harden-doc 3.19 - en to zh_CN translation catalogue (149 entries)

en: Frequently asked Questions (FAQ)
zh_CN: 常见问题解答 (FAQ)

en: This chapter introduces some of the most common questions from the Debian security mailing list. You should read them before posting there or else people might tell you to RTFM.
zh_CN: 本章介绍源自 Debian 安全邮件列表中的一些常见问题, 当您准备发送邮件, 甚至别人告诉您去 RTFM 时, 您可以阅读它们.

en: Security in the Debian operating system
zh_CN: Debian 操作系统的安全

en: Is Debian more secure than X?
zh_CN: Debian 比 X 更安全吗?

en: One of Debian's main advantages with regards to security is the ease of system updates through the use of <command>apt</command>. Here are some other aspects of security in Debian to consider:
zh_CN: Debian 在安全方面主要的优势在于系统通过 <command>apt</command> 完成升级非常简单. Debian 在安全方面还有以下方面值得考虑:

en: Debian provides more security tools than other distributions, see <xref linkend="sec-tools" />.
zh_CN: Debian 比其它发行版提供更多的安全工具, 参见 <xref linkend="sec-tools" />.

en: Debian documents best security practices in documents like this one.
zh_CN: 提供了最佳的安全实践文档, 就象本篇.

en: There are many Debian bugs in Bugtraq. Does this mean that it is very vulnerable?
zh_CN: 在 Bugtraq 中有很多 Debian bug. 这是否意味着它很脆弱吗?

en: The Debian distribution boasts a large and growing number of software packages, probably more than provided by many proprietary operating systems. The more packages installed, the greater the potential for security issues in any given system.
zh_CN: Debian 发行版号称拥有最多的软件包, 可能比任何一个操纵系统都多. 安装的软件包越多, 潜在的安全问题就越大.

en: More and more people are examining source code for flaws. There are many advisories related to source code audits of the major software components included in Debian. Whenever such source code audits turn up security flaws, they are fixed and an advisory is sent to lists such as Bugtraq.
zh_CN: 越来越多的人测试原代码的缺陷. 在 Debian 中许多公告与主要软件组件的源码审计有关. 每当诸如此类的源码审计出现漏洞, 它们将会被修复, 并向如 Bugtraq 的列表发送一个公告.

en: Bugs that are present in the Debian distribution usually affect other vendors and distributions as well. Check the "Debian specific: yes/no" section at the top of each advisory (DSA).
zh_CN: 通常在 Debian 中发现的 bug 同样会影响到其它发行版和开发商. 检查每个公告 (DSA) 顶端的 "Debian specific: yes/no" 部分.

en: Does Debian have any certification related to security?
zh_CN: Debian 有与安全相关的证书吗?

en: Short answer: no.
zh_CN: 简短的回答: 没有.

en: Are there any hardening programs for Debian?
zh_CN: 有针对 Debian 的安全化程序吗?

en: Some people believe, however, that a hardening tool does not eliminate the need for good administration.
zh_CN: 但是, 有些人认为一个安全设置工具并不能满足一个好的管理员的需求.

en: I want to run XYZ service, which one should I choose?
zh_CN: 我想要运行 XYZ 服务, 应当选择哪个?

en: One of Debian's great strengths is the wide variety of choice available between packages that provide the same functionality (DNS servers, mail servers, ftp servers, web servers, etc.). This can be confusing to the novice administrator when trying to determine which package is right for you. The best match for a given situation depends on a balance between your feature and security needs. Here are some questions to ask yourself when deciding between similar packages:
zh_CN: Debian 的一个强大之处在于对于相同功能( DNS 服务器, 邮件服务器, ftp服务器, web 服务器, 等等) 有很多软件包可供选择. 对于新管理员确定哪个软件包更适合来说很容易被搞糊涂. 对于给定条件的最好的选择是基于您的特点与安全需求之间的平衡. 当您在相似的软件包之间作选择时, 应当问自己这么几个问题:

en: Is the software maintained upstream? When was the last release?
zh_CN: 上游仍在维护这个软件吗? 什么时候发行的最新版?

en: Is the package mature? The version number really does <emphasis>not</emphasis> tell you about its maturity. Try to trace the software's history.
zh_CN: 软件包成熟吗? 版本号并<emphasis>不能</emphasis>告诉您它的成熟度. 设法查看软件的开发历史.

en: Is the software bug-ridden? Have there been security advisories related to it?
zh_CN: 软件 bug-ridden 吗? 有与其相关的安全公告吗?

en: Does the software provide all the functionality you need? Does it provide more than you really need?
zh_CN: 软件是否提供您所需要的所有功能? 是否多于您的真正需求?

en: How can I make service XYZ more secure in Debian?
zh_CN: 在 Debian 中如何使 XYZ 服务更安全?

en: You will find information in this document to make some services (FTP, Bind) more secure in Debian GNU/Linux. For services not covered here, check the program's documentation, or general Linux information. Most of the security guidelines for Unix systems also apply to Debian. In most cases, securing service X in Debian is like securing that service in any other Linux distribution (or Un*x, for that matter).
zh_CN: 在本文档中您会找到一些在 Debian GNU/Linux 中使一些服务(FTP,Bind)更安全的方法. 这里所没有提供的, 您可以查看程序的文档, 或常用的 Linux 信息. 大多数的用于 Unix 系统的安全指南同样适用于 Debian. 很多情况下, Debian 中服务 X 的安全设置于在其它 Linu x发行版相同行(或 Un*x ，就此而言).

en: How can I remove all the banners for services?
zh_CN: 如何删除服务的所有标语?

en: Are all Debian packages safe?
zh_CN: 所有的 Debian 软件包都安全吗?

en: The Debian security team cannot possibly analyze all the packages included in Debian for potential security vulnerabilities, since there are just not enough resources to source code audit the whole project. However, Debian does benefit from the source code audits made by upstream developers.
zh_CN: Debian 安全小组不可能分析 Debian 中所有的软件包的潜在漏洞, 因为没有足够的资金用于整个项目的源代码的安全审计. 但是, Debian 可受益于上游开发者.

en: As a matter of fact, a Debian developer could distribute a Trojan in a package, and there is no possible way to check it out. Even if introduced into a Debian branch, it would be impossible to cover all the possible situations in which the Trojan would execute. This is why Debian has a <emphasis>"no guarantees"</emphasis> license clause.
zh_CN: 实际上，Debian 开发者可能发布一个含有木马的软件包, 并且无法将其检查出来. 即使将其引入 Debian 的一个分支, 也不可能报告出木马可能运行的所有可能的状况. 这就是为什么 Debian 含有<emphasis>"无保证"</emphasis>条件许可的原因.

en: However, Debian users can take confidence in the fact that the stable code has a wide audience and most problems would be uncovered through use. Installing untested software is not recommended in a critical system (if you cannot provide the necessary code audit). In any case, if there were a security vulnerability introduced into the distribution, the process used to include packages (using digital signatures) ensures that the problem can be ultimately traced back to the developer. The Debian project has not taken this issue lightly.
zh_CN: 但是，Debian 用户事实上应当对有广泛用户的稳定版本有足够的信心, 其多数问题可以通过使用被发现. 对于一个重要的系统并不推荐安装未经测试的软件(如果无法提供必要的代码审计). 无论如何, 如果含有安全漏洞的软件被引入发行版, 通过包含软件包确认的使用过程, 这种问题最终可能将追踪到开发者. Debian 项目不轻易采取了这种方法.

en: Why are some log files/configuration files world-readable, isn't this insecure?
zh_CN: 为什么一些日志文件/配置文件设为完全可读(world-readable), 这样不是不安全吗?

en: Of course, you can change the default Debian permissions on your system. The current policy regarding log files and configuration files is that they are world readable <emphasis>unless</emphasis> they provide sensitive information.
zh_CN: 当然，您可以修改系统的缺省 Debian 许可. 当前关于日志文件和配置文件的策略是完全可读(world readable), <emphasis>除非</emphasis>它们提供的是高度机密的信息.

en: Be careful if you do make changes since:
zh_CN: 如果您作修改,那么就要小心:

en: Processes might not be able to write to log files if you restrict their permissions.
zh_CN: 进程也许不能写入日志, 如果您限制了它们的权限.

en: Some applications may not work if the configuration file they depend on cannot be read. For example, if you remove the world-readable permission from <filename>/etc/samba/smb.conf</filename>, the <command>smbclient</command> program will not work when run by a normal user.
zh_CN: 一些软件可能不能工作了, 如果它们依靠的配置文件不可读. 例如, 如果您移除了 <filename>/etc/samba/smb.conf</filename> 的完全可读权限, 普通用户将无法运行 <command>smbclient</command> 程序.

en: FIXME: Check if this is written in the Policy. Some packages (i.e. ftp daemons) seem to enforce different permissions.
zh_CN: FIXME: 检查策略里的写权限部分. 一些软件包(即, ftp 守护进程)似乎强制执行不同的权限.

en: Why does /root/ (or UserX) have 755 permissions?
zh_CN: 为什么 /root/(或 UserX)的权限是755?

en: As a matter of fact, the same questions stand for any other user. Since Debian's installation does not place <emphasis>any</emphasis> file under that directory, there's no sensitive information to protect there. If you feel these permissions are too broad for your system, consider tightening them to 750. For users, read <xref linkend="limit-user-perm" />.
zh_CN: 实际上，其他用户存在同样的问题. 因为 Debian 的安装不在这个目录下放置<emphasis>任何</emphasis>文件, 那里没有任何需要保护的机密信息. 对于您的系统来说, 如果您觉得权限过于宽松, 可以考虑设为750. 对于其他用户,参阅 <xref linkend="limit-user-perm" />.

en: After installing a grsec/firewall, I started receiving many console messages! How do I remove them?
zh_CN: 在安装 grsec/防火墙后，我开始接收到许多控制信息! 怎么删除他们?

en: If you are receiving console messages, and have configured <filename>/etc/syslog.conf</filename> to redirect them to either files or a special TTY, you might be seeing messages sent directly to the console.
zh_CN: 如果您正在接受控制台信息, 并已经配置了 <filename>/etc/syslog.conf</filename> 将日志信息转向其他文件或指定 TTY, 那么您可能会看到直接发送到控制台的信息.

en: The default console log level for any given kernel is 7, which means that any message with lower priority will appear in the console. Usually, firewalls (the LOG rule) and some other security tools log lower that this priority, and thus, are sent directly to the console.
zh_CN: 任何一个内核的缺省控制台日志级别都为 7, 这意味着任何低优先级信息都会出现在控制台. 通常, 防火墙(日志规则)和一些其它的安全工具的日志优先级较低, 因此, 会被直接发送到控制台.

en: to:
zh_CN: 为:

en: Use a lower number for <literal>-c</literal> if you are still seeing them. A description of the different log levels can be found in <filename>/usr/include/sys/syslog.h</filename>:
zh_CN: 如果仍然出现, 为 <literal>-c</literal> 设置更小的数字. 在 <filename>/usr/include/sys/syslog.h</filename> 中可以找到关于不同日志级别的描述:

en: Operating system users and groups
zh_CN: 操作系统的用户与组

en: Are all system users necessary?
zh_CN: 所有系统用户都是必需的吗?

en: root: Root is (typically) the superuser.
zh_CN: root: Root 是(典型的) 超级用户.

en: daemon: Some unprivileged daemons that need to write to files on disk run as daemon.daemon (e.g., <command>portmap</command>, <command>atd</command>, probably others). Daemons that don't need to own any files can run as nobody.nogroup instead, and more complex or security conscious daemons run as dedicated users. The daemon user is also handy for locally installed daemons.
zh_CN: daemon: 一些非特权守护进程运行时需要象 daemon.daemon (如, <command>portmap</command>, <command>atd</command>, 或许还有其它)一样对磁盘文件进行写操作. 守护进程以 nobody.nogroup 运行时不需要拥有任何文件. 更复杂或更安全的守护进程以指定用户运行. daemon 用户也可用于本地安装 daemon.

en: bin: maintained for historic reasons.
zh_CN: bin: 因为历史的原因被保留下来.

en: sys: same as with bin. However, /dev/vcs* and <filename>/var/spool/cups</filename> are owned by group sys.
zh_CN: sys: 同 bin. 但是，sys 组拥有 /dev/vcs* 和 <filename>/var/spool/cups</filename>.

en: sync: The shell of user sync is <filename>/bin/sync</filename>. Thus, if its password is set to something easy to guess (such as ""), anyone can sync the system at the console even if they have don't have an account.
zh_CN: sync: 用户 sync 的 shell 是 <filename>/bin/sync</filename>. 因而，如果它的密码被设置对容易事猜测(譬如 "" ) ，任何人都可以通过控制台 sync 系统. 既使他们没有帐户.

en: games: Many games are SETGID to games so they can write their high score files. This is explained in policy.
zh_CN: games: 许多游戏被 SETGID 为 games, 这样就可以对它们的高分值文件进行写操作. 这是策略里边的解释.

en: man: The man program (sometimes) runs as user man, so it can write cat pages to <filename>/var/cache/man</filename>
zh_CN: man: 程序(有时)以用户 man 运行, 这样可以将 cat 的页面写入 <filename>/var/cache/man</filename>.

en: lp: Used by printer daemons.
zh_CN: lp: 由打印机守护进程使用.

en: mail: Mailboxes in <filename>/var/mail</filename> are owned by group mail, as explained in policy. The user and group are used for other purposes by various MTA's as well.
zh_CN: mail: <filename>/var/mail</filename> 目录下的信箱由 mail 组拥有, 这是策略中的解释. 用户和组同时也被其它各种各样的 MTA 使用.

en: news: Various news servers and other associated programs (such as <command>suck</command>) use user and group news in various ways. Files in the news spool are often owned by user and group news. Programs such as <command>inews</command> that can be used to post news are typically SETGID news.
zh_CN: news: 各种各样的新闻服务器以及其它相关的程序(譬如 <command>suck</command>)以各种各样的方式使用 news 用户和组. 在 news spool 中的文件通常为 news 用户和组拥有. 用于投递新闻的程序,如 inews 就是典型的 SETGID news.

en: uucp: The uucp user and group is used by the UUCP subsystem. It owns spool and configuration files. Users in the uucp group may run uucico.
zh_CN: uucp: uucp 用户和组由 UUCP 子系统使用. 其拥有 spool 和配置文件. 属于 uucp 组的用户,可以运行 uucico.

en: proxy: Like daemon, this user and group is used by some daemons (specifically, proxy daemons) that don't have dedicated user id's and that need to own files. For example, group proxy is used by <command>pdnsd</command>, and <command>squid</command> runs as user proxy.
zh_CN: proxy: 如 daemon, 此用户和组由一些没有指定用户id, 但是需要拥有文件的守护进程(具体的, proxy 守护进程)使用. 例如, proxy 组由 <command>pdnsd</command> 使用, <command>squid</command> 以proxy用户运行.

en: majordom: <command>Majordomo</command> has a statically allocated UID on Debian systems for historical reasons. It is not installed on new systems.
zh_CN: majordom: 在Debian系统中, 因为历史的原因, <command>Majordomo</command> 有一个静态分配的 UID. 新的系统中没有.

en: postgres: <command>Postgresql</command> databases are owned by this user and group. All files in <filename>/var/lib/postgresql</filename> are owned by this user to enforce proper security.
zh_CN: postgres: <command>Postgresql</command> 数据库由这个用户和组拥有. 因为安全的原因, 目录 <filename>/var/lib/postgresql</filename> 下的所有文件由此用户拥有.

en: backup: So backup/restore responsibilities can be locally delegated to someone without full root permissions.
zh_CN: backup: 这样, 备份/恢复的任务可以委派没有完全 root 权限的用户.

en: operator: Operator is historically (and practically) the only 'user' account that can login remotely, and doesn't depend on NIS/NFS.
zh_CN: operator: operator 是过去(和现在)唯一可以不依赖于 NIS/NFS 远程登陆而'用户'账号.

en: list: Mailing list archives and data are owned by this user and group. Some mailing list programs may run as this user as well.
zh_CN: list: 邮件列表文件和数据由此用户和组拥有. 一些邮件列表程序也是以此用户运行.

en: irc: Used by irc daemons. A statically allocated user is needed only because of a bug in <command>ircd</command>, which SETUID()s itself to a given UID on startup.
zh_CN: irc: 由 irc 守护进程使用. 因为 <command>ircd</command> 的一个 bug, 需要分配一个静态用户, 启动时, 它将自身 SETUID() 给一个指定 UID.

en: nobody, nogroup: Daemons that need not own any files run as user nobody and group nogroup. Thus, no files on a system should be owned by this user or group.
zh_CN: nobody, nogroup: 不需要拥有任何文件的守护进程以用户 nobody 和组 nogroup 的方式运行. 因此, 此用户和组在一个系统上不会拥有任何文件.

en: Other groups which have no associated user:
zh_CN: 其它没有相关用户的组:

en: adm: Group adm is used for system monitoring tasks. Members of this group can read many log files in <filename>/var/log</filename>, and can use xconsole. Historically, <filename>/var/log</filename> was <filename>/usr/adm</filename> (and later <filename>/var/adm</filename>), thus the name of the group.
zh_CN: adm: adm 组由系统监控任务使用. 这个组的成员对 <filename>/var/log</filename> 下的许多日志文件有读权限. 并且可以使用 xconsole. 过去, <filename>/var/log</filename> 就是 <filename>/usr/adm</filename>(后来是 <filename>/var/adm</filename>). 这是这个组名字的由来.

en: tty: TTY devices are owned by this group. This is used by write and wall to enable them to write to other people's TTYs.
zh_CN: tty: TTY 设备由这个组拥有. 这样可以将 write 和 wall 操作传到其它人的 TTY 上.

en: disk: Raw access to disks. Mostly equivalent to root access.
zh_CN: disk: raw 对磁盘的访问, 等同于 root 的访问.

en: kmem: /dev/kmem and similar files are readable by this group. This is mostly a BSD relic, but any programs that need direct read access to the system's memory can thus be made SETGID kmem.
zh_CN: kmem: 此组可以读取 /dev/kmem 和类似的文件, 这是BSD的一个主要遗留痕迹, 任何需要直接读去系统内存的程序都需要 SETGID 为 kmem.

en: dialout: Full and direct access to serial ports. Members of this group can reconfigure the modem, dial anywhere, etc.
zh_CN: dialout: 对串口的全部和直接访问. 此组的成员可以对调制解调器, dial anywhere 等进行再配置.

en: dip: The group's name stands for "Dial-up IP", and membership in dip allows you to use tools like <command>ppp</command>, <command>dip</command>, <command>wvdial</command>, etc. to dial up a connection. The users in this group cannot configure the modem, but may run the programs that make use of it.
zh_CN: dip: 此组的标准名称为"Dial-up IP", 此组的成员允许使用<command>ppp</command>, <command>dip</command>, <command>wvdial</command>, 等一类的工具, 进行拨号连接. 这个组的用户不允许配置调制解调器, 但是可以运行使用它的程序.

en: fax: Allows members to use fax software to send / receive faxes.
zh_CN: fax: 允许成员使用fax软件收/发传真.

en: voice: Voicemail, useful for systems that use modems as answering machines.
zh_CN: voice: Voicemail, 对于使用调制解调器作为电话答录机的系统非常有用.

en: cdrom: This group can be used locally to give a set of users access to a CDROM drive.
zh_CN: cdrom: 这个组可以用来在本地分配给用户对 CDROM 的访问权限.

en: floppy: This group can be used locally to give a set of users access to a floppy drive.
zh_CN: floppy: 这个组可以用来在本地分配给用户对软驱的访问权限.

en: tape: This group can be used locally to give a set of users access to a tape drive.
zh_CN: tape: 这个组可以用来在本地分配给用户对磁带机的访问权限.

en: sudo: Members of this group don't need to type their password when using <command>sudo</command>. See <filename>/usr/share/doc/sudo/OPTIONS</filename>.
zh_CN: sudo: 当使用 <command>sudo</command> 时, 这个组的成员不需要键入密码. 参阅 <filename>/usr/share/doc/sudo/OPTIONS</filename>.

en: audio: This group can be used locally to give a set of users access to an audio device.
zh_CN: audio: 这个组可以用来在本地分配给用户对 audio 设备的访问权限.

en: src: This group owns source code, including files in <filename>/usr/src</filename>. It can be used locally to give a user the ability to manage system source code.
zh_CN: src: 这个组拥有源代码，包括 <filename>/usr/src</filename> 目录下的文件. 可以用来在本地给用户分配管理系统源代码的能力.

en: shadow: <filename>/etc/shadow</filename> is readable by this group. Some programs that need to be able to access the file are SETGID shadow.
zh_CN: shadow: 这个组可以读取 <filename>/etc/shadow</filename>. 需要访问这个文件的一些程序需要 SETGID 为 shadow.

en: utmp: This group can write to <filename>/var/run/utmp</filename> and similar files. Programs that need to be able to write to it are SETGID utmp.
zh_CN: utmp: 这个组可以对 <filename>/var/run/utmp</filename> 和类似的文件进行写操作. 需要对此类文件进行写操作的程序需要 SETGID 为 utmp.

en: staff: Allows users to add local modifications to the system (<filename>/usr/local</filename>, <filename>/home</filename>) without needing root privileges. Compare with group "adm", which is more related to monitoring/security.
zh_CN: staff: 允许用户添加对系统((<filename>/usr/local</filename>, <filename>/home</filename>)的本地修改, 而不需要特权. 与 "adm" 组相比, 更 monitoring/security.

en: users: While Debian systems use the private user group system by default (each user has their own group), some prefer to use a more traditional group system, in which each user is a member of this group.
zh_CN: users: 当 Debian 系统使用默认的私有用户组系统(每个用户都有他们自己的组)时, 有些更愿使用传统的组系统, 所有用户都是此组的一个成员.

en: What is the difference between the adm and the staff group?
zh_CN: adm 组和 staff 组之间有什么区别?

en: The 'adm' group are usually administrators, and this group permission allows them to read log files without having to <command>su</command>. The 'staff' group are usually help-desk/junior sysadmins, allowing them to work in <filename>/usr/local</filename> and create directories in <filename>/home</filename>.
zh_CN: 'adm' 组的成员通常为管理员, 这个组的权限允许他们不用 <command>su</command> 就能读取日志文件. 'staff' 组则通常为 help-desk/junior sysadmins, 允许成员在 <filename>/usr/local</filename> 目录下操作, 和在 <filename>/home</filename> 目录下创建目录.

en: Why is there a new group when I add a new user? (or Why does Debian give each user one group?)
zh_CN: 为什么我创建新用户时, 会同时出现一个新组?(或为什么 Debian 为每个用户创建一个所属组?)

en: The default behavior in Debian is that each user has its own, private group. The traditional UN*X scheme assigned all users to the <emphasis>users</emphasis> group. Additional groups were created and used to restrict access to shared files associated with different project directories. Managing files became difficult when a single user worked on multiple projects because when someone created a file, it was associated with the primary group to which they belong (e.g. 'users').
zh_CN: 在 Debian 中, 缺省设置为每个用户都有一个私有组. 传统的 UN*X 方案为每个用户指定了<emphasis>用户</emphasis>组. 创建的其它的组用于限制对不同项目目录下的共享文件的访问. 当单个用户操作多个项目时, 如果某个用户创建了一个文件, 文件的管理将变的困难, 它同它所属的主要组联系在一起(如,'users').

en: Debian's scheme solves this problem by assigning each user to their own group; so that with a proper umask (0002) and the SETGID bit set on a given project directory, the correct group is automatically assigned to files created in that directory. This makes it easier for people who work on multiple projects, because they will not have to change groups or umasks when working on shared files.
zh_CN: Debian 的方案是通过为每个用户指定一个他们自己的组解决了这一问题; 这样可以带有一个合适的 umask(0002)并且对给定项目目录设置了 SETGID 位, 在此目录下创建的文件都被正确的指定了组. 这使得处理多个项目更加简单, 因为不必切换所属的组或 umask.

en: You can, however, change this behavior by modifying <filename>/etc/adduser.conf</filename>. Change the <emphasis>USERGROUPS</emphasis> variable to 'no', so that a new group is not created when a new user is created. Also, set <emphasis>USERS_GID</emphasis> to the GID of the users group which all users will belong to.
zh_CN: 然而, 您也可以通过修改 <filename>/etc/adduser.conf</filename> 来改变这一特性. 修改 <emphasis>USERGROUPS</emphasis> 变量为 'no', 这样当创建用户时就不会伴随产生一个新组了. 也可以设置 <emphasis>USERS_GID</emphasis> 为所有用户都属于的组的GID.

en: Why are all services activated upon installation?
zh_CN: 为什么所有的服务安装后都被激活了?

en: That's just an approach to the problem of being, on one side, security conscious and on the other side user friendly. Unlike OpenBSD, which disables all services unless activated by the administrator, Debian GNU/Linux will activate all installed services unless deactivated (see <xref linkend="disableserv" /> for more information). After all you installed the service, didn't you?
zh_CN: 这只是解决问题的一种方法, 既考虑到了安全性, 又兼顾对用户的友好. 除非管理员将其激活, OpenBSD 将禁用所服务. 与此不同除非将其禁用, Debian GNU/Linux 会激活所有安装的服务(更多信息参见 <xref linkend="disableserv" />). 在您安装了服务之后, 不是这样吗?

en: There has been much discussion on Debian mailing lists (both at debian-devel and at debian-security) regarding which is the better approach for a standard installation. However, as of this writing (March 2002), there still isn't a consensus.
zh_CN: 对于标准安装, 哪个是更好的解决方案, 在 Debian 的邮件列表(debian-devel 和 debian-security)上有更多的讨论, 然而, 到目前为止(2002年3月), 仍然没有达成共识.

en: Can I remove <command>inetd</command>?
zh_CN: 我能删除 <command>inetd</command> 吗?

en: Why do I have port 111 open?
zh_CN: 为什么我的111端口是打开的?

en: Port 111 is sunrpc's portmapper, and it is installed by default as part of Debian's base installation since there is no need to know when a user's program might need RPC to work correctly. In any case, it is used mostly for NFS. If you do not need it, remove it as explained in <xref linkend="rpc" />.
zh_CN: 端口111是 sunrpc 的 portmapper，它是 Debian 的基本安装的默认部分, 因为不必知道何时用户的程序需要 RPC 才能正确运行. 无论如何, 它主要由 NFS 使用. 如果您不需要它, 您可以依照 <xref linkend="rpc" /> 的说明将其删除.

en: What use is <command>identd</command> (port 113) for?
zh_CN: <command>identd</command>(port 113)的主要用途是什么?

en: Identd service is an authentication service that identifies the owner of a specific TCP/IP connection to the remote server accepting the connection. Typically, when a user connects to a remote host, <command>inetd</command> on the remote host sends back a query to port 113 to find the owner information. It is often used by mail, FTP and IRC servers, and can also be used to track down which user in your local system is attacking a remote system.
zh_CN: Identd 服务是一个认证服务, 用于鉴别某个 TCP/IP 远程服务连接的拥有者的身份. 一个典型的例子, 当用户连接到远程主机, 远程主机上的 <command>inetd</command> 向113端口发回一个查询到, 索取用户信息, 通常由 mail, FTP 和 IRC 服务器使用, 也可用于跟踪您本地系统中的哪个用户试图攻击一个远程系统.

en: I have services using port 1 and 6, what are they and how can I remove them?
zh_CN: 使用 1 到 6 端口的是什么服务,如果删除?

en: If you have run the command <literal>netstat -an</literal> and receive:
zh_CN: 运行命令 <literal>netstat -an</literal>, 您会看到:

en: I found the port XYZ open, can I close it?
zh_CN: 我发现端口 XYZ 打开了, 可以将其关闭吗?

en: Yes, of course. The ports you are leaving open should adhere to your individual site's policy regarding public services available to other networks. Check if they are being opened by <command>inetd</command> (see <xref linkend="inetd" />), or by other installed packages and take the appropriate measures (i.e, configure inetd, remove the package, avoid it running on boot-up).
zh_CN: 是的，当然可以. 您所开放的端口应当遵循您的个人站点关于对其它网络提供公共服务的策略. 检查由 <command>inetd</command> 打开的端口(参见 <xref linkend="inetd" />), 或由于安装的其它软件包打开的端口, 并采取适当的措施(即,配置 inetd, 删除这个软件包, 避免其启动时运行).

en: Will removing services from <filename>/etc/services</filename> help secure my box?
zh_CN: 从 <filename>/etc/services</filename> 中删除服务, 是否对我的主机的安全有帮助?

en: <emphasis>No</emphasis>, <filename>/etc/services</filename> only provides a mapping between a virtual name and a given port number. Removing names from this file will not (usually) prevent services from being started. Some daemons may not run if <filename>/etc/services</filename> is modified, but that's not the norm. To properly disable the service, see <xref linkend="disableserv" />.
zh_CN: <emphasis>否</emphasis>, <filename>/etc/services</filename> 只是在真实名称和指定端口号之间提供一种映射. 从此文件中删除服务名并不能(通常)阻止运行的服务. <filename>/etc/services</filename> 修改后一些守护进程可能不能运行了, 但这样做并不规范. 正确的禁用服务的方法, 参见 <xref linkend="disableserv" />.

en: Common security issues
zh_CN: 常见安全问题

en: I have lost my password and cannot access the system!
zh_CN: 我的密码丢了，无法访问系统了!

en: The steps you need to take in order to recover from this depend on whether or not you have applied the suggested procedure for limiting access to <command>lilo</command> and your system's BIOS.
zh_CN: 您所需要做的恢复步骤与您是否采纳了限制访问 <command>lilo</command> 和系统的 BIOS 的建议有关.

en: If you have limited both, you need to disable the BIOS setting that only allows booting from the hard disk before proceeding. If you have also forgotten your BIOS password, you will have to reset your BIOS by opening the system and manually removing the BIOS battery.
zh_CN: 如果您两个都做了限制, 则进行下一步前, 您需要禁用只能从硬盘启动的 BIOS 设定. 如果你连 BIOS 的密码也忘了, 就需要打开机箱, 取下BIOS 的电池, 将 BIOS 的设置复位.

en: Once you have enabled booting from a CD-ROM or diskette enable, try the following:
zh_CN: 一旦您设定了从 CD-ROM 或软盘启动,尝试以下步骤:

en: Boot-up from a rescue disk and start the kernel
zh_CN: 由救援盘启动内核

en: Go to the virtual console (Alt+F2)
zh_CN: 转到虚拟控制台(Alt+F2)

en: Mount the hard disk where your /root is
zh_CN: 挂接 /root 所在硬盘分区

en: Edit (Debian 2.2 rescue disk comes with the editor <command>ae</command>, and Debian 3.0 comes with <command>nano-tiny</command> which is similar to <command>vi</command>) <filename>/etc/shadow</filename> and change the line:
zh_CN: 编辑(Debian2.2 救援盘提供 <command>ae</command> 编辑器, Debian3.0 提供与 <command>vi</command> 很相似的 <command>nano-tiny</command>)<filename>/etc/shadow</filename> 并修改:

en: This will remove the forgotten root password, contained in the first colon separated field after the user name. Save the file, reboot the system and login with root using an empty password. Remember to reset the password. This will work unless you have configured the system more tightly, i.e. if you have not allowed users to have null passwords or not allowed root to login from the console.
zh_CN: 这将删除遗忘的 root 密码, 包含在用户名之后第一个冒号分割的部分. 保存修改, 重起系统, 以 root 使用空密码登录. 记得重新设置密码. 这样就可行了, 除非您更严谨的配置了系统, 即您不允许用户使用空密码登录, 或不允许 root 由控制台登录.

en: If you have introduced these features, you will need to enter into single user mode. If LILO has been restricted, you will need to rerun <command>lilo</command> just after the root reset above. This is quite tricky since your <filename>/etc/lilo.conf</filename> will need to be tweaked due to the root (/) file system being a ramdisk and not the real hard disk.
zh_CN: 如果使用这些特性, 则您将需要以单用户模式进入. 如果对 LILO 做了限制, 则您需要在 root 重新设置了上述之后再次运行 <command>lilo</command>. 这相当棘手, 因为你的 <filename>/etc/lilo.conf</filename> 需要根据 root(/)文件系统来调整, 而不是真正的硬盘

en: Once LILO is unrestricted, try the following:
zh_CN: 一旦没有了 LILO 限制，尝试以下步骤:

en: Press the Alt, shift or Control key just before the system BIOS finishes, and you should get the LILO prompt.
zh_CN: 在系统 BIOS 完成之前按下 Alt, shift 或 Control 键, 您会得到 LILO 提示符.

en: Type <literal>linux single</literal>, <literal>linux init=/bin/sh</literal> or <literal>linux 1</literal> at the prompt.
zh_CN: 在提示符后键入 <literal>linux single</literal>, <literal>linux init=/bin/sh</literal> 或 <literal>linux 1</literal>.

en: This will give you a shell prompt in single-user mode (it will ask for a password, but you already know it)
zh_CN: 这样您会得到一个单用户模式下的 shell 提示符(将提示键入密码, 但是您已经知道了)

en: Re-mount read/write the root (/) partition, using the mount command.
zh_CN: 使用 mount 命令, 重新以 read/write 模式挂接 root(/) 分区.

en: Change the superuser password with <command>passwd</command> (since you are superuser it will not ask for the previous password).
zh_CN: 使用 <command>passwd</command> 命令修改超级用户密码(因为您就是超级用户, 所有不会要求您提供原密码).

en: How do I accomplish setting up a service for my users without giving out shell accounts?
zh_CN: 如何配置不需要分配用户 shell 账号的服务?

en: to, for example, ldap:
zh_CN: 为, 例如, 对于 ldap 来说:

en: In the case of LDAP directories, some services provide LDAP schemas to be included in your directory that are required in order to use LDAP authentication. If you are using a relational database, a useful trick is to use the <emphasis>where</emphasis> clause when configuring the PAM modules. For example, if you have a database with the following table attributes:
zh_CN: 就 LDAP 目录而论，为了使用 LDAP 认证, 一些服务需要在您的目录中提供 LDAP 方案. 如果您使用关系数据库，可以在配置 PAM 模块时, 使用一个有趣的设定. 例如, 如果您有一个带有如下表属性的数据库:

en: By making the services attributes boolean fields, you can use them to enable or disable access to the different services just by inserting the appropriate lines in the following files:
zh_CN: 通过标记服务的属性布尔字段, 就可以启用或禁用对于不同服务的访问, 仅仅需要在下列文件插入合适的内容:

en: My system is vulnerable! (Are you sure?)
zh_CN: 我的系统存在漏洞!(您确认吗?)

en: Vulnerability assessment scanner X says my Debian system is vulnerable!
zh_CN: 某个漏洞评估扫描工具说我的 Debian 系统存在漏洞！

en: Many vulnerability assessment scanners give false positives when used on Debian systems, since they only use version checks to determine if a given software package is vulnerable, but do not really test the security vulnerability itself. Since Debian does not change software versions when fixing a package (many times the fix made for newer releases is back ported), some tools tend to think that an updated Debian system is vulnerable when it is not.
zh_CN: 许多漏洞评估扫描器在 Debian 系统上使用不能给予肯定的回答, 因为它们通过版本检查来确定给定软件包是否存在漏洞, 并不真正的进行安全漏洞测试. 因为 Debian 在修正软件漏洞后并不修改软件版本信息 (很多时候, 修复一个更新版本仅仅是移植), 一些工具认为一个更新了的 Debian 系统是存在漏洞的, 即使并不是这样.

en: If you think your system is up to date with security patches, you might want to use the cross references to security vulnerability databases published with the DSAs (see <xref linkend="dsa" />) to weed out false positives, if the tool you are using includes CVE references.
zh_CN: 如果您认为您的系统已经更新了最新的安全补丁, 可以与 DSA(参见 <xref linkend="dsa" />) 公布的安全漏洞数据库相参考, 识别虚假信息, 如果您使用的工具包括 CVE 参考.

en: I've seen an attack in my system's logs. Is my system compromised?
zh_CN: 我在系统日志中看到一次攻击. 我的系统被入侵了吗?

en: I have found strange 'MARK' lines in my logs: Am I compromised?
zh_CN: 我在日志中发现了奇怪的 'MARK' 行: 我被入侵了吗??

en: You might find the following lines in your system logs:
zh_CN: 您也许在系统日志中发现了如下内容:

en: I found users using 'su' in my logs: Am I compromised?
zh_CN: 在日志中发现有用户使用'su': 我被入侵了?

en: You might find lines in your logs like:
zh_CN: 有可能您在日志中发现如下类似内容:

en: Don't worry too much. Check to see if these entries are due to <command>cron</command> jobs (usually <filename>/etc/cron.daily/find</filename> or <command>logrotate</command>):
zh_CN: 不必太担心. 检查这些内容是否与 <command>cron</command> 有关 (通常为 <filename>/etc/cron.daily/find</filename> 或 <command>logrotate</command>):

en: If you see entries like these in your logs:
zh_CN: 如果您在日志中发现了如下类似内容:

en: Check if there is a high number of connections to the server using <command>netstat</command>, for example:
zh_CN: 用 <command>netstat</command> 检查服务器是否存在大量的连接, 例如:

en: This is an indication of a denial of service (DoS) attack against your system's X port (most likely against a public service such as a web server or mail server). You should activate TCP syncookies in your kernel, see <xref linkend="tcp-syncookies" />. Note, however, that a DoS attack might flood your network even if you can stop it from crashing your systems (due to file descriptors being depleted, the system might become unresponsive until the TCP connections timeout). The only effective way to stop this attack is to contact your network provider.
zh_CN: 这表明对您的系统的 X 端口(通常是对应公共服务, 如 web 服务器, 或邮件服务器)进行了拒绝服务(DoS)攻击. 您应当激活内核中的 TCP syncookies, 参阅 <xref linkend="tcp-syncookies" />. 但是, 应当注意, 这样即使您能避免系统被搞瘫, 一个 DoS 攻击仍能湮没您的网络(由于资源标示被耗尽, 系统也许暂时无法应答 TCP 连接, 直至超时). 最有效的解决方法是联系您的网络提供商.

en: I have found strange root sessions in my logs: Am I compromised?
zh_CN: 在日志中发现了奇怪的 root 会话: 我被入侵了?

en: You might see these kind of entries in your <filename>/var/log/auth.log</filename> file:
zh_CN: 在 <filename>/var/log/auth.log</filename> 文件中, 也许您会发现如下类似内容:

en: These are due to a <command>cron</command> job being executed (in this example, every five minutes). To determine which program is responsible for these jobs, check entries under: <filename>/etc/crontab</filename>, <filename>/etc/cron.d</filename>, <filename>/etc/crond.daily</filename> and root's <filename>crontab</filename> under <filename>/var/spool/cron/crontabs</filename>.
zh_CN: 这与执行的 <command>cron</command> 任务有关(在这个例子中,每5分钟一次). 确定哪个程序对应这些任务, 检查如下目录中的内容: <filename>/etc/crontab</filename>, <filename>/etc/cron.d</filename>, <filename>/etc/crond.daily</filename> 和 root 的 <filename>crontab</filename> 目录.

en: I have suffered a break-in, what do I do?
zh_CN: 我被入侵了, 怎么办?

en: There are several steps you might want to take in case of a break-in:
zh_CN: 这种情况下,也许您应当采取如下措施:

en: Read this document, especially the <xref linkend="after-compromise" /> section.
zh_CN: 阅读本文档, 尤其 <xref linkend="after-compromise" /> 部分.

en: Ask for assistance. You might use the debian-security mailing list and ask for advice on how to recover/patch your system.
zh_CN: 寻求帮助. 您可以使用 Debian 安全邮件列表, 寻求如何恢复/修补您的系统的建议.

en: How can I trace an attack?
zh_CN: 如何跟踪攻击?

en: By watching the logs (if they have not been tampered with), using intrusion detection systems (see <xref linkend="intrusion-detect" />), <command>traceroute</command>, <command>whois</command> and similar tools (including forensic analysis), you may be able to trace an attack to the source. The way you should react to this information depends solely on your security policy, and what <emphasis>you</emphasis> consider is an attack. Is a remote scan an attack? Is a vulnerability probe an attack?
zh_CN: 查看日志(如果还未被篡改), 使用入侵检测系统(参见 <xref linkend="intrusion-detect" />), <command>traceroute</command>, <command>whois</command> 和其它简单的工具(包括事故分析), 您也许能跟踪到攻击源. 这种方法是否有效与您的安全策略, 以及<emphasis>您</emphasis>认为什么是攻击有关. 远程扫描是攻击吗? 漏洞探测是攻击吗?

en: Program X in Debian is vulnerable, what do I do?
zh_CN: Debian 系统中的程序 X 存在漏洞, 我该怎么办?

en: The version number for a package indicates that I am still running a vulnerable version!
zh_CN: 软件包的版本号表明，我正在运行一个存在漏洞的版本!

en: Specific software
zh_CN: 特定软件

en: That's just the way <command>portsentry</command> works. It opens about twenty unused ports to try to detect port scans.
zh_CN: 这是 <command>portsentry</command> 的工作方式. 它打开大约二十个未使用的端口用于确定端口扫描.

en: Questions regarding the Debian security team
zh_CN: 有关 Debian 安全小组的问题
