, you can define a maximum authorized “grace period” within which a soft limit may be exceeded. After this period, the soft limit will be treated like a hard limit, and the user will have to reduce their disk space usage to within this limit in order to be able to write anything to the hard drive.
zh-CN: 使用命令 <command>edquota -t</command> ，可以设定超过软限制的“宽限期”时长。宽限期之后，软限制将作为硬限制处理，要将数据写入硬盘，用户必须减少磁盘使用量至配额之内。

en: <emphasis>GOING FURTHER</emphasis> Setting up a default quota for new users
zh-CN: <emphasis>进阶</emphasis> 为新用户设定默认配额

en: To automatically setup a quota for new users, you have to configure a template user (with <command>edquota</command> or <command>setquota</command>) and indicate their user name in the <varname>QUOTAUSER</varname> variable in the <filename>/etc/adduser.conf</filename> file. This quota configuration will then be automatically applied to each new user created with the <command>adduser</command> command.
zh-CN: 要为新用户自动设定配额，需要配置用户模板（使用 <command>edquota</command> 或者 <command>setquota</command>）并在 <filename>/etc/adduser.conf</filename> 文件的 <varname>QUOTAUSER</varname> 变量中指明用户名。该配额配置会自动应用于 <command>adduser</command> 命令创建的新用户。

en: <primary>backup</primary>
zh-CN: <primary>备份</primary>

en: <primary>restoration</primary>
zh-CN: <primary>恢复</primary>

en: Making backups is one of the main responsibilities of any administrator, but it is a complex subject, involving powerful tools which are often difficult to master.
zh-CN: 制作备份是管理员的主要责任之一，但它是个相对复杂的课题，并包含一些很难掌握的强大工具。

en: Rather than detailing some of them, this section will present the thoughts of the Falcot Corp administrators when they defined their backup strategy.
zh-CN: 本节并没有详细介绍这些工具，而是介绍 Falcot Corp 管理员们确定备份策略时的思路。

en: At Falcot Corp, backups have two goals: recovering erroneously deleted files, and quickly restoring any computer (server or desktop) whose hard drive has failed.
zh-CN: 在 Falcot Corp公司，备份有两个目的：恢复被误删的文件，迅速恢复硬盘损坏的电脑（服务器或桌面电脑）。

en: Backing Up with <command>rsync</command>
zh-CN: 使用 <command>rsync</command>备份

en: Backups on tape having been deemed too slow and costly, data will be backed up on hard drives on a dedicated server, on which the use of software RAID (see <xref linkend="sect.raid-soft" />) will protect the data from hard drive failure. Desktop computers are not backed up individually, but users are advised that their personal account on their department's file server will be backed up. The <command>rsync</command> command (from the package of the same name) is used daily to back up these different servers.
zh-CN: 以磁带备份太慢且太贵，现在采用备份在专属服务器的硬盘策略，以 RAID (见 <xref linkend="sect.raid-soft" />) 软件保护数据在硬盘毁损时不致遗失。桌面电脑没有个别备份的策略，用户应在部门的文件服务器备份其数据。<command>rsync</command> 命令 (取自同名的软件包) 用于日常备份这些服务器。

en: <emphasis>BACK TO BASICS</emphasis> The hard link, a second name for the file
zh-CN: <emphasis>基础知识</emphasis> 硬链接，文件的第二个名称

en: <primary>link</primary><secondary>hard link</secondary>
zh-CN: <primary>链接</primary><secondary>硬链接</secondary>

en: <primary>hard link</primary>
zh-CN: <primary>硬链接</primary>

en: A hard link, as opposed to a symbolic link, cannot be differentiated from the linked file. Creating a hard link is essentially the same as giving an existing file a second name. This is why the deletion of a hard link only removes one of the names associated with the file. As long as another name is still assigned to the file, the data therein remain present on the filesystem. It is interesting to note that, unlike a copy, the hard link does not take up additional space on the hard drive.
zh-CN: 相对于符号链接，硬链接不能脱离被链接文件。添加的硬链接等于给文件另一个名称。删除硬链接等于删除该文件的另一个名称。只要还有另一个名称指定给文件，则数据仍在文件系统内。不同于复制，硬链接并未在硬盘里复制到另一个空间。

en: A hard link is created with the <command>ln <replaceable>target</replaceable> <replaceable>link</replaceable></command> command. The <replaceable>link</replaceable> file is then a new name for the <replaceable>target</replaceable> file. Hard links can only be created on the same filesystem, while symbolic links are not subject to this limitation.
zh-CN: 硬链接使用 <command>ln <replaceable>target</replaceable> <replaceable>link</replaceable></command> 命令创建。 然后<replaceable>link</replaceable> 文件是<replaceable>target</replaceable> 文件另外的新名字。硬链接只能在相同的文件系统上创建，而符号链接不受此限制。

en: The available hard drive space prohibits implementation of a complete daily backup. As such, the <command>rsync</command> command is preceded by a duplication of the content of the previous backup with hard links, which prevents usage of too much hard drive space. The <command>rsync</command> process then only replaces files that have been modified since the last backup. With this mechanism a great number of backups can be kept in a small amount of space. Since all backups are immediately available and accessible (for example, in different directories of a given share on the network), you can quickly make comparisons between two given dates.
zh-CN: 有限的硬盘空间限制了每天完全备份数据。因此，<command>rsync</command> 命令对之前备份的内容使用硬链接，这样可以避免使用过多的硬盘空间。 然后<command>rsync</command> 进程只覆盖上次备份后修改过的文件。通过这种机制，大量的备份只占用小的磁盘空间。所有的备份会立即生效并且可以读写（例如，在共享网络上的不同目录），可以迅速比较两个不同日期的文件。

en: <primary>copy, backup copy</primary>
zh-CN: <primary>拷贝, 备份拷贝</primary>

en: <primary>backup</primary><secondary>copy</secondary>
zh-CN: <primary>备份</primary><secondary>拷贝</secondary>

en: This backup mechanism is easily implemented with the <command>dirvish</command> program. It uses a backup storage space (“bank” in its vocabulary) in which it places timestamped copies of sets of backup files (these sets are called “vaults” in the dirvish documentation).
zh-CN: 这种备份机制可以通过 <command>dirvish</command> 程序执行。使用备份存储空间（“空”的），放置有时间戳的备份文件集（这些文件集在dirvish 文档中称为“vaults”）。

en: The main configuration is in the <filename>/etc/dirvish/master.conf</filename> file. It defines the location of the backup storage space, the list of “vaults” to manage, and default values for expiration of the backups. The rest of the configuration is located in the <filename><replaceable>bank</replaceable>/<replaceable>vault</replaceable>/dirvish/default.conf</filename> files and contains the specific configuration for the corresponding set of files.
zh-CN: 主要配置在 <filename>/etc/dirvish/master.conf</filename> 文件中。它定义了备份存储空间的位置，要管理的“vaults”，和备份超期的默认值。配置的其他部分在 <filename><replaceable>bank</replaceable>/<replaceable>vault</replaceable>/dirvish/default.conf</filename> 文件中，包含对应文件集的特殊配置。

en: The <filename>/etc/dirvish/master.conf</filename> file
zh-CN: <filename>/etc/dirvish/master.conf</filename> 文件

en: bank:
        /backup
    exclude:
        lost+found/
        core
        *~
    Runall:
        root    22:00
    expire-default: +15 days
    expire-rule:
    #   MIN HR    DOM MON       DOW  STRFTIME_FMT
        *   *     *   *         1    +3 months
        *   *     1-7 *         1    +1 year
        *   *     1-7 1,4,7,10  1
zh-CN: bank:
        /backup
    exclude:
        lost+found/
        core
        *~
    Runall:
        root    22:00
    expire-default: +15 days
    expire-rule:
    # MIN HR    DOM MON       DOW  STRFTIME_FMT
        *   *     *   *         1    +3 months
        *   *     1-7 *         1    +1 year
        *   *     1-7 1,4,7,10  1

en: <emphasis>IN PRACTICE</emphasis> Scheduled expiration
zh-CN: <emphasis>实践</emphasis> 计划过期

en: The expiration rules are not used by <command>dirvish-expire</command> to do its job. In reality, the expiration rules are applied when creating a new backup copy to define the expiration date associated with that copy. <command>dirvish-expire</command> simply peruses the stored copies and deletes those for which the expiration date has passed.
zh-CN: 过期规则未被 <command>dirvish-expire</command> 使用。实际上，在添加备份副本时，设置该副本失效的日期。<command>dirvish-expire</command> 简单分析保存的副本并删除已达失效日期的文件。

en: The <filename>/backup/root/dirvish/default.conf</filename> file
zh-CN: <filename>/backup/root/dirvish/default.conf</filename> 文件

en: The above example specifies the set of files to back up: these are files on the machine <emphasis>rivendell.falcot.com</emphasis> (for local data backup, simply specify the name of the local machine as indicated by <command>hostname</command>), especially those in the root tree (<literal>tree: /</literal>), except those listed in <literal>exclude</literal>. The backup will be limited to the contents of one filesystem (<literal>xdev: 1</literal>). It will not include files from other mount points. An index of saved files will be generated (<literal>index: gzip</literal>), and the image will be named according to the current date (<literal>image-default: %Y%m%d</literal>).
zh-CN: 上面的例子中指明了要备份的文件集：这些文件在机器 <emphasis>rivendell.falcot.com</emphasis> 上（对本地数据备份，只需指明本地机器 <command>hostname</command>），主要是在根目录下（<literal>tree: /</literal>），除了在 <literal>exclude</literal>中列出的文件。备份仅限于一个文件系统中的内容（<literal>xdev: 1</literal>）。不包含其他挂载点的文件。产生保存文件的索引（<literal>index: gzip</literal>），镜像文件根据当前日期进行命名（<literal>image-default: %Y%m%d</literal>）。

en: <emphasis>IN PRACTICE</emphasis> Remote backup over SSH
zh-CN: <emphasis>实践</emphasis> 使用SSH远程备份

en: When dirvish needs to save data to a remote machine, it will use <command>ssh</command> to connect to it, and will start <command>rsync</command> as a server. This requires the root user to be able to automatically connect to it. The use of an SSH authentication key allows precisely that (see <xref linkend="sect.ssh-key-based-auth" />).
zh-CN: 把数据保存在远程机器时，需用 <command>ssh</command> 命令链接它，并启用 <command>rsync</command> 作为服务器。需以root用户的权限才能自动链接。以 SSH 认证密钥允许连接 (见 <xref linkend="sect.ssh-key-based-auth" />)。

en: Restoring Machines without Backups
zh-CN: 不使用备份恢复系统

en: The Falcot Corp administrators are aware of the limits in their backup policy. Since they can't protect the backup server as well as a tape in a fireproof safe, they have installed it in a separate room so that a disaster such as a fire in the server room won't destroy backups along with everything else. Furthermore, they do an incremental backup on DVD-ROM once per week — only files that have been modified since the last backup are included.
zh-CN: Falcot Corp 的管理员知道该公司备份政策的限制。未以防火墙保护备份服务器，而是把它放在另一个房间，以免在灾难来临时与主服务器同归于尽。而且，每周以 DVD-ROM 做增量备份 — 只备份修改过的文件。

en: <emphasis>GOING FURTHER</emphasis> Backing up SQL and LDAP services
zh-CN: <emphasis>进阶 </emphasis> 备份SQL 和LDAP 服务

en: Many services (such as SQL or LDAP databases) cannot be backed up by simply copying their files (unless they are properly interrupted during creation of the backups, which is frequently problematic, since they are intended to be available at all times). As such, it is necessary to use an “export” mechanism to create a “data dump” that can be safely backed up. These are often quite large, but they compress well. To reduce the storage space required, you will only store a complete text file per week, and a <command>diff</command> each day, which is created with a command of the type <command>diff <replaceable>file_from_yesterday</replaceable> <replaceable>file_from_today</replaceable></command>. The <command>xdelta</command> program produces incremental differences from binary dumps.
zh-CN: 很多服务 (诸如 SQL 或 LDAP 数据库) 不能以复制文件的方式备份其系统 (除非在创建备份时正确停止，但经常会出问题，因为它们随时提供服务)。因此，必须以 “导出” 机制生成 “导出数据” 才能安全地备份。量很大，妥善地压缩。为了减少保存空间，每周只保存完成的文本档，以及每天的 <command>diff</command>，以 <command>diff <replaceable>file_from_yesterday</replaceable> <replaceable>file_from_today</replaceable></command> 命令创建。<command>xdelta</command> 程序从二进位倒出增量的不同数据。

en: <emphasis>CULTURE</emphasis> <emphasis>TAR</emphasis>, the standard for tape backups
zh-CN: <emphasis>文化</emphasis> <emphasis>TAR</emphasis>，磁带备份标准

en: <primary>backup</primary><secondary>on tape</secondary>
zh-CN: <primary>备份</primary><secondary>磁带</secondary>

en: <primary>tape, backup</primary>
zh-CN: <primary>磁带，备份</primary>

en: Historically, the simplest means of making a backup on Unix was to store a <emphasis>TAR</emphasis> archive on a tape. The <command>tar</command> command even got its name from “Tape ARchive”.
zh-CN: 历史上，在Unix 上制作备份最简单的方法是将一个 <emphasis>TAR</emphasis> 档案存到磁带上。 <command>tar</command> 甚至得名于“Tape ARchive”。

en: Hot Plugging: <emphasis>hotplug</emphasis>
zh-CN: 热插拔： <emphasis>hotplug</emphasis>

en: Introduction
zh-CN: 介绍

en: <primary>hotplug</primary>
zh-CN: <primary>热插拔</primary>

en: The kernel has a database that associates each device ID with the required driver. This database is used during boot to load all the drivers for the peripheral devices detected on the different buses, but also when an additional hotplug device is connected. Once the device is ready for use, a message is sent to <command>udevd</command> so it will be able to create the corresponding entry in <filename>/dev/</filename>.
zh-CN: 核心内的数据库有每个设备的 ID 及其驱动程序。在启动阶段加载此数据库，侦测各接口的周边设备，并在运行中侦测热插入的设备。接收到插入的设备后，送出消息给 <command>udevd</command>，让其添加对应的条目于 <filename>/dev/</filename> 内。

en: The Naming Problem
zh-CN: 命名问题

en: Before the appearance of hotplug connections, it was easy to assign a fixed name to a device. It was based simply on the position of the devices on their respective bus. But this is not possible when such devices can come and go on the bus. The typical case is the use of a digital camera and a USB key, both of which appear to the computer as disk drives. The first one connected may be <filename>/dev/sdb</filename> and the second <filename>/dev/sdc</filename> (with <filename>/dev/sda</filename> representing the computer's own hard drive). The device name is not fixed; it depends on the order in which devices are connected.
zh-CN: 在热插拔连接出现之前，很容易给设备赋予一个固定的名字。可以通过设备在总线上的位置简单命名。但是，如果设备能够在总线上来去自如，这就行不通了。典型的例子是数码相机和U 盘，两者都表现为磁盘驱动器。前者可能链接为 <filename>/dev/sdb</filename> ，后者可能是 <filename>/dev/sdc</filename> （假设<filename>/dev/sda</filename> 代表计算机自身的硬盘）。设备名是不固定的；它取决于设备连接的顺序。

en: Additionally, more and more drivers use dynamic values for devices' major/minor numbers, which makes it impossible to have static entries for the given devices, since these essential characteristics may vary after a reboot.
zh-CN: 另外，越来越多的驱动使用动态值作为设备的主、次设备号，这样就更不可能给设备赋予静态入口，而重启之后这些基本的特性也随之变化。

en: <emphasis>udev</emphasis> was created precisely to solve this problem.
zh-CN: <emphasis>udev</emphasis> 正是为了解决该问题而创立的。

en: How <emphasis>udev</emphasis> Works
zh-CN: <emphasis>udev</emphasis> 如何工作

en: When <emphasis>udev</emphasis> is notified by the kernel of the appearance of a new device, it collects various information on the given device by consulting the corresponding entries in <filename>/sys/</filename>, especially those that uniquely identify it (MAC address for a network card, serial number for some USB devices, etc.).
zh-CN: 当 <emphasis>udev</emphasis> 被内核告知有一个新的设备，它参考 <filename>/sys/</filename> 里对应的条目，搜集该设备的信息，尤其是那些足以辨别的独特信息 (网卡的 MAC 地址、某些 USB 设备的序号)。

en: Armed with all of this information, <emphasis>udev</emphasis> then consults all of the rules contained in <filename>/etc/udev/rules.d/</filename> and <filename>/lib/udev/rules.d/</filename>. In this process it decides how to name the device, what symbolic links to create (to give it alternative names), and what commands to execute. All of these files are consulted, and the rules are all evaluated sequentially (except when a file uses “GOTO” directives). Thus, there may be several rules that correspond to a given event.
zh-CN: 有了这些信息之后，然后 <emphasis>udev</emphasis> 会查阅<filename>/etc/udev/rules.d/</filename> 和 <filename>/lib/udev/rules.d/</filename>中包含的所有规则。在这个过程中，它会决定如何命名设备，创建什么样的符号连接（赋予设备另外的名字），执行什么命令。查询所有的文件，顺序（除非文件中使用“GOTO”指令）检查所有的规则。这样，有可能一个事件（event）对应多个规则。

en: The syntax of rules files is quite simple: each row contains selection criteria and variable assignments. The former are used to select events for which there is a need to react, and the latter defines the action to take. They are all simply separated with commas, and the operator implicitly differentiates between a selection criterion (with comparison operators, such as <literal>==</literal> or <literal>!=</literal>) or an assignment directive (with operators such as <literal>=</literal>, <literal>+=</literal> or <literal>:=</literal>).
zh-CN: 规则文件的语法很简单：每行包含选择规则和变量赋值。前者用于需要对那些事件作出响应，后者定义采取何种行动。它们通过逗号分隔，用运算符区分选择规则（使用比较运算符，例如<literal>==</literal> or <literal>!=</literal>）或赋值指令（使用 <literal>=</literal>, <literal>+=</literal> 或 <literal>:=</literal>运算符）。

en: Comparison operators are used on the following variables:
zh-CN: 比较运算符用于如下变量：

en: <literal>KERNEL</literal>: the name that the kernel assigns to the device;
zh-CN: <literal>KERNEL</literal>：内核赋予设备的名称;

en: <literal>ACTION</literal>: the action corresponding to the event (“add” when a device has been added, “remove” when it has been removed);
zh-CN: <literal>ACTION</literal>：与事件相对应的行动（“add”当设备被添加，“remove”当设备被移除）;

en: <literal>DEVPATH</literal>: the path of the device's <filename>/sys/</filename> entry;
zh-CN: <literal>DEVPATH</literal>：设备在 <filename>/sys/</filename> 记录中的路径;

en: <literal>SUBSYSTEM</literal>: the kernel subsystem which generated the request (there are many, but a few examples are “usb”, “ide”, “net”, “firmware”, etc.);
zh-CN: <literal>SUBSYSTEM</literal>：产生请求的内核子系统（有很多这样的子系统，例如是“usb”，“ide”，“net”，“firmware”等）;

en: <literal>ATTR{<replaceable>attribute</replaceable>}</literal>: file contents of the <replaceable>attribute</replaceable> file in the <filename>/sys/<replaceable>$devpath</replaceable>/</filename> directory of the device. This is where you find the MAC address and other bus specific identifiers;
zh-CN: <literal>ATTR{<replaceable>attribute</replaceable>}</literal>：<replaceable>attribute</replaceable> 文件的内容在设备的 <filename>/sys/<replaceable>$devpath</replaceable>/</filename> 文件夹内。可在此找到 MAC 地址及其他辨识用的总线;

en: <literal>KERNELS</literal>, <literal>SUBSYSTEMS</literal> and <literal>ATTRS{<replaceable>attributes</replaceable>}</literal> are variations that will try to match the different options on one of the parent devices of the current device;
zh-CN: <literal>KERNELS</literal>、<literal>SUBSYSTEMS</literal> 和 <literal>ATTRS{<replaceable>attributes</replaceable>}</literal> 是用来匹配当前设备父设备的可选变量;

en: <literal>PROGRAM</literal>: delegates the test to the indicated program (true if it returns 0, false if not). The content of the program's standard output is stored so that it can be reused by the <literal>RESULT</literal> test;
zh-CN: <literal>PROGRAM</literal>：指明要运行的测试程序（真则返回０）。程序的输出内容会被储存以便 <literal>RESULT</literal> 测试重用;

en: <literal>RESULT</literal>: execute tests on the standard output stored during the last call to <literal>PROGRAM</literal>.
zh-CN: <literal>RESULT</literal>：对最后一次调用 <literal>PROGRAM</literal>产生的结果进行检查。

en: The right operands can use pattern expressions to match several values at the same time. For instance, <literal>*</literal> matches any string (even an empty one); <literal>?</literal> matches any character, and <literal>[]</literal> matches the set of characters listed between the square brackets (or the opposite thereof if the first character is an exclamation point, and contiguous ranges of characters are indicated like <literal>a-z</literal>).
zh-CN: 右操作数可以使用模式表达式来同时匹配几个值。比如， <literal>*</literal> 匹配任何字符串（甚至是空字符串）； <literal>?</literal> 匹配任何一个字符， <literal>[]</literal> 匹配方括号中间的字符集（如果首字符是惊叹号标示求反集，连续的字符集可表示为如 <literal>a-z</literal>）。

en: Regarding the assignment operators, <literal>=</literal> assigns a value (and replaces the current value); in the case of a list, it is emptied and contains only the value assigned. <literal>:=</literal> does the same, but prevents later changes to the same variable. As for <literal>+=</literal>, it adds an item to a list. The following variables can be changed:
zh-CN: 关于赋值操作符， <literal>=</literal>用来赋值（并取代当前值）；如果用在列表上，列表被清空并只包含赋予的新值。 <literal>:=</literal> 做同样工作，但是它会阻止随后对该变量的更改。至于 <literal>+=</literal>，则是给列表添加新项目。如下的变量可以被更改：

en: <literal>NAME</literal>: the device filename to be created in <filename>/dev/</filename>. Only the first assignment counts; the others are ignored;
zh-CN: <literal>NAME</literal>：将在 <filename>/dev/</filename>中创建的设备文件名。只有第一次赋值起作用；其它的会被忽略;

en: <literal>SYMLINK</literal>: the list of symbolic links that will point to the same device;
zh-CN: <literal>SYMLINK</literal>：指向同一个设备的符号列表清单;

en: <literal>OWNER</literal>, <literal>GROUP</literal> and <literal>MODE</literal> define the user and group that owns the device, as well as the associated permission;
zh-CN: <literal>OWNER</literal>、<literal>GROUP</literal> 和 <literal>MODE</literal> 指示拥有该设备的用户和组，还有相关的访问许可;

en: <literal>RUN</literal>: the list of programs to execute in response to this event.
zh-CN: <literal>RUN</literal>：响应事件时执行的程序清单。

en: The values assigned to these variables may use a number of substitutions:
zh-CN: 赋予这些变量的值可以使用一系列的替代表示：

en: <literal>$kernel</literal> or <literal>%k</literal>: equivalent to <literal>KERNEL</literal>;
zh-CN: <literal>$kernel</literal> 或者 <literal>%k</literal>：等价于 <literal>KERNEL</literal>;

en: <literal>$number</literal> or <literal>%n</literal>: the order number of the device, for example, for <literal>sda3</literal>, it would be “3”;
zh-CN: <literal>$number</literal> 或者 <literal>%n</literal>：设备的顺序号码，例如，对 <literal>sda3</literal>，它就是“３”;

en: <literal>$devpath</literal> or <literal>%p</literal>: equivalent to <literal>DEVPATH</literal>;
zh-CN: <literal>$devpath</literal> 或 <literal>%p</literal>：等价于 <literal>DEVPATH</literal>;

en: <literal>$attr{<replaceable>attribute</replaceable>}</literal> or <literal>%s{<replaceable>attribute</replaceable>}</literal>: equivalent to <literal>ATTRS{<replaceable>attribute</replaceable>}</literal>;
zh-CN: <literal>$attr{<replaceable>attribute</replaceable>}</literal> 或 <literal>%s{<replaceable>attribute</replaceable>}</literal>: 等价于 <literal>ATTRS{<replaceable>attribute</replaceable>}</literal>;

en: <literal>$major</literal> or <literal>%M</literal>: the kernel major number of the device;
zh-CN: <literal>$major</literal> 或 <literal>%M</literal>：设备的内核主设备号;

en: <literal>$minor</literal> or <literal>%m</literal>: the kernel minor number of the device;
zh-CN: <literal>$minor</literal> 或 <literal>%m</literal>：内核次设备号码;

en: <literal>$result</literal> or <literal>%c</literal>: the string output by the last program invoked by <literal>PROGRAM</literal>;
zh-CN: <literal>$result</literal> 或 <literal>%c</literal>：<literal>PROGRAM</literal>设定的最后一个程序输出的字符串;

en: and, finally, <literal>%%</literal> and <literal>$$</literal> for the percent and dollar sign, respectively.
zh-CN: 最后， <literal>%%</literal> 和 <literal>$$</literal> 相应代表百分号和美元符号。

en: A concrete example
zh-CN: 一个具体例子

en: Let us consider the case of a simple USB key and try to assign it a fixed name. First, you must find the elements that will identify it in a unique manner. For this, plug it in and run <command>udevadm info -a -n /dev/sdc</command> (replacing <replaceable>/dev/sdc</replaceable> with the actual name assigned to the key).
zh-CN: 我们来考虑一个Ｕ盘并给它指派固定名字的例子。首先，必须要找到能唯一识别它的元素。可以插入并运行 <command>udevadm info -a -n /dev/sdc</command> （ 用指派给Ｕ盘的名字代替<replaceable>/dev/sdc</replaceable> ）。

en: To create a new rule, you can use tests on the device's variables, as well as those of one of the parent devices. The above case allows us to create two rules like these:
zh-CN: 可以通过检测设备变量，还有父设备变量创建新的规则。上面的例子运行我们创建两个这样的规则：

en: Once these rules are set in a file, named for example <filename>/etc/udev/rules.d/010_local.rules</filename>, you can simply remove and reconnect the USB key. You can then see that <filename>/dev/usb_key/disk</filename> represents the disk associated with the USB key, and <filename>/dev/usb_key/part1</filename> is its first partition.
zh-CN: 这些规则在文件中设定，例如该文件名为 <filename>/etc/udev/rules.d/010_local.rules</filename>，就可以移除和重新插入Ｕ盘了。可以看到文件<filename>/dev/usb_key/disk</filename> 代表和Ｕ盘相关联的磁盘，<filename>/dev/usb_key/part1</filename> 是它的第一个扇区。

en: <emphasis>GOING FURTHER</emphasis> Debugging <emphasis>udev</emphasis>'s configuration
zh-CN: <emphasis>进阶</emphasis> 调试<emphasis>udev</emphasis>配置

en: Like many daemons, <command>udevd</command> stores logs in <filename>/var/log/daemon.log</filename>. But it is not very verbose by default, and it is usually not enough to understand what is happening. The <command>udevadm control --log-priority=info</command> command increases the verbosity level and solves this problem. <command>udevadm control --log-priority=err</command> returns to the default verbosity level.
zh-CN: 如同其他的后台进程，<command>udevd</command> 把日志保存在 <filename>/var/log/daemon.log</filename>。但是缺省不够详细，且不足以了解发生的事情。<command>udevadm control --log-priority=info</command> 命令增加其详细的内容并可解决此问题。<command>udevadm control --log-priority=err</command> 则回到缺省的层次。

en: Power Management: Advanced Configuration and Power Interface (ACPI)
zh-CN: 电源管理：高级配置与电源接口 (ACPI)

en: The topic of power management is often problematic. Indeed, properly suspending the computer requires that all the computer's device drivers know how to put them to standby, and that they properly reconfigure the devices upon waking. Unfortunately, there are still a few devices unable to sleep well under Linux, because their manufacturers have not provided the required specifications.
zh-CN: 电源管理很麻烦。是的，适度的暂停电脑时，需让其设备的驱动程序知道如何进入待机状态，而且在唤醒时分，可以适当的配置。不幸的是，在 Linux 之下，还有少数设备无法好好的休眠，因为制造商未提供必要的规范。

en: <emphasis>BEWARE</emphasis> Graphics card and standby
zh-CN: <emphasis>小心</emphasis>显卡与待机

en: The graphics card driver is often the culprit when standby doesn't work properly. In that case, it is a good idea to test the latest version of the X.org graphics server.
zh-CN: 无法顺利待机时，罪魁祸首多半是显卡的驱动程序。碰到这种情况，先尝试最新的 X.org 图形服务器的最新版本。

en: After this overview of basic services common to many Unix systems, we will focus on the environment of the administered machines: the network. Many services are required for the network to work properly. They will be discussed in the next chapter.
zh-CN: 在介绍了这么多Unix 系统上通用的基本服务之后，接下来关注管理机器的运行环境：网络。许多服务都需要网络的支持。这些会在下一章讨论。
