harden-doc 3.19 - en to zh_CN translation catalogue (38 entries)

en: Security tools in Debian
zh_CN: Debian 中的安全工具

en: FIXME: More content needed.
zh_CN: FIXME: 需要更多内容.

en: Since Debian 3.0 (<emphasis>woody</emphasis>), the distribution features cryptographic software integrated into the main distribution. OpenSSH and GNU Privacy Guard are included in the default install, and strong encryption is now present in web browsers and web servers, databases, and so forth. Further integration of cryptography is planned for future releases. This software, due to export restrictions in the US, was not distributed along with the main distribution but included only in non-US sites.
zh_CN: 从 Debian 3.0(<emphasis>woody</emphasis>) 开始, 发行版就具有了将密码软件集成到主发行版中的特点. 缺省安装包括 OpenSSH 和 GPG(GNU Privacy Guard), 在浏览器, web服务器, 数据库, 等等中也出现了高强度加密. 计划在未来的发行版中, 进一步集成数据加密. 由于美国的出口限制, 这种软件是不允许随主发行版发布的, 只能包含在 non-US 站点上.

en: Remote vulnerability assessment tools
zh_CN: 远程风险评估工具

en: By far, the most complete and up-to-date tools is <application>nessus</application> which is composed of a client (<application>nessus</application>) used as a GUI and a server (<application>nessusd</application>) which launches the programmed attacks. Nessus includes remote vulnerabilities for quite a number of systems including network appliances, ftp servers, www servers, etc. The latest security plugins are able even to parse a web site and try to discover which interactive pages are available which could be attacked. There are also Java and Win32 clients (not included in Debian) which can be used to contact the management server.
zh_CN: 显然, 最完善和最新的工具是 <application>nessus</application>, 它由一个GUI客户端(<application>nessus</application>), 和一个负责攻击的服务器端(<application>nessusd</application>)组成. Nessus 包括许多系统的远程漏洞如网络工具, ftp 服务器, www 服务器, 等等. 最新版本甚至可以解析网站, 并设法发现可以用于攻击的交互式页面. 并且还提供(没有包含在 Debian 中)用于连接管理服务器的 java 和 Win32 客户端.

en: Network scanner tools
zh_CN: 网络扫描器工具

en: Debian does provide some tools used for remote scanning of hosts (but not vulnerability assessment). These tools are, in some cases, used by vulnerability assessment scanners as the first type of "attack" run against remote hosts in an attempt to determine remote services available. Currently Debian provides:
zh_CN: Debian 确实提供了一些工具用于远程扫描主机(并不是风险评估). 这些工具在某些情况下被用作风险评估扫描器, 而不是当做攻击工具用于扫描以发现远程可用服务. Debian 当前提供:

en: On the other hand, <application>fragrouter</application> can be used to test network intrusion detection systems and see if the NIDS can be eluded by fragmentation attacks.
zh_CN: 另一方面, <application>fragrouter</application> 可以用于测试网络的入侵检测系统, 检查攻击者是否能绕过 NIDS.

en: Internal audits
zh_CN: 内部审计

en: Currently, only the <application>tiger</application> tool used in Debian can be used to perform internal (also called white box) audit of hosts in order to determine if the file system is properly set up, which processes are listening on the host, etc.
zh_CN: 当前, 在 Debian 系统中只有 <application>tiger</application> 工具可用于完成主机的内部(也称作白盒)审计, 以确定文件系统是否设置正确, 这个过程进行主机监听, 等等.

en: Auditing source code
zh_CN: 源代码的审核

en: Virtual Private Networks
zh_CN: 虚拟专用网

en: A virtual private network (VPN) is a group of two or more computer systems, typically connected to a private network with limited public network access, that communicate securely over a public network. VPNs may connect a single computer to a private network (client-server), or a remote LAN to a private network (server-server). VPNs often include the use of encryption, strong authentication of remote users or hosts, and methods for hiding the private network's topology.
zh_CN: 一个虚拟专用网(VPN)至少由两台以上计算机系统组成, 典型的通过公网访问私有网络, 实现在公网的安全通信. VPNs 可能是将单机连入一个私有网络(客户端-服务器), 也可能是将一个远程局域网与一个私有网络相连(服务器-服务器). VPNs 通常包括使用加密, 远程用户或主机的强认证, 和隐藏私有网络拓扑结构的方法.

en: Debian provides quite a few packages to set up encrypted virtual private networks:
zh_CN: Debian 提供一些软件包用于设置虚拟专用网的加密:

en: Point to Point tunneling
zh_CN: 点对点隧道

en: If you want to provide a tunneling server for a mixed environment (both Microsoft operating systems and Linux clients) and IPsec is not an option (since it's only provided for Windows 2000 and Windows XP), you can use <emphasis>PoPToP</emphasis> (Point to Point Tunneling Server), provided in the <application>pptpd</application> package.
zh_CN: 如果您想为混合环境(微软操作系统和 linux 客户端)提供隧道服务, 并且不能选 IPsec(它是基于 Windows 2000 和 Windows XP 的), 那么可以使用 <application>pptpd</application> 软件包中提供的 <emphasis>PoPToP</emphasis> (点对点隧道服务).

en: If you want to use Microsoft's authentication and encryption with the server provided in the <application>ppp</application> package, note the following from the FAQ:
zh_CN: 如果您想使用 PPP 包中提供的微软的认证和加密服务, 注意下边的FAQ:

en: However, you also have to apply the kernel patch provided by the <application>kernel-patch-mppe</application> package, which provides the pp_mppe module for pppd.
zh_CN: 然而, 您还必须使用 <application>kernel-patch-mppe</application> 软件包提供的内核补丁才行, 它为 pppd 提供了 pp_mppe 模块.

en: Public Key Infrastructure (PKI)
zh_CN: 公钥机制 (PKI)

en: Public Key Infrastructure (PKI) is a security architecture introduced to provide an increased level of confidence for exchanging information over insecure networks. It makes use of the concept of public and private cryptographic keys to verify the identity of the sender (signing) and to ensure privacy (encryption).
zh_CN: 公钥机制(PKI)是在不安全的网络上, 用于增加信息通讯的安全信心级别的安全平台. 它利用公钥和私钥的概念来核实发送者(签名)的身份以确保保密性(加密).

en: When considering a PKI, you are confronted with a wide variety of issues:
zh_CN: 就 PKI 而言, 您要面对各种各样的问题:

en: SSL Infrastructure
zh_CN: SSL 机制

en: Debian does provide some SSL certificates with the distribution so that they can be installed locally. They are found in the <application>ca-certificates</application> package. This package provides a central repository of certificates that have been submitted to Debian and approved (that is, verified) by the package maintainer, useful for any OpenSSL applications which verify SSL connections.
zh_CN: Debian 在发行版中提供一些用于安装到本地的 SSL 证书. 您可以在 <application>ca-certificates</application> 包中找到它们. 此软件包提供了一个重要的证书仓库, 它已由软件包维护者认可(就是校验)的, 并被提交到了Debian, 对任何一个使用 SSL 校验连接的 OpenSSL 应用程序都非常有用.

en: FIXME: read debian-devel to see if there was something added to this.
zh_CN: FIXME: 查看 debian-devel 中是否有些东西需要添加到这里.

en: Antivirus tools
zh_CN: 病毒工具

en: Debian GNU/Linux currently provides the following tools for building antivirus environments:
zh_CN: 当前的 Debian GNU/Linux 提供如下用于构建防火墙环境的工具:

en: <application>libfile-scan-perl</application> which provides File::Scan, a Perl extension for scanning files for viruses. This modules can be used to make platform independent virus scanners.
zh_CN: <application>libfile-scan-perl</application> 提供 File::Scan 一个扫描病毒的 perl 扩展. 此模块可用于制作 plataform 独立病毒扫描器.

en: <application>exiscan</application>, an e-mail virus scanner written in Perl that works with Exim.
zh_CN: <application>exiscan</application>, 一个用 perl 写的基于 Exim 的电子邮件病毒扫描器.

en: <application>blackhole-qmail</application> a spam filter for Qmail with built-in support for Clamav.
zh_CN: <application>blackhole-qmail</application> 一个 Qmail 的垃圾过滤器, 内置支持 Clamav.

en: Some gateway daemons support already tools extensions to build antivirus environments including <application>exim4-daemon-heavy</application> (the <emphasis>heavy</emphasis> version of the Exim MTA), <application>frox</application> (a transparent caching ftp proxy server), <application>messagewall</application> (an SMTP proxy daemon) and <application>pop3vscan</application> (a transparent POP3 proxy).
zh_CN: 一些网关守护进程已经支持工具扩展, 以构建防病毒环境, 其包括 <application>exim4-daemon-heavy</application> (Exim MTA 的 <emphasis>heavy</emphasis> 版), <application>frox</application>(一个透明缓存的 ftp 代理服务器), <application>messagewall</application>(一个 SMTP 代理守护进程), 和 <application>pop3vscan</application> (透明的 POP3 代理).

en: GPG agent
zh_CN: GPG 代理

en: It is very common nowadays to digitally sign (and sometimes encrypt) e-mail. You might, for example, find that many people participating on mailing lists sign their list e-mail. Public key signatures are currently the only means to verify that an e-mail was sent by the sender and not by some other person.
zh_CN: 现在对一个邮件进行数字签名(有时是加密)非常普遍. 例如, 您可能发现邮件列表上的很多人对其列表邮件进行签名. 公钥签名是现在唯一的核实一个邮件是由其发送者发送, 而不是其他人仿冒的唯一手段.

en: Debian GNU/Linux provides a number of e-mail clients with built-in e-mail signing capabilities that interoperate either with <application>gnupg</application> or <application>pgp</application>:
zh_CN: Debian GNU/Linux 提供了很多内置可以与 <application>gnupg</application> 或 <application>pgp</application> 交互的邮件客户端:

en: <application>sylpheed</application>. Depending on how the stable version of this package evolves, you may need to use the <emphasis>bleeding edge version</emphasis>, <application>sylpheed-claws</application>.
zh_CN: <application>sylpheed</application>. 基于此软件包的稳定版本的演变, 您可能需要使用 <emphasis>bleeding edge version</emphasis>, <application>sylpheed-claws</application>.

en: <application>gnus</application>, which when installed with the <application>mailcrypt</application> package, is an <command>emacs</command> interface to <command>gnupg</command>.
zh_CN: <application>gnus</application>, 当其与 <application>mailcrypt</application> 软件包一起安装时, 是一个 <command>gnupg</command> 的 <command>emacs</command> 接口.

en: <application>kuvert</application>, which provides this functionality independently of your chosen mail user agent (MUA) by interacting with the mail transport agent (MTA).
zh_CN: <application>kuvert</application>, 其由于和邮件传输代理( MTA )的融合, 可以提供独立于邮件用户代理( MUA )的功能.

en: Most key servers are linked, so that when your public key is added to one server, the addition is propagated to all the other public key servers. There is also a Debian GNU/Linux package <application>debian-keyring</application>, that provides all the public keys of the Debian developers. The <command>gnupg</command> keyrings are installed in <filename>/usr/share/keyrings/</filename>.
zh_CN: 很多 key server 是相互连接的, 因为当您的公钥加入一个服务器时, 它也将附加的蔓延到其它 key server 上. Debian GNU/Linux 也提供了一个 <application>debian-keyring</application> 软件包, 提供了 Debian 开发者的所有公钥. <command>gnupg</command> keyrings 被安装在 <filename>/usr/share/keyrings/</filename> 目录下.

en: For more information:
zh_CN: 更多信息:
