harden-doc 3.19 - en to zh_CN translation catalogue (52 entries)

en: Before the compromise
zh_CN: 被攻陷之前

en: Continuously update the system
zh_CN: 系统的及时更新

en: Manually checking which security updates are available
zh_CN: 手动检查有效的安全更新

en: If you have configured your system as described in <xref linkend="security-update" /> you just need to do:
zh_CN: 如果您如 <xref linkend="security-update" /> 所述, 配置了系统. 那么, 仅需要:

en: The first line will download the list of packages available from your configured package sources. The <literal>-s</literal> will do a simulation run, that is, it will <emphasis>not</emphasis> download or install the packages but rather tell you which ones should be downloaded/installed. From the output you can derive which packages have been fixed by Debian and are available as a security update. Sample:
zh_CN: 第一行将从您配置的源下载可用软件包列表. -s 将做一个模拟运行, 即并不真的下载, 并安装软件包, 而只是告诉您将会下载/安装哪些. 从输出中, 您可以知道 Debian 对哪些软件包做了修补, 可以做为一个安全更新. 例如:

en: Automatically checking for updates with cron-apt
zh_CN: 使用 cron-apt 自动完成更新检查

en: Avoid using the unstable branch
zh_CN: 避免使用 unstable 分支

en: In order to do security upgrades in the <emphasis>unstable</emphasis> branch, you might have to do full upgrades to new versions (which might update much more than just the affected package). Although there have been some exceptions, security patches are usually only back ported into the <emphasis>stable</emphasis> branch. The main idea being that between updates, <emphasis>no new code</emphasis> should be added, just fixes for important issues.
zh_CN: 为了对 <emphasis>unstable</emphasis> 分支进行安全更新, 您可能必须全部更新到新版本(其影响远远不止对软件包). 尽管存在一些例外, 安全补丁通常只进入 <emphasis>stable</emphasis> 分支. 其主要想法是在更新之间不再加入<emphasis>新的代码</emphasis>, 主要进行修补重大问题.

en: If you are using the <emphasis>testing</emphasis> branch, there are some issues that you must take into account regarding the availability of security updates:
zh_CN: 如果您正在使用 <emphasis>testing</emphasis> 分支，那么您则必须考虑一些有关可用安全更新的问题:

en: Security updates are available for the <emphasis>unstable</emphasis> branch usually when the package maintainer makes a new package and for the <emphasis>stable</emphasis> branch when the Security Team make a new upload and publish a DSA. Notice that neither of these change the <emphasis>testing</emphasis> branch.
zh_CN: 通常也有用于 <emphasis>unstable</emphasis> 的更新, 当软件包的维护者制作了一个新的软件包, 并且当安全小组制作了新的上载, 并公布了 DSA. 注意这两者都不会更改 <emphasis>testing</emphasis> 分支

en: This behavior might change based on the release state of the distribution. When a release is almost imminent, the Security Team or package maintainers might provide updates directly to testing.
zh_CN: 根据发行版的发行状态, 这种方式可能会改变. 当一个发行版将要放出时, 安全小组或软件包维护者可能对 testing 直接提供更新.

en: Automatic updates in a Debian GNU/Linux system
zh_CN: 自动完成 Debian GNU/Linux 系统的更新

en: First of all, automatic updates are not fully recommended, since administrators should review the DSAs and understand the impact of any given security update.
zh_CN: 首先，并不十分推荐自动更新, 因为管理员应当查阅 DSA, 并了解每次安全更新的影响.

en: If you want to update your system automatically you should:
zh_CN: 如果要自动完成系统的更新, 您应该:

en: FIXME: verify if this configuration is OK.
zh_CN: FIXME: 检查这种配置的正确性.

en: Check the results of the <command>cron</command> execution, which will be mailed to the superuser (unless changed with <literal>MAILTO</literal> environment variable in the script).
zh_CN: 检查 <command>cron</command> 的执行结果, 它将会通过mail发送给超级用户(除非修改了与 <literal>MAILTO</literal> 环境变量相关的脚本).

en: A safer alternative might be to use the <literal>-d</literal> (or <literal>--download-only</literal>) option, which will download but not install the necessary packages. Then if the <command>cron</command> execution shows that the system needs to be updated, it can be done manually.
zh_CN: 使用 <literal>-d</literal>(或 <literal>--download-only</literal>)选项也许会更加安全, 这样只下载所需的软件包, 而并不安装. 然后如果 <command>cron</command> 执行的结果显示系统需要更新, 就手动完成.

en: In order to accomplish any of these tasks, the system must be properly configured to download security updates as discussed in <xref linkend="security-update" />.
zh_CN: 为了完成这些工作, 需要正确配置系统以下载安全更新如<xref linkend="security-update" />中建议的.

en: However, this is not recommended for <emphasis>unstable</emphasis> without careful analysis, since you might bring your system into an unusable state if some serious bug creeps into an important package and gets installed in your system. <emphasis>Testing</emphasis> is slightly more <emphasis>secure</emphasis> with regard to this issue, since serious bugs have a better chance of being detected before the package is moved into the testing branch (although, you may have <emphasis>no</emphasis> security updates available whatsoever).
zh_CN: 但是，如果没有经过仔细的分析, 并不推荐在 <emphasis>unstable</emphasis> 中这样做, 因为如果您安装到系统中的一个重要的软件包中存在严重 bug, 可能会使系统崩溃. 对于这种问题, <emphasis>testing</emphasis> 相对要好一点. 因为<emphasis>严重</emphasis>的 bug 在进入 testing 分支前有更多机会被检测出来.(尽管,您可能<emphasis>没有</emphasis>任何安全更新可用).

en: Do periodic integrity checks
zh_CN: 周期性入侵检测

en: Based on the baseline information you generated after installation (i.e. the snapshot described in <xref linkend="snapshot" />), you should be able to do an integrity check from time to time. An integrity check will be able to detect filesystem modifications made by an intruder or due to a system administrators mistake.
zh_CN: 通常完成安装后, 一条基本准则是(即, 如 <xref linkend="snapshot" /> 所描述)应当经常进行系统完整性检查. 完整性检查有助于发现入侵者对文件系统的改动, 或系统管理的操作失误.

en: You can consider doing integrity checks online using any of the filesystem integrity tools available (described in <xref linkend="check-integ" />) if taking offline the system is not an option. However, precaution should be taken to use a read-only integrity database and also assure that the integrity checking tool (and the operating system kernel) has not been tampered with.
zh_CN: 您可以考虑使用有效的文件系统完整性检查工具(如 ref id="check-integ" /> 中所述)在线完成完整性检查, 如果离线完成这一工作不太可能. 但是, 除了使用只读数据库这一预防措施, 还要确保完整性检查工具(和操作系统内核)未被篡.

en: Of course, if you execute a security update of the system, the snapshot taken for the system should be re-taken to accommodate the changes done by the security update.
zh_CN: 当然, 如果您对系统进行了安全更新, 应当重新制作系统快照, 以包容安全更新所产生的改动.

en: Set up Intrusion Detection
zh_CN: 设置入侵检测

en: Always be aware that in order to really improve the system's security with the introduction of any of these tools, you need to have an alert+response mechanism in place. Intrusion detection is a waste of time if you are not going to alert anyone.
zh_CN: 谨记, 为了使用介绍的工具真正改善系统的安全性, 您需要到位的报警和响应机制. 如果没有报警, 入侵检测将会非常费时.

en: When a particular attack has been detected, most intrusion detection tools will either log the event with <command>syslogd</command> or send e-mail to the root user (the mail recipient is usually configurable). An administrator has to properly configure the tools so that false positives do not trigger alerts. Alerts may also indicate an ongoing attack and might not be useful, say, one day later, since the attack might have already succeeded. So be sure that there is a proper policy on handling alerts and that the technical mechanisms to implement this policy are in place.
zh_CN: 当检测到一次特殊的攻击时, 多数的入侵检测工具要么使用 <command>syslogd</command> 记录事件, 要么要么发送邮件到 root 用户(邮件接收者是可以配置的). 管理员必须正确的配置这些工具, 以便错误的信息不会触发报警. 报警也许还表明当一次持续的攻击, 也许一天以后已经没用了, 因为攻击可能已经成功了. 因此要确保正确的处理报警的策略以及相应的技术机制应当到位.

en: Network based intrusion detection
zh_CN: 基于网络的入侵检测

en: Network based intrusion detection tools monitor the traffic on a network segment and use this information as a data source. Specifically, the packets on the network are examined, and they are checked to see if they match a certain signature.
zh_CN: 基于网络的入侵检测工具监测在网络上传送的数据段, 并将其作为数据源. 具体就是审查网上的数据包, 看是否与某些特征匹配.

en: Host based intrusion detection
zh_CN: 基于主机的入侵检测

en: Host based intrusion detection involves loading software on the system to be monitored which uses log files and/or the systems auditing programs as a data source. It looks for suspicious processes, monitors host access, and may even monitor changes to critical system files.
zh_CN: 基于主机的入侵检测包括在被检测的系统中加载软件, 其使用日志文件和/或系统的检测程序作为数据源. 它搜寻可疑的进程, 监视主机的访问, 也许甚至监控对重要文件的修改.

en: In addition, packages which monitor file system integrity (see <xref linkend="check-integ" />) can be quite useful in detecting anomalies in a secured environment. It is most likely that an effective intrusion will modify some files in the local file system in order to circumvent local security policy, install Trojans, or create users. Such events can be detected with file system integrity checkers.
zh_CN: 另外，用于监测文件系统完整性的软件包(参见 <xref linkend="check-integ" />)在检查一个安全系统的异常现象时也非常有用. 一个有效的侵入很可能会 修改一些本地文件系统中的文件以绕过本地安全策略, 安装木马, 或创建用户. 这些事件通常可以通过使用文件系统完整性检查工具检测到.

en: Avoiding root-kits
zh_CN: 避免 root-kits

en: Loadable Kernel Modules (LKM)
zh_CN: 可加载内核模块 (LKM)

en: Loadable kernel modules are files containing dynamically loadable kernel components used to expand the functionality of the kernel. The main benefit of using modules is the ability to add additional devices, like an Ethernet or sound card, without patching the kernel source and recompiling the entire kernel. However, crackers are now using LKMs for root-kits (knark and adore), opening up back doors in GNU/Linux systems.
zh_CN: 可加载内核模块是指包含动态可加载内核组件的文件, 用于扩展内核功能. 使用模块最大的好处是在添加另外的设备时, 如网卡或声卡, 不必修补内核源码, 并重新编译整个内核. 然而, 现在黑客将 LKMs 用于 root-kits(knark 和 adore),在 GNU/Linux 系统中开启后门.

en: LKM back doors are more sophisticated and less detectable than traditional root-kits. They can hide processes, files, directories and even connections without modifying the source code of binaries. For example, a malicious LKM can force the kernel into hiding specific processes from <filename>procfs</filename>, so that even a known good copy of the binary <command>ps</command> would not list accurate information about the current processes on the system.
zh_CN: LKM 后门比传统的 root-kits 更加先进和隐蔽. 可以隐藏进程, 文件, 目录, 甚至连接而不必修改二进制源码. 例如, 一个恶意的 LKM 可以迫使内核隐藏源自 <filename>procfs</filename> 的进程, 这样即使是著名的 <command>ps</command> 也不能列出关于系统的当前进程的准确信息.

en: Detecting root-kits
zh_CN: 检测 root-kits

en: There are two approaches to defending your system against LKM root-kits, a proactive defense and a reactive defense. The detection work can be simple and painless, or difficult and tiring, depending on the approach taken.
zh_CN: 有两种方法保护您的系统免受 LKM 伤害, 主动防护和被动防护. 检测工作可能是简单和轻松的, 或是麻烦和繁重的, 这和采取的方法有关.

en: Proactive defense
zh_CN: 主动防护

en: Debian GNU/Linux has a few packages that can be used to mount a proactive defense:
zh_CN: Debian GNU/Linux 仅提供很少的软件包用于挂载一个主动防御防护:

en: If you don't really need many kernel features on your GNU/Linux system, you may want to disable loadable modules support during kernel configuration. To disable loadable module support, just set CONFIG_MODULES=n during the configuration stage of building your kernel, or in the <filename>.config</filename> file. This will prevent LKM root-kits, but you lose this powerful feature of the Linux kernel. Also, disabling loadable modules can sometimes overload the kernel, making loadable support necessary.
zh_CN: 如果您的 GNU/Linux 系统确实不需要那么多的内核特性, 您可能想在内核配置阶段取消可加载模块支持. 禁用可加载模块支持, 只要在构建内核的配置阶段或者在 <filename>.config</filename> 文件中设置 CONFIG_MODULES=n 就可以了. 这将能防止 LKM root-kits, 但是你也将丧失 Linux 内核的强大特性. 同时, 有时对可加载的支持是必须的, 禁用可加载模块可能会引起内核过载.

en: Reactive defense
zh_CN: 被动防护

en: The advantage of a reactive defense is that it does not overload system resources. It works by comparing the system call table with a known clean copy in a disk file, <filename>System.map</filename>. Of course, a reactive defense will only notify the system administrator after the system has already been compromised.
zh_CN: 被动防护的优点是不必重载系统资源. 其通过将系统与一个已知干净系统的清单 <filename>System.map</filename> 相比较. 当然, 被动防护只能在系统被攻克以后通知管理员.

en: Playing around with Pluggable Authentication Modules (PAM). As quoted in the Phrack 56 PAM article, the nice thing about PAM is that "You are limited only by what you can think of." It is true. Imagine root login only being possible with fingerprint or eye scan or cryptocard (why did I use an OR conjunction instead of AND?).
zh_CN: 轻率的对待可插入认证模块 (PAM). 就象文章 Phrack 56 PAM 中说的一样, PAM 最好是"您只是受您思维的限制", 这是真的, 设想一下 root 通过指纹或眼睛扫描或 加密卡认证登陆(为什么我使用 或 连接词来代替 和 ?).

en: Fascist Logging. I would refer to all the previous logging discussion above as "soft logging". If you want to perform real logging, get a printer with fanfold paper, and send all logs to it. Sounds funny, but it's reliable and it cannot be tampered with or removed.
zh_CN: 法西斯式记录. 我把前面所做的关于日志的讨论称作"软件日志". 如果您想完成真正的日志, 就配置一台打印机, 并把所有的日志打印出来. 这听起来很滑稽, 但这样才可靠, 不会被篡改或删除.

en: CD distribution. This idea is very easy to realize and offers pretty good security. Create a hardened Debian distribution, with proper firewall rules. Turn it into a boot-able ISO image, and burn it on a CDROM. Now you have a read-only distribution, with about 600 MB space for services. Just make sure all data that should get written is done over the network. It is impossible for intruders to get read/write access on this system, and any changes an intruder does make can be disabled with a reboot of the system.
zh_CN: 光盘版本. 这个想法很好实现, 并更具安全性. 构建一个安全化的 Debian 发行版, 并带有合适的防火墙规则. 把它转换成可引导 ISO 影像, 然后烧录成光盘. 这样您就拥有了一个只读版本, 大约有600M空间用于服务. 只要确保所有需要写入的数据都是通过网络完成的就行了. 这样入侵者就不可能拥有系统的读/写权限, 并且入侵者的任何修改都不会影像重起后的系统.

en: Switch module capability off. As discussed earlier, when you disable the usage of kernel modules at kernel compile time, many kernel based back doors are impossible to implement because most are based on installing modified kernel modules.
zh_CN: 禁用模块切换能力. 就象前边所谈论的, 当您在编译阶段禁用掉模块, 许多基于内核的后门就不可能实现, 因为它们中的大部分基于安装时对内核模块的修改.

en: This strategy also makes a variety of security and denial of service (DoS) exploits either impossible or more difficult (since many of them rely on overwriting a file through the actions of some SETUID program that <emphasis>isn't providing an arbitrary shell command</emphasis>).
zh_CN: 这个策略也可使系统免受拒绝服务攻击(DoS), 或使其更加困难(因为大多数基于通过激活一些 SETUID 程序, 来重写一个文件,这<emphasis>并不能避免随意的 shell 命令</emphasis>).

en: Note that this strategy also prevents you from upgrading your system's packages, since the files updated packages provide cannot be overwritten. You might want to have a script or other mechanism to disable the immutable flag on all binaries right before doing an <command>apt-get update</command>.
zh_CN: 注意这个策略将会使您无法升级系统, 因为被更新的文件是无法重写的. 您也许需要一个脚本或机制使得在 <command>apt-get update</command> 前取消所有程序的不可修改标志.

en: Play with UTP cabling in a way that you cut 2 or 4 wires and make the cable one-way traffic only. Then use UDP packets to send information to the destination machine which can act as a secure log server or a credit card storage system.
zh_CN: 使用 UTP 电缆时, 去掉2根或4根线, 使其只能进行 one-way 传输. 这样, 使用 UDP 包向做为安全日志服务器或信用卡存储系统的机器发送信息包.

en: Building a honeypot
zh_CN: 构建蜜罐

en: A honeypot is a system designed to teach system administrators how crackers probe for and exploit a system. It is a system setup with the expectation and goal that the system will be probed, attacked and potentially exploited. By learning the tools and methods employed by the cracker, a system administrator can learn to better protect their own systems and network.
zh_CN: 蜜罐(honeypot)是一个设计来让系统管理员用于学习黑客如何探测和利用一个系统的系统. 这个系统的设置目的是希望被探测, 攻击, 和潜在的利用. 通过学习黑客使用的工具和方法, 系统管理员可以更好的保护他们的系统和网络.

en: The firewall technology you will use (provided by the Linux kernel).
zh_CN: 您要使用的防火墙技术(由 Linux 内核提供).
