harden-doc 3.19 - en to pt_BR translation catalogue (155 entries)

en: The hardening process step by step
pt_BR: Passo-a-passo do processo de fortalecimento

en: Below is a post-installation, step-by-step procedure for hardening a Debian 2.2 GNU/Linux system. This is one possible approach to such a procedure and is oriented toward the hardening of network services. It is included to show the entire process you might use during configuration. Also, see <xref linkend="checklist" />.
pt_BR: Abaixo está uma pós-instalação, um procedimento passo-a-passo para tornar no sistema Debian 2.2 GNU/Linux mais seguro. Esse procedimento é uma alternativa para tornar os serviços de redes mais seguros. Será mostrado o processo completo do que deve ser feito durante a configuração. Também, veja  <xref linkend="checklist" />.

en: Install the system, taking into account the information regarding partitioning included earlier in this document. After base installation, go into custom install. Do not select task packages.
pt_BR: Instale o sistema, levando em conta as informações sobre o particionamento que foi citada anteriormente neste documento. Depois da instalação básica, vá à instalação personalizada. Não selecione os pacotes de tarefa. Selecione senhas no formato shadow.

en: Using <command>dselect</command>, remove all unneeded but selected packages before doing [I]nstall. Keep the bare minimum of packages for the system.
pt_BR: Usando <command>dselect</command>, exclua todos os pacotes desnecessários, exceto os selecionados, antes de proceder com o [I]nstall. Mantenha um número reduzido de pacotes para o sistema.

en: Update all software from the latest packages available at security.debian.org as explained previously in <xref linkend="security-update" />.
pt_BR: Atualize todos os softwares para a última versão disponível dos pacotes em security.debian.org como explicado anteriormente em <xref linkend="security-update" />.

en: Implement the suggestions presented in this manual regarding user quotas, login definitions and <command>lilo</command>
pt_BR: Implementar as sugestões apresentadas neste manual com relação às cotas de usuários, definições de login e <command>lilo</command>

en: Make a list of services currently running on your system. Try:
pt_BR: Fazer uma lista de serviços que estão rodando no seu sistema. Tente:

en: 
      $ ps aux
      $ netstat -pn -l -A inet 
      # /usr/sbin/lsof -i | grep LISTEN
pt_BR: 
      $ ps -aux
      $ netstat -pn -l -A inet 
      # /usr/sbin/lsof -i | grep LISTEN

en: You will need to install <package>lsof-2.2</package> for the third command to work (run it as root). You should be aware that <command>lsof</command> can translate the word LISTEN to your locale settings.
pt_BR: Você precisará instalar o <package>lsof-2.2</package> para o terceiro comando acima funcionar (execute como super-usuário). Você deve estar ciente de que o <command>lsof</command> pode traduzir a palavra LISTEN para suas configurações de localização.

en: In order to remove unnecessary services, first determine what package provides the service and how it is started. This can be accomplished by checking the program that listens in the socket. The following shell script, which uses the programs <command>lsof</command> and <command>dpkg</command>, does just that:
pt_BR: Para excluir serviços desnecessários, primeiro determine qual pacote fornece o serviço e como ele é inicializado. Isto pode ser feito verificando os programas que escutam no soquete. O shell script abaixo, que utiliza os programas <command>lsof</command> e <command>dpkg</command>, faz isso:

en: 
    #!/bin/sh
    # FIXME: this is quick and dirty; replace with a more robust script snippet
    for i in `sudo lsof -i | grep LISTEN | cut -d " " -f 1 |sort -u` ; do
      pack=`dpkg -S $i |grep bin |cut -f 1 -d : | uniq`
      echo "Service $i is installed by $pack";
      init=`dpkg -L $pack |grep init.d/ `
      if [ ! -z "$init" ]; then
        echo "and is run by $init"
      fi
    done
pt_BR: 
      #!/bin/sh
      # FIXME: this is quick and dirty; replace with a more robust script snippet
      for i in `sudo lsof -i | grep LISTEN | cut -d " " -f 1 |sort -u` ; do
    	  pack=`dpkg -S $i |grep bin |cut -f 1 -d : | uniq`
    	  echo "Service $i is installed by $pack";
    	  init=`dpkg -L $pack |grep init.d/ `
    	  if [ ! -z "$init" ]; then
    		   echo "and is run by $init"
    	  fi
      done

en: Once you find any unwanted services, remove the associated package (with <command>dpkg --purge</command>), or disable the service from starting automatically at boot time using <command>update-rc.d</command> (see <xref linkend="disableserv" />).
pt_BR: Se você encontrar algum serviço desnecessário, exclua o pacote associado (com <command>dpkg --purge</command>), ou desabilite a inicialização automática durante a fase de boot usando o comando <command>update-rc.d</command> (veja <xref linkend="disableserv" />).

en: For inetd services (launched by the superdaemon), check which services are enabled in <filename>/etc/inetd.conf</filename> using:
pt_BR: Para os serviços inetd (iniciados pelo superdaemon), verifique quais serviços estão ativados em <filename>/etc/inetd.conf</filename> através de:

en: Then disable those services that are not needed by commenting out the line that includes them in <filename>/etc/inetd.conf</filename>, removing the package, or using <command>update-inetd</command>.
pt_BR: Então desative estes serviços desnecessários comentando a linha referente em <filename>/etc/inetd.conf</filename>, excluindo o pacote ou utilizando o comando <command>update-inetd</command>.

en: If you have wrapped services (those using <command>/usr/sbin/tcpd</command>), check that the files <filename>/etc/hosts.allow</filename> and <filename>/etc/hosts.deny</filename> are configured according to your service policy.
pt_BR: Se você utiliza serviços wrapped (aqueles que utilizam <command>/usr/sbin/tcpd</command>), verifique se os arquivos <filename>/etc/hosts.allow</filename> e <filename>/etc/hosts.deny</filename> são configurados de acordo com sua política de serviço.

en: If the server uses more than one external interface, depending on the service, you may want to limit the service to listen on a specific interface. For example, if you want internal FTP access only, make the FTP daemon listen only on your management interface, not on all interfaces (i.e, 0.0.0.0:21).
pt_BR: Se o servidor usa mais que uma interface externa, dependendo do seu serviço, você pode limitar o serviço para escutar em uma interface específica. Por exemplo, se você quiser somente acesso interno para o FTP, você deve configurar o daemon FTP para escutar somente na sua interface de gerência, não em todas interfaces (i.e, 0.0.0.0:21).

en: Re-boot the machine, or switch to single user mode and then back to multiuser using the commands:
pt_BR: Reinicie o computador, ou troque o modo de single user para multiuser usando os comandos:

en: 
      # init 1
      (....)
      # init 2
pt_BR: 
      $ init 1
      (....)
      $ init 2

en: Check the services now available, and, if necessary, repeat the steps above.
pt_BR: Então verifique agora os serviços que estão disponíveis, e se necessário, repita os passos acima.

en: Now install the needed services, if you have not done so already, and configure them properly.
pt_BR: Agora instale os serviços necessários, se não tiver feito isso ainda, e os configure corretamente.

en: Use the following shell command to determine what user each available service is running as:
pt_BR: Use o comando shell abaixo para determinar com que usuário cada serviço disponível está sendo executado:

en: 
      # for i in `/usr/sbin/lsof -i |grep LISTEN |cut -d " " -f 1 |sort -u`; \
      &gt; do user=`ps ef |grep $i |grep -v grep |cut -f 1 -d " "` ; \
      &gt; echo "Service $i is running as user $user"; done
pt_BR: 
      $ for i in `/usr/sbin/lsof -i |grep LISTEN |cut -d " " -f 1 |sort -u`; \
      > do user=`ps -ef |grep $i |grep -v grep |cut -f 1 -d " "` ; \
      > echo "Service $i is running as user $user"; done

en: Consider changing these services to a specific user/group and maybe <command>chroot</command>'ing them for increased security. You can do this by changing the <filename>/etc/init.d</filename> scripts which start the service. Most services in Debian use <command>start-stop-daemon</command>, which has options (<literal>--change-uid</literal> and <literal>--chroot</literal>) for accomplishing this. A word of warning regarding the <command>chroot</command>'ing of services: you may need to put all the files installed by the package (use dpkg -L) providing the service, as well as any packages it depends on, in the <command>chroot</command>'ed environment. Information about setting up a <command>chroot</command> environment for the <command>ssh</command> program can be found in <xref linkend="chroot-ssh-env" />.
pt_BR: Considere alterar esses serviços para um usuário/grupo específico e talvez até enjaulá-los (<command>chroot</command>'ing) para aumentar nível de segurança. Você pode fazer isto alterando os scripts de inicialização em <filename>/etc/init.d</filename>. A maioria dos serviços no Debian usa o <command>start-stop-daemon</command> com as opções (<literal>--change-uid</literal> e <literal>--chroot</literal>) para fazer isso. Uma observação com relação ao enjaulamento (<command>chroot</command>'ing) dos serviços: você precisa colocar todos os arquivos instalados pelo pacote (use dpkg -L) que fornece o serviço, assim como qualquer pacote dependente, na jaula <command>chroot</command>. Informações sobre a configuração de um ambiente <command>chroot</command> para o programa <command>ssh</command> podem ser encontrada em <xref linkend="chroot-ssh-env" />.

en: Repeat the steps above in order to check that only desired services are running and that they are running as the desired user/group combination.
pt_BR: Repita os passos acima para certificar que somente os serviços desejados estejam rodando e esteja sendo usada a combinação de usuário/grupo correta.

en: Test the installed services in order to see if they work as expected.
pt_BR: Teste os serviços instalados para ver se estão funcionando corretamente.

en: Check the system using a vulnerability assessment scanner (like <package>nessus</package>), in order to determine vulnerabilities in the system (i.e., misconfiguration, old services or unneeded services).
pt_BR: Verifique o sistema usando um vulnerability assessment scanner (tipo o <package>nessus</package>), para determinar as vulnerabilidades no sistema (i.e., mal-configuração, serviços antigos e desnecessários).

en: Install network and host intrusion measures like <package>snort</package> and <package>logcheck</package>.
pt_BR: Instale ferramentas de detecção de intrusão de rede e host como <package>snort</package> e <package>logsentry</package>.

en: Repeat the network scanner step and verify that the intrusion detection systems are working correctly.
pt_BR: Repita o passo de varredura da rede e verifique se os sistemas de detecção de intrusão estão funcionando corretamente.

en: For the truly paranoid, also consider the following:
pt_BR: Para paranóia real, também considere o seguinte:

en: Add firewalling capabilities to the system, accepting incoming connections only to offered services and limiting outgoing connections only to those that are authorized.
pt_BR: Adicione as capacidades de firewall do sistema, conexões de entrada só devem ser feitas para os serviços oferecidos e limite as conexões de saída somente para aqueles que são autorizados.

en: Re-check the installation with a new vulnerability assessment using a network scanner.
pt_BR: Verifique novamente a instalação com uma nova vulnerability assessment usando um varredor de rede.

en: Using a network scanner, check outbound connections from the system to an outside host and verify that unwanted connections do not find their way out.
pt_BR: Usando um varredor de rede, verifique as conexões de saídas do sistema para um host remoto e certifique-se que as conexões indesejadas sejam estabelecida.

en: FIXME: this procedure considers service hardening but not system hardening at the user level, include information regarding checking user permissions, SETUID files and freezing changes in the system using the ext2 file system.
pt_BR: FIXME: este procedimento engloba o fortalecimento de serviços, mas não o fortalecimento a nível de usuário, incluindo informações sobre verificação de permissões de usuários, arquivos SETUID e congelamento de alterações no sistema utilizando o sistema de arquivo ext2.

en: Configuration checklist
pt_BR: Checklist de configuração

en: This appendix briefly reiterates points from other sections in this manual in a condensed checklist format. This is intended as a quick summary for someone who has already read the manual. There are other good checklists available, including Kurt Seifried's <ulink name="Securing Linux Step by Step" url="http://seifried.org/security/os/linux/20020324-securing-linux-step-by-step.html" /> and <ulink name="CERT's Unix Security Checklist" url="http://www.cert.org/tech_tips/usc20_full.html" />.
pt_BR: Este apêndice retrata resumidamente os pontos de outras seções neste manual em um checklist no formato. A idéia é disponibilizar um sumário para a pessoa que já leu o manual buscar uma informação rapidamente. Existem outros checklists bons disponíveis, incluindo o <ulink name="Securing Linux Step by Step" url="http://seifried.org/security/os/linux/20020324-securing-linux-step-by-step.html" /> de Kurt Seifried e <ulink url="http://www.cert.org/tech_tips/usc20_full.html" name="CERT's Unix Security Checklist" />.

en: FIXME: This is based on v1.4 of the manual and might need to be updated.
pt_BR: FIXME: Isso é baseado na versão 1.4 do manual e talvez precise de atualização.

en: Limit physical access and booting capabilities
pt_BR: Limite o acesso físico e as capacidade de inicialização

en: Set a LILO or GRUB password (<filename>/etc/lilo.conf</filename> or <filename>/boot/grub/menu.lst</filename>, respectively); check that the LILO or GRUB configuration file is read-protected.
pt_BR: Configure uma senha para o LILO ou GRUB (<filename>/etc/lilo.conf</filename> ou <filename>/boot/grub/menu.lst</filename>, respectivamente); verifique se o arquivo de configuração do LILO ou GRUB está protegido contra gravação.

en: Partitioning
pt_BR: Particionamento

en: Separate user-writable data, non-system data, and rapidly changing run-time data to their own partitions
pt_BR: Separe os dados de escrita do usuário, dados que não são do sistema, e dados que são trocados rapidamente em tempo de execução para suas próprias partições

en: Password hygiene and login security
pt_BR: Higiene de senhas e segurança no login

en: Set a good root password
pt_BR: Configure uma senha segura para o super-usuário

en: Install and use PAM
pt_BR: Instale e use o PAM

en: Add MD5 support to PAM and make sure that (generally speaking) entries in <filename>/etc/pam.d/</filename> files which grant access to the machine have the second field in the pam.d file set to <literal>requisite</literal> or <literal>required</literal>.
pt_BR: Adicione suporte MD5 para o PAM e tenha certeza que (falando de forma generalizada) as entradas nos arquivos em <filename>/etc/pam.d/</filename> que garantem acesso à máquina tenham o segundo campo configurado como <literal>requisite</literal> ou <literal>required</literal>.

en: Tweak <filename>/etc/pam.d/login</filename> so as to only permit local root logins.
pt_BR: Modifique o <filename>/etc/pam.d/login</filename> para permite somente logins locais para o super-usuário.

en: Also mark authorized tty:s in <filename>/etc/security/access.conf</filename> and generally set up this file to limit root logins as much as possible.
pt_BR: Também marque tty:s autorizado em <filename>/etc/security/access.conf</filename> e geralmente configure este arquivo para limitar ao máximo possível o login do super-usuário.

en: Add pam_limits.so if you want to set per-user limits
pt_BR: Adicione o módulo pam_limits.so se você deseja configurar os limites por usuários

en: Tweak <filename>/etc/pam.d/passwd</filename>: set minimum length of passwords higher (6 characters maybe) and enable MD5
pt_BR: Modifique <filename>/etc/pam.d/passwd</filename>: configure o tamanho mínimo para as senhas (6 caracteres talvez) e ative o MD5

en: Add group wheel to <filename>/etc/group</filename> if desired; add pam_wheel.so group=wheel entry to <filename>/etc/pam.d/su</filename>
pt_BR: Adicione o grupo wheel para <filename>/etc/group</filename> se desejar; adicione a entrada pam_wheel.so group=wheel para <filename>/etc/pam.d/su</filename>

en: For custom per-user controls, use pam_listfile.so entries where appropriate
pt_BR: Para controles customizados por usuários, utilize o módulo pam_listfile.so

en: Have an <filename>/etc/pam.d/other</filename> file and set it up with tight security
pt_BR: Tenha um arquivo <filename>/etc/pam.d/other</filename> e o configure com um grau de segurança reforçado

en: Set up limits in <filename>/etc/security/limits.conf</filename> (note that <filename>/etc/limits</filename> is not used if you are using PAM)
pt_BR: Configure limites em <filename>/etc/security/limits.conf</filename> (note que <filename>/etc/limits</filename> não é usado se você já estiver usando o PAM)

en: Tighten up <filename>/etc/login.defs</filename>; also, if you enabled MD5 and/or PAM, make sure you make the corresponding changes here, too
pt_BR: Aumente a segurança em <filename>/etc/login.defs</filename>; também, se você ativar o MD5 e/ou PAM, tenha certeza de fazer também as alterações correspondentes aqui, também

en: Disable root ftp access in <filename>/etc/ftpusers</filename>
pt_BR: Desative o acesso ftp ao super-usuário em <filename>/etc/ftpusers</filename>

en: Use PAM to enforce additional constraints on logins?
pt_BR: Usar o PAM para reforçar barreiras adicionais aos logins?

en: Other local security issues
pt_BR: Outras questões de segurança local

en: Kernel tweaks (see <xref linkend="kernel-conf" />)
pt_BR: Modificações no kernel (veja <xref linkend="kernel-conf" />)

en: Kernel patches (see <xref linkend="kernel-patches" />)
pt_BR: Patches no Kernel (veja <xref linkend="kernel-patches" />)

en: Verify that SETUID checking is enabled in <filename>/etc/checksecurity.conf</filename>
pt_BR: Certifique-se que a verificação SETUID está ativada em <filename>/etc/checksecurity.conf</filename>

en: Consider making some log files append-only and configuration files immutable using chattr (ext2/3 file systems only)
pt_BR: Considere configurar alguns arquivos de logs como somente append e os arquivo de configuração imutáveis, usando o comando chattr (somente para arquivos ext2)

en: Set up file integrity (see <xref linkend="check-integ" />). Install <package>debsums</package>
pt_BR: Configurar a integridade de arquivo (veja <xref linkend="check-integ" />). Instale <package>debsums</package>

en: Log everything to a local printer?
pt_BR: Efetuar o log de tudo em uma impressora local?

en: Burn your configuration on a boot-able CD and boot off that?
pt_BR: Gravar suas configurações em um CD inicializável e boof off?

en: Disable kernel modules?
pt_BR: Desativar os módulos do kernel?

en: Limit network access
pt_BR: Limitar acesso a rede

en: Install and configure <command>ssh</command> (suggest PermitRootLogin No in <filename>/etc/ssh/sshd_config</filename>, PermitEmptyPasswords No; note other suggestions in text also)
pt_BR: Instale e configure <command>ssh</command> (sugiro PermitRootLogin No em <filename>/etc/ssh/sshd_config</filename>, PermitEmptyPasswords No; note outras sugestões também no texto)

en: Generally, disable gratuitous services in <filename>/etc/inetd.conf</filename> using <command>update-inetd --disable</command> (or disable <command>inetd</command> altogether, or use a replacement such as <command>xinetd</command> or <command>rlinetd</command>)
pt_BR: Geralmente, desative serviços desnecessários em <filename>/etc/inetd.conf</filename> usando o comando <command>update-inetd --disable</command> (ou desative <command>inetd</command> completamente, ou use o um substituto como <command>xinetd</command> ou <command>rlinetd</command>)

en: For those services which you do need, do not just use the most common programs, look for more secure versions shipped with Debian (or from other sources). Whatever you end up running, make sure you understand the risks.
pt_BR: Para aqueles serviços que você precisa, não use os programas mais comuns, procure por versões mais seguras distribuídas com o Debian (ou de outras fontes). Seja lá o que você for parar de executar, tenha certeza que você entende os riscos.

en: Set up <command>chroot</command> jails for outside users and daemons.
pt_BR: Configure jaula <command>chroot</command> para usuários externos e daemons.

en: If you run ftp, set up your ftpd server to always run <command>chroot</command>'ed to the user's home directory
pt_BR: Se você executa o ftp, configure seu servidor ftpd sempre para executar enjaulado para o diretório home dos usuários

en: If you run X, disable xhost authentication and go with <command>ssh</command> instead; better yet, disable remote X if you can (add -nolisten tcp to the X command line and turn off XDMCP in <filename>/etc/X11/xdm/xdm-config</filename> by setting the requestPort to 0)
pt_BR: Se você executa X, desative a autenticação xhost e use-o com <command>ssh</command>; melhor ainda, se puder desative o X (adicione -nolisten tcp para a linha de comando do X e desligue o XDMCP no <filename>/etc/X11/xdm/xdm-config</filename> configurando requestPort para 0)

en: Disable remote access to printers
pt_BR: Desative acesso externo para as impressoras

en: Tunnel any IMAP or POP sessions through SSL or <command>ssh</command>; install stunnel if you want to provide this service to remote mail users
pt_BR: Use tunelamento para qualquer sessão IMAP ou POP através do SSL ou <command>ssh</command>; instale stuneel se você quer fornecer este serviços para usuários de mail externos

en: Set up a log host and configure other machines to send logs to this host (<filename>/etc/syslog.conf</filename>)
pt_BR: Configure um host de log e configure as outras máquinas para enviar logs para esse host (<filename>/etc/syslog.conf</filename>)

en: Secure BIND, Sendmail, and other complex daemons (run in a <command>chroot</command> jail; run as a non-root pseudo-user)
pt_BR: Torne seguro o BIND, Sendmail, e outros daemons complexos (execute-os com uma jaula<command>chroot</command>; execute como um pseudo-usuário não root)

en: Do without NIS and RPC if you can (disable portmap).
pt_BR: Faça sem NIS ou RPC se puder (desative portmap).

en: Policy issues
pt_BR: Políticas de segurança

en: Educate users about the whys and hows of your policies. When you have prohibited something which is regularly available on other systems, provide documentation which explains how to accomplish similar results using other, more secure means.
pt_BR: Eduque os usuários sobre os porquês e comos de suas políticas. Quando você proíbe algo que está disponível regularmente em outros sistemas, forneça uma documentação que explique como obter resultados similares através de outros meios mais seguros.

en: Prohibit use of protocols which use clear-text passwords (<command>telnet</command>, <command>rsh</command> and friends; ftp, imap, http, ...).
pt_BR: Proíba o uso de protocolos que utilizam senhas em texto plano (<command>telnet</command>, <command>rsh</command> e similares; ftp, imap, http, ...).

en: Prohibit programs which use SVGAlib.
pt_BR: Proíba programas que usam SVGAlib.

en: Use disk quotas.
pt_BR: Use cotas de disco.

en: Keep informed about security issues
pt_BR: Mantenha-se informado sobre questões relacionadas à segurança

en: Subscribe to security mailing lists
pt_BR: Inscreva-se em listas de discussão sobre segurança

en: Configure <package>apt</package> for security updates -- add to <filename>/etc/apt/sources.list</filename> an entry (or entries) for http://security.debian.org/
pt_BR: Configure <package>apt</package> para atualização de segurança -- adicione no arquivo <filename>/etc/apt/sources.list</filename> uma entrada (ou entradas) para http://security.debian.org/debian-security

en: Also remember to periodically run <command>apt-get update ; apt-get upgrade</command> (perhaps install as a <command>cron</command> job?) as explained in <xref linkend="security-update" />.
pt_BR: Também lembre-se de executar periodicamente os comandos <command>apt-get update ; apt-get upgrade</command> (talvez instalar como um job no <command>cron</command>?) como explicado em <xref linkend="security-update" />.

en: Setting up a stand-alone IDS
pt_BR: Configurando um IDS stand-alone

en: Install a base Debian system and select no additional packages.
pt_BR: Instale um sistema Debian base e não selecione nenhum pacote adicional.

en: This system should be set up with at least two interfaces: one interface connected to a management LAN (for accessing the results and maintaining the system), and one interface with no IP address attached to the network segment being analyzed. You should configure the web server to listen only on the interface connected to the management LAN.
pt_BR: Este sistema deve ser configurado com pelo menos duas interfaces de rede; uma interface conectada ao gerenciamento da LAN (para acessar os resultados e suporte do sistema), e outra interface sem nenhum endereço IP anexada ao segmento de rede a ser analisado.

en: Setting up a bridge firewall
pt_BR: Configurando uma ponte firewall

en: This information was contributed by Francois Bayart in order to help users set up a Linux bridge/firewall with the 2.4.x kernel and <package>iptables</package>. Kernel patches are no more needed as the code was made standard part of the Linux kernel distribution.
pt_BR: Esta informação foi contribuição de Francois Bayart para ajudar os usuário a configurar um Linux como ponte/firewall com o kernel 2.4.x e <package>iptables</package>. Patches do kernel não são mais necessários, uma vez que o código passou a fazer parte do kernel do Linux.

en: To configure the kernel with necessary support, run <literal>make menuconfig</literal> or <literal>make xconfig</literal>. In the section <emphasis>Networking options</emphasis>, enable the following options:
pt_BR: Para configurar o kernel com o suporte necessário, execute <literal>make menuconfig</literal> ou <literal>make xconfig</literal>. Na seção <emphasis>Networking options</emphasis>, ative as seguintes opções:

en: Caution: you must disable this if you want to apply some firewalling rules or else <command>iptables</command> will not work:
pt_BR: Cuidado: você deve desativar isso se você quiser aplicar algumas regras de firewall ou o <command>iptables</command> não funcionará:

en: Next, add the correct options in the section <emphasis>IP: Netfilter Configuration</emphasis>. Then, compile and install the kernel. If you want to do it the <emphasis>Debian way</emphasis>, install <package>kernel-package</package> and run <command>make-kpkg</command> to create a custom Debian kernel package you can install on your server using dpkg. Once the new kernel is compiled and installed, install the <package>bridge-utils</package> package.
pt_BR: Próximo passo, adicione as opções corretas na seção <emphasis>IP: Netfilter Configuration</emphasis>. Então, compile e instale o kernel. Se você quiser fazer isso no <emphasis>jeito do Debian</emphasis>, instale o <package>kernel-package</package> e execute <command>make-kpkg</command> para criar um pacote Debian customizado do kernel que possa ser instalado no servidor usando o dpkg. Uma vez que o novo kernel é compilado e instalado, instale o pacote <package>bridge-utils</package>.

en: Once these steps are complete, you can complete the configuration of your bridge. The next section presents two different possible configurations for the bridge, each with a hypothetical network map and the necessary commands.
pt_BR: Quando estes passos forem feitos, você pode completar a configuração de sua ponte. A próxima seção apresenta duas possíveis configurações para a ponte, cada uma com um mapa de rede hipotético e os comandos necessários.

en: A bridge providing NAT and firewall capabilities
pt_BR: Uma ponte fornecendo capacidades de NAT e firewall

en: The first configuration uses the bridge as a firewall with network address translation (NAT) that protects a server and internal LAN clients. A diagram of the network configuration is shown below:
pt_BR: A primeira configuração usa a ponte como um firewall com tradução de endereços de rede (NAT) que protege o servidor e os clientes da rede interna. Um diagrama da configuração da rede é mostrado abaixo:

en: The following commands show how this bridge can be configured.
pt_BR: Os seguintes comando mostram como esta ponte pode ser configurada.

en: 
    # Create the interface br0
    /usr/sbin/brctl addbr br0
    
    # Add the Ethernet interface to use with the bridge
    /usr/sbin/brctl addif br0 eth0
    /usr/sbin/brctl addif br0 eth1
    
    # Start up the Ethernet interface
    /sbin/ifconfig eth0 0.0.0.0
    /sbin/ifconfig eth1 0.0.0.0
    
    # Configure the bridge ethernet
    # The bridge will be correct and invisible ( transparent firewall ).
    # It's hidden in a traceroute and you keep your real gateway on the 
    # other computers. Now if you want you can config a gateway on your 
    # bridge and choose it as your new gateway for the other computers.
    
    /sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.31
    
    # I have added this internal IP to create my NAT 
    ip addr add 192.168.0.1/24 dev br0
    /sbin/route add default gw 62.3.3.25
pt_BR: 
    # Create the interface br0
    /usr/sbin/brctl addbr br0
    
    # Add the Ethernet interface to use with the bridge
    /usr/sbin/brctl addif br0 eth0
    /usr/sbin/brctl addif br0 eth1
    
    # Start up the Ethernet interface
    /sbin/ifconfig eth0 0.0.0.0
    /sbin/ifconfig eth1 0.0.0.0
    
    # Configure the bridge ethernet
    # The bridge will be correct and invisible ( transparent firewall ).
    # It's hidden in a traceroute and you keep your real gateway on the 
    # other computers. Now if you want you can config a gateway on your 
    # bridge and choose it as your new gateway for the other computers.
    
    /sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.32
    
    # I have added this internal IP to create my NAT 
    ip addr add 192.168.0.1/24 dev br0
    /sbin/route add default gw 62.3.3.25

en: A bridge providing firewall capabilities
pt_BR: Uma ponte fornecendo capacidades de firewall

en: A second possible configuration is a system that is set up as a transparent firewall for a LAN with a public IP address space.
pt_BR: Uma segunda possível configuração é um sistema que funciona como um firewall transparente para a LAN com um espaço de endereços IP públicos.

en: 
    # Create the interface br0
    /usr/sbin/brctl addbr br0
    
    # Add the Ethernet interface to use with the bridge
    /usr/sbin/brctl addif br0 eth0
    /usr/sbin/brctl addif br0 eth1
    
    # Start up the Ethernet interface
    /sbin/ifconfig eth0 0.0.0.0
    /sbin/ifconfig eth1 0.0.0.0
    
    # Configure the bridge Ethernet
    # The bridge will be correct and invisible ( transparent firewall ).
    # It's hidden in a traceroute and you keep your real gateway on the 
    # other computers. Now if you want you can config a gateway on your
    # bridge and choose it as your new gateway for the other computers.
    
    /sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.31
pt_BR: 
    # Create the interface br0
    /usr/sbin/brctl addbr br0
    
    # Add the Ethernet interface to use with the bridge
    /usr/sbin/brctl addif br0 eth0
    /usr/sbin/brctl addif br0 eth1
    
    # Start up the Ethernet interface
    /sbin/ifconfig eth0 0.0.0.0
    /sbin/ifconfig eth1 0.0.0.0
    
    # Configure the bridge Ethernet
    # The bridge will be correct and invisible ( transparent firewall ).
    # It's hidden in a traceroute and you keep your real gateway on the 
    # other computers. Now if you want you can config a gateway on your
    # bridge and choose it as your new gateway for the other computers.
    
    /sbin/ifconfig br0 62.3.3.26 netmask 255.255.255.248 broadcast 62.3.3.32

en: If you traceroute the Linux Mail Server, you won't see the bridge. If you want access to the bridge with <command>ssh</command>, you must have a gateway or you must first connect to another server, such as the "Mail Server", and then connect to the bridge through the internal network card.
pt_BR: Se você seguir as rotas para o Linux Mail Server, não enxergará a ponte. Se você quiser acessar a ponte com o <command>ssh</command>, você deve ter um gateway ou acessar um outro servidor, como o "Mail Server", e então conectar à ponte através de uma placa de rede interna.

en: Basic IPtables rules
pt_BR: Regras básicas do IPtables

en: This is an example of the basic rules that could be used for either of these setups.
pt_BR: As regras básicas a seguir podem ser usadas em qualquer uma das duas configurações mostradas acima.

en: Basic Iptables rules
pt_BR: Regras básicas do IPtables

en: 
    iptables -F FORWARD
    iptables -P FORWARD DROP
    iptables -A FORWARD -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP
    iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
    
    # Some funny rules but not in a classic Iptables sorry ...
    # Limit ICMP 
    # iptables -A FORWARD -p icmp -m limit --limit 4/s -j ACCEPT
    # Match string, a good simple method to block some VIRUS very quickly
    # iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 -m string --string "cmd.exe"
    
    # Block all MySQL connection just to be sure
    iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP
    
    # Linux Mail Server Rules
    
    # Allow FTP-DATA (20), FTP (21), SSH (22) 
    iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.27/32 --dport 20:22 -j ACCEPT
    
    # Allow the Mail Server to connect to the outside
    # Note: This is *not* needed for the previous connections 
    # (remember: stateful filtering) and could be removed.
    iptables -A FORWARD -p tcp -s 62.3.3.27/32 -d 0/0 -j ACCEPT
    
    # WWW Server Rules
    
    # Allow HTTP ( 80 ) connections with the WWW server
    iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 80 -j ACCEPT
    
    # Allow HTTPS ( 443 ) connections with the WWW server
    iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 443 -j ACCEPT
    
    # Allow the WWW server to go out
    # Note: This is *not* needed for the previous connections 
    # (remember: stateful filtering) and could be removed.
    iptables -A FORWARD -p tcp -s 62.3.3.28/32 -d 0/0 -j ACCEPT
pt_BR: 
      iptables -F FORWARD
      iptables -P FORWARD DROP
      iptables -A FORWARD -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -m state --state INVALID -j DROP
      iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
    
      # Some funny rules but not in a classic Iptables sorry ...
      # Limit ICMP 
      # iptables -A FORWARD -p icmp -m limit --limit 4/s -j ACCEPT
      # Match string, a good simple method to block some VIRUS very quickly
      # iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 -m string --string "cmd.exe"
    
      # Block all MySQL connection just to be sure
      iptables -A FORWARD -p tcp -s 0/0 -d 62.3.3.0/24 --dport 3306 -j DROP
    
      # Linux Mail Server Rules
    
      # Allow FTP-DATA ( 20 ) , FTP ( 21 ) , SSH ( 22 ) 
      iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.27/32 --dport 20:22 -j ACCEPT
    
      # Allow the Mail Server to connect to the outside
      # Note: This is *not* needed for the previous connections 
      # (remember: stateful filtering) and could be removed.
      iptables -A FORWARD -p tcp -s 62.3.3.27/32 -d 0/0 -j ACCEPT
    
      # WWW Server Rules
    
      # Allow HTTP ( 80 ) connections with the WWW server
      iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 80 -j ACCEPT
    
      # Allow HTTPS ( 443 ) connections with the WWW server
      iptables -A FORWARD -p tcp -s 0.0.0.0/0 -d 62.3.3.28/32 --dport 443 -j ACCEPT
    
      # Allow the WWW server to go out
      # Note: This is *not* needed for the previous connections 
      # (remember: stateful filtering) and could be removed.
      iptables -A FORWARD -p tcp -s 62.3.3.28/32 -d 0/0 -j ACCEPT

en: Sample script to change the default Bind installation.
pt_BR: Exemplo de script para alterar a instalação padrão do Bind.

en: 
      #!/bin/sh
      # Change the default Debian bind v8 configuration to have it run
      # with a non-root user and group.
      # 
      # DO NOT USER this with version 9, use debconf for configure this instead
      #
      # WARN: This script has not been tested thoroughly, please
      # verify the changes made to the INITD script
    
      # (c) 2002 Javier Fernandez-Sanguino Pena
      #
      #    This program is free software; you can redistribute it and/or modify
      #    it under the terms of the GNU General Public License as published by
      #    the Free Software Foundation; either version 1, or (at your option)
      #    any later version.
      #
      #    This program is distributed in the hope that it will be useful,
      #    but WITHOUT ANY WARRANTY; without even the implied warranty of
      #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      #    GNU General Public License for more details.
      #
      #     Please see the file `COPYING' for the complete copyright notice.
      #
    
      restore() {
      # Just in case, restore the system if the changes fail
        echo "WARN: Restoring to the previous setup since I'm unable to properly change it."
        echo "WARN: Please check the $INITDERR script."
        mv $INITD $INITDERR
        cp $INITDBAK $INITD
      }
    
    
      USER=named
      GROUP=named
      INITD=/etc/init.d/bind
      DEFAULT=/etc/default/bind
      INITDBAK=$INITD.preuserchange
      INITDERR=$INITD.changeerror
      AWKS="awk ' /\/usr\/sbin\/ndc reload/ { print \"stop; sleep 2; start;\"; noprint = 1; } /\\\\$/ { if ( noprint != 0 ) { noprint = noprint + 1;} } /^.*$/ { if ( noprint != 0 ) { noprint = noprint - 1; } else { print \$0; } } '"
    
      [ `id -u` -ne 0 ] &amp;&amp; {
        echo "This program must be run by the root user"
        exit 1
      }
    
      RUNUSER=`ps eo user,fname |grep named |cut -f 1 -d " "`
    
      if [ "$RUNUSER" = "$USER" ] 
      then
        echo "WARN: The name server running daemon is already running as $USER"
        echo "ERR:  This script will not do any changes to your setup."
        exit 1
      fi
      if [ ! -f "$INITD" ]
      then
        echo "ERR:  This system does not have $INITD (which this script tries to change)"
        RUNNING=`ps eo fname |grep named`
        [ -z "$RUNNING" ] &amp;&amp; \
          echo "ERR:  In fact the name server daemon is not even running (is it installed?)"
        echo "ERR:  No changes will be made to your system"
        exit 1
      fi
    
      # Check if there are options already setup 
      if [ -e "$DEFAULT" ]
      then
        if grep -q ^OPTIONS $DEFAULT; then
          echo "ERR: The $DEFAULT file already has options set."
          echo "ERR:  No changes will be made to your system"
        fi
      fi
    
      # Check if named group exists
      if [ -z "`grep $GROUP /etc/group`" ] 
      then
        echo "Creating group $GROUP:"
        addgroup $GROUP
      else
        echo "WARN: Group $GROUP already exists. Will not create it"
      fi
      # Same for the user
      if [ -z "`grep $USER /etc/passwd`" ] 
      then
        echo "Creating user $USER:"
        adduser --system --home /home/$USER \
          --no-create-home --ingroup $GROUP \
          --disabled-password --disabled-login $USER
      else
        echo "WARN: The user $USER already exists. Will not create it"
      fi
    
      # Change the init.d script
    
      # First make a backup (check that there is not already
      # one there first)
      if [ ! -f $INITDBAK ] 
      then
        cp $INITD $INITDBAK
      fi
    
      # Then use it to change it
      cat $INITDBAK |
      eval $AWKS &gt; $INITD
    
      # Now put the options in the /etc/default/bind file:
      cat &gt;&gt;$DEFAULT &lt;&lt;EOF
    # Make bind run with the user we defined
    OPTIONS="-u $USER -g $GROUP"
    EOF
    
      echo "WARN: The script $INITD has been changed, trying to test the changes."
      echo "Restarting the named daemon (check for errors here)."
    
      $INITD restart
      if [ $? -ne 0 ] 
      then
        echo "ERR:  Failed to restart the daemon."
        restore
        exit 1
      fi
    
      RUNNING=`ps eo fname |grep named`
      if [ -z "$RUNNING" ] 
      then
        echo "ERR:  Named is not running, probably due to a problem with the changes."
        restore
        exit 1
      fi
    
      # Check if it's running as expected
      RUNUSER=`ps eo user,fname |grep named |cut -f 1 -d " "`
    
      if [ "$RUNUSER" = "$USER" ] 
      then
        echo "All has gone well, named seems to be running now as $USER."
      else
        echo "ERR:  The script failed to automatically change the system."
        echo "ERR:  Named is currently running as $RUNUSER."
        restore
        exit 1
      fi
    
      exit 0
pt_BR: 
      #!/bin/sh
      # Change the default Debian bind configuration to have it run
      # with a non-root user and group.
      #
      # WARN: This script has not been tested thoroughly, please
      # verify the changes made to the INITD script
    
      # (c) 2002 Javier Fernandez-Sanguino Peña
      #
      #    This program is free software; you can redistribute it and/or modify
      #    it under the terms of the GNU General Public License as published by
      #    the Free Software Foundation; either version 1, or (at your option)
      #    any later version.
      #
      #    This program is distributed in the hope that it will be useful,
      #    but WITHOUT ANY WARRANTY; without even the implied warranty of
      #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      #    GNU General Public License for more details.
      #
      #     Please see the file `COPYING' for the complete copyright notice.
      #
    
      restore() {
      # Just in case, restore the system if the changes fail
    	  echo "WARN: Restoring to the previous setup since I'm unable to properly change it."
    	  echo "WARN: Please check the $INITDERR script."
    	  mv $INITD $INITDERR
    	  cp $INITDBAK $INITD
      }
    
    
      USER=named
      GROUP=named
      INITD=/etc/init.d/bind
      INITDBAK=$INITD.preuserchange
      INITDERR=$INITD.changeerror
      START="start-stop-daemon --start --quiet --exec /usr/sbin/named -- -g $GROUP -u $USER"
      AWKS="awk ' /start-stop-daemon --start/ { print \"$START\"; noprint = 1; }; /\/usr\/sbin\/ndc reload/ { print \"stop; sleep 2; start;\"; noprint = 1; } /\\\\$/ { if ( noprint != 0 ) { noprint = noprint + 1;} } /^.*$/ { if ( noprint != 0 ) { noprint = noprint - 1; } else { print \$0; } } '"
    
      [ `id -u` -ne 0 ] &amp;&amp; {
    	  echo "This program must be run by the root user"
    	  exit 1
      }
    
      RUNUSER=`ps -eo user,fname |grep named |cut -f 1 -d " "`
    
      if [ "$RUNUSER" = "$USER" ] 
      then
    	  echo "WARN: The name server running daemon is already running as $USER"
    	  echo "ERR:  This script will not many any changes to your setup."
    	  exit 1
      fi
      if [ ! -f $INITD ]
      then
    	  echo "ERR:  This system does not have $INITD (which this script tries to change)"
    	  RUNNING=`ps -eo fname |grep named`
    	   [ -z "$RUNNING" ] &amp;&amp; \
    	      echo "ERR:  In fact the name server daemon is not even running (is it installed?)"
    	   echo "ERR:  No changes will be made to your system"
    	  exit 1
      fi
    
      # Check if named group exists
      if [ -z "`grep $GROUP /etc/group`" ] 
      then
    	  echo "Creating group $GROUP:"
    	  addgroup $GROUP
      else
    	  echo "WARN: Group $GROUP already exists. Will not create it"
      fi
      # Same for the user
      if [ -z "`grep $USER /etc/passwd`" ] 
      then
    	  echo "Creating user $USER:"
    	  adduser --system --home /home/$USER \
    	  --no-create-home --ingroup $GROUP \
    	  --disabled-password --disabled-login $USER
      else
    	  echo "WARN: The user $USER already exists. Will not create it"
      fi
    
      # Change the init.d script
    
      # First make a backup (check that there is not already
      # one there first)
      if [ ! -f $INITDBAK ] 
      then
    	  cp $INITD $INITDBAK
      fi
    
      # Then use it to change it
      cat $INITDBAK |
      eval $AWKS > $INITD
    
      echo "WARN: The script $INITD has been changed, trying to test the changes."
      echo "Restarting the named daemon (check for errors here)."
    
      $INITD restart
      if [ $? -ne 0 ] 
      then
    	  echo "ERR:  Failed to restart the daemon."
    	  restore
    	  exit 1
      fi
    
      RUNNING=`ps -eo fname |grep named`
      if [ -z "$RUNNING" ] 
      then
    	  echo "ERR:  Named is not running, probably due to a problem with the changes."
    	  restore
    	  exit 1
      fi
    
      # Check if it's running as expected
      RUNUSER=`ps -eo user,fname |grep named |cut -f 1 -d " "`
    
      if [ "$RUNUSER" = "$USER" ] 
      then
    	  echo "All has gone well, named seems to be running now as $USER."
      else
    	  echo "ERR:  The script failed to automatically change the system."
    	  echo "ERR:  Named is currently running as $RUNUSER."
    	  restore
    	  exit 1
      fi
    
      exit 0

en: The previous script, run on Woody's (Debian 3.0) custom <command>bind</command> (version 8), will modify the initd file after creating the 'named' user and group and will
pt_BR: O script anterior, execute-o no <command>bind</command> customizado do Woody (Debian 3.0), irá produzir o arquivo initd abaixo depois de criar o usuário e grupo 'named':

en: Security update protected by a firewall
pt_BR: Atualização de segurança protegida por um firewall

en: After a standard installation, a system may still have some security vulnerabilities. Unless you can download updates for the vulnerable packages on another system (or you have mirrored security.debian.org for local use), the system will have to be connected to the Internet for the downloads.
pt_BR: Depois de uma instalaçõa padrão, o sistema ainda poderá ter algumas vulnerabilidades de segurança. Ao menos que você baixe as atualizações para os pacotes vulneráveis em outro computador (ou você tenha espelhado security.debian.org para uso local), o sistema deverá ter acesso à Internet para os downloads.

en: However, as soon as you connect to the Internet you are exposing this system. If one of your local services is vulnerable, you might be compromised even before the update is finished! This may seem paranoid but, in fact, analysis from the <ulink name="Honeynet Project" url="http://www.honeynet.org" /> has shown that systems can be compromised in less than three days, even if the system is not publicly known (i.e., not published in DNS records).
pt_BR: Entretanto, na medida que você se conecta à Internet estará expondo seu sistema. Se um de seus serviços locais estiver vulnerável, poderá ser comprometido mesmo antes de finalizar as atualizações! Isso pode ser paranóico, mas as análises do <ulink name="Projeto Honeynet" url="http://www.honeynet.org" /> têm mostrado que sistemas podem ser comprometidos em menos de três dias, mesmo que o sistema não seja conhecido publicamento (i.e., não está publicado nos registros DNS).

en: When doing an update on a system not protected by an external system like a firewall, it is possible to properly configure your local firewall to restrict connections involving only the security update itself. The example below shows how to set up such local firewall capabilities, which allow connections from security.debian.org only, logging all others.
pt_BR: Quando estiver fazendo uma atualização em um sistema não protegido por um mecanismo externo como firewall, é possível configurar seu firewall local para restringir conexões envolvendo somente as próprias atualizações de segurança. O exemplo abaixo mostra como configurar estas capacidades de firewall, que permitem somente conexões do security.debian.org, registrando todas as outras que são negadas.

en: 
      # iptables -F
      # iptables -L
      Chain INPUT (policy ACCEPT)
      target     prot opt source               destination
    
      Chain FORWARD (policy ACCEPT)
      target     prot opt source               destination
    
      Chain OUTPUT (policy ACCEPT)
      target     prot opt source               destination
      # iptables -A OUTPUT -d security.debian.org --dport 80 -j ACCEPT
      # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      # iptables -A INPUT -p icmp -j ACCEPT
      # iptables -A INPUT -j LOG
      # iptables -A OUTPUT -j LOG
      # iptables -P INPUT DROP
      # iptables -P FORWARD DROP
      # iptables -P OUTPUT DROP
      # iptables -L
      Chain INPUT (policy DROP)
      target     prot opt source               destination
      ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
      ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
      LOG        all  --  anywhere             anywhere           LOG level warning
    
      Chain FORWARD (policy DROP)
      target     prot opt source               destination
    
      Chain OUTPUT (policy DROP)
      target     prot opt source               destination
      ACCEPT     80   --  anywhere             security.debian.org
      LOG        all  --  anywhere             anywhere           LOG level warning
pt_BR: 
      # iptables -F
      # iptables -L
      Chain INPUT (policy ACCEPT)
      target     prot opt source               destination
    
      Chain FORWARD (policy ACCEPT)
      target     prot opt source               destination
    
      Chain OUTPUT (policy ACCEPT)
      target     prot opt source               destination
      # iptables -P INPUT DROP
      # iptables -P FORWARD DROP
      # iptables -P OUTPUT DROP
      # iptables -A OUTPUT -d security.debian.org --dport 80 -j ACCEPT
      # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      # iptables -A INPUT -p icmp -j ACCEPT
      # iptables -A INPUT -j LOG
      # iptables -A OUTPUT -j LOG
      # iptables -L
      Chain INPUT (policy DROP)
      target     prot opt source               destination
      ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
      ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
      LOG        all  --  anywhere             anywhere           LOG level warning
    
      Chain FORWARD (policy DROP)
      target     prot opt source               destination
    
      Chain OUTPUT (policy DROP)
      target     prot opt source               destination
      ACCEPT     80   --  anywhere             security.debian.org
      LOG        all  --  anywhere             anywhere           LOG level warning

en: This will restrict <emphasis>both</emphasis> remote shell access, as well as remote copy through the <command>ssh</command> channel.
pt_BR: Isto irá restringir <emphasis>ambos</emphasis> o acesso remoto ao shell, como também a cópia remota através do canal <command>ssh</command>.

en: Make sure to have all the needed binaries and libraries in the <command>chroot</command>'ed path for users. These files should be owned by root to avoid tampering by the user (so as to exit the <command>chroot</command>'ed jailed). A sample might include:
pt_BR: Tenha certeza de ter todos os binários e bibliotecas necessárias dentro do caminho que está enjaulado para os usuários. Estes arquivos devem pertencer ao root para evitar tampering pelo usuário (como sair da jaula <command>chroot</command>'ed). Um exemplo possível inclue:

en: Automatically making the environment (the easy way)
pt_BR: Configurando automaticamente o ambiente (a maneira fácil)

en: You can easily create a restricted environment with the <package>makejail</package> package, since it automatically takes care of tracing the server daemon (with <command>strace</command>), and makes it run under the restricted environment.
pt_BR: Você pode facilmente criar um ambiente restrito com o pacote <package>makejail</package>, já que ele automaticamente segue as trilhas do servidor daemon (com <command>strace</command>) e faz com que ele execute em um ambiente restrito.

en: The advantage of programs that automatically generate <command>chroot</command> environments is that they are capable of copying any package to the <command>chroot</command> environment (even following the package's dependencies and making sure it's complete). Thus, providing user applications is easier.
pt_BR: A vantagem de programas que automaticamente geram um ambiente <command>chroot</command> é que eles são capazes de copiar qualquer pacote para o ambiente <command>chroot</command> (mesmo seguindo as dependências do pacote e certificar que foi completada). Então, fornecer as aplicações dos usuários é bem mais fácil.

en: Read the sample file to see what other changes need to be made to the environment. Some of these changes, such as copying user's home directories, cannot be done automatically. Also, limit the exposure of sensitive information by only copying the data from a given number of users from the files <filename>/etc/shadow</filename> or <filename>/etc/group</filename>. Notice that if you are using Privilege Separation the <emphasis>sshd</emphasis> user needs to exist in those files.
pt_BR: Leia o arquivo exemplo para ver que outras mudanças devem ser feitas para o ambiente. Algumas dessas mudanças, como copiar os diretórios home do usuário, não podem ser feitas automaticamente. Também limite a exposição de informações sensíveis, copiando os dados de um certo número de usuários dos arquivos <filename>/etc/shadow</filename> ou <filename>/etc/group</filename>.

en: The following sample environment has been (slightly) tested in Debian 3.0 and is built with the configuration file provided in the package and includes the <package>fileutils</package> package:
pt_BR: O seguinte exemplo de ambiente tem sido (levemente) testado, foi construído com o arquivo de configuração fornecido no pacote e inclue o pacote <package>fileutils</package>:

en: 
    .
    |-- bin
    |   |-- ash
    |   |-- bash
    |   |-- chgrp
    |   |-- chmod
    |   |-- chown
    |   |-- cp
    |   |-- csh -&gt; /etc/alternatives/csh
    |   |-- dd
    |   |-- df
    |   |-- dir
    |   |-- fdflush
    |   |-- ksh
    |   |-- ln
    |   |-- ls
    |   |-- mkdir
    |   |-- mknod
    |   |-- mv
    |   |-- rbash -&gt; bash
    |   |-- rm
    |   |-- rmdir
    |   |-- sh -&gt; bash
    |   |-- sync
    |   |-- tcsh
    |   |-- touch
    |   |-- vdir
    |   |-- zsh -&gt; /etc/alternatives/zsh
    |   `-- zsh4
    |-- dev
    |   |-- null
    |   |-- ptmx
    |   |-- pts
    |   |-- ptya0
    (...)
    |   |-- tty
    |   |-- tty0
    (...)
    |   `-- urandom
    |-- etc
    |   |-- alternatives
    |   |   |-- csh -&gt; /bin/tcsh
    |   |   `-- zsh -&gt; /bin/zsh4
    |   |-- environment
    |   |-- hosts
    |   |-- hosts.allow
    |   |-- hosts.deny
    |   |-- ld.so.conf
    |   |-- localtime -&gt; /usr/share/zoneinfo/Europe/Madrid
    |   |-- motd
    |   |-- nsswitch.conf
    |   |-- pam.conf
    |   |-- pam.d
    |   |   |-- other
    |   |   `-- ssh
    |   |-- passwd
    |   |-- resolv.conf
    |   |-- security
    |   |   |-- access.conf
    |   |   |-- chroot.conf
    |   |   |-- group.conf
    |   |   |-- limits.conf
    |   |   |-- pam_env.conf
    |   |   `-- time.conf
    |   |-- shadow
    |   |-- shells
    |   `-- ssh
    |       |-- moduli
    |       |-- ssh_host_dsa_key
    |       |-- ssh_host_dsa_key.pub
    |       |-- ssh_host_rsa_key
    |       |-- ssh_host_rsa_key.pub
    |       `-- sshd_config
    |-- home
    |   `-- userX
    |-- lib
    |   |-- ld-2.2.5.so
    |   |-- ld-linux.so.2 -&gt; ld-2.2.5.so
    |   |-- libc-2.2.5.so
    |   |-- libc.so.6 -&gt; libc-2.2.5.so
    |   |-- libcap.so.1 -&gt; libcap.so.1.10
    |   |-- libcap.so.1.10
    |   |-- libcrypt-2.2.5.so
    |   |-- libcrypt.so.1 -&gt; libcrypt-2.2.5.so
    |   |-- libdl-2.2.5.so
    |   |-- libdl.so.2 -&gt; libdl-2.2.5.so
    |   |-- libm-2.2.5.so
    |   |-- libm.so.6 -&gt; libm-2.2.5.so
    |   |-- libncurses.so.5 -&gt; libncurses.so.5.2
    |   |-- libncurses.so.5.2
    |   |-- libnsl-2.2.5.so
    |   |-- libnsl.so.1 -&gt; libnsl-2.2.5.so
    |   |-- libnss_compat-2.2.5.so
    |   |-- libnss_compat.so.2 -&gt; libnss_compat-2.2.5.so
    |   |-- libnss_db-2.2.so
    |   |-- libnss_db.so.2 -&gt; libnss_db-2.2.so
    |   |-- libnss_dns-2.2.5.so
    |   |-- libnss_dns.so.2 -&gt; libnss_dns-2.2.5.so
    |   |-- libnss_files-2.2.5.so
    |   |-- libnss_files.so.2 -&gt; libnss_files-2.2.5.so
    |   |-- libnss_hesiod-2.2.5.so
    |   |-- libnss_hesiod.so.2 -&gt; libnss_hesiod-2.2.5.so
    |   |-- libnss_nis-2.2.5.so
    |   |-- libnss_nis.so.2 -&gt; libnss_nis-2.2.5.so
    |   |-- libnss_nisplus-2.2.5.so
    |   |-- libnss_nisplus.so.2 -&gt; libnss_nisplus-2.2.5.so
    |   |-- libpam.so.0 -&gt; libpam.so.0.72
    |   |-- libpam.so.0.72
    |   |-- libpthread-0.9.so
    |   |-- libpthread.so.0 -&gt; libpthread-0.9.so
    |   |-- libresolv-2.2.5.so
    |   |-- libresolv.so.2 -&gt; libresolv-2.2.5.so
    |   |-- librt-2.2.5.so
    |   |-- librt.so.1 -&gt; librt-2.2.5.so
    |   |-- libutil-2.2.5.so
    |   |-- libutil.so.1 -&gt; libutil-2.2.5.so
    |   |-- libwrap.so.0 -&gt; libwrap.so.0.7.6
    |   |-- libwrap.so.0.7.6
    |   `-- security
    |       |-- pam_access.so
    |       |-- pam_chroot.so
    |       |-- pam_deny.so
    |       |-- pam_env.so
    |       |-- pam_filter.so
    |       |-- pam_ftp.so
    |       |-- pam_group.so
    |       |-- pam_issue.so
    |       |-- pam_lastlog.so
    |       |-- pam_limits.so
    |       |-- pam_listfile.so
    |       |-- pam_mail.so
    |       |-- pam_mkhomedir.so
    |       |-- pam_motd.so
    |       |-- pam_nologin.so
    |       |-- pam_permit.so
    |       |-- pam_rhosts_auth.so
    |       |-- pam_rootok.so
    |       |-- pam_securetty.so
    |       |-- pam_shells.so
    |       |-- pam_stress.so
    |       |-- pam_tally.so
    |       |-- pam_time.so
    |       |-- pam_unix.so
    |       |-- pam_unix_acct.so -&gt; pam_unix.so
    |       |-- pam_unix_auth.so -&gt; pam_unix.so
    |       |-- pam_unix_passwd.so -&gt; pam_unix.so
    |       |-- pam_unix_session.so -&gt; pam_unix.so
    |       |-- pam_userdb.so
    |       |-- pam_warn.so
    |       `-- pam_wheel.so
    |-- sbin
    |   `-- start-stop-daemon
    |-- usr
    |   |-- bin
    |   |   |-- dircolors
    |   |   |-- du
    |   |   |-- install
    |   |   |-- link
    |   |   |-- mkfifo
    |   |   |-- shred
    |   |   |-- touch -&gt; /bin/touch
    |   |   `-- unlink
    |   |-- lib
    |   |   |-- libcrypto.so.0.9.6
    |   |   |-- libdb3.so.3 -&gt; libdb3.so.3.0.2
    |   |   |-- libdb3.so.3.0.2
    |   |   |-- libz.so.1 -&gt; libz.so.1.1.4
    |   |   `-- libz.so.1.1.4
    |   |-- sbin
    |   |   `-- sshd
    |   `-- share
    |       |-- locale
    |       |   `-- es
    |       |       |-- LC_MESSAGES
    |       |       |   |-- fileutils.mo
    |       |       |   |-- libc.mo
    |       |       |   `-- sh-utils.mo
    |       |       `-- LC_TIME -&gt; LC_MESSAGES
    |       `-- zoneinfo
    |           `-- Europe
    |               `-- Madrid
    `-- var
        `-- run
            |-- sshd
            `-- sshd.pid
    
    27 directories, 733 files
pt_BR: 
    .
    |-- bin
    |   |-- ash
    |   |-- bash
    |   |-- chgrp
    |   |-- chmod
    |   |-- chown
    |   |-- cp
    |   |-- csh -> /etc/alternatives/csh
    |   |-- dd
    |   |-- df
    |   |-- dir
    |   |-- fdflush
    |   |-- ksh
    |   |-- ln
    |   |-- ls
    |   |-- mkdir
    |   |-- mknod
    |   |-- mv
    |   |-- rbash -> bash
    |   |-- rm
    |   |-- rmdir
    |   |-- sh -> bash
    |   |-- sync
    |   |-- tcsh
    |   |-- touch
    |   |-- vdir
    |   |-- zsh -> /etc/alternatives/zsh
    |   `-- zsh4
    |-- dev
    |   |-- null
    |   |-- ptmx
    |   |-- pts
    |   |-- ptya0
    (...)
    |   |-- tty
    |   |-- tty0
    (...)
    |   `-- urandom
    |-- etc
    |   |-- alternatives
    |   |   |-- csh -> /bin/tcsh
    |   |   `-- zsh -> /bin/zsh4
    |   |-- environment
    |   |-- hosts
    |   |-- hosts.allow
    |   |-- hosts.deny
    |   |-- ld.so.conf
    |   |-- localtime -> /usr/share/zoneinfo/Europe/Madrid
    |   |-- motd
    |   |-- nsswitch.conf
    |   |-- pam.conf
    |   |-- pam.d
    |   |   |-- other
    |   |   `-- ssh
    |   |-- passwd
    |   |-- resolv.conf
    |   |-- security
    |   |   |-- access.conf
    |   |   |-- chroot.conf
    |   |   |-- group.conf
    |   |   |-- limits.conf
    |   |   |-- pam_env.conf
    |   |   `-- time.conf
    |   |-- shadow
    |   |-- shells
    |   `-- ssh
    |       |-- moduli
    |       |-- ssh_host_dsa_key
    |       |-- ssh_host_dsa_key.pub
    |       |-- ssh_host_rsa_key
    |       |-- ssh_host_rsa_key.pub
    |       `-- sshd_config
    |-- home
    |   `-- userX
    |-- lib
    |   |-- ld-2.2.5.so
    |   |-- ld-linux.so.2 -> ld-2.2.5.so
    |   |-- libc-2.2.5.so
    |   |-- libc.so.6 -> libc-2.2.5.so
    |   |-- libcap.so.1 -> libcap.so.1.10
    |   |-- libcap.so.1.10
    |   |-- libcrypt-2.2.5.so
    |   |-- libcrypt.so.1 -> libcrypt-2.2.5.so
    |   |-- libdl-2.2.5.so
    |   |-- libdl.so.2 -> libdl-2.2.5.so
    |   |-- libm-2.2.5.so
    |   |-- libm.so.6 -> libm-2.2.5.so
    |   |-- libncurses.so.5 -> libncurses.so.5.2
    |   |-- libncurses.so.5.2
    |   |-- libnsl-2.2.5.so
    |   |-- libnsl.so.1 -> libnsl-2.2.5.so
    |   |-- libnss_compat-2.2.5.so
    |   |-- libnss_compat.so.2 -> libnss_compat-2.2.5.so
    |   |-- libnss_db-2.2.so
    |   |-- libnss_db.so.2 -> libnss_db-2.2.so
    |   |-- libnss_dns-2.2.5.so
    |   |-- libnss_dns.so.2 -> libnss_dns-2.2.5.so
    |   |-- libnss_files-2.2.5.so
    |   |-- libnss_files.so.2 -> libnss_files-2.2.5.so
    |   |-- libnss_hesiod-2.2.5.so
    |   |-- libnss_hesiod.so.2 -> libnss_hesiod-2.2.5.so
    |   |-- libnss_nis-2.2.5.so
    |   |-- libnss_nis.so.2 -> libnss_nis-2.2.5.so
    |   |-- libnss_nisplus-2.2.5.so
    |   |-- libnss_nisplus.so.2 -> libnss_nisplus-2.2.5.so
    |   |-- libpam.so.0 -> libpam.so.0.72
    |   |-- libpam.so.0.72
    |   |-- libpthread-0.9.so
    |   |-- libpthread.so.0 -> libpthread-0.9.so
    |   |-- libresolv-2.2.5.so
    |   |-- libresolv.so.2 -> libresolv-2.2.5.so
    |   |-- librt-2.2.5.so
    |   |-- librt.so.1 -> librt-2.2.5.so
    |   |-- libutil-2.2.5.so
    |   |-- libutil.so.1 -> libutil-2.2.5.so
    |   |-- libwrap.so.0 -> libwrap.so.0.7.6
    |   |-- libwrap.so.0.7.6
    |   `-- security
    |       |-- pam_access.so
    |       |-- pam_chroot.so
    |       |-- pam_deny.so
    |       |-- pam_env.so
    |       |-- pam_filter.so
    |       |-- pam_ftp.so
    |       |-- pam_group.so
    |       |-- pam_issue.so
    |       |-- pam_lastlog.so
    |       |-- pam_limits.so
    |       |-- pam_listfile.so
    |       |-- pam_mail.so
    |       |-- pam_mkhomedir.so
    |       |-- pam_motd.so
    |       |-- pam_nologin.so
    |       |-- pam_permit.so
    |       |-- pam_rhosts_auth.so
    |       |-- pam_rootok.so
    |       |-- pam_securetty.so
    |       |-- pam_shells.so
    |       |-- pam_stress.so
    |       |-- pam_tally.so
    |       |-- pam_time.so
    |       |-- pam_unix.so
    |       |-- pam_unix_acct.so -> pam_unix.so
    |       |-- pam_unix_auth.so -> pam_unix.so
    |       |-- pam_unix_passwd.so -> pam_unix.so
    |       |-- pam_unix_session.so -> pam_unix.so
    |       |-- pam_userdb.so
    |       |-- pam_warn.so
    |       `-- pam_wheel.so
    |-- sbin
    |   `-- start-stop-daemon
    |-- usr
    |   |-- bin
    |   |   |-- dircolors
    |   |   |-- du
    |   |   |-- install
    |   |   |-- link
    |   |   |-- mkfifo
    |   |   |-- shred
    |   |   |-- touch -> /bin/touch
    |   |   `-- unlink
    |   |-- lib
    |   |   |-- libcrypto.so.0.9.6
    |   |   |-- libdb3.so.3 -> libdb3.so.3.0.2
    |   |   |-- libdb3.so.3.0.2
    |   |   |-- libz.so.1 -> libz.so.1.1.4
    |   |   `-- libz.so.1.1.4
    |   |-- sbin
    |   |   `-- sshd
    |   `-- share
    |       |-- locale
    |       |   `-- es
    |       |       |-- LC_MESSAGES
    |       |       |   |-- fileutils.mo
    |       |       |   |-- libc.mo
    |       |       |   `-- sh-utils.mo
    |       |       `-- LC_TIME -> LC_MESSAGES
    |       `-- zoneinfo
    |           `-- Europe
    |               `-- Madrid
    `-- var
        `-- run
            |-- sshd
            `-- sshd.pid
    
    27 directories, 733 files

en: It is possible to create an environment, using a trial-and-error method, by monitoring the <command>sshd</command> server traces and log files in order to determine the necessary files. The following environment, contributed by José Luis Ledesma, is a sample listing of files in a <command>chroot</command> environment for <command>ssh</command> in Debian woody (3.0): <footnote><para> Notice that there are no SETUID files. This makes it more difficult for remote users to escape the <command>chroot</command> environment. However, it also prevents users from changing their passwords, since the <command>passwd</command> program cannot modify the files <filename>/etc/passwd</filename> or <filename>/etc/shadow</filename>. </para></footnote>
pt_BR: É possível criar um ambiente, usando o método de tentativa e erro, seguindo a execução do servidor <command>sshd</command> e arquivos de log para determinar os arquivos necessários. O seguinte ambiente, contribuído por José Luis Ledesma, é uma listagem amostral do arquivos que estão no ambiente <command>chroot</command> para o <command>ssh</command>: <footnote><para>Observe que não existem arquivos SETUID. Isso torna mais difícil para usuários remotos fugir o ambiente <command>chroot</command>. Entretanto, isso também previne que os usuários alterem suas senhas, já que o programa <command>passwd</command> não pode modificar os arquivos <filename>/etc/passwd</filename> ou <filename>/etc/shadow</filename>.</para></footnote>

en: 
    .:
    total 36
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ./
    drwxr-xr-x 11 root root 4096 Jun 3 13:43 ../
    drwxr-xr-x 2 root root 4096 Jun 4 12:13 bin/
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 dev/
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 etc/
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 lib/
    drwxr-xr-x 2 root root 4096 Jun 4 12:35 sbin/
    drwxr-xr-x 2 root root 4096 Jun 4 12:32 tmp/
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 usr/
    ./bin:
    total 8368
    drwxr-xr-x 2 root root 4096 Jun 4 12:13 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rwxr-xr-x 1 root root 109855 Jun 3 13:45 a2p*
    -rwxr-xr-x 1 root root 387764 Jun 3 13:45 bash*
    -rwxr-xr-x 1 root root 36365 Jun 3 13:45 c2ph*
    -rwxr-xr-x 1 root root 20629 Jun 3 13:45 dprofpp*
    -rwxr-xr-x 1 root root 6956 Jun 3 13:46 env*
    -rwxr-xr-x 1 root root 158116 Jun 3 13:45 fax2ps*
    -rwxr-xr-x 1 root root 104008 Jun 3 13:45 faxalter*
    -rwxr-xr-x 1 root root 89340 Jun 3 13:45 faxcover*
    -rwxr-xr-x 1 root root 441584 Jun 3 13:45 faxmail*
    -rwxr-xr-x 1 root root 96036 Jun 3 13:45 faxrm*
    -rwxr-xr-x 1 root root 107000 Jun 3 13:45 faxstat*
    -rwxr-xr-x 1 root root 77832 Jun 4 11:46 grep*
    -rwxr-xr-x 1 root root 19597 Jun 3 13:45 h2ph*
    -rwxr-xr-x 1 root root 46979 Jun 3 13:45 h2xs*
    -rwxr-xr-x 1 root root 10420 Jun 3 13:46 id*
    -rwxr-xr-x 1 root root 4528 Jun 3 13:46 ldd*
    -rwxr-xr-x 1 root root 111386 Jun 4 11:46 less*
    -r-xr-xr-x 1 root root 26168 Jun 3 13:45 login*
    -rwxr-xr-x 1 root root 49164 Jun 3 13:45 ls*
    -rwxr-xr-x 1 root root 11600 Jun 3 13:45 mkdir*
    -rwxr-xr-x 1 root root 24780 Jun 3 13:45 more*
    -rwxr-xr-x 1 root root 154980 Jun 3 13:45 pal2rgb*
    -rwxr-xr-x 1 root root 27920 Jun 3 13:46 passwd*
    -rwxr-xr-x 1 root root 4241 Jun 3 13:45 pl2pm*
    -rwxr-xr-x 1 root root 2350 Jun 3 13:45 pod2html*
    -rwxr-xr-x 1 root root 7875 Jun 3 13:45 pod2latex*
    -rwxr-xr-x 1 root root 17587 Jun 3 13:45 pod2man*
    -rwxr-xr-x 1 root root 6877 Jun 3 13:45 pod2text*
    -rwxr-xr-x 1 root root 3300 Jun 3 13:45 pod2usage*
    -rwxr-xr-x 1 root root 3341 Jun 3 13:45 podchecker*
    -rwxr-xr-x 1 root root 2483 Jun 3 13:45 podselect*
    -r-xr-xr-x 1 root root 82412 Jun 4 11:46 ps*
    -rwxr-xr-x 1 root root 36365 Jun 3 13:45 pstruct*
    -rwxr-xr-x 1 root root 7120 Jun 3 13:45 pwd*
    -rwxr-xr-x 1 root root 179884 Jun 3 13:45 rgb2ycbcr*
    -rwxr-xr-x 1 root root 20532 Jun 3 13:45 rm*
    -rwxr-xr-x 1 root root 6720 Jun 4 10:15 rmdir*
    -rwxr-xr-x 1 root root 14705 Jun 3 13:45 s2p*
    -rwxr-xr-x 1 root root 28764 Jun 3 13:46 scp*
    -rwxr-xr-x 1 root root 385000 Jun 3 13:45 sendfax*
    -rwxr-xr-x 1 root root 67548 Jun 3 13:45 sendpage*
    -rwxr-xr-x 1 root root 88632 Jun 3 13:46 sftp*
    -rwxr-xr-x 1 root root 387764 Jun 3 13:45 sh*
    -rws--x--x 1 root root 744500 Jun 3 13:46 slogin*
    -rwxr-xr-x 1 root root 14523 Jun 3 13:46 splain*
    -rws--x--x 1 root root 744500 Jun 3 13:46 ssh*
    -rwxr-xr-x 1 root root 570960 Jun 3 13:46 ssh-add*
    -rwxr-xr-x 1 root root 502952 Jun 3 13:46 ssh-agent*
    -rwxr-xr-x 1 root root 575740 Jun 3 13:46 ssh-keygen*
    -rwxr-xr-x 1 root root 383480 Jun 3 13:46 ssh-keyscan*
    -rwxr-xr-x 1 root root 39 Jun 3 13:46 ssh_europa*
    -rwxr-xr-x 1 root root 107252 Jun 4 10:14 strace*
    -rwxr-xr-x 1 root root 8323 Jun 4 10:14 strace-graph*
    -rwxr-xr-x 1 root root 158088 Jun 3 13:46 thumbnail*
    -rwxr-xr-x 1 root root 6312 Jun 3 13:46 tty*
    -rwxr-xr-x 1 root root 55904 Jun 4 11:46 useradd*
    -rwxr-xr-x 1 root root 585656 Jun 4 11:47 vi*
    -rwxr-xr-x 1 root root 6444 Jun 4 11:45 whoami*
    ./dev:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    crw-r--r-- 1 root root 1, 9 Jun 3 13:43 urandom
    ./etc:
    total 208
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rw------- 1 root root 0 Jun 4 11:46 .pwd.lock
    -rw-r--r-- 1 root root 653 Jun 3 13:46 group
    -rw-r--r-- 1 root root 242 Jun 4 11:33 host.conf
    -rw-r--r-- 1 root root 857 Jun 4 12:04 hosts
    -rw-r--r-- 1 root root 1050 Jun 4 11:29 ld.so.cache
    -rw-r--r-- 1 root root 304 Jun 4 11:28 ld.so.conf
    -rw-r--r-- 1 root root 235 Jun 4 11:27 ld.so.conf~
    -rw-r--r-- 1 root root 88039 Jun 3 13:46 moduli
    -rw-r--r-- 1 root root 1342 Jun 4 11:34 nsswitch.conf
    drwxr-xr-x 2 root root 4096 Jun 4 12:02 pam.d/
    -rw-r--r-- 1 root root 28 Jun 4 12:00 pam_smb.conf
    -rw-r--r-- 1 root root 2520 Jun 4 11:57 passwd
    -rw-r--r-- 1 root root 7228 Jun 3 13:48 profile
    -rw-r--r-- 1 root root 1339 Jun 4 11:33 protocols
    -rw-r--r-- 1 root root 274 Jun 4 11:44 resolv.conf
    drwxr-xr-x 2 root root 4096 Jun 3 13:43 security/
    -rw-r----- 1 root root 1178 Jun 4 11:51 shadow
    -rw------- 1 root root 80 Jun 4 11:45 shadow-
    -rw-r----- 1 root root 1178 Jun 4 11:48 shadow.old
    -rw-r--r-- 1 root root 161 Jun 3 13:46 shells
    -rw-r--r-- 1 root root 1144 Jun 3 13:46 ssh_config
    -rw------- 1 root root 668 Jun 3 13:46 ssh_host_dsa_key
    -rw-r--r-- 1 root root 602 Jun 3 13:46 ssh_host_dsa_key.pub
    -rw------- 1 root root 527 Jun 3 13:46 ssh_host_key
    -rw-r--r-- 1 root root 331 Jun 3 13:46 ssh_host_key.pub
    -rw------- 1 root root 883 Jun 3 13:46 ssh_host_rsa_key
    -rw-r--r-- 1 root root 222 Jun 3 13:46 ssh_host_rsa_key.pub
    -rw-r--r-- 1 root root 2471 Jun 4 12:15 sshd_config
    ./etc/pam.d:
    total 24
    drwxr-xr-x 2 root root 4096 Jun 4 12:02 ./
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ../
    lrwxrwxrwx 1 root root 4 Jun 4 12:02 other -&gt; sshd
    -rw-r--r-- 1 root root 318 Jun 3 13:46 passwd
    -rw-r--r-- 1 root root 546 Jun 4 11:36 ssh
    -rw-r--r-- 1 root root 479 Jun 4 12:02 sshd
    -rw-r--r-- 1 root root 370 Jun 3 13:46 su
    ./etc/security:
    total 32
    drwxr-xr-x 2 root root 4096 Jun 3 13:43 ./
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ../
    -rw-r--r-- 1 root root 1971 Jun 3 13:46 access.conf
    -rw-r--r-- 1 root root 184 Jun 3 13:46 chroot.conf
    -rw-r--r-- 1 root root 2145 Jun 3 13:46 group.conf
    -rw-r--r-- 1 root root 1356 Jun 3 13:46 limits.conf
    -rw-r--r-- 1 root root 2858 Jun 3 13:46 pam_env.conf
    -rw-r--r-- 1 root root 2154 Jun 3 13:46 time.conf
    ./lib:
    total 8316
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rw-r--r-- 1 root root 1024 Jun 4 11:51 cracklib_dict.hwm
    -rw-r--r-- 1 root root 214324 Jun 4 11:51 cracklib_dict.pwd
    -rw-r--r-- 1 root root 11360 Jun 4 11:51 cracklib_dict.pwi
    -rwxr-xr-x 1 root root 342427 Jun 3 13:46 ld-linux.so.2*
    -rwxr-xr-x 1 root root 4061504 Jun 3 13:46 libc.so.6*
    lrwxrwxrwx 1 root root 15 Jun 4 12:11 libcrack.so -&gt; libcrack.so.2.7*
    lrwxrwxrwx 1 root root 15 Jun 4 12:11 libcrack.so.2 -&gt; libcrack.so.2.7*
    -rwxr-xr-x 1 root root 33291 Jun 4 11:39 libcrack.so.2.7*
    -rwxr-xr-x 1 root root 60988 Jun 3 13:46 libcrypt.so.1*
    -rwxr-xr-x 1 root root 71846 Jun 3 13:46 libdl.so.2*
    -rwxr-xr-x 1 root root 27762 Jun 3 13:46 libhistory.so.4.0*
    lrwxrwxrwx 1 root root 17 Jun 4 12:12 libncurses.so.4 -&gt; libncurses.so.4.2*
    -rwxr-xr-x 1 root root 503903 Jun 3 13:46 libncurses.so.4.2*
    lrwxrwxrwx 1 root root 17 Jun 4 12:12 libncurses.so.5 -&gt; libncurses.so.5.0*
    -rwxr-xr-x 1 root root 549429 Jun 3 13:46 libncurses.so.5.0*
    -rwxr-xr-x 1 root root 369801 Jun 3 13:46 libnsl.so.1*
    -rwxr-xr-x 1 root root 142563 Jun 4 11:49 libnss_compat.so.1*
    -rwxr-xr-x 1 root root 215569 Jun 4 11:49 libnss_compat.so.2*
    -rwxr-xr-x 1 root root 61648 Jun 4 11:34 libnss_dns.so.1*
    -rwxr-xr-x 1 root root 63453 Jun 4 11:34 libnss_dns.so.2*
    -rwxr-xr-x 1 root root 63782 Jun 4 11:34 libnss_dns6.so.2*
    -rwxr-xr-x 1 root root 205715 Jun 3 13:46 libnss_files.so.1*
    -rwxr-xr-x 1 root root 235932 Jun 3 13:49 libnss_files.so.2*
    -rwxr-xr-x 1 root root 204383 Jun 4 11:33 libnss_nis.so.1*
    -rwxr-xr-x 1 root root 254023 Jun 4 11:33 libnss_nis.so.2*
    -rwxr-xr-x 1 root root 256465 Jun 4 11:33 libnss_nisplus.so.2*
    lrwxrwxrwx 1 root root 14 Jun 4 12:12 libpam.so.0 -&gt; libpam.so.0.72*
    -rwxr-xr-x 1 root root 31449 Jun 3 13:46 libpam.so.0.72*
    lrwxrwxrwx 1 root root 19 Jun 4 12:12 libpam_misc.so.0 -&gt;
    libpam_misc.so.0.72*
    -rwxr-xr-x 1 root root 8125 Jun 3 13:46 libpam_misc.so.0.72*
    lrwxrwxrwx 1 root root 15 Jun 4 12:12 libpamc.so.0 -&gt; libpamc.so.0.72*
    -rwxr-xr-x 1 root root 10499 Jun 3 13:46 libpamc.so.0.72*
    -rwxr-xr-x 1 root root 176427 Jun 3 13:46 libreadline.so.4.0*
    -rwxr-xr-x 1 root root 44729 Jun 3 13:46 libutil.so.1*
    -rwxr-xr-x 1 root root 70254 Jun 3 13:46 libz.a*
    lrwxrwxrwx 1 root root 13 Jun 4 12:13 libz.so -&gt; libz.so.1.1.3*
    lrwxrwxrwx 1 root root 13 Jun 4 12:13 libz.so.1 -&gt; libz.so.1.1.3*
    -rwxr-xr-x 1 root root 63312 Jun 3 13:46 libz.so.1.1.3*
    drwxr-xr-x 2 root root 4096 Jun 4 12:00 security/
    ./lib/security:
    total 668
    drwxr-xr-x 2 root root 4096 Jun 4 12:00 ./
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 ../
    -rwxr-xr-x 1 root root 10067 Jun 3 13:46 pam_access.so*
    -rwxr-xr-x 1 root root 8300 Jun 3 13:46 pam_chroot.so*
    -rwxr-xr-x 1 root root 14397 Jun 3 13:46 pam_cracklib.so*
    -rwxr-xr-x 1 root root 5082 Jun 3 13:46 pam_deny.so*
    -rwxr-xr-x 1 root root 13153 Jun 3 13:46 pam_env.so*
    -rwxr-xr-x 1 root root 13371 Jun 3 13:46 pam_filter.so*
    -rwxr-xr-x 1 root root 7957 Jun 3 13:46 pam_ftp.so*
    -rwxr-xr-x 1 root root 12771 Jun 3 13:46 pam_group.so*
    -rwxr-xr-x 1 root root 10174 Jun 3 13:46 pam_issue.so*
    -rwxr-xr-x 1 root root 9774 Jun 3 13:46 pam_lastlog.so*
    -rwxr-xr-x 1 root root 13591 Jun 3 13:46 pam_limits.so*
    -rwxr-xr-x 1 root root 11268 Jun 3 13:46 pam_listfile.so*
    -rwxr-xr-x 1 root root 11182 Jun 3 13:46 pam_mail.so*
    -rwxr-xr-x 1 root root 5923 Jun 3 13:46 pam_nologin.so*
    -rwxr-xr-x 1 root root 5460 Jun 3 13:46 pam_permit.so*
    -rwxr-xr-x 1 root root 18226 Jun 3 13:46 pam_pwcheck.so*
    -rwxr-xr-x 1 root root 12590 Jun 3 13:46 pam_rhosts_auth.so*
    -rwxr-xr-x 1 root root 5551 Jun 3 13:46 pam_rootok.so*
    -rwxr-xr-x 1 root root 7239 Jun 3 13:46 pam_securetty.so*
    -rwxr-xr-x 1 root root 6551 Jun 3 13:46 pam_shells.so*
    -rwxr-xr-x 1 root root 55925 Jun 4 12:00 pam_smb_auth.so*
    -rwxr-xr-x 1 root root 12678 Jun 3 13:46 pam_stress.so*
    -rwxr-xr-x 1 root root 11170 Jun 3 13:46 pam_tally.so*
    -rwxr-xr-x 1 root root 11124 Jun 3 13:46 pam_time.so*
    -rwxr-xr-x 1 root root 45703 Jun 3 13:46 pam_unix.so*
    -rwxr-xr-x 1 root root 45703 Jun 3 13:46 pam_unix2.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_acct.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_auth.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_passwd.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_session.so*
    -rwxr-xr-x 1 root root 9726 Jun 3 13:46 pam_userdb.so*
    -rwxr-xr-x 1 root root 6424 Jun 3 13:46 pam_warn.so*
    -rwxr-xr-x 1 root root 7460 Jun 3 13:46 pam_wheel.so*
    ./sbin:
    total 3132
    drwxr-xr-x 2 root root 4096 Jun 4 12:35 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rwxr-xr-x 1 root root 178256 Jun 3 13:46 choptest*
    -rwxr-xr-x 1 root root 184032 Jun 3 13:46 cqtest*
    -rwxr-xr-x 1 root root 81096 Jun 3 13:46 dialtest*
    -rwxr-xr-x 1 root root 1142128 Jun 4 11:28 ldconfig*
    -rwxr-xr-x 1 root root 2868 Jun 3 13:46 lockname*
    -rwxr-xr-x 1 root root 3340 Jun 3 13:46 ondelay*
    -rwxr-xr-x 1 root root 376796 Jun 3 13:46 pagesend*
    -rwxr-xr-x 1 root root 13950 Jun 3 13:46 probemodem*
    -rwxr-xr-x 1 root root 9234 Jun 3 13:46 recvstats*
    -rwxr-xr-x 1 root root 64480 Jun 3 13:46 sftp-server*
    -rwxr-xr-x 1 root root 744412 Jun 3 13:46 sshd*
    -rwxr-xr-x 1 root root 30750 Jun 4 11:46 su*
    -rwxr-xr-x 1 root root 194632 Jun 3 13:46 tagtest*
    -rwxr-xr-x 1 root root 69892 Jun 3 13:46 tsitest*
    -rwxr-xr-x 1 root root 43792 Jun 3 13:46 typetest*
    ./tmp:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:32 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    ./usr:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    lrwxrwxrwx 1 root root 7 Jun 4 12:14 bin -&gt; ../bin//
    lrwxrwxrwx 1 root root 7 Jun 4 11:33 lib -&gt; ../lib//
    lrwxrwxrwx 1 root root 8 Jun 4 12:13 sbin -&gt; ../sbin//
pt_BR: 
    .:
    total 36
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ./
    drwxr-xr-x 11 root root 4096 Jun 3 13:43 ../
    drwxr-xr-x 2 root root 4096 Jun 4 12:13 bin/
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 dev/
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 etc/
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 lib/
    drwxr-xr-x 2 root root 4096 Jun 4 12:35 sbin/
    drwxr-xr-x 2 root root 4096 Jun 4 12:32 tmp/
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 usr/
    ./bin:
    total 8368
    drwxr-xr-x 2 root root 4096 Jun 4 12:13 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rwxr-xr-x 1 root root 109855 Jun 3 13:45 a2p*
    -rwxr-xr-x 1 root root 387764 Jun 3 13:45 bash*
    -rwxr-xr-x 1 root root 36365 Jun 3 13:45 c2ph*
    -rwxr-xr-x 1 root root 20629 Jun 3 13:45 dprofpp*
    -rwxr-xr-x 1 root root 6956 Jun 3 13:46 env*
    -rwxr-xr-x 1 root root 158116 Jun 3 13:45 fax2ps*
    -rwxr-xr-x 1 root root 104008 Jun 3 13:45 faxalter*
    -rwxr-xr-x 1 root root 89340 Jun 3 13:45 faxcover*
    -rwxr-xr-x 1 root root 441584 Jun 3 13:45 faxmail*
    -rwxr-xr-x 1 root root 96036 Jun 3 13:45 faxrm*
    -rwxr-xr-x 1 root root 107000 Jun 3 13:45 faxstat*
    -rwxr-xr-x 1 root root 77832 Jun 4 11:46 grep*
    -rwxr-xr-x 1 root root 19597 Jun 3 13:45 h2ph*
    -rwxr-xr-x 1 root root 46979 Jun 3 13:45 h2xs*
    -rwxr-xr-x 1 root root 10420 Jun 3 13:46 id*
    -rwxr-xr-x 1 root root 4528 Jun 3 13:46 ldd*
    -rwxr-xr-x 1 root root 111386 Jun 4 11:46 less*
    -r-xr-xr-x 1 root root 26168 Jun 3 13:45 login*
    -rwxr-xr-x 1 root root 49164 Jun 3 13:45 ls*
    -rwxr-xr-x 1 root root 11600 Jun 3 13:45 mkdir*
    -rwxr-xr-x 1 root root 24780 Jun 3 13:45 more*
    -rwxr-xr-x 1 root root 154980 Jun 3 13:45 pal2rgb*
    -rwxr-xr-x 1 root root 27920 Jun 3 13:46 passwd*
    -rwxr-xr-x 1 root root 4241 Jun 3 13:45 pl2pm*
    -rwxr-xr-x 1 root root 2350 Jun 3 13:45 pod2html*
    -rwxr-xr-x 1 root root 7875 Jun 3 13:45 pod2latex*
    -rwxr-xr-x 1 root root 17587 Jun 3 13:45 pod2man*
    -rwxr-xr-x 1 root root 6877 Jun 3 13:45 pod2text*
    -rwxr-xr-x 1 root root 3300 Jun 3 13:45 pod2usage*
    -rwxr-xr-x 1 root root 3341 Jun 3 13:45 podchecker*
    -rwxr-xr-x 1 root root 2483 Jun 3 13:45 podselect*
    -r-xr-xr-x 1 root root 82412 Jun 4 11:46 ps*
    -rwxr-xr-x 1 root root 36365 Jun 3 13:45 pstruct*
    -rwxr-xr-x 1 root root 7120 Jun 3 13:45 pwd*
    -rwxr-xr-x 1 root root 179884 Jun 3 13:45 rgb2ycbcr*
    -rwxr-xr-x 1 root root 20532 Jun 3 13:45 rm*
    -rwxr-xr-x 1 root root 6720 Jun 4 10:15 rmdir*
    -rwxr-xr-x 1 root root 14705 Jun 3 13:45 s2p*
    -rwxr-xr-x 1 root root 28764 Jun 3 13:46 scp*
    -rwxr-xr-x 1 root root 385000 Jun 3 13:45 sendfax*
    -rwxr-xr-x 1 root root 67548 Jun 3 13:45 sendpage*
    -rwxr-xr-x 1 root root 88632 Jun 3 13:46 sftp*
    -rwxr-xr-x 1 root root 387764 Jun 3 13:45 sh*
    -rws--x--x 1 root root 744500 Jun 3 13:46 slogin*
    -rwxr-xr-x 1 root root 14523 Jun 3 13:46 splain*
    -rws--x--x 1 root root 744500 Jun 3 13:46 ssh*
    -rwxr-xr-x 1 root root 570960 Jun 3 13:46 ssh-add*
    -rwxr-xr-x 1 root root 502952 Jun 3 13:46 ssh-agent*
    -rwxr-xr-x 1 root root 575740 Jun 3 13:46 ssh-keygen*
    -rwxr-xr-x 1 root root 383480 Jun 3 13:46 ssh-keyscan*
    -rwxr-xr-x 1 root root 39 Jun 3 13:46 ssh_europa*
    -rwxr-xr-x 1 root root 107252 Jun 4 10:14 strace*
    -rwxr-xr-x 1 root root 8323 Jun 4 10:14 strace-graph*
    -rwxr-xr-x 1 root root 158088 Jun 3 13:46 thumbnail*
    -rwxr-xr-x 1 root root 6312 Jun 3 13:46 tty*
    -rwxr-xr-x 1 root root 55904 Jun 4 11:46 useradd*
    -rwxr-xr-x 1 root root 585656 Jun 4 11:47 vi*
    -rwxr-xr-x 1 root root 6444 Jun 4 11:45 whoami*
    ./dev:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    crw-r--r-- 1 root root 1, 9 Jun 3 13:43 urandom
    ./etc:
    total 208
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rw------- 1 root root 0 Jun 4 11:46 .pwd.lock
    -rw-r--r-- 1 root root 653 Jun 3 13:46 group
    -rw-r--r-- 1 root root 242 Jun 4 11:33 host.conf
    -rw-r--r-- 1 root root 857 Jun 4 12:04 hosts
    -rw-r--r-- 1 root root 1050 Jun 4 11:29 ld.so.cache
    -rw-r--r-- 1 root root 304 Jun 4 11:28 ld.so.conf
    -rw-r--r-- 1 root root 235 Jun 4 11:27 ld.so.conf~
    -rw-r--r-- 1 root root 88039 Jun 3 13:46 moduli
    -rw-r--r-- 1 root root 1342 Jun 4 11:34 nsswitch.conf
    drwxr-xr-x 2 root root 4096 Jun 4 12:02 pam.d/
    -rw-r--r-- 1 root root 28 Jun 4 12:00 pam_smb.conf
    -rw-r--r-- 1 root root 2520 Jun 4 11:57 passwd
    -rw-r--r-- 1 root root 7228 Jun 3 13:48 profile
    -rw-r--r-- 1 root root 1339 Jun 4 11:33 protocols
    -rw-r--r-- 1 root root 274 Jun 4 11:44 resolv.conf
    drwxr-xr-x 2 root root 4096 Jun 3 13:43 security/
    -rw-r----- 1 root root 1178 Jun 4 11:51 shadow
    -rw------- 1 root root 80 Jun 4 11:45 shadow-
    -rw-r----- 1 root root 1178 Jun 4 11:48 shadow.old
    -rw-r--r-- 1 root root 161 Jun 3 13:46 shells
    -rw-r--r-- 1 root root 1144 Jun 3 13:46 ssh_config
    -rw------- 1 root root 668 Jun 3 13:46 ssh_host_dsa_key
    -rw-r--r-- 1 root root 602 Jun 3 13:46 ssh_host_dsa_key.pub
    -rw------- 1 root root 527 Jun 3 13:46 ssh_host_key
    -rw-r--r-- 1 root root 331 Jun 3 13:46 ssh_host_key.pub
    -rw------- 1 root root 883 Jun 3 13:46 ssh_host_rsa_key
    -rw-r--r-- 1 root root 222 Jun 3 13:46 ssh_host_rsa_key.pub
    -rw-r--r-- 1 root root 2471 Jun 4 12:15 sshd_config
    ./etc/pam.d:
    total 24
    drwxr-xr-x 2 root root 4096 Jun 4 12:02 ./
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ../
    lrwxrwxrwx 1 root root 4 Jun 4 12:02 other -> sshd
    -rw-r--r-- 1 root root 318 Jun 3 13:46 passwd
    -rw-r--r-- 1 root root 546 Jun 4 11:36 ssh
    -rw-r--r-- 1 root root 479 Jun 4 12:02 sshd
    -rw-r--r-- 1 root root 370 Jun 3 13:46 su
    ./etc/security:
    total 32
    drwxr-xr-x 2 root root 4096 Jun 3 13:43 ./
    drwxr-xr-x 4 root root 4096 Jun 4 12:35 ../
    -rw-r--r-- 1 root root 1971 Jun 3 13:46 access.conf
    -rw-r--r-- 1 root root 184 Jun 3 13:46 chroot.conf
    -rw-r--r-- 1 root root 2145 Jun 3 13:46 group.conf
    -rw-r--r-- 1 root root 1356 Jun 3 13:46 limits.conf
    -rw-r--r-- 1 root root 2858 Jun 3 13:46 pam_env.conf
    -rw-r--r-- 1 root root 2154 Jun 3 13:46 time.conf
    ./lib:
    total 8316
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rw-r--r-- 1 root root 1024 Jun 4 11:51 cracklib_dict.hwm
    -rw-r--r-- 1 root root 214324 Jun 4 11:51 cracklib_dict.pwd
    -rw-r--r-- 1 root root 11360 Jun 4 11:51 cracklib_dict.pwi
    -rwxr-xr-x 1 root root 342427 Jun 3 13:46 ld-linux.so.2*
    -rwxr-xr-x 1 root root 4061504 Jun 3 13:46 libc.so.6*
    lrwxrwxrwx 1 root root 15 Jun 4 12:11 libcrack.so -> libcrack.so.2.7*
    lrwxrwxrwx 1 root root 15 Jun 4 12:11 libcrack.so.2 -> libcrack.so.2.7*
    -rwxr-xr-x 1 root root 33291 Jun 4 11:39 libcrack.so.2.7*
    -rwxr-xr-x 1 root root 60988 Jun 3 13:46 libcrypt.so.1*
    -rwxr-xr-x 1 root root 71846 Jun 3 13:46 libdl.so.2*
    -rwxr-xr-x 1 root root 27762 Jun 3 13:46 libhistory.so.4.0*
    lrwxrwxrwx 1 root root 17 Jun 4 12:12 libncurses.so.4 -> libncurses.so.4.2*
    -rwxr-xr-x 1 root root 503903 Jun 3 13:46 libncurses.so.4.2*
    lrwxrwxrwx 1 root root 17 Jun 4 12:12 libncurses.so.5 -> libncurses.so.5.0*
    -rwxr-xr-x 1 root root 549429 Jun 3 13:46 libncurses.so.5.0*
    -rwxr-xr-x 1 root root 369801 Jun 3 13:46 libnsl.so.1*
    -rwxr-xr-x 1 root root 142563 Jun 4 11:49 libnss_compat.so.1*
    -rwxr-xr-x 1 root root 215569 Jun 4 11:49 libnss_compat.so.2*
    -rwxr-xr-x 1 root root 61648 Jun 4 11:34 libnss_dns.so.1*
    -rwxr-xr-x 1 root root 63453 Jun 4 11:34 libnss_dns.so.2*
    -rwxr-xr-x 1 root root 63782 Jun 4 11:34 libnss_dns6.so.2*
    -rwxr-xr-x 1 root root 205715 Jun 3 13:46 libnss_files.so.1*
    -rwxr-xr-x 1 root root 235932 Jun 3 13:49 libnss_files.so.2*
    -rwxr-xr-x 1 root root 204383 Jun 4 11:33 libnss_nis.so.1*
    -rwxr-xr-x 1 root root 254023 Jun 4 11:33 libnss_nis.so.2*
    -rwxr-xr-x 1 root root 256465 Jun 4 11:33 libnss_nisplus.so.2*
    lrwxrwxrwx 1 root root 14 Jun 4 12:12 libpam.so.0 -> libpam.so.0.72*
    -rwxr-xr-x 1 root root 31449 Jun 3 13:46 libpam.so.0.72*
    lrwxrwxrwx 1 root root 19 Jun 4 12:12 libpam_misc.so.0 ->
    libpam_misc.so.0.72*
    -rwxr-xr-x 1 root root 8125 Jun 3 13:46 libpam_misc.so.0.72*
    lrwxrwxrwx 1 root root 15 Jun 4 12:12 libpamc.so.0 -> libpamc.so.0.72*
    -rwxr-xr-x 1 root root 10499 Jun 3 13:46 libpamc.so.0.72*
    -rwxr-xr-x 1 root root 176427 Jun 3 13:46 libreadline.so.4.0*
    -rwxr-xr-x 1 root root 44729 Jun 3 13:46 libutil.so.1*
    -rwxr-xr-x 1 root root 70254 Jun 3 13:46 libz.a*
    lrwxrwxrwx 1 root root 13 Jun 4 12:13 libz.so -> libz.so.1.1.3*
    lrwxrwxrwx 1 root root 13 Jun 4 12:13 libz.so.1 -> libz.so.1.1.3*
    -rwxr-xr-x 1 root root 63312 Jun 3 13:46 libz.so.1.1.3*
    drwxr-xr-x 2 root root 4096 Jun 4 12:00 security/
    ./lib/security:
    total 668
    drwxr-xr-x 2 root root 4096 Jun 4 12:00 ./
    drwxr-xr-x 3 root root 4096 Jun 4 12:13 ../
    -rwxr-xr-x 1 root root 10067 Jun 3 13:46 pam_access.so*
    -rwxr-xr-x 1 root root 8300 Jun 3 13:46 pam_chroot.so*
    -rwxr-xr-x 1 root root 14397 Jun 3 13:46 pam_cracklib.so*
    -rwxr-xr-x 1 root root 5082 Jun 3 13:46 pam_deny.so*
    -rwxr-xr-x 1 root root 13153 Jun 3 13:46 pam_env.so*
    -rwxr-xr-x 1 root root 13371 Jun 3 13:46 pam_filter.so*
    -rwxr-xr-x 1 root root 7957 Jun 3 13:46 pam_ftp.so*
    -rwxr-xr-x 1 root root 12771 Jun 3 13:46 pam_group.so*
    -rwxr-xr-x 1 root root 10174 Jun 3 13:46 pam_issue.so*
    -rwxr-xr-x 1 root root 9774 Jun 3 13:46 pam_lastlog.so*
    -rwxr-xr-x 1 root root 13591 Jun 3 13:46 pam_limits.so*
    -rwxr-xr-x 1 root root 11268 Jun 3 13:46 pam_listfile.so*
    -rwxr-xr-x 1 root root 11182 Jun 3 13:46 pam_mail.so*
    -rwxr-xr-x 1 root root 5923 Jun 3 13:46 pam_nologin.so*
    -rwxr-xr-x 1 root root 5460 Jun 3 13:46 pam_permit.so*
    -rwxr-xr-x 1 root root 18226 Jun 3 13:46 pam_pwcheck.so*
    -rwxr-xr-x 1 root root 12590 Jun 3 13:46 pam_rhosts_auth.so*
    -rwxr-xr-x 1 root root 5551 Jun 3 13:46 pam_rootok.so*
    -rwxr-xr-x 1 root root 7239 Jun 3 13:46 pam_securetty.so*
    -rwxr-xr-x 1 root root 6551 Jun 3 13:46 pam_shells.so*
    -rwxr-xr-x 1 root root 55925 Jun 4 12:00 pam_smb_auth.so*
    -rwxr-xr-x 1 root root 12678 Jun 3 13:46 pam_stress.so*
    -rwxr-xr-x 1 root root 11170 Jun 3 13:46 pam_tally.so*
    -rwxr-xr-x 1 root root 11124 Jun 3 13:46 pam_time.so*
    -rwxr-xr-x 1 root root 45703 Jun 3 13:46 pam_unix.so*
    -rwxr-xr-x 1 root root 45703 Jun 3 13:46 pam_unix2.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_acct.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_auth.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_passwd.so*
    -rwxr-xr-x 1 root root 45386 Jun 3 13:46 pam_unix_session.so*
    -rwxr-xr-x 1 root root 9726 Jun 3 13:46 pam_userdb.so*
    -rwxr-xr-x 1 root root 6424 Jun 3 13:46 pam_warn.so*
    -rwxr-xr-x 1 root root 7460 Jun 3 13:46 pam_wheel.so*
    ./sbin:
    total 3132
    drwxr-xr-x 2 root root 4096 Jun 4 12:35 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    -rwxr-xr-x 1 root root 178256 Jun 3 13:46 choptest*
    -rwxr-xr-x 1 root root 184032 Jun 3 13:46 cqtest*
    -rwxr-xr-x 1 root root 81096 Jun 3 13:46 dialtest*
    -rwxr-xr-x 1 root root 1142128 Jun 4 11:28 ldconfig*
    -rwxr-xr-x 1 root root 2868 Jun 3 13:46 lockname*
    -rwxr-xr-x 1 root root 3340 Jun 3 13:46 ondelay*
    -rwxr-xr-x 1 root root 376796 Jun 3 13:46 pagesend*
    -rwxr-xr-x 1 root root 13950 Jun 3 13:46 probemodem*
    -rwxr-xr-x 1 root root 9234 Jun 3 13:46 recvstats*
    -rwxr-xr-x 1 root root 64480 Jun 3 13:46 sftp-server*
    -rwxr-xr-x 1 root root 744412 Jun 3 13:46 sshd*
    -rwxr-xr-x 1 root root 30750 Jun 4 11:46 su*
    -rwxr-xr-x 1 root root 194632 Jun 3 13:46 tagtest*
    -rwxr-xr-x 1 root root 69892 Jun 3 13:46 tsitest*
    -rwxr-xr-x 1 root root 43792 Jun 3 13:46 typetest*
    ./tmp:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:32 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    ./usr:
    total 8
    drwxr-xr-x 2 root root 4096 Jun 4 12:16 ./
    drwxr-xr-x 9 root root 4096 Jun 5 10:05 ../
    lrwxrwxrwx 1 root root 7 Jun 4 12:14 bin -> ../bin//
    lrwxrwxrwx 1 root root 7 Jun 4 11:33 lib -> ../lib//
    lrwxrwxrwx 1 root root 8 Jun 4 12:13 sbin -> ../sbin//

en: Introduction
pt_BR: Introduçao

en: The <command>chroot</command> utility is often used to jail a daemon in a restricted tree. You can use it to insulate services from one another, so that security issues in a software package do not jeopardize the whole server. When using the <command>makejail</command> script, setting up and updating the chrooted tree is much easier.
pt_BR: O utilitário <command>chroot</command> é muitas vezes usado para enjaular um daemon dentro de uma estrutura restrita. Voce pode usá-lo para isolar um serviço do outro, desta forma um problema de segurança em um pacote de software específico não interfere em todo o servidor. A utilização do script <command>makejail</command> torna a configuração e atualização da árvore enjaulada muito mais fácil.

en: FIXME: Apache can also be chrooted using <ulink url="http://www.modsecurity.org" /> which is available in <package>libapache-mod-security</package> (for Apache 1.x) and <package>libapache2-mod-security</package> (for Apache 2.x).
pt_BR: FIXME: Apache também pode ser enjaulado usando <ulink url="http://www.modsecurity.org" /> que está disponível em <package>libapache-mod-security</package> (para Apache 1.x) e <package>libapache2-mod-security</package> (para Apache 2.x).

en: Licensing
pt_BR: Licença

en: Installing the server
pt_BR: Instalando o servidor

en: This procedure was tested on Debian GNU/Linux 3.0 (Woody) with <command>makejail</command> 0.0.4-1 (in Debian/testing).
pt_BR: Este procedimento foi testado no Debian GNU/Linux&nbsp;3.0 (Woody) com <command>makejail</command> 0.0.4-1 (em Debian/testing).

en: Log in as <command>root</command> and create a new jail directory:
pt_BR: Efetue o login como <command>root</command> e crie um novo diretório para jaula:

en: Create a new user and a new group. The chrooted Apache server will run as this user/group, which isn't used for anything else on the system. In this example, both user and group are called <command>chrapach</command>.
pt_BR: Crie um novo usuário e novo grupo. O servidor Apache enjaulado irá executar com este usuário/grupo, que não é utilizado para mais nada no sistema. Neste exemplo, ambos usuário e grupo são chamados de <command>chrapach</command>.

en: FIXME: is a new user needed? (Apache already runs as the apache user)
pt_BR: FIXME: é preciso um novo usuário? (Apache já executa como usuário apache)

en: Install Apache as usual on Debian: <literal>apt-get install apache</literal>
pt_BR: Instale o Apache normalmente no Debian: <literal>apt-get install apache</literal>

en: Set up Apache (e.g. define your subdomains, etc.). In the <filename>/etc/apache/httpd.conf</filename> configuration file, set the <emphasis>Group</emphasis> and <emphasis>User</emphasis> options to <literal>chrapach</literal>. Restart Apache and make sure the server is working correctly. Now, stop the Apache daemon.
pt_BR: Configure o Apache (por exemplo defina seus subdomínios e etc.). No arquivo de configuração <filename>/etc/apache/httpd.conf</filename>, altere as opções <emphasis>Group</emphasis> e <emphasis>User</emphasis> para <literal>chrapach</literal>. Reinicie o Apache e tenha certeza que o servidor está funcionando corretamente. Agora, pare o daemon do Apache.

en: Install <command>makejail</command> (available in Debian/testing for now). You should also install <command>wget</command> and <command>lynx</command> as they will be used by <command>makejail</command> to test the chrooted server: <literal>apt-get install makejail wget lynx</literal>
pt_BR: Instale o <command>makejail</command> (disponível agora no Debian/testing). Você também deve instalar <command>wget</command> e <command>lynx</command>, pois eles serão usados pelo <command>makejail</command> para testar o servidor enjaulado: <literal>apt-get install makejail wget lynx</literal>

en: Copy the sample configuration file for Apache to the <filename>/etc/makejail</filename> directory:
pt_BR: Copie o arquivo de configuração de exemplo para o Apache para o diretório <filename>/etc/makejail</filename>:

en: <emphasis>FIXME:</emphasis> some options do not seem to work properly. For instance, <filename>/etc/shadow</filename> and <filename>/etc/gshadow</filename> are not copied, whereas <filename>/etc/password</filename> and <filename>/etc/group</filename> are fully copied instead of being filtered.
pt_BR: <emphasis>FIXME:</emphasis> algumas opções parecem não funcionar corretamente. Por exemplo, <filename>/etc/shadow</filename> e <filename>/etc/gshadow</filename> não são copiados, visto que <filename>/etc/password</filename> e <filename>/etc/group</filename> são copiados em vez de serem filtrados.

en: Create the chroot tree: <literal>makejail /etc/makejail/apache.py</literal>
pt_BR: Crie a árvore da jaula: <literal>makejail /etc/makejail/apache.py</literal>

en: If <filename>/etc/password</filename> and <filename>/etc/group</filename> were fully copied, type:
pt_BR: Se <filename>/etc/password</filename> e <filename>/etc/group</filename> forem copiados completamente, digite:

en: to replace them with filtered copies.
pt_BR: para substituí-los com as cópias filtradas.

en: Copy the Web site pages and the logs into the jail. These files are not copied automatically (see the <emphasis>preserve</emphasis> option in <command>makejail</command>'s configuration file).
pt_BR: Copie as páginas e os logs do site Web dentro da jaula. Estes arquivos não são copiados automaticamente (veja a opção <emphasis>preserve</emphasis> no arquivo de configuração do <command>makejail</command>).

en: Edit the startup script for the system logging daemon so that it also listen to the <filename>/var/chroot/apache/dev/log</filename> socket. In <filename>/etc/default/syslogd</filename>, replace: <literal>SYSLOGD=""</literal> with <literal>SYSLOGD=" -a /var/chroot/apache/dev/log"</literal> and restart the daemon (<literal>/etc/init.d/sysklogd restart</literal>).
pt_BR: Edite o script de inicialização para que o daemon de logging do sistema também ouça do socket <filename>/var/chroot/apache/dev/log</filename>. No arquivo <filename>/etc/init.d/sysklogd</filename>, substitua: <literal>SYSLOGD=&quot;&quot;</literal> com <literal>SYSLOGD=&quot; -a /var/chroot/apache/dev/log&quot;</literal> e reinicie o daemon (<literal>/etc/init.d/sysklogd restart</literal>).

en: Edit the Apache startup script (<filename>/etc/init.d/apache</filename>). You might need to make some changes to the default startup script for it to run properly with a chrooted tree. Such as:
pt_BR: Edite o script de inicialização do Apache (<filename>/etc/init.d/apache</filename>). Você pode precisar fazer algumas alterações no script de inicialização padrão para que ele funcione apropriadamente com a árvore enjaulada. Como:

en: set a new <emphasis>CHRDIR</emphasis> variable at the top of the file;
pt_BR: configure uma nova variável <emphasis>CHRDIR</emphasis> no início do arquivo;

en: edit the <emphasis>start</emphasis>, <emphasis>stop</emphasis>, <emphasis>reload</emphasis>, etc. sections;
pt_BR: edite as seções <emphasis>start</emphasis>, <emphasis>stop</emphasis>, <emphasis>reload</emphasis>, etc.;

en: add a line to mount and unmount the <filename>/proc</filename> filesystem within the jail.
pt_BR: adicione uma linha para montar e desmontar o sistema de arquivo <filename>/proc</filename> que está dentro da jaula.

en: 
    #! /bin/bash
    #
    # apache        Start the apache HTTP server.
    #
    
    CHRDIR=/var/chroot/apache
    
    NAME=apache
    PATH=/bin:/usr/bin:/sbin:/usr/sbin
    DAEMON=/usr/sbin/apache
    SUEXEC=/usr/lib/apache/suexec
    PIDFILE=/var/run/$NAME.pid
    CONF=/etc/apache/httpd.conf
    APACHECTL=/usr/sbin/apachectl 
    
    trap "" 1
    export LANG=C
    export PATH
    
    test -f $DAEMON || exit 0
    test -f $APACHECTL || exit 0
    
    # ensure we don't leak environment vars into apachectl
    APACHECTL="env -i LANG=${LANG} PATH=${PATH} chroot $CHRDIR $APACHECTL"
    
    if egrep -q -i "^[[:space:]]*ServerType[[:space:]]+inet" $CONF
    then
        exit 0
    fi
    
    case "$1" in
      start)
        echo -n "Starting web server: $NAME"
        mount -t proc proc /var/chroot/apache/proc
        start-stop-daemon --start --pidfile $PIDFILE --exec $DAEMON \
          --chroot $CHRDIR
        ;;
    
      stop)
        echo -n "Stopping web server: $NAME"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" --oknodo
        umount /var/chroot/apache/proc
        ;;
    
      reload)
        echo -n "Reloading $NAME configuration"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" \
          --signal USR1 --startas $DAEMON --chroot $CHRDIR
        ;;
    
      reload-modules)
        echo -n "Reloading $NAME modules"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" --oknodo \
          --retry 30
        start-stop-daemon --start --pidfile $PIDFILE \
          --exec $DAEMON --chroot $CHRDIR
        ;;
    
      restart)
        $0 reload-modules
        exit $?
        ;;
    
      force-reload)
        $0 reload-modules
        exit $?
        ;;
    
      *)
        echo "Usage: /etc/init.d/$NAME {start|stop|reload|reload-modules|force-reload|restart}"
        exit 1
        ;;
    esac
    
    if [ $? == 0 ]; then
      echo .
      exit 0
    else
      echo failed
      exit 1
    fi
pt_BR: 
    #! /bin/bash
    #
    # apache	Start the apache HTTP server.
    #
    
    CHRDIR=/var/chroot/apache
    
    NAME=apache
    PATH=/bin:/usr/bin:/sbin:/usr/sbin
    DAEMON=/usr/sbin/apache
    SUEXEC=/usr/lib/apache/suexec
    PIDFILE=/var/run/$NAME.pid
    CONF=/etc/apache/httpd.conf
    APACHECTL=/usr/sbin/apachectl 
    
    trap "" 1
    export LANG=C
    export PATH
    
    test -f $DAEMON || exit 0
    test -f $APACHECTL || exit 0
    
    # ensure we don't leak environment vars into apachectl
    APACHECTL="env -i LANG=${LANG} PATH=${PATH} chroot $CHRDIR $APACHECTL"
    
    if egrep -q -i "^[[:space:]]*ServerType[[:space:]]+inet" $CONF
    then
        exit 0
    fi
    
    case "$1" in
      start)
        echo -n "Starting web server: $NAME"
        mount -t proc proc /var/chroot/apache/proc
        start-stop-daemon --start --pidfile $PIDFILE --exec $DAEMON \
    	--chroot $CHRDIR
        ;;
    
      stop)
        echo -n "Stopping web server: $NAME"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" --oknodo
        umount /var/chroot/apache/proc
        ;;
    
      reload)
        echo -n "Reloading $NAME configuration"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" \
    	--signal USR1 --startas $DAEMON --chroot $CHRDIR
        ;;
    
      reload-modules)
        echo -n "Reloading $NAME modules"
        start-stop-daemon --stop --pidfile "$CHRDIR/$PIDFILE" --oknodo \
    	--retry 30
        start-stop-daemon --start --pidfile $PIDFILE \
    	--exec $DAEMON --chroot $CHRDIR
        ;;
    
      restart)
        $0 reload-modules
        exit $?
        ;;
    
      force-reload)
        $0 reload-modules
        exit $?
        ;;
    
      *)
        echo "Usage: /etc/init.d/$NAME {start|stop|reload|reload-modules|force-reload|restart}"
        exit 1
        ;;
    esac
    
    if [ $? == 0 ]; then
    	echo .
    	exit 0
    else
    	echo failed
    	exit 1
    fi

en: Replace in <filename>/etc/logrotate.d/apache</filename> <literal>/var/log/apache/*.log</literal> with <literal>/var/chroot/apache/var/log/apache/*.log</literal>
pt_BR: Substitua no <filename>/etc/logrotate.d/apache</filename> o <literal>/var/log/apache/*.log</literal> com <literal>/var/chroot/apache/var/log/apache/*.log</literal>

en: Start Apache (<command>/etc/init.d/apache start</command>) and check what is it reported in the jail log (<filename>/var/chroot/apache/var/log/apache/error.log</filename>). If your setup is more complex, (e.g. if you also use PHP and MySQL), files will probably be missing. if some files are not copied automatically by <command>makejail</command>, you can list them in the <emphasis>forceCopy</emphasis> (to copy files directly) or <emphasis>packages</emphasis> (to copy full packages and their dependencies) option the <filename>/etc/makejail/apache.py</filename> configuration file.
pt_BR: Inicialize o Apache (<command>/etc/init.d/apache start</command>) e verifique o que está sendo reportado no log da jaula (<filename>/var/chroot/apache/var/log/apache/error.log</filename>). Se a sua configuração for mais complexa (exemplo: se também utiliza PHP e MySQL), alguns arquivos provavelmente estarão faltando. Se estes arquivos não são copiados automaticamente pelo <command>makejail</command>, você pode listá-los com a opção <emphasis>forceCopy</emphasis> (para copiar os arquivos diretamente) ou <emphasis>packages</emphasis> (para copiar pacotes completos e suas dependências) no arquivo de configuração <filename>/etc/makejail/apache.py</filename>.

en: Type <literal>ps aux | grep apache</literal> to make sure Apache is running. You should see something like:
pt_BR: Digite <literal>ps aux | grep apache</literal> para ter certeza que o Apache está rodando. Você deve ver algo do tipo:

en: Make sure the Apache processes are running chrooted by looking in the <filename>/proc</filename> filesystem: <literal>ls -la /proc/<varname>process_number</varname>/root/.</literal> where <varname>process_number</varname> is one of the PID numbers listed above (2nd column; 189 for instance). The entries for a restricted tree should be listed:
pt_BR: Certifique-se que os processos do Apache estão sendo executados na jaula chroot procurando no sistema de arquivo <filename>/proc</filename>: <literal>ls -la /proc/process_number/root/.</literal> onde <emphasis>process_number</emphasis> é um dos PID listados acima (por exemplo: segunda coluna; PID 189). As entradas para a árvore restrita devem ser listadas:

en: To automate this test, you can type:<literal>ls -la /proc/`cat /var/chroot/apache/var/run/apache.pid`/root/.</literal>
pt_BR: Para automatizar este teste, você pode digitar:<literal>ls -la /proc/`cat /var/chroot/apache/var/run/apache.pid`/root/.</literal>

en: The reason I like this is because setting up the jail is not very difficult and the server can be updated in just two lines:
pt_BR: A razão pela qual eu gosto disso é que a configuração da jaula não é tão complicada e o servidor pode ser atualizado em somente duas linhas:

en: See also
pt_BR: Veja também
