harden-doc 3.19 - en to zh_CN translation catalogue (42 entries)

en: Before and during the installation
zh_CN: 安装前和安装过程中

en: Choose a BIOS password
zh_CN: 选择一个 BIOS 密码

en: Disabling booting unless a password is supplied is even better. This can be very effective if you run a server, because it is not rebooted very often. The downside to this tactic is that rebooting requires human intervention which can cause problems if the machine is not easily accessible.
zh_CN: 没有密码就无法引导相对要好一点. 如果您运行的是一个服务器, 这将非常有效, 因为不需要经常重起. 在此情况下, 重起时需要人工干预, 如果机器不是很容易接触, 则可能变得很不方便.

en: Note: many BIOSes have well known default master passwords, and applications also exist to retrieve the passwords from the BIOS. Corollary: don't depend on this measure to secure console access to system.
zh_CN: 注: 很多 BIOS 都有广为人知的默认密码, 并且有些程序还可以从 BIOS 中获取密码. 推论: 不要依靠这种方法来保证控制台访问的安全.

en: Partitioning the system
zh_CN: 系统分区

en: Choose an intelligent partition scheme
zh_CN: 选择明智的分区方案

en: An intelligent partition scheme depends on how the machine is used. A good rule of thumb is to be fairly liberal with your partitions and to pay attention to the following factors:
zh_CN: 一份明智的分区方案依赖于机器的用途. 合理使用分区是一条不错的经验, 并注意一下因素:

en: Any partition which can fluctuate, e.g. <filename>/var</filename> (especially <filename>/var/log</filename>) should also be on a separate partition. On a Debian system, you should create <filename>/var</filename> a little bit bigger than on other systems, because downloaded packages (the apt cache) are stored in <filename>/var/cache/apt/archives</filename>.
zh_CN: 变化较大的分区, <filename>/var</filename> (特别是 <filename>/var/log</filename>)/var 应该放在一个独立的分区上. 在 Debian 系统中, 您创建的 <filename>/var</filename> 应当比在其它系统中稍大一点, 因为下载的软件包( apt 缓存) 存放于 <filename>/var/cache/apt/archives</filename> 目录下.

en: Any partition where you want to install non-distribution software should be on a separate partition. According to the File Hierarchy Standard, this is <filename>/opt</filename> or <filename>/usr/local</filename>. If these are separate partitions, they will not be erased if you (have to) reinstall Debian itself.
zh_CN: 您打算安装 non-distribution 软件的任何分区都应是是独立的. 根据文件层次标准, 应当是 <filename>/opt</filename> 或 <filename>/usr/local</filename> 目录. 如果这些在独立分区上, (必须)重装 Debian 系统时将不会被删除.

en: From a security point of view, it makes sense to try to move static data to its own partition, and then mount that partition read-only. Better yet, put the data on read-only media. See below for more details.
zh_CN: 从安全的角度考虑, 应当将静态数据放在独立的分区上, 并将此分区以只读的方式挂载. 将这些数据存放在只读介质上会更好. 后边会详细讲解.

en: Also, for partitions in which you cannot be sure of the needed space, installing Logical Volume Manager (<application>lvm-common</application> and the needed binaries for your kernel, this might be either <application>lvm10</application>, <application>lvm6</application>, or <application>lvm5</application>). Using <literal>lvm</literal>, you can create volume groups that expand multiple physical volumes.
zh_CN: 某些情况下您可能无法确定是否需要独立的分区, 可以安装逻辑卷管理器(Logical Volume Manager) (<application>lvm-common</application> 和您的内核所需的二进制程序, 可能是 <application>lvm10</application>, <application>lvm6</application>, 或 <application>lvm5</application>), 使用 <literal>lvm</literal> 可以创造扩展多物理容量的卷组.

en: Selecting the appropriate file systems
zh_CN: 选择合适的文件系统

en: for laptops in all the file systems installed. That way if you run out of battery unexpectedly or the system freezes due to a hardware issue (such as X configuration which is somewhat common) you will be less likely to lose data during a hardware reboot.
zh_CN: 为膝上电脑安装任何文件系统. 在意外的电池耗尽或因为硬件问题(如一般的 X 配置问题) 引起系统锁死, 重起后可能丢失数据.

en: for production systems which store large amounts of data (like mail servers, ftp servers, network file systems...) it is recommended on these partitions. That way, in the event of a system crash, the server will take less time to recover and check the file systems, and data loss will be less likely.
zh_CN: 对于存放大量数据的系统来说(象邮件服务器, ftp服务器, 网络文件系统...)推荐使用这些分区格式. 这样, 系统出现故障的时候, 系统用于恢复和检查文件系统的时间就会大大缩短, 同时数据丢失的可能也会降低.

en: In any case, data integrity might be better under <literal>ext3</literal> since it does file-data journalling while others do only meta-data journalling, see <ulink url="http://lwn.net/2001/0802/a/ext3-modes.php3" />.
zh_CN: 无论怎样, 在 <literal>ext3</literal> 下数据完整性也许更好，因为它是真正的文件-数据记录, 而其它的仅仅是元-数据记录, 参见 <ulink url="http://lwn.net/2001/0802/a/ext3-modes.php3" />.

en: Do not plug to the Internet until ready
zh_CN: 准备好前不要连入互联网

en: The system should not be immediately connected to the Internet during installation. This could sound stupid but network installation is a common method. Since the system will install and activate services immediately, if the system is connected to the Internet and the services are not properly configured you are opening it to attack.
zh_CN: 系统在安装过程中不应该被连入互联网. 这听起来很蠢, 因为网络安装是最常用的方法. 系统安装后服务马上被激活, 如果系统连入互联网但服务没有被正确配置，那么您将面临着被攻击.

en: Also note that some services might have security vulnerabilities not fixed in the packages you are using for installation. This is usually true if you are installing from old media (like CD-ROMs). In this case, the system could even be compromised before you finish installation!
zh_CN: 同时应当注意到您所安装软件包中的一些服务可能存在着未被修复的安全漏洞. 如果您的系统是由老版本安装的, 通常会是如此(象 CD ROM). 在这种情况下，安装完成前您的系统是非常脆弱的!

en: Since Debian installation and upgrades can be done over the Internet you might think it is a good idea to use this feature on installation. If the system is going to be directly connected to the Internet (and not protected by a firewall or NAT), it is best to install without connection to the Internet, using a local packages mirror for both the Debian package sources and the security updates. You can set up package mirrors by using another system connected to the Internet with Debian-specific tools (if it's a Debian system) like <application>apt-move</application> or <application>apt-proxy</application>, or other common mirroring tools, to provide the archive to the installed system. If you cannot do this, you can set up firewall rules to limit access to the system while doing the update (see <xref linkend="fw-security-update" />).
zh_CN: 因为 Debian 的安装和升级可以通过互联网来完成, 可能您认为使用它的这个特性进行安装是个不错的主意. 如果系统用于直接连入互联网(且没有防火墙或 NAT 的保护), 那么安装过程最好不要与互联网相连, 而是使用本地软件 包镜象进行安装和安全升级. 您可以使用 Debian 的工具(如果是 Debian 系统)在其它和互联网相连的系统上设置 软件包镜象, 譬如 <application>apt-move</application> 或 <application>apt-proxy</application>, 或其它的常见镜象工具, 来提供安装源. 如果不能实现, 您可以通过设置防火墙规则, 来限制在安装过程中对系统的访问 (参见 <xref linkend="fw-security-update" />).

en: Set a root password
zh_CN: 设置root密码

en: Run the minimum number of services required
zh_CN: 运行最少服务需求

en: Services are programs such as ftp servers and web servers. Since they have to be <emphasis>listening</emphasis> for incoming connections that request the service, external computers can connect to yours. Services are sometimes vulnerable (i.e. can be compromised under a given attack) and hence present a security risk.
zh_CN: 服务就是程序, 如 ftp 服务器和 web 服务. 因为它们必需 <emphasis>侦听</emphasis> 连接请求, 并响应服务, 这样外部计算机就可以和您的计算机建立连接. 服务器有时候是非常脆弱的(即, 可能在遭受一次攻击后瘫痪), 因此存在安全风险.

en: You should not install services which are not needed on your machine. Every installed service might introduce new, perhaps not obvious (or known), security holes on your computer.
zh_CN: 您不应该在您的机器安装不需要的服务. 每个安装的服务都可能在您的计算机上产生新的，或许不明显(或不知道)的安全漏洞.

en: When you install a new network-related service (daemon) in your Debian GNU/Linux system it can be enabled in two ways: through the <command>inetd</command> superdaemon (i.e. a line will be added to <filename>/etc/inetd.conf</filename>) or through a standalone program that binds itself to your network interfaces. Standalone programs are controlled through the <filename>/etc/init.d</filename> files, which are called at boot time through the SysV mechanism (or an alternative one) by using symlinks in <filename>/etc/rc?.d/*</filename> (for more information on how this is done read <filename>/usr/share/doc/sysvinit/README.runlevels.gz</filename>).
zh_CN: 当您在 Debian GNU/Linux 系统中安装一个新的网络相关的服务(守护进程), 有两种方式将其激活: 通过 <command>inetd</command> 超级守护进程(即在 <filename>/etc/inetd.conf</filename> 中加入一行)或 通过一个独立的程序将自身与您的网络接口绑定. 独立程序由 <filename>/etc/init.d</filename> 目录下的文件控制, 通过 SysV 机制在启动时使用 <filename>/etc/rc?.d/*</filename> 下的连接来启用相应的服务 (更多信息参阅 <filename>/usr/share/doc/sysvinit/README.runlevels.gz</filename>).

en: Disabling daemon services
zh_CN: 禁用守护进程服务

en: If you are using <application>file-rc</application> all the information regarding services bootup is handled by a common configuration file and is maintained even if packages are removed from the system.
zh_CN: 如果您使用 <application>file-rc</application> 则关于服务启动的所有信息由一个共同的配置文件处理和维护, 既使软件包从系统中删除.

en: Disabling <command>inetd</command> or its services
zh_CN: 禁用 <command>inetd</command> 服务

en: You should check if you really need the <command>inetd</command> daemon nowadays. Inetd was always a way to compensate for kernel deficiencies, but those have been taken care of in modern Linux kernels. Denial of Service possibilities exist against <command>inetd</command> (which can increase the machine's load tremendously), and many people always preferred using stand-alone daemons instead of calling services via <command>inetd</command>. If you still want to run some kind of <command>inetd</command> service, then at least switch to a more configurable Inet daemon like <command>xinetd</command>, <command>rlinetd</command> or <command>openbsd-inetd</command>.
zh_CN: 现在, 您应当检查一下是否真的需要 <command>inetd</command> 守护进程. inetd 一直是对内核不足的一个补偿, 但是那些问题已经在最新的内核中得到了解决. 可能会因为 <command>inetd</command> 而存在拒绝服务(它将会极大的增加机器的负载), 并且很多人喜欢直接使用守护进程而不是通过 <command>inetd</command> 加载. 如果您仍然想使用 <command>inetd</command> 类的服务, 请使用更加结构化的 inet 守护进程 如 <command>xinetd</command> 或 <command>rlinetd</command> 或 <command>rlinetd</command>.

en: You can disable services by editing <filename>/etc/inetd.conf</filename> directly, but Debian provides a better alternative: <literal>update-inetd</literal> (which comments the services in a way that it can easily be turned on again). You could remove the <command>telnet</command> daemon by executing this commands to change the config file and to restart the daemon (in this case the <command>telnet</command> service is disabled):
zh_CN: 您可以通过直接编辑<filename>/etc/inetd.conf</filename> 来禁用服务, 但 Debian 提供一个更好的选择: <literal>update-inetd</literal>(当您要启用服务的时候会更方便). 您可以通过执行下边的命令来改变文件设置并重起守护进程以删除 <command>telnet</command> 服务(这样 <command>telnet</command> 就被禁用了):

en: If you do want services listening, but do not want to have them listen on all IP addresses of your host, you might want to use an undocumented feature on <command>inetd</command> (replace service name with service@ip syntax) or use an alternative <command>inetd</command> daemon like <command>xinetd</command>.
zh_CN: 如果您想保留一项服务, 但又不想让其监听您的主机的所有IP地址, 那么您可以使用 <command>inetd</command> 的非归档特性 (服务名称用 service@ip 代替)或者使用其他的 <command>inetd</command> 守护进程如 <command>xinetd</command>.

en: Install the minimum amount of software required
zh_CN: 安装最少数量的需求软件

en: Since you already know what the system is for (don't you?) you should only install software that is really needed for it to work. Any unnecessary tool that is installed might be used by a user that wants to compromise the system or by an external intruder that has gotten shell access (or remote code execution through an exploitable service).
zh_CN: 您已经知道了系统的用途(不是吗?), 因此应该只安装真正需要的软件. 安装的任何多余的工具都可能被试图破坏系统的用户或外部入侵者所利用(或通过可利用服务执行远端代码).

en: The presence, for example, of development utilities (a C compiler) or interpreted languages (such as <command>perl</command> - but see below -, <command>python</command>, <command>tcl</command>...) may help an attacker compromise the system even further:
zh_CN: 例如, 开发工具( C 编译器)或解释型语言(譬如 <command>perl</command>, <command>python</command>, <command>tcl</command>..., 其中 perl 在后面还会讲到) 可以帮助攻击者破坏系统做很多事情:

en: allowing him to do privilege escalation. It's easier, for example, to run local exploits in the system if there is a debugger and compiler ready to compile and test them!
zh_CN: 允许他提升权限. 这非常容易, 例如，如果装有调试器和编译器,就可以在本地系统运行 exploits, 并进行调试 !

en: Of course, an intruder with local shell access can download his own set of tools and execute them, and even the shell itself can be used to make complex programs. Removing unnecessary software will not help <emphasis>prevent</emphasis> the problem but will make it slightly more difficult for an attacker to proceed (and some might give up in this situation looking for easier targets). So, if you leave tools in a production system that could be used to remotely attack systems (see <xref linkend="vuln-asses" />) you can expect an intruder to use them too if available.
zh_CN: 当然, 一个入侵者通过本地 shell 下载他们的工具并运行, 即使是 shell 本身也能做出复杂的程序. 删除不必要的软件并不能 <emphasis>避免</emphasis> 问题的发生, 但是可以增加入侵者入侵的难度(并且有可能放弃它转而寻找更容易的目标). 因此, 如果在生产系统中安装了用于远程攻击的工具(参阅 <xref linkend="vuln-asses" />), 就不要期望入侵者不会利用它.

en: Removing Perl
zh_CN: 删除 Perl

en: Which utilities use <command>perl</command>? You can see for yourself:
zh_CN: 哪些程序使用 <command>perl</command>? 运行下边的命令您自己可以看到:

en: These include the following utilities in packages with priority <emphasis>required</emphasis> or <emphasis>important</emphasis>:
zh_CN: 输出的程序是的优先级是 <emphasis>required</emphasis> 或 <emphasis>important</emphasis>:

en: So, without Perl and, unless you remake these utilities in shell script, you will probably not be able to manage any packages (so you will not be able to upgrade the system, which is <emphasis>not a Good Thing</emphasis>).
zh_CN: 因此, 没有Perl, 除非你在 shell 脚本里重新编制这些程序, 否则您将不能处理任何软件包 (因此您将不能升级系统, 这不是<emphasis>一件好事情</emphasis>).

en: If you are determined to remove Perl from the Debian base system, and you have spare time, submit bug reports to the previous packages including (as a patch) replacements for the utilities above written in shell script.
zh_CN: 如果您确定从 Debian 基本系统中删除 Perl, 并且您有比较宽松的时间, 递交错误报告, 以及 shell 脚本程序作为以前的软件包(作为补丁)的替代.

en: Read the Debian security mailing lists
zh_CN: 阅读 Debian 的安全邮件列表

en: It is never wrong to take a look at either the debian-security-announce mailing list, where advisories and fixes to released packages are announced by the Debian security team, or at <ulink url="mailto:debian-security@lists.debian.org" />, where you can participate in discussions about things related to Debian security.
zh_CN: 浏览一下 debian 安全公告的邮件列表, 此处 Debian 安全小组发布对已发行软件包的公告和修正, 或发邮件给<ulink url="mailto:debian-security@lists.debian.org" />, 您可以参与 Debian 安全相关问题的讨论, 并不属于浪费时间.
