harden-doc 3.19 - en to zh_CN translation catalogue (116 entries)

en: The hardening process step by step
zh_CN: 循序渐进安全化

en: Below is a post-installation, step-by-step procedure for hardening a Debian 2.2 GNU/Linux system. This is one possible approach to such a procedure and is oriented toward the hardening of network services. It is included to show the entire process you might use during configuration. Also, see <xref linkend="checklist" />.
zh_CN: 下边是安装完成后, 来循序渐进的增强 Debian 2.2 GNU/Linux 系统的安全性. 对于增强网络服务的安全性, 这是一种可行的方法. 这包括展示您的整个配置过程. 更多信息参见 <xref linkend="checklist" />.

en: Using <command>dselect</command>, remove all unneeded but selected packages before doing [I]nstall. Keep the bare minimum of packages for the system.
zh_CN: 使用 <command>dselect</command>, 删除在前边使用 [I]nstall 时安装了但是并不需要的软件包. 使得系统安装的软件包最少.

en: Update all software from the latest packages available at security.debian.org as explained previously in <xref linkend="security-update" />.
zh_CN: 如前边 <xref linkend="security-update" /> 阐明的, 从 security.debian.org 更新所有的软件包.

en: Implement the suggestions presented in this manual regarding user quotas, login definitions and <command>lilo</command>
zh_CN: 实现本手册前边提出的建议, 特边是用户限额, 登录定义和 <command>lilo</command>

en: Make a list of services currently running on your system. Try:
zh_CN: 构建一个系统当前运行服务的列表. 尝试:

en: In order to remove unnecessary services, first determine what package provides the service and how it is started. This can be accomplished by checking the program that listens in the socket. The following shell script, which uses the programs <command>lsof</command> and <command>dpkg</command>, does just that:
zh_CN: 为了删除多余的服务, 首先应当确定服务是由什么软件包提供的, 它是如何启动的. 这可以通过检查程序监听的 socket 来确定. 下边使用了 <command>lsof</command> 和 <command>dpkg</command> 程序的脚本可以完成这一任务:

en: Once you find any unwanted services, remove the associated package (with <command>dpkg --purge</command>), or disable the service from starting automatically at boot time using <command>update-rc.d</command> (see <xref linkend="disableserv" />).
zh_CN: 一旦发现了您不需要的任务, 删除相关软件包(使用 <command>dpkg --purge</command>), 或使用 <command>update-rc.d</command>(参阅 <xref linkend="disableserv" />) 禁止服务在启动时自动运行.

en: For inetd services (launched by the superdaemon), check which services are enabled in <filename>/etc/inetd.conf</filename> using:
zh_CN: 对于 inetd 服务(由超级用户装入的), 检查在 <filename>/etc/inetd.conf</filename> 中启用了哪些服务:

en: Then disable those services that are not needed by commenting out the line that includes them in <filename>/etc/inetd.conf</filename>, removing the package, or using <command>update-inetd</command>.
zh_CN: 然后通过注释掉 <filename>/etc/inetd.conf</filename> 中的对应行, 将其禁用, 删除对应软件包, 或使用 <command>update-inetd</command>.

en: If you have wrapped services (those using <command>/usr/sbin/tcpd</command>), check that the files <filename>/etc/hosts.allow</filename> and <filename>/etc/hosts.deny</filename> are configured according to your service policy.
zh_CN: 如果您使用了 wrapped 服务(它们使用 <command>/usr/sbin/tcpd</command>), 根据您的服务策略, 检查 <filename>/etc/hosts.allow</filename> 和 <filename>/etc/hosts.deny</filename> 文件的配置.

en: If the server uses more than one external interface, depending on the service, you may want to limit the service to listen on a specific interface. For example, if you want internal FTP access only, make the FTP daemon listen only on your management interface, not on all interfaces (i.e, 0.0.0.0:21).
zh_CN: 如果服务器使用了多个外部接口, 根据服务, 您可以限制服务只监听特定的接口. 例如, 如果您只允许内网访问 FTP, 那么就配置 FTP 守护进程只监听您管理的接口, 而不是所有接口(即, 0.0.0.0:21).

en: Check the services now available, and, if necessary, repeat the steps above.
zh_CN: 检查现在的服务, 并, 如果需要, 重复上边的步骤.

en: Now install the needed services, if you have not done so already, and configure them properly.
zh_CN: 现在, 安装所需服务, 如果, 您还没有做好, 正确的配置它们...

en: Use the following shell command to determine what user each available service is running as:
zh_CN: 使用下边的 shell 命令, 确定服务是以什么用户运行的:

en: Consider changing these services to a specific user/group and maybe <command>chroot</command>'ing them for increased security. You can do this by changing the <filename>/etc/init.d</filename> scripts which start the service. Most services in Debian use <command>start-stop-daemon</command>, which has options (<literal>--change-uid</literal> and <literal>--chroot</literal>) for accomplishing this. A word of warning regarding the <command>chroot</command>'ing of services: you may need to put all the files installed by the package (use dpkg -L) providing the service, as well as any packages it depends on, in the <command>chroot</command>'ed environment. Information about setting up a <command>chroot</command> environment for the <command>ssh</command> program can be found in <xref linkend="chroot-ssh-env" />.
zh_CN: 考虑用指定的用户/组运行这些服务, 为了增强安全性, 也可为它们设置 <command>chroot</command>. 您可以通过修改启动服务的脚本 <filename>/etc/init.d</filename> 达到这个目的. Debian 中许多服务使用 <command>start-stop-daemon</command>, 它们都有完成这种设置的选项 (<literal>--change-uid</literal> 和 <literal>--chroot</literal>). 有关为服务设置 <command>chroot</command> 的警告信息: 您可能需要将服务对应软件包(使用 dpkg -L)所安装的所有文件, 以及其依赖的软件包, 置于 <command>chroot</command> 环境中. 有关配置 <command>ssh</command> 的 <command>chroot</command> 环境的信息, 参阅 <xref linkend="chroot-ssh-env" />.

en: Repeat the steps above in order to check that only desired services are running and that they are running as the desired user/group combination.
zh_CN: 重复上边的步骤, 直至只有所希望的服务运行, 并且与希望的用户/组绑定.

en: Test the installed services in order to see if they work as expected.
zh_CN: 测试安装的服务是否与期望相符.

en: Repeat the network scanner step and verify that the intrusion detection systems are working correctly.
zh_CN: 重复进行网络扫描和入侵检测校验, 直至确定系统运行正常.

en: For the truly paranoid, also consider the following:
zh_CN: 下边是更加偏执的做法:

en: Add firewalling capabilities to the system, accepting incoming connections only to offered services and limiting outgoing connections only to those that are authorized.
zh_CN: 提高系统防火墙的性能, 只接受对所提供服务的连入访问, 并限制连出访问, 只允许授权的连接通行.

en: Re-check the installation with a new vulnerability assessment using a network scanner.
zh_CN: 使用网络扫描器, 再次对系统进行漏洞评估.

en: Using a network scanner, check outbound connections from the system to an outside host and verify that unwanted connections do not find their way out.
zh_CN: 使用网络扫描器, 检查系统指向外部站点的出站连接, 确保没有多余的连出连接.

en: FIXME: this procedure considers service hardening but not system hardening at the user level, include information regarding checking user permissions, SETUID files and freezing changes in the system using the ext2 file system.
zh_CN: FIXME: 这个过程只是考虑增强服务的安全性, 而不是在用户级别上增强系统的安全性, 包括检查用户权限的信息, SETUID 文件和使用 ext2 文件系统的冻结修改.

en: Configuration checklist
zh_CN: 配置清单

en: FIXME: This is based on v1.4 of the manual and might need to be updated.
zh_CN: FIXME: 这些内容基于手册的 1.4 版, 也许需要更新了..

en: Limit physical access and booting capabilities
zh_CN: 限制物理访问和启动

en: Set a LILO or GRUB password (<filename>/etc/lilo.conf</filename> or <filename>/boot/grub/menu.lst</filename>, respectively); check that the LILO or GRUB configuration file is read-protected.
zh_CN: 设置 LILO 或 GRUB 密码(<filename>/etc/lilo.conf</filename> 或 <filename>/boot/grub/menu.lst</filename>, 分别); 检查LILO 或 GRUB 配置文件是否为只读保护.

en: Partitioning
zh_CN: 分区

en: Separate user-writable data, non-system data, and rapidly changing run-time data to their own partitions
zh_CN: 用户可写数据, 非系统数据, 和运行时频繁改变的数据与安装分区分离.

en: Password hygiene and login security
zh_CN: 密码学和登陆安全

en: Set a good root password
zh_CN: 设置一个好的 root 密码

en: Install and use PAM
zh_CN: 安装并使用 PAM

en: Add MD5 support to PAM and make sure that (generally speaking) entries in <filename>/etc/pam.d/</filename> files which grant access to the machine have the second field in the pam.d file set to <literal>requisite</literal> or <literal>required</literal>.
zh_CN: 增加PAM 对 MD5 的支持, 并确保(一般而言) <filename>/etc/pam.d/</filename> 下的文件中授权对机器的访问条目, 第二个域设为 <literal>requisite</literal> 或 <literal>required</literal>

en: Tweak <filename>/etc/pam.d/login</filename> so as to only permit local root logins.
zh_CN: 调整 <filename>/etc/pam.d/login</filename> 以使只允许本地 root 登陆.

en: Also mark authorized tty:s in <filename>/etc/security/access.conf</filename> and generally set up this file to limit root logins as much as possible.
zh_CN: 在 <filename>/etc/security/access.conf</filename> 中标记 authorized tty:s ,通常配置此文件以尽量限制 root 登录.

en: Add pam_limits.so if you want to set per-user limits
zh_CN: 如果要对每个用户设置限制, 增加 pam_limits.so.

en: Tweak <filename>/etc/pam.d/passwd</filename>: set minimum length of passwords higher (6 characters maybe) and enable MD5
zh_CN: 调整 <filename>/etc/pam.d/passwd</filename>: 增大密码的最小长度设置(可能为 6 字符) 并启用 MD5

en: Add group wheel to <filename>/etc/group</filename> if desired; add pam_wheel.so group=wheel entry to <filename>/etc/pam.d/su</filename>
zh_CN: 如果需要, 在 <filename>/etc/group</filename> 中增加 wheel 组; 在 <filename>/etc/pam.d/su</filename> 中增加 pam_wheel.so group=wheel条目

en: For custom per-user controls, use pam_listfile.so entries where appropriate
zh_CN: 适当的使用 pam_listfile.so 条目, 以习惯每个用户的控制

en: Have an <filename>/etc/pam.d/other</filename> file and set it up with tight security
zh_CN: 增加 <filename>/etc/pam.d/other</filename> 文件, 以设置更高的安全性.

en: Set up limits in <filename>/etc/security/limits.conf</filename> (note that <filename>/etc/limits</filename> is not used if you are using PAM)
zh_CN: 配置 <filename>/etc/security/limits.conf</filename>(注意 如果您使用 PAM, 则<filename>/etc/limits</filename>不会被使用)

en: Tighten up <filename>/etc/login.defs</filename>; also, if you enabled MD5 and/or PAM, make sure you make the corresponding changes here, too
zh_CN: 配置 <filename>/etc/login.defs</filename>; 还有, 如果您启用了 MD5 和/或 PAM, 确保在对应处也做了修改

en: Disable root ftp access in <filename>/etc/ftpusers</filename>
zh_CN: 在 <filename>/etc/ftpusers</filename> 中禁止 root 的 ftp 访问

en: Use PAM to enforce additional constraints on logins?
zh_CN: 使用 PAM 登录时强制附加另外的限制?

en: Other local security issues
zh_CN: 其它本地安全问题

en: Kernel tweaks (see <xref linkend="kernel-conf" />)
zh_CN: 调整内核(参见 <xref linkend="kernel-conf" />)

en: Kernel patches (see <xref linkend="kernel-patches" />)
zh_CN: 内核补丁(参见 <xref linkend="kernel-patches" />)

en: Tighten up log file permissions (<filename>/var/log/{last,fail}log</filename>, Apache logs)
zh_CN: 限制日志文件的访问(<filename>/var/log/{last,fail}log</filename>, Apache 日志)

en: Verify that SETUID checking is enabled in <filename>/etc/checksecurity.conf</filename>
zh_CN: 确保在 <filename>/etc/checksecurity.conf</filename> 中启用了 SETUID 检查

en: Log everything to a local printer?
zh_CN: 使用本地打印机记录日志?

en: Burn your configuration on a boot-able CD and boot off that?
zh_CN: 将您的配置烧录到可引导 CD 上并 boot off that?

en: Disable kernel modules?
zh_CN: 禁用内核模块?

en: Limit network access
zh_CN: 网络访问限制

en: Install and configure <command>ssh</command> (suggest PermitRootLogin No in <filename>/etc/ssh/sshd_config</filename>, PermitEmptyPasswords No; note other suggestions in text also)
zh_CN: 安装和配置 <command>ssh</command>(建议在 <filename>/etc/ssh/sshd_config</filename> 中设置 PermitRootLogin No, 注意文章中的其它建议)

en: Generally, disable gratuitous services in <filename>/etc/inetd.conf</filename> using <command>update-inetd --disable</command> (or disable <command>inetd</command> altogether, or use a replacement such as <command>xinetd</command> or <command>rlinetd</command>)
zh_CN: 通常, 使用 <command>update-inetd --disable</command> 禁用 <filename>/etc/inetd.conf</filename> 中无用的服务(或全部禁用 <command>inetd</command>, 或使用 <command>xinetd</command> 或 <command>rlinetd</command> 替换)

en: For those services which you do need, do not just use the most common programs, look for more secure versions shipped with Debian (or from other sources). Whatever you end up running, make sure you understand the risks.
zh_CN: 对于您需要的那些服务, 不要仅仅使用通用版本, 寻找引入 Debian(或从其它地方)的更加安全的版本.无论使用什么, 都应当了解其风险.

en: Set up <command>chroot</command> jails for outside users and daemons.
zh_CN: 为外部用户和守护进程设置 <command>chroot</command> jail.

en: If you run ftp, set up your ftpd server to always run <command>chroot</command>'ed to the user's home directory
zh_CN: 如果运行了ftp, 设置您的ftpd服务器总是运行在<command>chroot</command> 了的用户家目录内

en: If you run X, disable xhost authentication and go with <command>ssh</command> instead; better yet, disable remote X if you can (add -nolisten tcp to the X command line and turn off XDMCP in <filename>/etc/X11/xdm/xdm-config</filename> by setting the requestPort to 0)
zh_CN: 如果运行了 X, 禁用 xhost 认证, 使用 <command>ssh</command> 替代; 最好禁用远程X 如果可以的话(为X命令行增加 -nolisten tcp 选项,通过在 <filename>/etc/X11/xdm/xdm-config</filename>中设置 requestPort 为 0, 关闭 XDMCP)

en: Tunnel any IMAP or POP sessions through SSL or <command>ssh</command>; install stunnel if you want to provide this service to remote mail users
zh_CN: 任何 IMAP 或 POP 会话都使用 SSL 或 <command>ssh</command> 隧道; 如果为远程邮件用户提供此项服务,安装 stunnel

en: Set up a log host and configure other machines to send logs to this host (<filename>/etc/syslog.conf</filename>)
zh_CN: 配置日志主机, 并设置其它机器将日志发送到此主机(<filename>/etc/syslog.conf</filename>)

en: Secure BIND, Sendmail, and other complex daemons (run in a <command>chroot</command> jail; run as a non-root pseudo-user)
zh_CN: 增强 BIND, Sendmail, 和其它复杂守护进程的安全性.(运行在 <command>chroot</command> 中; 以非root pseduo 用户运行)

en: Do without NIS and RPC if you can (disable portmap).
zh_CN: 如果可能不要使用 NIS 和 RPC(禁用 portmap).

en: Policy issues
zh_CN: 策略问题

en: Educate users about the whys and hows of your policies. When you have prohibited something which is regularly available on other systems, provide documentation which explains how to accomplish similar results using other, more secure means.
zh_CN: 培训用户了解您的策略. 当您禁止某些在其它系统通常可以使用的事项时, 提供文档, 解释如何使用其它的以达到近似的效果, 或更安全的方法.

en: Prohibit use of protocols which use clear-text passwords (<command>telnet</command>, <command>rsh</command> and friends; ftp, imap, http, ...).
zh_CN: 禁止使用明文密码的协议(<command>telnet</command>, <command>rsh</command> 和类似的; ftp, imap, http, ...).

en: Prohibit programs which use SVGAlib.
zh_CN: 禁止使用 SVGAlib 的程序.

en: Use disk quotas.
zh_CN: 启用磁盘配额.

en: Keep informed about security issues
zh_CN: 谨记的安全问题

en: Subscribe to security mailing lists
zh_CN: 订阅安全邮件列表

en: Also remember to periodically run <command>apt-get update ; apt-get upgrade</command> (perhaps install as a <command>cron</command> job?) as explained in <xref linkend="security-update" />.
zh_CN: 并且谨记经常运行 <command>apt-get update ; apt-get upgrade</command>(或许可以设为一个 <command>cron</command> job?) 如 <xref linkend="security-update" /> 所述.

en: Setting up a stand-alone IDS
zh_CN: 设定独立的 IDS

en: Install a base Debian system and select no additional packages.
zh_CN: 安装一个基本的Debian 系统, 不要选择多余的软件包.

en: Setting up a bridge firewall
zh_CN: 设定网桥防火墙

en: To configure the kernel with necessary support, run <literal>make menuconfig</literal> or <literal>make xconfig</literal>. In the section <emphasis>Networking options</emphasis>, enable the following options:
zh_CN: 配置内核提供必要的支持, 运行 <literal>make menuconfig</literal> 或 <literal>make menuconfig</literal>. 在 <emphasis>Networking options</emphasis> 部分, 启用下边的选项:

en: Caution: you must disable this if you want to apply some firewalling rules or else <command>iptables</command> will not work:
zh_CN: 小心: 您如果要应用一些防火墙规则, 必须禁用此项, 否则 <command>iptables</command> 不会工作.

en: Once these steps are complete, you can complete the configuration of your bridge. The next section presents two different possible configurations for the bridge, each with a hypothetical network map and the necessary commands.
zh_CN: 完成这些步骤后, 您就可以完成网桥的配置了. 下边的部分给出两种不通的配置网桥的可用方法, 都给出了假定的网络映射和必要的命令.

en: A bridge providing NAT and firewall capabilities
zh_CN: 提供 NAT 和防火墙能力的网桥

en: The first configuration uses the bridge as a firewall with network address translation (NAT) that protects a server and internal LAN clients. A diagram of the network configuration is shown below:
zh_CN: 这个配置使用桥梁作为带有网络地址转发(NAT)功能的防火墙, 用于保护服务器和内部局域网客户端. 下边给出的是网络布局图::

en: A bridge providing firewall capabilities
zh_CN: 提供防火墙能力的网桥

en: A second possible configuration is a system that is set up as a transparent firewall for a LAN with a public IP address space.
zh_CN: 这种可能的配置用于系统用于为拥有公网IP地址的内外提供透明的防火墙.

en: If you traceroute the Linux Mail Server, you won't see the bridge. If you want access to the bridge with <command>ssh</command>, you must have a gateway or you must first connect to another server, such as the "Mail Server", and then connect to the bridge through the internal network card.
zh_CN: 如果 traceroute Linux 邮件服务器, 您不会看到网桥. 如果想使用 <command>ssh</command> 访问网桥, 则必须拥有一个网关,或者首先联接到其它服务器, 如"邮件服务器". 然后通过内部网卡联接到网桥.

en: This is an example of the basic rules that could be used for either of these setups.
zh_CN: 这是基本规则的范例, 可用于任何的设定.

en: Sample script to change the default Bind installation.
zh_CN: 修改Bind默认安装的示例脚本.

en: Security update protected by a firewall
zh_CN: 防火墙保护下的安全更新

en: After a standard installation, a system may still have some security vulnerabilities. Unless you can download updates for the vulnerable packages on another system (or you have mirrored security.debian.org for local use), the system will have to be connected to the Internet for the downloads.
zh_CN: 标准安装完成后, 系统也许仍然存在一些漏洞. 除非您下载用于其它系统的漏洞修补包(或您有 security.debian.org 的本地镜像)系统必须连入互联网进行下载.

en: When doing an update on a system not protected by an external system like a firewall, it is possible to properly configure your local firewall to restrict connections involving only the security update itself. The example below shows how to set up such local firewall capabilities, which allow connections from security.debian.org only, logging all others.
zh_CN: 当对没有外部系统如防火墙保护的系统进行升级时, 可以正确的设置本地防火墙, 以阻止除更新以外的其它连接. 下边的例子给出如何设置本地防火墙, 仅允许源自 security.debian.org 的更新连接.

en: FIXME: this will only work with HTTP URLs since ftp might need the ip_conntrack_ftp module, or use passive mode.
zh_CN: FIXME: 这只适用于 HTTP URL 因为 ftp 可能需要 ip_conntrack_ftp 模块,或者使用 passive 方式.

en: This will restrict <emphasis>both</emphasis> remote shell access, as well as remote copy through the <command>ssh</command> channel.
zh_CN: 这将限制通过 ssh 隧道的远程 shell 访问, 和通过 <command>ssh</command> 隧道进行的远程拷贝.

en: Make sure to have all the needed binaries and libraries in the <command>chroot</command>'ed path for users. These files should be owned by root to avoid tampering by the user (so as to exit the <command>chroot</command>'ed jailed). A sample might include:
zh_CN: 确保用户的 <command>chroot</command> 目录下包含了所有需要的程序和库文件. 这些文件的宿主应当是 root 以避免被用户篡改(在用户退出 <command>chroot</command> jail 时). 下边是一个范例:

en: Automatically making the environment (the easy way)
zh_CN: 环境的自动构建(简单的方式)

en: The advantage of programs that automatically generate <command>chroot</command> environments is that they are capable of copying any package to the <command>chroot</command> environment (even following the package's dependencies and making sure it's complete). Thus, providing user applications is easier.
zh_CN: 自动构建 <command>chroot</command> 环境程序的优势在于它能为 <command>chroot</command> 环境复制任何软件包(甚至下边的依赖包, 并能保证其完整性). 因此, 用户使用起来更加容易.

en: Introduction
zh_CN: 介绍

en: Licensing
zh_CN: 许可证

en: Installing the server
zh_CN: 安装服务器

en: Log in as <command>root</command> and create a new jail directory:
zh_CN: 以 <command>root</command> 登录, 创建 jail 目录:

en: Create a new user and a new group. The chrooted Apache server will run as this user/group, which isn't used for anything else on the system. In this example, both user and group are called <command>chrapach</command>.
zh_CN: 创造一个用户和新组. 除了 chroot 了的 Apache 服务器用这个用户/组运行, 在此系统上不再做别的用途. 在这个例子中, 用户和组都叫 <command>chrapach</command>.

en: FIXME: is a new user needed? (Apache already runs as the apache user)
zh_CN: FIXME: 需要新的用户吗? (Apache 已经作为 apache 用户运行了)

en: Install Apache as usual on Debian: <literal>apt-get install apache</literal>
zh_CN: 象通常一样在 Debian 上安装 Apache: <literal>apt-get install apache</literal>

en: Copy the sample configuration file for Apache to the <filename>/etc/makejail</filename> directory:
zh_CN: 复制 Apache 示例配置文件到 <filename>/etc/makejail</filename> 目录:

en: Create the chroot tree: <literal>makejail /etc/makejail/apache.py</literal>
zh_CN: 创造 chroot 目录树: <literal>makejail /etc/makejail/apache.py</literal>

en: If <filename>/etc/password</filename> and <filename>/etc/group</filename> were fully copied, type:
zh_CN: 如果 <filename>/etc/password</filename> 和 <filename>/etc/group</filename> 被全部复制, 键入:

en: to replace them with filtered copies.
zh_CN: 用过滤出的拷贝覆盖它们.

en: Copy the Web site pages and the logs into the jail. These files are not copied automatically (see the <emphasis>preserve</emphasis> option in <command>makejail</command>'s configuration file).
zh_CN: 复制网站的网页和日志文件到 jail 中. 这些文件都不是自动复制的.(参阅 <command>makejail</command> 配置文件中的 <emphasis>preserve</emphasis> 项).

en: Edit the Apache startup script (<filename>/etc/init.d/apache</filename>). You might need to make some changes to the default startup script for it to run properly with a chrooted tree. Such as:
zh_CN: 编辑 Apache 的启动脚本(<filename>/etc/init.d/apache</filename>). 您可能需要适当地做对缺省的启动脚本做一些调整, 使其在 chroot 目录树中运行正常. 譬如:

en: set a new <emphasis>CHRDIR</emphasis> variable at the top of the file;
zh_CN: 在文件顶部设置一新 <emphasis>CHRDIR</emphasis> 变量;

en: edit the <emphasis>start</emphasis>, <emphasis>stop</emphasis>, <emphasis>reload</emphasis>, etc. sections;
zh_CN: 编辑 <emphasis>start</emphasis>, <emphasis>stop</emphasis>, <emphasis>reload</emphasis>, 等部分;

en: add a line to mount and unmount the <filename>/proc</filename> filesystem within the jail.
zh_CN: 增加一行用于在 jail 中加载和卸载 <filename>/proc</filename> 文件系统

en: <emphasis>FIXME</emphasis>: should the first Apache process be run as another user than root (i.e. add --chuid chrapach:chrapach)? Cons: chrapach will need write access to the logs, which is awkward.
zh_CN: <emphasis>FIXME</emphasis>: 第一个 Apache 进程应当以其它用户而不是 root 用户运行的(即, add --chuid chrapach:chrapach)? Cons: chrapache将需要对日志有写权限, 这非常不便.

en: Replace in <filename>/etc/logrotate.d/apache</filename> <literal>/var/log/apache/*.log</literal> with <literal>/var/chroot/apache/var/log/apache/*.log</literal>
zh_CN: 在 <filename>/etc/logrotate.d/apache</filename> 中用 <literal>/var/chroot/apache/var/log/apache/*.log</literal> 替换 <literal>/var/log/apache/*.log</literal>

en: Type <literal>ps aux | grep apache</literal> to make sure Apache is running. You should see something like:
zh_CN: 键入 <literal>ps aux | grep apache</literal> 以确保 Apache 正在运行. 您应当看到如下类似内容:

en: To automate this test, you can type:<literal>ls -la /proc/`cat /var/chroot/apache/var/run/apache.pid`/root/.</literal>
zh_CN: 键入: <literal>ls -la /proc/`cat /var/chroot/apache/var/run/apache.pid`/root/.</literal> 自动完成整个测试

en: <emphasis>FIXME</emphasis>: Add other tests that can be run to make sure the jail is closed?
zh_CN: <emphasis>FIXME</emphasis>: 增加其它的测试, 以确保 jail 被关闭了?

en: The reason I like this is because setting up the jail is not very difficult and the server can be updated in just two lines:
zh_CN: 我喜欢这样的原因是因为设定 jail 不是很困难, 并且服务器可以通过下边两行更新:

en: See also
zh_CN: 其它
