« back to all changes in this revision
Viewing changes to serverguide/po/mk.po
- browse files at revision 94
- compare with another revision
- download diff
- download tarball
- view history from revision 94
- Committer: Bazaar Package Importer
- Author(s): Matthew East
- Date: 2010-09-19 11:35:42 UTC
- Revision ID: james.westby@ubuntu.com-20100919113542-mbxqe7yuo4ggnrw3
Tags: 10.10.3
* Amend font-family for browser startpage (LP: #195590)
* Add translations from Launchpad
* Add translations from Launchpad
- files added:
- internet/po/nn.po
- files removed:
- serverguide
- serverguide/C
- serverguide/po
- serverguide/sample
- files modified:
- about-ubuntu/po/ace.po
added
removed
serverguide/po/mk.po
1
# Macedonian translation for ubuntu-docs
2
# Copyright (c) 2006 Rosetta Contributors and Canonical Ltd 2006
3
# This file is distributed under the same license as the ubuntu-docs package.
4
# FIRST AUTHOR <EMAIL@ADDRESS>, 2006.
5
#
6
msgid ""
7
msgstr ""
8
"Project-Id-Version: ubuntu-docs\n"
9
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
10
"POT-Creation-Date: 2010-03-29 08:26+0100\n"
11
"PO-Revision-Date: 2009-10-20 02:13+0000\n"
12
"Last-Translator: Андон Сикавица <sikavica@gmail.com>\n"
13
"Language-Team: Macedonian <mk@li.org>\n"
14
"MIME-Version: 1.0\n"
15
"Content-Type: text/plain; charset=UTF-8\n"
16
"Content-Transfer-Encoding: 8bit\n"
17
"X-Launchpad-Export-Date: 2010-04-17 14:52+0000\n"
18
"X-Generator: Launchpad (build Unknown)\n"
19
20
#: serverguide/C/serverguide-C.omf:6(creator) serverguide/C/serverguide-C.omf:7(maintainer)
21
msgid "ubuntu-doc@lists.ubuntu.com (Ubuntu Documentation Project)"
22
msgstr "ubuntu-doc@lists.ubuntu.com (Проект за документација на Ubuntu)"
23
24
#: serverguide/C/serverguide-C.omf:8(title) serverguide/C/serverguide-C.omf:11(description) serverguide/C/serverguide.xml:14(title) serverguide/C/bookinfo.xml:13(title)
25
msgid "Ubuntu Server Guide"
26
msgstr "Водич за Ubuntu Server"
27
28
#: serverguide/C/serverguide-C.omf:9(date)
29
msgid "2007-09-30"
30
msgstr "2007-09-30"
31
32
#: serverguide/C/windows-networking.xml:13(title)
33
msgid "Windows Networking"
34
msgstr "Windows вмрежување"
35
36
#: serverguide/C/windows-networking.xml:15(para)
37
msgid ""
38
"Computer networks are often comprised of diverse systems, and while "
39
"operating a network made up entirely of Ubuntu desktop and server computers "
40
"would certainly be fun, some network environments must consist of both "
41
"Ubuntu and <trademark class=\"registered\">Microsoft</trademark><trademark "
42
"class=\"registered\">Windows</trademark> systems working together in "
43
"harmony. This section of the <phrase>Ubuntu</phrase> Server Guide introduces "
44
"principles and tools used in configuring your Ubuntu Server for sharing "
45
"network resources with Windows computers."
46
msgstr ""
47
"Компјутерските мрежи се најчесто составени од различни системи. Во идеален "
48
"случај, најзабавно би било на компјутерите да работи Ubuntu оперативниот "
49
"систем, но некои мрежни околини мора да содржат покрај Ubutnu и <trademark "
50
"class=\"registered\">Microsoft</trademark><trademark "
51
"class=\"registered\">Windows</trademark> системи со кои треба да работат во "
52
"хармонија. Наредниот дел од <phrase>Ubuntu</phrase> водичот за сервери ќе ве "
53
"запознае со принципите и алатките за подесување на Ubutnu Server за "
54
"споделување на мрежни ресурси со Windows компјутерите."
55
56
#: serverguide/C/windows-networking.xml:25(title) serverguide/C/virtualization.xml:402(title) serverguide/C/security.xml:354(title) serverguide/C/remote-administration.xml:22(title) serverguide/C/package-management.xml:20(title) serverguide/C/introduction.xml:13(title)
57
msgid "Introduction"
58
msgstr "Вовед"
59
60
#: serverguide/C/windows-networking.xml:27(para)
61
msgid ""
62
"Successfully networking your Ubuntu system with Windows clients involves "
63
"providing and integrating with services common to Windows environments. Such "
64
"services assist the sharing of data and information about the computers and "
65
"users involved in the network, and may be classified under three major "
66
"categories of functionality:"
67
msgstr ""
68
"За успешно вмрежување на вашиот Ubuntu систем со Windows клиенти потребо е "
69
"овозможување и интегрирање на услуги кои често се појавуваат во Windows "
70
"околините. Таквите услути помагаат при споделување на податоци и информации "
71
"за компјутерите и корисниците инволвирани во мрежата и можат да се "
72
"класифицираат по три главни категории на функционалност:"
73
74
#: serverguide/C/windows-networking.xml:35(para)
75
msgid ""
76
"<emphasis role=\"bold\">File and Printer Sharing Services</emphasis>. Using "
77
"the Server Message Block (SMB) protocol to facilitate the sharing of files, "
78
"folders, volumes, and the sharing of printers throughout the network."
79
msgstr ""
80
"<emphasis role=\"bold\">Сервиси за споделување на датотеки и "
81
"принтери</emphasis>. Се користи Server Message Block (SMB) протоколот за да "
82
"се олесни споделувањето на датотеки, директориуми и принтери во мрежата."
83
84
#: serverguide/C/windows-networking.xml:41(para)
85
msgid ""
86
"<emphasis role=\"bold\">Directory Services</emphasis>. Sharing vital "
87
"information about the computers and users of the network with such "
88
"technologies as the Lightweight Directory Access Protocol (LDAP) and "
89
"Microsoft <trademark class=\"registered\">Active Directory</trademark>."
90
msgstr ""
91
"<emphasis role=\"bold\">Директориумски сервиси (Directory "
92
"Services)</emphasis>. Делење на витални информации за компјутерите и "
93
"корисниците во мрежата со помош на технологии како Lightweight Directory "
94
"Access Protocol (LDAP) и Microsoft <trademark class=\"registered\">Active "
95
"Directory</trademark>."
96
97
#: serverguide/C/windows-networking.xml:48(para)
98
msgid ""
99
"<emphasis role=\"bold\">Authentication and Access</emphasis>. Establishing "
100
"the identity of a computer or user of the network and determining the "
101
"information the computer or user is authorized to access using such "
102
"principles and technologies as file permissions, group policies, and the "
103
"Kerberos authentication service."
104
msgstr ""
105
"<emphasis role=\"bold\">Автентификација и пристап</emphasis>. Идентификација "
106
"на компјутер или корисник во мрежата и одредување на информациите за кои "
107
"компјутерот или корисникот е авторизиран да им пристапи, користејќи ги при "
108
"тоа принципите и технологиите како што се: датотечни дозволи, групни полиси "
109
"и Kerberos автентификацискиот сервис."
110
111
#: serverguide/C/windows-networking.xml:56(para)
112
msgid ""
113
"Fortunately, your Ubuntu system may provide all such facilities to Windows "
114
"clients and share network resources among them. One of the principal pieces "
115
"of software your Ubuntu system includes for Windows networking is the Samba "
116
"suite of SMB server applications and tools."
117
msgstr ""
118
119
#: serverguide/C/windows-networking.xml:62(para)
120
msgid ""
121
"This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some "
122
"of the common Samba use cases, and how to install and configure the "
123
"necessary packages. Additional detailed documentation and information on "
124
"Samba can be found on the <ulink url=\"http://www.samba.org\">Samba "
125
"website</ulink>."
126
msgstr ""
127
128
#: serverguide/C/windows-networking.xml:70(title)
129
msgid "Samba File Server"
130
msgstr ""
131
132
#: serverguide/C/windows-networking.xml:72(para)
133
msgid ""
134
"One of the most common ways to network Ubuntu and Windows computers is to "
135
"configure Samba as a File Server. This section covers setting up a "
136
"<application>Samba</application> server to share files with Windows clients."
137
msgstr ""
138
139
#: serverguide/C/windows-networking.xml:77(para)
140
msgid ""
141
"The server will be configured to share files with any client on the network "
142
"without prompting for a password. If your environment requires stricter "
143
"Access Controls see <xref linkend=\"samba-fileprint-security\"/>"
144
msgstr ""
145
146
#: serverguide/C/windows-networking.xml:83(title) serverguide/C/windows-networking.xml:287(title) serverguide/C/windows-networking.xml:1302(title) serverguide/C/web-servers.xml:41(title) serverguide/C/web-servers.xml:675(title) serverguide/C/web-servers.xml:816(title) serverguide/C/web-servers.xml:940(title) serverguide/C/vpn.xml:33(title) serverguide/C/virtualization.xml:62(title) serverguide/C/virtualization.xml:2014(title) serverguide/C/vcs.xml:28(title) serverguide/C/vcs.xml:86(title) serverguide/C/vcs.xml:405(title) serverguide/C/remote-administration.xml:52(title) serverguide/C/remote-administration.xml:233(title) serverguide/C/network-config.xml:937(title) serverguide/C/network-auth.xml:52(title) serverguide/C/network-auth.xml:1581(title) serverguide/C/network-auth.xml:2092(title) serverguide/C/network-auth.xml:2483(title) serverguide/C/monitoring.xml:42(title) serverguide/C/monitoring.xml:428(title) serverguide/C/mail.xml:40(title) serverguide/C/mail.xml:496(title) serverguide/C/mail.xml:674(title) serverguide/C/mail.xml:823(title) serverguide/C/mail.xml:1315(title) serverguide/C/lamp-applications.xml:108(title) serverguide/C/lamp-applications.xml:287(title) serverguide/C/lamp-applications.xml:423(title) serverguide/C/installation.xml:13(title) serverguide/C/installation.xml:957(title) serverguide/C/file-server.xml:347(title) serverguide/C/file-server.xml:462(title) serverguide/C/dns.xml:23(title) serverguide/C/databases.xml:40(title) serverguide/C/databases.xml:164(title) serverguide/C/chat.xml:37(title) serverguide/C/chat.xml:141(title) serverguide/C/backups.xml:593(title)
147
msgid "Installation"
148
msgstr "Инсталација"
149
150
#: serverguide/C/windows-networking.xml:85(para)
151
msgid ""
152
"The first step is to install the <application>samba</application> package. "
153
"From a terminal prompt enter:"
154
msgstr ""
155
156
#: serverguide/C/windows-networking.xml:90(command) serverguide/C/windows-networking.xml:299(command)
157
msgid "sudo apt-get install samba"
158
msgstr ""
159
160
#: serverguide/C/windows-networking.xml:93(para)
161
msgid ""
162
"That's all there is to it; you are now ready to configure Samba to share "
163
"files."
164
msgstr ""
165
166
#: serverguide/C/windows-networking.xml:99(title) serverguide/C/windows-networking.xml:304(title) serverguide/C/web-servers.xml:61(title) serverguide/C/web-servers.xml:726(title) serverguide/C/web-servers.xml:827(title) serverguide/C/web-servers.xml:967(title) serverguide/C/web-servers.xml:1067(title) serverguide/C/vpn.xml:138(title) serverguide/C/virtualization.xml:2088(title) serverguide/C/vcs.xml:39(title) serverguide/C/vcs.xml:423(title) serverguide/C/remote-administration.xml:74(title) serverguide/C/remote-administration.xml:258(title) serverguide/C/package-management.xml:387(title) serverguide/C/network-config.xml:959(title) serverguide/C/network-auth.xml:2131(title) serverguide/C/network-auth.xml:2504(title) serverguide/C/monitoring.xml:187(title) serverguide/C/monitoring.xml:454(title) serverguide/C/mail.xml:505(title) serverguide/C/mail.xml:684(title) serverguide/C/mail.xml:908(title) serverguide/C/mail.xml:1344(title) serverguide/C/lamp-applications.xml:128(title) serverguide/C/lamp-applications.xml:314(title) serverguide/C/lamp-applications.xml:453(title) serverguide/C/file-server.xml:360(title) serverguide/C/file-server.xml:488(title) serverguide/C/dns.xml:39(title) serverguide/C/databases.xml:84(title) serverguide/C/databases.xml:183(title) serverguide/C/clustering.xml:47(title) serverguide/C/chat.xml:57(title) serverguide/C/chat.xml:153(title) serverguide/C/backups.xml:616(title)
167
msgid "Configuration"
168
msgstr "Конфигурација"
169
170
#: serverguide/C/windows-networking.xml:101(para)
171
msgid ""
172
"The main Samba configuration file is located in "
173
"<filename>/etc/samba/smb.conf</filename>. The default configuration file has "
174
"a significant amount of comments in order to document various configuration "
175
"directives."
176
msgstr ""
177
178
#: serverguide/C/windows-networking.xml:106(para)
179
msgid ""
180
"Not all the available options are included in the default configuration "
181
"file. See the <filename>smb.conf</filename><application>man</application> "
182
"page or the <ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
183
"Collection/\">Samba HOWTO Collection</ulink> for more details."
184
msgstr ""
185
186
#: serverguide/C/windows-networking.xml:116(para)
187
msgid ""
188
"First, edit the following key/value pairs in the "
189
"<emphasis>[global]</emphasis> section of "
190
"<filename>/etc/samba/smb.conf</filename>:"
191
msgstr ""
192
193
#: serverguide/C/windows-networking.xml:121(programlisting) serverguide/C/windows-networking.xml:311(programlisting) serverguide/C/windows-networking.xml:776(programlisting) serverguide/C/windows-networking.xml:990(programlisting)
194
#, no-wrap
195
msgid ""
196
"\n"
197
" workgroup = EXAMPLE\n"
198
" ...\n"
199
" security = user\n"
200
msgstr ""
201
202
#: serverguide/C/windows-networking.xml:127(para)
203
msgid ""
204
"The <emphasis>security</emphasis> parameter is farther down in the [global] "
205
"section, and is commented by default. Also, change "
206
"<emphasis>EXAMPLE</emphasis> to better match your environment."
207
msgstr ""
208
209
#: serverguide/C/windows-networking.xml:135(para)
210
msgid ""
211
"Create a new section at the bottom of the file, or uncomment one of the "
212
"examples, for the directory to be shared:"
213
msgstr ""
214
215
#: serverguide/C/windows-networking.xml:139(programlisting)
216
#, no-wrap
217
msgid ""
218
"\n"
219
"[share]\n"
220
" comment = Ubuntu File Server Share\n"
221
" path = /srv/samba/share\n"
222
" browsable = yes\n"
223
" guest ok = yes\n"
224
" read only = no\n"
225
" create mask = 0755\n"
226
msgstr ""
227
228
#: serverguide/C/windows-networking.xml:151(para)
229
msgid ""
230
"<emphasis>comment:</emphasis> a short description of the share. Adjust to "
231
"fit your needs."
232
msgstr ""
233
234
#: serverguide/C/windows-networking.xml:156(para)
235
msgid "<emphasis>path:</emphasis> the path to the directory to share."
236
msgstr ""
237
238
#: serverguide/C/windows-networking.xml:159(para)
239
msgid ""
240
"This example uses <filename>/srv/samba/sharename</filename> because, "
241
"according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, "
242
"<ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
243
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is where site-"
244
"specific data should be served. Technically Samba shares can be placed "
245
"anywhere on the filesystem as long as the permissions are correct, but "
246
"adhering to standards is recommended."
247
msgstr ""
248
249
#: serverguide/C/windows-networking.xml:168(para)
250
msgid ""
251
"<emphasis>browsable:</emphasis> enables Windows clients to browse the shared "
252
"directory using <application>Windows Explorer</application>."
253
msgstr ""
254
255
#: serverguide/C/windows-networking.xml:174(para)
256
msgid ""
257
"<emphasis>guest ok:</emphasis> allows clients to connect to the share "
258
"without supplying a password."
259
msgstr ""
260
261
#: serverguide/C/windows-networking.xml:179(para)
262
msgid ""
263
"<emphasis>read only:</emphasis> determines if the share is read only or if "
264
"write privileges are granted. Write privileges are allowed only when the "
265
"value is <emphasis>no</emphasis>, as is seen in this example. If the value "
266
"is <emphasis>yes</emphasis>, then access to the share is read only."
267
msgstr ""
268
269
#: serverguide/C/windows-networking.xml:184(para)
270
msgid ""
271
"<emphasis>create mask:</emphasis> determines the permissions new files will "
272
"have when created."
273
msgstr ""
274
275
#: serverguide/C/windows-networking.xml:193(para)
276
msgid ""
277
"Now that <application>Samba</application> is configured, the directory needs "
278
"to be created and the permissions changed. From a terminal enter:"
279
msgstr ""
280
281
#: serverguide/C/windows-networking.xml:199(command)
282
msgid "sudo mkdir -p /srv/samba/share"
283
msgstr ""
284
285
#: serverguide/C/windows-networking.xml:200(command)
286
msgid "sudo chown nobody.nogroup /srv/samba/share/"
287
msgstr ""
288
289
#: serverguide/C/windows-networking.xml:204(para)
290
msgid ""
291
"The <emphasis>-p</emphasis> switch tells mkdir to create the entire "
292
"directory tree if it doesn't exist. Change the share name to fit your "
293
"environment."
294
msgstr ""
295
296
#: serverguide/C/windows-networking.xml:213(para)
297
msgid ""
298
"Finally, restart the <application>samba</application> services to enable the "
299
"new configuration:"
300
msgstr ""
301
302
#: serverguide/C/windows-networking.xml:218(command) serverguide/C/windows-networking.xml:331(command) serverguide/C/windows-networking.xml:468(command) serverguide/C/windows-networking.xml:567(command) serverguide/C/windows-networking.xml:937(command) serverguide/C/windows-networking.xml:1047(command) serverguide/C/windows-networking.xml:1162(command) serverguide/C/network-auth.xml:1860(command)
303
msgid "sudo /etc/init.d/samba restart"
304
msgstr "sudo /etc/init.d/samba restart"
305
306
#: serverguide/C/windows-networking.xml:225(para)
307
msgid ""
308
"Once again, the above configuration gives all access to any client on the "
309
"local network. For a more secure configuration see <xref linkend=\"samba-"
310
"fileprint-security\"/>."
311
msgstr ""
312
313
#: serverguide/C/windows-networking.xml:231(para)
314
msgid ""
315
"From a Windows client you should now be able to browse to the Ubuntu file "
316
"server and see the shared directory. To check that everything is working try "
317
"creating a directory from Windows."
318
msgstr ""
319
320
#: serverguide/C/windows-networking.xml:236(para)
321
msgid ""
322
"To create additional shares simply create new <emphasis>[dir]</emphasis> "
323
"sections in <filename>/etc/samba/smb.conf</filename>, and restart "
324
"<emphasis>Samba</emphasis>. Just make sure that the directory you want to "
325
"share actually exists and the permissions are correct."
326
msgstr ""
327
328
#: serverguide/C/windows-networking.xml:243(title) serverguide/C/windows-networking.xml:341(title) serverguide/C/windows-networking.xml:696(title) serverguide/C/windows-networking.xml:1066(title) serverguide/C/windows-networking.xml:1273(title) serverguide/C/virtualization.xml:366(title) serverguide/C/virtualization.xml:1168(title) serverguide/C/reporting-bugs.xml:304(title) serverguide/C/remote-administration.xml:491(title) serverguide/C/network-config.xml:569(title) serverguide/C/network-config.xml:824(title) serverguide/C/network-auth.xml:1531(title) serverguide/C/network-auth.xml:1975(title) serverguide/C/network-auth.xml:2579(title) serverguide/C/network-auth.xml:3087(title) serverguide/C/installation.xml:892(title) serverguide/C/installation.xml:1173(title) serverguide/C/databases.xml:122(title) serverguide/C/databases.xml:273(title) serverguide/C/backups.xml:855(title)
329
msgid "Resources"
330
msgstr ""
331
332
#: serverguide/C/windows-networking.xml:247(para) serverguide/C/windows-networking.xml:345(para) serverguide/C/windows-networking.xml:700(para) serverguide/C/windows-networking.xml:1070(para)
333
msgid ""
334
"For in depth Samba configurations see the <ulink "
335
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
336
"Collection</ulink>"
337
msgstr ""
338
339
#: serverguide/C/windows-networking.xml:253(para) serverguide/C/windows-networking.xml:351(para) serverguide/C/windows-networking.xml:706(para) serverguide/C/windows-networking.xml:1076(para)
340
msgid ""
341
"The guide is also available in <ulink "
342
"url=\"http://www.amazon.com/exec/obidos/tg/detail/-/0131882228\">printed "
343
"format</ulink>."
344
msgstr ""
345
346
#: serverguide/C/windows-networking.xml:259(para) serverguide/C/windows-networking.xml:357(para)
347
msgid ""
348
"O'Reilly's <ulink "
349
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
350
"another good reference."
351
msgstr ""
352
353
#: serverguide/C/windows-networking.xml:265(para) serverguide/C/windows-networking.xml:368(para) serverguide/C/windows-networking.xml:731(para) serverguide/C/windows-networking.xml:1100(para) serverguide/C/windows-networking.xml:1286(para)
354
msgid ""
355
"The <ulink url=\"https://help.ubuntu.com/community/Samba\">Ubuntu Wiki Samba "
356
"</ulink> page."
357
msgstr ""
358
359
#: serverguide/C/windows-networking.xml:274(title)
360
msgid "Samba Print Server"
361
msgstr ""
362
363
#: serverguide/C/windows-networking.xml:276(para)
364
msgid ""
365
"Another common use of Samba is to configure it to share printers installed, "
366
"either locally or over the network, on an Ubuntu server. Similar to <xref "
367
"linkend=\"samba-fileserver\"/> this section will configure Samba to allow "
368
"any client on the local network to use the installed printers without "
369
"prompting for a username and password."
370
msgstr ""
371
372
#: serverguide/C/windows-networking.xml:282(para)
373
msgid ""
374
"For a more secure configuration see <xref linkend=\"samba-fileprint-"
375
"security\"/>."
376
msgstr ""
377
378
#: serverguide/C/windows-networking.xml:289(para)
379
msgid ""
380
"Before installing and configuring Samba it is best to already have a working "
381
"<application>CUPS</application> installation. See <xref linkend=\"cups\"/> "
382
"for details."
383
msgstr ""
384
385
#: serverguide/C/windows-networking.xml:294(para)
386
msgid ""
387
"To install the <application>samba</application> package, from a terminal "
388
"enter:"
389
msgstr ""
390
391
#: serverguide/C/windows-networking.xml:305(para)
392
msgid ""
393
"After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change "
394
"the <emphasis>workgroup</emphasis> attribute to what is appropriate for your "
395
"network, and change <emphasis>security</emphasis> to <emphasis "
396
"role=\"italic\">share</emphasis>:"
397
msgstr ""
398
399
#: serverguide/C/windows-networking.xml:317(para)
400
msgid ""
401
"In the <emphasis>[printers]</emphasis> section change the <emphasis>guest "
402
"ok</emphasis> option to <emphasis role=\"italic\">yes</emphasis>:"
403
msgstr ""
404
405
#: serverguide/C/windows-networking.xml:321(programlisting)
406
#, no-wrap
407
msgid ""
408
"\n"
409
" browsable = yes\n"
410
" guest ok = yes\n"
411
msgstr ""
412
413
#: serverguide/C/windows-networking.xml:326(para)
414
msgid "After editing <filename>smb.conf</filename> restart Samba:"
415
msgstr ""
416
417
#: serverguide/C/windows-networking.xml:334(para)
418
msgid ""
419
"The default Samba configuration will automatically share any printers "
420
"installed. Simply install the printer locally on your Windows clients."
421
msgstr ""
422
423
#: serverguide/C/windows-networking.xml:363(para)
424
msgid ""
425
"Also, see the <ulink url=\"http://www.cups.org/\">CUPS Website</ulink> for "
426
"more information on configuring CUPS."
427
msgstr ""
428
429
#: serverguide/C/windows-networking.xml:377(title)
430
msgid "Securing a Samba File and Print Server"
431
msgstr ""
432
433
#: serverguide/C/windows-networking.xml:380(title)
434
msgid "Samba Security Modes"
435
msgstr ""
436
437
#: serverguide/C/windows-networking.xml:382(para)
438
msgid ""
439
"There are two security levels available to the Common Internet Filesystem "
440
"(CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-"
441
"level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation "
442
"allows more flexibility, providing four ways of implementing user-level "
443
"security and one way to implement share-level:"
444
msgstr ""
445
446
#: serverguide/C/windows-networking.xml:391(para)
447
msgid ""
448
"<emphasis>security = user:</emphasis> requires clients to supply a username "
449
"and password to connect to shares. Samba user accounts are separate from "
450
"system accounts, but the <application>libpam-smbpass</application> package "
451
"will sync system users and passwords with the Samba user database."
452
msgstr ""
453
454
#: serverguide/C/windows-networking.xml:398(para)
455
msgid ""
456
"<emphasis>security = domain:</emphasis> this mode allows the Samba server to "
457
"appear to Windows clients as a Primary Domain Controller (PDC), Backup "
458
"Domain Controller (BDC), or a Domain Member Server (DMS). See <xref "
459
"linkend=\"samba-dc\"/> for further information."
460
msgstr ""
461
462
#: serverguide/C/windows-networking.xml:405(para)
463
msgid ""
464
"<emphasis>security = ADS:</emphasis> allows the Samba server to join an "
465
"Active Directory domain as a native member. See <xref linkend=\"samba-ad-"
466
"integration\"/> for details."
467
msgstr ""
468
469
#: serverguide/C/windows-networking.xml:411(para)
470
msgid ""
471
"<emphasis>security = server:</emphasis> this mode is left over from before "
472
"Samba could become a member server, and due to some security issues should "
473
"not be used. See the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
474
"HOWTO-Collection/ServerType.html#id349531\">Server Security</ulink> section "
475
"of the Samba guide for more details."
476
msgstr ""
477
478
#: serverguide/C/windows-networking.xml:419(para)
479
msgid ""
480
"<emphasis>security = share:</emphasis> allows clients to connect to shares "
481
"without supplying a username and password."
482
msgstr ""
483
484
#: serverguide/C/windows-networking.xml:426(para)
485
msgid ""
486
"The security mode you choose will depend on your environment and what you "
487
"need the Samba server to accomplish."
488
msgstr ""
489
490
#: serverguide/C/windows-networking.xml:432(title)
491
msgid "Security = User"
492
msgstr ""
493
494
#: serverguide/C/windows-networking.xml:434(para)
495
msgid ""
496
"This section will reconfigure the Samba file and print server, from <xref "
497
"linkend=\"samba-fileserver\"/> and <xref linkend=\"samba-printserver\"/>, to "
498
"require authentication."
499
msgstr ""
500
501
#: serverguide/C/windows-networking.xml:439(para)
502
msgid ""
503
"First, install the <application>libpam-smbpass</application> package which "
504
"will sync the system users to the Samba user database:"
505
msgstr ""
506
507
#: serverguide/C/windows-networking.xml:445(command)
508
msgid "sudo apt-get install libpam-smbpass"
509
msgstr ""
510
511
#: serverguide/C/windows-networking.xml:449(para)
512
msgid ""
513
"If you chose the <emphasis>Samba Server</emphasis> task during installation "
514
"<application>libpam-smbpass</application> is already installed."
515
msgstr ""
516
517
#: serverguide/C/windows-networking.xml:455(para)
518
msgid ""
519
"Edit <filename>/etc/samba/smb.conf</filename>, and in the "
520
"<emphasis>[share]</emphasis> section change:"
521
msgstr ""
522
523
#: serverguide/C/windows-networking.xml:459(programlisting)
524
#, no-wrap
525
msgid ""
526
"\n"
527
" guest ok = no\n"
528
msgstr ""
529
530
#: serverguide/C/windows-networking.xml:463(para)
531
msgid "Finally, restart Samba for the new settings to take effect:"
532
msgstr ""
533
534
#: serverguide/C/windows-networking.xml:471(para)
535
msgid ""
536
"Now when connecting to the shared directories or printers you should be "
537
"prompted for a username and password."
538
msgstr ""
539
540
#: serverguide/C/windows-networking.xml:476(para)
541
msgid ""
542
"If you choose to map a network drive to the share you can check the "
543
"<quote>Reconnect at Logon</quote> check box, which will require you to only "
544
"enter the username and password once, at least until the password changes."
545
msgstr ""
546
547
#: serverguide/C/windows-networking.xml:484(title)
548
msgid "Share Security"
549
msgstr ""
550
551
#: serverguide/C/windows-networking.xml:486(para)
552
msgid ""
553
"There are several options available to increase the security for each "
554
"individual shared directory. Using the <emphasis>[share]</emphasis> example, "
555
"this section will cover some common options."
556
msgstr ""
557
558
#: serverguide/C/windows-networking.xml:492(title)
559
msgid "Groups"
560
msgstr "Групи"
561
562
#: serverguide/C/windows-networking.xml:494(para)
563
msgid ""
564
"Groups define a collection of computers or users which have a common level "
565
"of access to particular network resources and offer a level of granularity "
566
"in controlling access to such resources. For example, if a group <emphasis "
567
"role=\"italic\">qa</emphasis> is defined and contains the users <emphasis "
568
"role=\"italic\">freda</emphasis>, <emphasis "
569
"role=\"italic\">danika</emphasis>, and <emphasis "
570
"role=\"italic\">rob</emphasis> and a second group <emphasis "
571
"role=\"italic\">support</emphasis> is defined and consists of users "
572
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
573
"role=\"italic\">jeremy</emphasis>, and <emphasis "
574
"role=\"italic\">vincent</emphasis> then certain network resources configured "
575
"to allow access by the <emphasis role=\"italic\">qa</emphasis> group will "
576
"subsequently enable access by freda, danika, and rob, but not jeremy or "
577
"vincent. Since the user <emphasis role=\"italic\">danika</emphasis> belongs "
578
"to both the <emphasis role=\"italic\">qa</emphasis> and <emphasis "
579
"role=\"italic\">support</emphasis> groups, she will be able to access "
580
"resources configured for access by both groups, whereas all other users will "
581
"have only access to resources explicitly allowing the group they are part of."
582
msgstr ""
583
"Групите дефинираат колекција на компјутери или корисници кои имаат заедничко "
584
"ниво на пристап до одредени мрежни ресурси и одредуваат ниво на грануларност "
585
"во контролирањето на пристапот до таквите ресурси. На пример, ако групата "
586
"<emphasis role=\"italic\">qa</emphasis> е дефинирана и содржи корисници "
587
"<emphasis role=\"italic\">freda</emphasis>, <emphasis "
588
"role=\"italic\">danika</emphasis>, и <emphasis "
589
"role=\"italic\">rob</emphasis>, а втора група <emphasis "
590
"role=\"italic\">support</emphasis> е дефинирана и составена од корисниците "
591
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
592
"role=\"italic\">jeremy</emphasis>, и <emphasis "
593
"role=\"italic\">vincent</emphasis> тогаш одредени мрежни ресурси "
594
"конфигурирани да ѝ дадат пристап на <emphasis role=\"italic\">qa</emphasis> "
595
"групата ќе им дозволат пристап на freda, danika и rob, но не и на jeremy или "
596
"vincent. Бидејќи корисникот <emphasis role=\"italic\">danika</emphasis> "
597
"припаѓа и на <emphasis role=\"italic\">qa</emphasis> и на <emphasis "
598
"role=\"italic\">support</emphasis> групата, таа ќе има пристап до ресурсите "
599
"конфигурирани за пристап од страна на двете групи, за разлика од сите други "
600
"корисници кои ќе имаат само пристап до ресурсите кои експлицитно им се "
601
"дозволени во зависност од групата во која припаѓаат."
602
603
#: serverguide/C/windows-networking.xml:508(para)
604
msgid ""
605
"By default Samba looks for the local system groups defined in "
606
"<filename>/etc/group</filename> to determine which users belong to which "
607
"groups. For more information on adding and removing users from groups see "
608
"<xref linkend=\"adding-deleting-users\"/>."
609
msgstr ""
610
611
#: serverguide/C/windows-networking.xml:514(para)
612
msgid ""
613
"When defining groups in the Samba configuration file, "
614
"<filename>/etc/samba/smb.conf</filename>, the recognized syntax is to "
615
"preface the group name with an \"@\" symbol. For example, if you wished to "
616
"define a group named <emphasis role=\"italic\">sysadmin</emphasis> in a "
617
"certain section of the <filename>/etc/samba/smb.conf</filename>, you would "
618
"do so by entering the group name as <emphasis "
619
"role=\"bold\">@sysadmin</emphasis>."
620
msgstr ""
621
622
#: serverguide/C/windows-networking.xml:523(title)
623
msgid "File Permissions"
624
msgstr "Дозволи на датотека"
625
626
#: serverguide/C/windows-networking.xml:525(para)
627
msgid ""
628
"File Permissions define the explicit rights a computer or user has to a "
629
"particular directory, file, or set of files. Such permissions may be defined "
630
"by editing the <filename>/etc/samba/smb.conf</filename> file and specifying "
631
"the explicit permissions of a defined file share."
632
msgstr ""
633
634
#: serverguide/C/windows-networking.xml:531(para)
635
msgid ""
636
"For example, if you have defined a Samba share called "
637
"<emphasis>share</emphasis> and wish to give <emphasis role=\"italic\">read-"
638
"only</emphasis> permissions to the group of users known as <emphasis "
639
"role=\"italic\">qa</emphasis>, but wanted to allow writing to the share by "
640
"the group called <emphasis role=\"italic\">sysadmin</emphasis> and the user "
641
"named <emphasis role=\"italic\">vincent</emphasis>, then you could edit the "
642
"<filename>/etc/samba/smb.conf</filename> file, and add the following entries "
643
"under the <emphasis>[share]</emphasis> entry:"
644
msgstr ""
645
646
#: serverguide/C/windows-networking.xml:540(programlisting)
647
#, no-wrap
648
msgid ""
649
"\n"
650
" read list = @qa\n"
651
" write list = @sysadmin, vincent\n"
652
msgstr ""
653
654
#: serverguide/C/windows-networking.xml:545(para)
655
msgid ""
656
"Another possible Samba permission is to declare "
657
"<emphasis>administrative</emphasis> permissions to a particular shared "
658
"resource. Users having administrative permissions may read, write, or modify "
659
"any information contained in the resource the user has been given explicit "
660
"administrative permissions to."
661
msgstr ""
662
663
#: serverguide/C/windows-networking.xml:551(para)
664
msgid ""
665
"For example, if you wanted to give the user <emphasis "
666
"role=\"italic\">melissa</emphasis> administrative permissions to the "
667
"<emphasis role=\"italic\">share</emphasis> example, you would edit the "
668
"<filename>/etc/samba/smb.conf</filename> file, and add the following line "
669
"under the <emphasis>[share]</emphasis> entry:"
670
msgstr ""
671
672
#: serverguide/C/windows-networking.xml:558(programlisting)
673
#, no-wrap
674
msgid ""
675
"\n"
676
" admin users = melissa\n"
677
msgstr ""
678
679
#: serverguide/C/windows-networking.xml:562(para)
680
msgid ""
681
"After editing <filename>/etc/samba/smb.conf</filename>, restart Samba for "
682
"the changes to take effect:"
683
msgstr ""
684
685
#: serverguide/C/windows-networking.xml:571(para)
686
msgid ""
687
"For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> "
688
"to work the Samba security mode must <emphasis>not</emphasis> be set to "
689
"<emphasis role=\"italic\">security = share</emphasis>"
690
msgstr ""
691
692
#: serverguide/C/windows-networking.xml:577(para)
693
msgid ""
694
"Now that Samba has been configured to limit which groups have access to the "
695
"shared directory, the filesystem permissions need to be updated."
696
msgstr ""
697
698
#: serverguide/C/windows-networking.xml:582(para)
699
msgid ""
700
"Traditional Linux file permissions do not map well to Windows NT Access "
701
"Control Lists (ACLs). Fortunately POSIX ACLs are available on Ubuntu servers "
702
"providing more fine grained control. For example, to enable ACLs on "
703
"<filename>/srv</filename> an EXT3 filesystem, edit "
704
"<filename>/etc/fstab</filename> adding the <emphasis>acl</emphasis> option:"
705
msgstr ""
706
707
#: serverguide/C/windows-networking.xml:589(programlisting)
708
#, no-wrap
709
msgid ""
710
"\n"
711
"UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl "
712
"0 1\n"
713
msgstr ""
714
715
#: serverguide/C/windows-networking.xml:593(para)
716
msgid "Then remount the partition:"
717
msgstr ""
718
719
#: serverguide/C/windows-networking.xml:598(command)
720
msgid "sudo mount -v -o remount /srv"
721
msgstr ""
722
723
#: serverguide/C/windows-networking.xml:602(para)
724
msgid ""
725
"The above example assumes <filename>/srv</filename> on a separate partition. "
726
"If <filename>/srv</filename>, or wherever you have configured your share "
727
"path, is part of the <filename>/</filename> partition a reboot may be "
728
"required."
729
msgstr ""
730
731
#: serverguide/C/windows-networking.xml:609(para)
732
msgid ""
733
"To match the Samba configuration above the <emphasis>sysadmin</emphasis> "
734
"group will be given read, write, and execute permissions to "
735
"<filename>/srv/samba/share</filename>, the <emphasis>qa</emphasis> group "
736
"will be given read and execute permissions, and the files will be owned by "
737
"the username <emphasis>melissa</emphasis>. Enter the following in a terminal:"
738
msgstr ""
739
740
#: serverguide/C/windows-networking.xml:617(command)
741
msgid "sudo chown -R melissa /srv/samba/share/"
742
msgstr ""
743
744
#: serverguide/C/windows-networking.xml:618(command)
745
msgid "sudo chgrp -R sysadmin /srv/samba/share/"
746
msgstr ""
747
748
#: serverguide/C/windows-networking.xml:619(command)
749
msgid "sudo setfacl -R -m g:qa:rx /srv/samba/share/"
750
msgstr ""
751
752
#: serverguide/C/windows-networking.xml:623(para)
753
msgid ""
754
"The <application>setfacl</application> command above gives "
755
"<emphasis>execute</emphasis> permissions to all files in the "
756
"<filename>/srv/samba/share</filename> directory, which you may or may not "
757
"want."
758
msgstr ""
759
760
#: serverguide/C/windows-networking.xml:629(para)
761
msgid ""
762
"Now from a Windows client you should notice the new file permissions are "
763
"implemented. See the <application>acl</application> and "
764
"<application>setfacl</application> man pages for more information on POSIX "
765
"ACLs."
766
msgstr ""
767
768
#: serverguide/C/windows-networking.xml:637(title)
769
msgid "Samba AppArmor Profile"
770
msgstr ""
771
772
#: serverguide/C/windows-networking.xml:639(para)
773
msgid ""
774
"Ubuntu comes with the <application>AppArmor</application> security module, "
775
"which provides mandatory access controls. The default AppArmor profile for "
776
"Samba will need to be adapted to your configuration. For more details on "
777
"using AppArmor see <xref linkend=\"apparmor\"/>."
778
msgstr ""
779
780
#: serverguide/C/windows-networking.xml:645(para)
781
msgid ""
782
"There are default AppArmor profiles for <filename>/usr/sbin/smbd</filename> "
783
"and <filename>/usr/sbin/nmbd</filename>, the Samba daemon binaries, as part "
784
"of the <application>apparmor-profiles</application> packages. To install the "
785
"package, from a terminal prompt enter:"
786
msgstr ""
787
788
#: serverguide/C/windows-networking.xml:652(command) serverguide/C/security.xml:925(command)
789
msgid "sudo apt-get install apparmor-profiles"
790
msgstr ""
791
792
#: serverguide/C/windows-networking.xml:656(para)
793
msgid "This package contains profiles for several other binaries."
794
msgstr ""
795
796
#: serverguide/C/windows-networking.xml:661(para)
797
msgid ""
798
"By default the profiles for <application>smbd</application> and "
799
"<application>nmbd</application> are in <emphasis>complain</emphasis> mode "
800
"allowing Samba to work without modifying the profile, and only logging "
801
"errors. To place the <application>smbd</application> profile into "
802
"<emphasis>enforce</emphasis> mode, and have Samba work as expected, the "
803
"profile will need to be modified to reflect any directories that are shared."
804
msgstr ""
805
806
#: serverguide/C/windows-networking.xml:668(para)
807
msgid ""
808
"Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information "
809
"for <emphasis>[share]</emphasis> from the file server example:"
810
msgstr ""
811
812
#: serverguide/C/windows-networking.xml:673(programlisting)
813
#, no-wrap
814
msgid ""
815
"\n"
816
" /srv/samba/share/ r,\n"
817
" /srv/samba/share/** rwkix,\n"
818
msgstr ""
819
820
#: serverguide/C/windows-networking.xml:678(para)
821
msgid ""
822
"Now place the profile into <emphasis>enforce</emphasis> and reload it:"
823
msgstr ""
824
825
#: serverguide/C/windows-networking.xml:683(command)
826
msgid "sudo aa-enforce /usr/sbin/smbd"
827
msgstr ""
828
829
#: serverguide/C/windows-networking.xml:684(command)
830
msgid "cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r"
831
msgstr ""
832
833
#: serverguide/C/windows-networking.xml:687(para)
834
msgid ""
835
"You should now be able to read, write, and execute files in the shared "
836
"directory as normal, and the <application>smbd</application> binary will "
837
"have access to only the configured files and directories. Be sure to add "
838
"entries for each directory you configure Samba to share. Also, any errors "
839
"will be logged to <filename>/var/log/syslog</filename>."
840
msgstr ""
841
842
#: serverguide/C/windows-networking.xml:712(para) serverguide/C/windows-networking.xml:1082(para)
843
msgid ""
844
"O'Reilly's <ulink "
845
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
846
"also a good reference."
847
msgstr ""
848
849
#: serverguide/C/windows-networking.xml:718(para)
850
msgid ""
851
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-"
852
"samba.html\">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to "
853
"security."
854
msgstr ""
855
856
#: serverguide/C/windows-networking.xml:724(para)
857
msgid ""
858
"For more information on Samba and ACLs see the <ulink "
859
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
860
"Collection/AccessControls.html#id397568\">Samba ACLs page </ulink>."
861
msgstr ""
862
863
#: serverguide/C/windows-networking.xml:740(title)
864
msgid "Samba as a Domain Controller"
865
msgstr ""
866
867
#: serverguide/C/windows-networking.xml:742(para)
868
msgid ""
869
"Although it cannot act as an Active Directory Primary Domain Controller "
870
"(PDC), a Samba server can be configured to appear as a Windows NT4-style "
871
"domain controller. A major advantage of this configuration is the ability to "
872
"centralize user and machine credentials. Samba can also use multiple "
873
"backends to store the user information."
874
msgstr ""
875
876
#: serverguide/C/windows-networking.xml:749(title)
877
msgid "Primary Domain Controller"
878
msgstr ""
879
880
#: serverguide/C/windows-networking.xml:751(para)
881
msgid ""
882
"This section covers configuring Samba as a Primary Domain Controller (PDC) "
883
"using the default smbpasswd backend."
884
msgstr ""
885
886
#: serverguide/C/windows-networking.xml:758(para)
887
msgid ""
888
"First, install Samba, and <application>libpam-smbpass</application> to sync "
889
"the user accounts, by entering the following in a terminal prompt:"
890
msgstr ""
891
892
#: serverguide/C/windows-networking.xml:764(command) serverguide/C/windows-networking.xml:980(command)
893
msgid "sudo apt-get install samba libpam-smbpass"
894
msgstr ""
895
896
#: serverguide/C/windows-networking.xml:770(para)
897
msgid ""
898
"Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. "
899
"The <emphasis>security</emphasis> mode should be set to <emphasis "
900
"role=\"italic\">user</emphasis>, and the <emphasis>workgroup</emphasis> "
901
"should relate to your organization:"
902
msgstr ""
903
904
#: serverguide/C/windows-networking.xml:785(para)
905
msgid ""
906
"In the commented <quote>Domains</quote> section add or uncomment the "
907
"following:"
908
msgstr ""
909
910
#: serverguide/C/windows-networking.xml:789(programlisting)
911
#, no-wrap
912
msgid ""
913
"\n"
914
" domain logons = yes\n"
915
" logon path = \\\\%N\\%U\\profile\n"
916
" logon drive = H:\n"
917
" logon home = \\\\%N\\%U\n"
918
" logon script = logon.cmd\n"
919
" add machine script = sudo /usr/sbin/useradd -N -g machines -c Machine -d "
920
"/var/lib/samba -s /bin/false %u\n"
921
msgstr ""
922
923
#: serverguide/C/windows-networking.xml:800(para)
924
msgid ""
925
"<emphasis>domain logons:</emphasis> provides the netlogon service causing "
926
"Samba to act as a domain controller."
927
msgstr ""
928
929
#: serverguide/C/windows-networking.xml:805(para)
930
msgid ""
931
"<emphasis>logon path:</emphasis> places the user's Windows profile into "
932
"their home directory. It is also possible to configure a "
933
"<emphasis>[profiles]</emphasis> share placing all profiles under a single "
934
"directory."
935
msgstr ""
936
937
#: serverguide/C/windows-networking.xml:811(para)
938
msgid ""
939
"<emphasis>logon drive:</emphasis> specifies the home directory local path."
940
msgstr ""
941
942
#: serverguide/C/windows-networking.xml:816(para)
943
msgid ""
944
"<emphasis>logon home:</emphasis> specifies the home directory location."
945
msgstr ""
946
947
#: serverguide/C/windows-networking.xml:821(para)
948
msgid ""
949
"<emphasis>logon script:</emphasis> determines the script to be run locally "
950
"once a user has logged in. The script needs to be placed in the "
951
"<emphasis>[netlogon]</emphasis> share."
952
msgstr ""
953
954
#: serverguide/C/windows-networking.xml:827(para)
955
msgid ""
956
"<emphasis>add machine script:</emphasis> a script that will automatically "
957
"create the <emphasis>Machine Trust Account</emphasis> needed for a "
958
"workstation to join the domain."
959
msgstr ""
960
961
#: serverguide/C/windows-networking.xml:831(para)
962
msgid ""
963
"In this example the <emphasis>machines</emphasis> group will need to be "
964
"created using the <application>addgroup</application> utility see <xref "
965
"linkend=\"adding-deleting-users\"/> for details."
966
msgstr ""
967
968
#: serverguide/C/windows-networking.xml:839(para)
969
msgid ""
970
"If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the "
971
"<emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options "
972
"commented."
973
msgstr ""
974
975
#: serverguide/C/windows-networking.xml:848(para)
976
msgid ""
977
"Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis "
978
"role=\"italic\">logon home</emphasis> to be mapped:"
979
msgstr ""
980
981
#: serverguide/C/windows-networking.xml:853(programlisting)
982
#, no-wrap
983
msgid ""
984
"\n"
985
"[homes]\n"
986
" comment = Home Directories\n"
987
" browseable = no\n"
988
" read only = no\n"
989
" create mask = 0700\n"
990
" directory mask = 0700\n"
991
" valid users = %S\n"
992
msgstr ""
993
994
#: serverguide/C/windows-networking.xml:866(para)
995
msgid ""
996
"When configured as a domain controller a <emphasis>[netlogon]</emphasis> "
997
"share needs to be configured. To enable the share, uncomment:"
998
msgstr ""
999
1000
#: serverguide/C/windows-networking.xml:871(programlisting)
1001
#, no-wrap
1002
msgid ""
1003
"\n"
1004
"[netlogon]\n"
1005
" comment = Network Logon Service\n"
1006
" path = /srv/samba/netlogon\n"
1007
" guest ok = yes\n"
1008
" read only = yes\n"
1009
" share modes = no\n"
1010
msgstr ""
1011
1012
#: serverguide/C/windows-networking.xml:881(para)
1013
msgid ""
1014
"The original <emphasis>netlogon</emphasis> share path is "
1015
"<filename>/home/samba/netlogon</filename>, but according to the Filesystem "
1016
"Hierarchy Standard (FHS), <ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
1017
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is the correct "
1018
"location for site-specific data provided by the system."
1019
msgstr ""
1020
1021
#: serverguide/C/windows-networking.xml:892(para)
1022
msgid ""
1023
"Now create the <filename role=\"directory\">netlogon</filename> directory, "
1024
"and an empty (for now) <filename>logon.cmd</filename> script file:"
1025
msgstr ""
1026
1027
#: serverguide/C/windows-networking.xml:898(command)
1028
msgid "sudo mkdir -p /srv/samba/netlogon"
1029
msgstr ""
1030
1031
#: serverguide/C/windows-networking.xml:899(command)
1032
msgid "sudo touch /srv/samba/netlogon/logon.cmd"
1033
msgstr ""
1034
1035
#: serverguide/C/windows-networking.xml:902(para)
1036
msgid ""
1037
"You can enter any normal Windows logon script commands in "
1038
"<filename>logon.cmd</filename> to customize the client's environment."
1039
msgstr ""
1040
1041
#: serverguide/C/windows-networking.xml:910(para)
1042
msgid ""
1043
"With <emphasis>root</emphasis> being disabled by default, in order to join a "
1044
"workstation to the domain, a system group needs to be mapped to the Windows "
1045
"<emphasis>Domain Admins</emphasis> group. Using the "
1046
"<application>net</application> utility, from a terminal enter:"
1047
msgstr ""
1048
1049
#: serverguide/C/windows-networking.xml:917(command)
1050
msgid ""
1051
"sudo net groupmap add ntgroup=\"Domain Admins\" unixgroup=sysadmin rid=512 "
1052
"type=d"
1053
msgstr ""
1054
1055
#: serverguide/C/windows-networking.xml:921(para)
1056
msgid ""
1057
"Change <emphasis role=\"italic\">sysadmin</emphasis> to whichever group you "
1058
"prefer. Also, the user used to join the domain needs to be a member of the "
1059
"<emphasis>sysadmin</emphasis> group, as well as a member of the system "
1060
"<emphasis>admin</emphasis> group. The <emphasis>admin</emphasis> group "
1061
"allows <application>sudo</application> use."
1062
msgstr ""
1063
1064
#: serverguide/C/windows-networking.xml:932(para)
1065
msgid "Finally, restart Samba to enable the new domain controller:"
1066
msgstr ""
1067
1068
#: serverguide/C/windows-networking.xml:943(para)
1069
msgid ""
1070
"You should now be able to join Windows clients to the Domain in the same "
1071
"manner as joining them to an NT4 domain running on a Windows server."
1072
msgstr ""
1073
1074
#: serverguide/C/windows-networking.xml:953(title)
1075
msgid "Backup Domain Controller"
1076
msgstr ""
1077
1078
#: serverguide/C/windows-networking.xml:955(para)
1079
msgid ""
1080
"With a Primary Domain Controller (PDC) on the network it is best to have a "
1081
"Backup Domain Controller (BDC) as well. This will allow clients to "
1082
"authenticate in case the PDC becomes unavailable."
1083
msgstr ""
1084
1085
#: serverguide/C/windows-networking.xml:960(para)
1086
msgid ""
1087
"When configuring Samba as a BDC you need a way to sync account information "
1088
"with the PDC. There are multiple ways of accomplishing this "
1089
"<application>scp</application>, <application>rsync</application>, or by "
1090
"using <application>LDAP</application> as the <emphasis>passdb "
1091
"backend</emphasis>."
1092
msgstr ""
1093
1094
#: serverguide/C/windows-networking.xml:966(para)
1095
msgid ""
1096
"Using LDAP is the most robust way to sync account information, because both "
1097
"domain controllers can use the same information in real time. However, "
1098
"setting up a LDAP server may be overly complicated for a small number of "
1099
"user and computer accounts. See <xref linkend=\"samba-ldap\"/> for details."
1100
msgstr ""
1101
1102
#: serverguide/C/windows-networking.xml:975(para)
1103
msgid ""
1104
"First, install <application>samba</application> and <application>libpam-"
1105
"smbpass</application>. From a terminal enter:"
1106
msgstr ""
1107
1108
#: serverguide/C/windows-networking.xml:986(para)
1109
msgid ""
1110
"Now, edit <filename>/etc/samba/smb.conf</filename> and uncomment the "
1111
"following in the <emphasis>[global]</emphasis>:"
1112
msgstr ""
1113
1114
#: serverguide/C/windows-networking.xml:999(para)
1115
msgid "In the commented <emphasis>Domains</emphasis> uncomment or add:"
1116
msgstr ""
1117
1118
#: serverguide/C/windows-networking.xml:1003(programlisting)
1119
#, no-wrap
1120
msgid ""
1121
"\n"
1122
" domain logons = yes\n"
1123
" domain master = no\n"
1124
msgstr ""
1125
1126
#: serverguide/C/windows-networking.xml:1011(para)
1127
msgid ""
1128
"Make sure a user has rights to read the files in "
1129
"<filename>/var/lib/samba</filename>. For example, to allow users in the "
1130
"<emphasis>admin</emphasis> group to <application>scp</application> the "
1131
"files, enter:"
1132
msgstr ""
1133
1134
#: serverguide/C/windows-networking.xml:1017(command)
1135
msgid "sudo chgrp -R admin /var/lib/samba"
1136
msgstr ""
1137
1138
#: serverguide/C/windows-networking.xml:1023(para)
1139
msgid ""
1140
"Next, sync the user accounts, using <application>scp</application> to copy "
1141
"the <filename>/var/lib/samba</filename> directory from the PDC:"
1142
msgstr ""
1143
1144
#: serverguide/C/windows-networking.xml:1029(command)
1145
msgid "sudo scp -r username@pdc:/var/lib/samba /var/lib"
1146
msgstr ""
1147
1148
#: serverguide/C/windows-networking.xml:1033(para)
1149
msgid ""
1150
"Replace <emphasis>username</emphasis> with a valid username and "
1151
"<emphasis>pdc</emphasis> with the hostname or IP Address of your actual PDC."
1152
msgstr ""
1153
1154
#: serverguide/C/windows-networking.xml:1042(para)
1155
msgid "Finally, restart <application>samba</application>:"
1156
msgstr ""
1157
1158
#: serverguide/C/windows-networking.xml:1053(para)
1159
msgid ""
1160
"You can test that your Backup Domain controller is working by stopping the "
1161
"Samba daemon on the PDC, then trying to login to a Windows client joined to "
1162
"the domain."
1163
msgstr ""
1164
1165
#: serverguide/C/windows-networking.xml:1058(para)
1166
msgid ""
1167
"Another thing to keep in mind is if you have configured the <emphasis>logon "
1168
"home</emphasis> option as a directory on the PDC, and the PDC becomes "
1169
"unavailable, access to the user's <emphasis>Home</emphasis> drive will also "
1170
"be unavailable. For this reason it is best to configure the <emphasis>logon "
1171
"home</emphasis> to reside on a separate file server from the PDC and BDC."
1172
msgstr ""
1173
1174
#: serverguide/C/windows-networking.xml:1088(para)
1175
msgid ""
1176
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-"
1177
"pdc.html\">Chapter 4</ulink> of the Samba HOWTO Collection explains setting "
1178
"up a Primary Domain Controller."
1179
msgstr ""
1180
1181
#: serverguide/C/windows-networking.xml:1094(para)
1182
msgid ""
1183
"<ulink url=\"http://us3.samba.org/samba/docs/man/Samba-HOWTO-"
1184
"Collection/samba-bdc.html\">Chapter 5</ulink> of the Samba HOWTO Collection "
1185
"explains setting up a Backup Domain Controller."
1186
msgstr ""
1187
1188
#: serverguide/C/windows-networking.xml:1109(title)
1189
msgid "Samba Active Directory Integration"
1190
msgstr ""
1191
1192
#: serverguide/C/windows-networking.xml:1112(title)
1193
msgid "Accessing a Samba Share"
1194
msgstr ""
1195
1196
#: serverguide/C/windows-networking.xml:1114(para)
1197
msgid ""
1198
"Another, use for Samba is to integrate into an existing Windows network. "
1199
"Once part of an Active Directory domain, Samba can provide file and print "
1200
"services to AD users."
1201
msgstr ""
1202
1203
#: serverguide/C/windows-networking.xml:1119(para)
1204
msgid ""
1205
"The simplest way to join an AD domain is to use <application>Likewise-"
1206
"open</application>. For detailed instructions see <xref linkend=\"likewise-"
1207
"open\"/>."
1208
msgstr ""
1209
1210
#: serverguide/C/windows-networking.xml:1124(para)
1211
msgid ""
1212
"Once part of the domain, enter the following command in the terminal prompt:"
1213
msgstr ""
1214
1215
#: serverguide/C/windows-networking.xml:1129(command)
1216
msgid "sudo apt-get install samba smbfs smbclient"
1217
msgstr ""
1218
1219
#: serverguide/C/windows-networking.xml:1132(para)
1220
msgid ""
1221
"Since the <application>likewise-open</application> and "
1222
"<application>samba</application> packages use separate "
1223
"<filename>secrets.tdb</filename> files, a symlink will need to be created in "
1224
"<filename role=\"directory\">/var/lib/samba</filename>:"
1225
msgstr ""
1226
1227
#: serverguide/C/windows-networking.xml:1138(command)
1228
msgid "sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig"
1229
msgstr ""
1230
1231
#: serverguide/C/windows-networking.xml:1139(command)
1232
msgid "sudo ln -s /etc/samba/secrets.tdb /var/lib/samba"
1233
msgstr ""
1234
1235
#: serverguide/C/windows-networking.xml:1142(para)
1236
msgid "Next, edit <filename>/etc/samba/smb.conf</filename> changing:"
1237
msgstr ""
1238
1239
#: serverguide/C/windows-networking.xml:1146(programlisting)
1240
#, no-wrap
1241
msgid ""
1242
"\n"
1243
" workgroup = EXAMPLE\n"
1244
" ...\n"
1245
" security = ads\n"
1246
" realm = EXAMPLE.COM\n"
1247
" ...\n"
1248
" idmap backend = lwopen\n"
1249
" idmap uid = 50-9999999999\n"
1250
" idmap gid = 50-9999999999\n"
1251
msgstr ""
1252
1253
#: serverguide/C/windows-networking.xml:1157(para)
1254
msgid ""
1255
"Restart <application>samba</application> for the new settings to take effect:"
1256
msgstr ""
1257
1258
#: serverguide/C/windows-networking.xml:1165(para)
1259
msgid ""
1260
"You should now be able to access any <application>Samba</application> shares "
1261
"from a Windows client. However, be sure to give the appropriate AD users or "
1262
"groups access to the share directory. See <xref linkend=\"samba-fileprint-"
1263
"security\"/> for more details."
1264
msgstr ""
1265
1266
#: serverguide/C/windows-networking.xml:1173(title)
1267
msgid "Accessing a Windows Share"
1268
msgstr ""
1269
1270
#: serverguide/C/windows-networking.xml:1175(para)
1271
msgid ""
1272
"Now that the Samba server is part of the Active Directory domain you can "
1273
"access any Windows server shares:"
1274
msgstr ""
1275
1276
#: serverguide/C/windows-networking.xml:1182(para)
1277
msgid ""
1278
"To mount a Windows file share enter the following in a terminal prompt:"
1279
msgstr ""
1280
1281
#: serverguide/C/windows-networking.xml:1186(command)
1282
msgid "mount.cifs //fs01.example.com/share mount_point"
1283
msgstr ""
1284
1285
#: serverguide/C/windows-networking.xml:1189(para)
1286
msgid ""
1287
"It is also possible to access shares on computers not part of an AD domain, "
1288
"but a username and password will need to be provided."
1289
msgstr ""
1290
1291
#: serverguide/C/windows-networking.xml:1197(para)
1292
msgid ""
1293
"To mount the share during boot place an entry in "
1294
"<filename>/etc/fstab</filename>, for example:"
1295
msgstr ""
1296
1297
#: serverguide/C/windows-networking.xml:1201(programlisting)
1298
#, no-wrap
1299
msgid ""
1300
"\n"
1301
"//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw "
1302
"0 0\n"
1303
msgstr ""
1304
1305
#: serverguide/C/windows-networking.xml:1208(para)
1306
msgid ""
1307
"Another way to copy files from a Windows server is to use the "
1308
"<application>smbclient</application> utility. To list the files in a Windows "
1309
"share:"
1310
msgstr ""
1311
1312
#: serverguide/C/windows-networking.xml:1214(command)
1313
msgid "smbclient //fs01.example.com/share -k -c \"ls\""
1314
msgstr ""
1315
1316
#: serverguide/C/windows-networking.xml:1220(para)
1317
msgid "To copy a file from the share, enter:"
1318
msgstr ""
1319
1320
#: serverguide/C/windows-networking.xml:1225(command)
1321
msgid "smbclient //fs01.example.com/share -k -c \"get file.txt\""
1322
msgstr ""
1323
1324
#: serverguide/C/windows-networking.xml:1228(para)
1325
msgid ""
1326
"This will copy the <filename>file.txt</filename> into the current directory."
1327
msgstr ""
1328
1329
#: serverguide/C/windows-networking.xml:1235(para)
1330
msgid "And to copy a file to the share:"
1331
msgstr ""
1332
1333
#: serverguide/C/windows-networking.xml:1240(command)
1334
msgid "smbclient //fs01.example.com/share -k -c \"put /etc/hosts hosts\""
1335
msgstr ""
1336
1337
#: serverguide/C/windows-networking.xml:1243(para)
1338
msgid ""
1339
"This will copy the <filename>/etc/hosts</filename> to "
1340
"<filename>//fs01.example.com/share/hosts</filename>."
1341
msgstr ""
1342
1343
#: serverguide/C/windows-networking.xml:1250(para)
1344
msgid ""
1345
"The <emphasis>-c</emphasis> option used above allows you to execute the "
1346
"<application>smbclient</application> command all at once. This is useful for "
1347
"scripting and minor file operations. To enter the <emphasis>smb: \\"
1348
"></emphasis> prompt, a FTP like prompt where you can execute normal file "
1349
"and directory commands, simply execute:"
1350
msgstr ""
1351
1352
#: serverguide/C/windows-networking.xml:1257(command)
1353
msgid "smbclient //fs01.example.com/share -k"
1354
msgstr ""
1355
1356
#: serverguide/C/windows-networking.xml:1264(para)
1357
msgid ""
1358
"Replace all instances of <emphasis>fs01.example.com/share</emphasis>, "
1359
"<emphasis>//192.168.0.5/share</emphasis>, "
1360
"<emphasis>username=steve,password=secret</emphasis>, and "
1361
"<emphasis>file.txt</emphasis> with your server's IP, hostname, share name, "
1362
"file name, and an actual username and password with rights to the share."
1363
msgstr ""
1364
1365
#: serverguide/C/windows-networking.xml:1275(para)
1366
msgid ""
1367
"For more <application>smbclient</application> options see the man page: "
1368
"<command>man smbclient</command>, also available <ulink "
1369
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/smbclient.1.html\">on"
1370
"line</ulink>."
1371
msgstr ""
1372
1373
#: serverguide/C/windows-networking.xml:1280(para)
1374
msgid ""
1375
"The <application>mount.cifs</application><ulink "
1376
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/mount.cifs.8.html\">m"
1377
"an page</ulink> is also useful for more detailed information."
1378
msgstr ""
1379
1380
#: serverguide/C/windows-networking.xml:1293(title)
1381
msgid "Likewise Open"
1382
msgstr "Likewise Open"
1383
1384
#: serverguide/C/windows-networking.xml:1295(para)
1385
msgid ""
1386
"<application>Likewise Open</application> simplifies the necessary "
1387
"configuration needed to authenticate a Linux machine to an Active Directory "
1388
"domain. Based on <application>winbind</application>, the "
1389
"<application>likewise-open</application> package takes the pain out of "
1390
"integrating Ubuntu authentication into an existing Windows network."
1391
msgstr ""
1392
"<application>Likewise Open</application> го поедноставува процесот на "
1393
"конфигурација за да се автентицирате Linux машина во Active Directory домен. "
1394
"Базиран на <application>winbind</application>, <application>likewise-"
1395
"open</application> ја отстранува болката при интегрирање на Ubuntu "
1396
"автентикација во веќе постоечка Windows мрежа."
1397
1398
#: serverguide/C/windows-networking.xml:1304(para)
1399
msgid ""
1400
"There are two ways to use Likewise Open, <application>likewise-"
1401
"open</application> the command line utility and <application>likewise-open-"
1402
"gui</application>. This section focuses on the command line utility."
1403
msgstr ""
1404
"Постојат два начини на користење на Likewise Open, командната алатка "
1405
"<application>likewise-open</application> и <application>likewise-open-"
1406
"gui</application>. Овој оддел ќе се фокусира на користење на командната "
1407
"алатка."
1408
1409
#: serverguide/C/windows-networking.xml:1309(para)
1410
msgid ""
1411
"To install the <application>likewise-open</application> package, open a "
1412
"terminal prompt and enter:"
1413
msgstr ""
1414
"За инсталација на <application>likewise-open</application> пакетот, отворете "
1415
"терминал и внесете:"
1416
1417
#: serverguide/C/windows-networking.xml:1314(command)
1418
msgid "sudo apt-get install likewise-open"
1419
msgstr "sudo apt-get install likewise-open"
1420
1421
#: serverguide/C/windows-networking.xml:1319(title)
1422
msgid "Joining a Domain"
1423
msgstr "Приклучување на домен"
1424
1425
#: serverguide/C/windows-networking.xml:1321(para)
1426
msgid ""
1427
"The main executable file of the <application>likewise-open</application> "
1428
"package is <filename>/usr/bin/domainjoin-cli</filename>, which is used to "
1429
"join your computer to the domain. Before you join a domain you will need to "
1430
"make sure you have:"
1431
msgstr ""
1432
1433
#: serverguide/C/windows-networking.xml:1329(para)
1434
msgid ""
1435
"Access to an Active Directory user with appropriate rights to join the "
1436
"domain."
1437
msgstr ""
1438
"Пристап до Active Directory корисник со соодветни привилегии за приклучување "
1439
"на доменот."
1440
1441
#: serverguide/C/windows-networking.xml:1334(para)
1442
msgid ""
1443
"The <emphasis>Fully Qualified Domain Name</emphasis> (FQDN) of the domain "
1444
"you want to join. If your AD domain does not match a valid domain such as "
1445
"<emphasis role=\"italic\">example.com</emphasis>, it is likely that it has "
1446
"the form of <emphasis>domainname.local</emphasis>."
1447
msgstr ""
1448
1449
#: serverguide/C/windows-networking.xml:1341(para)
1450
msgid ""
1451
"DNS for the domain setup properly. In a production AD environment this "
1452
"should be the case. Proper Microsoft DNS is needed so that client "
1453
"workstations can determine the Active Directory domain is available."
1454
msgstr ""
1455
1456
#: serverguide/C/windows-networking.xml:1345(para)
1457
msgid ""
1458
"If you don't have a Windows DNS server on your network, see <xref "
1459
"linkend=\"likewise-open-ms-dns\"/> for details."
1460
msgstr ""
1461
1462
#: serverguide/C/windows-networking.xml:1352(para)
1463
msgid "To join a domain, from a terminal prompt enter:"
1464
msgstr "За приклучување кон домен, во командна линија внесете:"
1465
1466
#: serverguide/C/windows-networking.xml:1357(command)
1467
msgid "sudo domainjoin-cli join example.com Administrator"
1468
msgstr ""
1469
1470
#: serverguide/C/windows-networking.xml:1361(para)
1471
msgid ""
1472
"Replace <emphasis>example.com</emphasis> with your domain name, and "
1473
"<emphasis>Administrator</emphasis> with the appropriate user name."
1474
msgstr ""
1475
1476
#: serverguide/C/windows-networking.xml:1367(para)
1477
msgid ""
1478
"You will then be prompted for the user's password. If all goes well a "
1479
"<emphasis>SUCCESS</emphasis> message should be printed to the console."
1480
msgstr ""
1481
"Ќе биде побарано да внесете корисничка лозинка. Ако е се во ред ќе се "
1482
"прикаже порака <emphasis>SUCCESS</emphasis> во самиот терминал."
1483
1484
#: serverguide/C/windows-networking.xml:1373(para)
1485
msgid ""
1486
"After joining the domain, it is necessary to reboot before attempting to "
1487
"authenticate against the domain."
1488
msgstr ""
1489
1490
#: serverguide/C/windows-networking.xml:1379(para)
1491
msgid ""
1492
"After successfully joining an Ubuntu machine to an Active Directory domain "
1493
"you can authenticate using any valid AD user. To login you will need to "
1494
"enter the user name as 'domain\\username'. For example to ssh to a server "
1495
"joined to the domain enter:"
1496
msgstr ""
1497
"По успешно приклучување на Ubuntu машина кон Active Directory домен, ќе "
1498
"можете да се автентификувате со сите валидни AD корисници. За логирање ќе Ви "
1499
"биде потребно корисничко име како 'domain\\username'. На пример за "
1500
"поврзување со ssh кон сервер приклучен во доменот, внесете:"
1501
1502
#: serverguide/C/windows-networking.xml:1386(command)
1503
msgid "ssh 'example\\steve'@hostname"
1504
msgstr "ssh 'example\\steve'@hostname"
1505
1506
#: serverguide/C/windows-networking.xml:1390(para)
1507
msgid ""
1508
"If configuring a Desktop the user name will need to be prefixed with "
1509
"<emphasis role=\"italic\">domain\\</emphasis> in the graphical logon as well."
1510
msgstr ""
1511
1512
#: serverguide/C/windows-networking.xml:1396(para)
1513
msgid ""
1514
"To make likewise-open use a default domain, you can add the following "
1515
"statement to <filename>/etc/samba/lwiauthd.conf</filename>:"
1516
msgstr ""
1517
1518
#: serverguide/C/windows-networking.xml:1400(programlisting)
1519
#, no-wrap
1520
msgid ""
1521
"\n"
1522
"winbind use default domain = yes\n"
1523
msgstr ""
1524
1525
#: serverguide/C/windows-networking.xml:1404(para)
1526
msgid "Then restart the <application>likewise-open</application> daemons:"
1527
msgstr ""
1528
1529
#: serverguide/C/windows-networking.xml:1409(command)
1530
msgid "sudo /etc/init.d/likewise-open restart"
1531
msgstr ""
1532
1533
#: serverguide/C/windows-networking.xml:1413(para)
1534
msgid ""
1535
"Once configured for a <emphasis>default domain</emphasis> the <emphasis "
1536
"role=\"italic\">'domain\\'</emphasis> is no longer required, users can login "
1537
"using only their username."
1538
msgstr ""
1539
1540
#: serverguide/C/windows-networking.xml:1419(para)
1541
msgid ""
1542
"The <application>domainjoin-cli</application> utility can also be used to "
1543
"leave the domain. From a terminal:"
1544
msgstr ""
1545
1546
#: serverguide/C/windows-networking.xml:1424(command)
1547
msgid "sudo domainjoin-cli leave"
1548
msgstr "sudo domainjoin-cli leave"
1549
1550
#: serverguide/C/windows-networking.xml:1429(title) serverguide/C/security.xml:1777(title)
1551
msgid "Other Utilities"
1552
msgstr ""
1553
1554
#: serverguide/C/windows-networking.xml:1431(para)
1555
msgid ""
1556
"The <application>likewise-open</application> package comes with a few other "
1557
"utilities that may be useful for gathering information about the Active "
1558
"Directory environment. These utilities are used to join the machine to the "
1559
"domain, and are the same as those available in the <application>samba-"
1560
"common</application> and <application>winbind</application> packages:"
1561
msgstr ""
1562
1563
#: serverguide/C/windows-networking.xml:1440(para)
1564
msgid ""
1565
"<application>lwinet</application>: Returns information about the network and "
1566
"the domain."
1567
msgstr ""
1568
1569
#: serverguide/C/windows-networking.xml:1445(para)
1570
msgid ""
1571
"<application>lwimsg</application>: Allows interaction with the "
1572
"<application>likewise-winbindd</application> daemon."
1573
msgstr ""
1574
1575
#: serverguide/C/windows-networking.xml:1450(para)
1576
msgid ""
1577
"<application>lwiinfo</application>: Displays information about various parts "
1578
"of the Domain."
1579
msgstr ""
1580
1581
#: serverguide/C/windows-networking.xml:1456(para)
1582
msgid "Please refer to each utility's man page specific for details."
1583
msgstr ""
1584
1585
#: serverguide/C/windows-networking.xml:1462(title) serverguide/C/mail.xml:351(title) serverguide/C/mail.xml:1598(title) serverguide/C/dns.xml:338(title)
1586
msgid "Troubleshooting"
1587
msgstr ""
1588
1589
#: serverguide/C/windows-networking.xml:1466(para)
1590
msgid ""
1591
"If the client has trouble joining the domain, double check that the "
1592
"Microsoft DNS is listed first in <filename>/etc/resolv.conf</filename>. For "
1593
"example:"
1594
msgstr ""
1595
1596
#: serverguide/C/windows-networking.xml:1471(programlisting)
1597
#, no-wrap
1598
msgid ""
1599
"\n"
1600
"nameserver 192.168.0.1\n"
1601
msgstr ""
1602
1603
#: serverguide/C/windows-networking.xml:1476(para)
1604
msgid ""
1605
"For more information when joining a domain, use the <emphasis>--loglevel "
1606
"verbose</emphasis> or <emphasis>--advanced</emphasis> option of the "
1607
"<application>domainjoin-cli</application> utility:"
1608
msgstr ""
1609
1610
#: serverguide/C/windows-networking.xml:1482(command)
1611
msgid "sudo domainjoin-cli --loglevel verbose join example.com Administrator"
1612
msgstr ""
1613
1614
#: serverguide/C/windows-networking.xml:1486(para)
1615
msgid ""
1616
"If an Active Directory user has trouble logging in, check the "
1617
"<filename>/var/log/auth.log</filename> for details."
1618
msgstr ""
1619
1620
#: serverguide/C/windows-networking.xml:1491(para)
1621
msgid ""
1622
"When joining an Ubuntu Desktop workstation to a domain, you may need to edit "
1623
"<filename>/etc/nsswitch.conf</filename> if your AD domain uses the <emphasis "
1624
"role=\"italic\">.local</emphasis> syntax. In order to join the domain the "
1625
"<emphasis>\"mdns4\"</emphasis> entry should be removed from the "
1626
"<emphasis>hosts</emphasis> option. For example:"
1627
msgstr ""
1628
1629
#: serverguide/C/windows-networking.xml:1497(programlisting)
1630
#, no-wrap
1631
msgid ""
1632
"\n"
1633
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
1634
msgstr ""
1635
1636
#: serverguide/C/windows-networking.xml:1501(para)
1637
msgid "Change the above to:"
1638
msgstr ""
1639
1640
#: serverguide/C/windows-networking.xml:1505(programlisting)
1641
#, no-wrap
1642
msgid ""
1643
"\n"
1644
"hosts: files dns [NOTFOUND=return]\n"
1645
msgstr ""
1646
1647
#: serverguide/C/windows-networking.xml:1509(para)
1648
msgid "Then restart networking by entering:"
1649
msgstr ""
1650
1651
#: serverguide/C/windows-networking.xml:1514(command) serverguide/C/network-config.xml:559(command)
1652
msgid "sudo /etc/init.d/networking restart"
1653
msgstr ""
1654
1655
#: serverguide/C/windows-networking.xml:1517(para)
1656
msgid "You should now be able to join the Active Directory domain."
1657
msgstr ""
1658
1659
#: serverguide/C/windows-networking.xml:1525(title)
1660
msgid "Microsoft DNS"
1661
msgstr ""
1662
1663
#: serverguide/C/windows-networking.xml:1527(para)
1664
msgid ""
1665
"The following are instructions for installing DNS on an Active Directory "
1666
"domain controller running Windows Server 2003, but the instructions should "
1667
"be similar for other versions:"
1668
msgstr ""
1669
1670
#: serverguide/C/windows-networking.xml:1536(para)
1671
msgid ""
1672
"Click "
1673
"<menuchoice><guimenuitem>Start</guimenuitem><guimenuitem>Administrative Tools"
1674
"</guimenuitem><guimenuitem>Manage Your Server</guimenuitem></menuchoice>. "
1675
"This will open the <application>Server Role Mangement</application> utility."
1676
msgstr ""
1677
1678
#: serverguide/C/windows-networking.xml:1544(para)
1679
msgid "Click <guilabel>Add or remove a role</guilabel>"
1680
msgstr ""
1681
1682
#: serverguide/C/windows-networking.xml:1545(para) serverguide/C/windows-networking.xml:1547(para) serverguide/C/windows-networking.xml:1550(para)
1683
msgid "Click Next"
1684
msgstr ""
1685
1686
#: serverguide/C/windows-networking.xml:1546(para)
1687
msgid "Select \"DNS Server\""
1688
msgstr ""
1689
1690
#: serverguide/C/windows-networking.xml:1548(para)
1691
msgid "Click Next again to proceed"
1692
msgstr ""
1693
1694
#: serverguide/C/windows-networking.xml:1549(para)
1695
msgid "Select \"Create a forward lookup zone\" if it is not selected."
1696
msgstr ""
1697
1698
#: serverguide/C/windows-networking.xml:1551(para)
1699
msgid ""
1700
"Make sure \"This server maintains the zone\" is selected and click Next."
1701
msgstr ""
1702
1703
#: serverguide/C/windows-networking.xml:1552(para)
1704
msgid "Enter your domain name and click Next"
1705
msgstr ""
1706
1707
#: serverguide/C/windows-networking.xml:1553(para)
1708
msgid "Click Next to \"Allow only secure dynamic updates\""
1709
msgstr ""
1710
1711
#: serverguide/C/windows-networking.xml:1555(para)
1712
msgid ""
1713
"Enter the IP for DNS servers to forward queries to, or Select \"No, it "
1714
"should not forward queries\" and click Next."
1715
msgstr ""
1716
1717
#: serverguide/C/windows-networking.xml:1559(para) serverguide/C/windows-networking.xml:1560(para)
1718
msgid "Click Finish"
1719
msgstr ""
1720
1721
#: serverguide/C/windows-networking.xml:1562(para)
1722
msgid ""
1723
"DNS is now installed and can be further configured using the "
1724
"<application>Microsoft Management Console</application> DNS snap-in."
1725
msgstr ""
1726
1727
#: serverguide/C/windows-networking.xml:1570(para)
1728
msgid "Click Start"
1729
msgstr ""
1730
1731
#: serverguide/C/windows-networking.xml:1571(para)
1732
msgid "Control Panel"
1733
msgstr ""
1734
1735
#: serverguide/C/windows-networking.xml:1572(para)
1736
msgid "Network Connections"
1737
msgstr ""
1738
1739
#: serverguide/C/windows-networking.xml:1573(para)
1740
msgid "Right Click \"Local Area Connection\""
1741
msgstr ""
1742
1743
#: serverguide/C/windows-networking.xml:1574(para)
1744
msgid "Click Properties"
1745
msgstr ""
1746
1747
#: serverguide/C/windows-networking.xml:1575(para)
1748
msgid "Double click \"Internet Protocol (TCP/IP)\""
1749
msgstr ""
1750
1751
#: serverguide/C/windows-networking.xml:1576(para)
1752
msgid "Enter the Server's IP Address as the \"Preferred DNS server\""
1753
msgstr ""
1754
1755
#: serverguide/C/windows-networking.xml:1577(para)
1756
msgid "Click Ok"
1757
msgstr ""
1758
1759
#: serverguide/C/windows-networking.xml:1578(para)
1760
msgid "Click Ok again to save the settings"
1761
msgstr ""
1762
1763
#: serverguide/C/windows-networking.xml:1567(para)
1764
msgid ""
1765
"Next, configure the Server to use itself for DNS queries: <placeholder-1/>"
1766
msgstr ""
1767
1768
#: serverguide/C/windows-networking.xml:1585(title) serverguide/C/web-servers.xml:624(title) serverguide/C/web-servers.xml:772(title) serverguide/C/web-servers.xml:922(title) serverguide/C/web-servers.xml:1017(title) serverguide/C/web-servers.xml:1239(title) serverguide/C/vpn.xml:303(title) serverguide/C/virtualization.xml:1840(title) serverguide/C/virtualization.xml:2165(title) serverguide/C/vcs.xml:539(title) serverguide/C/security.xml:877(title) serverguide/C/security.xml:1211(title) serverguide/C/security.xml:1626(title) serverguide/C/security.xml:1817(title) serverguide/C/remote-administration.xml:203(title) serverguide/C/package-management.xml:454(title) serverguide/C/other-apps.xml:330(title) serverguide/C/network-config.xml:1006(title) serverguide/C/network-config.xml:1107(title) serverguide/C/monitoring.xml:391(title) serverguide/C/monitoring.xml:527(title) serverguide/C/mail.xml:459(title) serverguide/C/mail.xml:643(title) serverguide/C/mail.xml:795(title) serverguide/C/mail.xml:1217(title) serverguide/C/mail.xml:1646(title) serverguide/C/lamp-applications.xml:259(title) serverguide/C/lamp-applications.xml:388(title) serverguide/C/lamp-applications.xml:496(title) serverguide/C/file-server.xml:284(title) serverguide/C/file-server.xml:436(title) serverguide/C/file-server.xml:619(title) serverguide/C/dns.xml:572(title) serverguide/C/clustering.xml:234(title) serverguide/C/chat.xml:107(title) serverguide/C/chat.xml:221(title) serverguide/C/backups.xml:297(title)
1769
msgid "References"
1770
msgstr ""
1771
1772
#: serverguide/C/windows-networking.xml:1587(para)
1773
msgid ""
1774
"Please refer to the <ulink "
1775
"url=\"http://www.likewisesoftware.com/\">Likewise</ulink> home page for "
1776
"further information."
1777
msgstr ""
1778
1779
#: serverguide/C/windows-networking.xml:1591(para)
1780
msgid ""
1781
"For more <application>domainjoin-cli</application> options see the man page: "
1782
"<command>man domainjoin-cli</command>."
1783
msgstr ""
1784
1785
#: serverguide/C/windows-networking.xml:1595(para)
1786
msgid ""
1787
"Also, see the <ulink "
1788
"url=\"https://help.ubuntu.com/community/LikewiseOpen\">Ubuntu Wiki "
1789
"LikewiseOpen</ulink> page."
1790
msgstr ""
1791
1792
#: serverguide/C/web-servers.xml:13(title)
1793
msgid "Web Servers"
1794
msgstr ""
1795
1796
#: serverguide/C/web-servers.xml:14(para)
1797
msgid ""
1798
"A Web server is a software responsible for accepting HTTP requests from "
1799
"clients, which are known as Web browsers, and serving them HTTP responses "
1800
"along with optional data contents, which usually are Web pages such as HTML "
1801
"documents and linked objects (images, etc.)."
1802
msgstr ""
1803
1804
#: serverguide/C/web-servers.xml:19(title)
1805
msgid "HTTPD - Apache2 Web Server"
1806
msgstr ""
1807
1808
#: serverguide/C/web-servers.xml:20(para)
1809
msgid ""
1810
"Apache is the most commonly used Web Server on Linux systems. Web Servers "
1811
"are used to serve Web Pages requested by client computers. Clients typically "
1812
"request and view Web Pages using Web Browser applications such as "
1813
"<application>Firefox</application>, <application>Opera</application>, or "
1814
"<application>Mozilla</application>."
1815
msgstr ""
1816
1817
#: serverguide/C/web-servers.xml:24(para)
1818
msgid ""
1819
"Users enter a Uniform Resource Locator (URL) to point to a Web server by "
1820
"means of its Fully Qualified Domain Name (FQDN) and a path to the required "
1821
"resource. For example, to view the home page of the <ulink "
1822
"url=\"http://www.ubuntu.com\">Ubuntu Web site</ulink> a user will enter only "
1823
"the FQDN. To request specific information about <ulink "
1824
"url=\"http://www.ubuntu.com/support/paid\">paid support</ulink>, a user will "
1825
"enter the FQDN followed by a path."
1826
msgstr ""
1827
1828
#: serverguide/C/web-servers.xml:29(para)
1829
msgid ""
1830
"The most common protocol used to transfer Web pages is the Hyper Text "
1831
"Transfer Protocol (HTTP). Protocols such as Hyper Text Transfer Protocol "
1832
"over Secure Sockets Layer (HTTPS), and File Transfer Protocol (FTP), a "
1833
"protocol for uploading and downloading files, are also supported."
1834
msgstr ""
1835
1836
#: serverguide/C/web-servers.xml:33(para)
1837
msgid ""
1838
"Apache Web Servers are often used in combination with the "
1839
"<application>MySQL</application> database engine, the HyperText Preprocessor "
1840
"(<application>PHP</application>) scripting language, and other popular "
1841
"scripting languages such as <application>Python</application> and "
1842
"<application>Perl</application>. This configuration is termed LAMP (Linux, "
1843
"Apache, MySQL and Perl/Python/PHP) and forms a powerful and robust platform "
1844
"for the development and deployment of Web-based applications."
1845
msgstr ""
1846
1847
#: serverguide/C/web-servers.xml:42(para)
1848
msgid ""
1849
"The <application>Apache2</application> web server is available in Ubuntu "
1850
"Linux. To install Apache2:"
1851
msgstr ""
1852
1853
#: serverguide/C/web-servers.xml:48(para)
1854
msgid "At a terminal prompt enter the following command:"
1855
msgstr ""
1856
1857
#: serverguide/C/web-servers.xml:53(command)
1858
msgid "sudo apt-get install apache2"
1859
msgstr ""
1860
1861
#: serverguide/C/web-servers.xml:63(para)
1862
msgid ""
1863
"Apache2 is configured by placing <emphasis>directives</emphasis> in plain "
1864
"text configuration files. These <emphasis>directives</emphasis> are "
1865
"separated between the following files and directories:"
1866
msgstr ""
1867
1868
#: serverguide/C/web-servers.xml:71(para)
1869
msgid ""
1870
"<emphasis>apache2.conf:</emphasis> the main Apache2 configuration file. "
1871
"Contains settings that are <emphasis>global</emphasis> to Apache2."
1872
msgstr ""
1873
1874
#: serverguide/C/web-servers.xml:77(para)
1875
msgid ""
1876
"<emphasis>conf.d:</emphasis> contains configuration files which apply "
1877
"<emphasis>globally</emphasis> to Apache2. Other packages that use Apache2 to "
1878
"serve content may add files, or symlinks, to this directory."
1879
msgstr ""
1880
1881
#: serverguide/C/web-servers.xml:83(para)
1882
msgid ""
1883
"<emphasis>envvars:</emphasis> file where Apache2 "
1884
"<emphasis>environment</emphasis> variables are set."
1885
msgstr ""
1886
1887
#: serverguide/C/web-servers.xml:88(para)
1888
msgid ""
1889
"<emphasis>httpd.conf:</emphasis> historically the main Apache2 configuration "
1890
"file, named after the <application>httpd</application> daemon. The file can "
1891
"be used for <emphasis>user specific</emphasis> configuration options that "
1892
"globally effect Apache2."
1893
msgstr ""
1894
1895
#: serverguide/C/web-servers.xml:95(para)
1896
msgid ""
1897
"<emphasis>mods-available:</emphasis> this directory contains configuration "
1898
"files to both load <emphasis>modules</emphasis> and configure them. Not all "
1899
"modules will have specific configuration files, however."
1900
msgstr ""
1901
1902
#: serverguide/C/web-servers.xml:101(para)
1903
msgid ""
1904
"<emphasis>mods-enabled:</emphasis> holds <emphasis>symlinks</emphasis> to "
1905
"the files in <filename>/etc/apache2/mods-available</filename>. When a module "
1906
"configuration file is symlinked it will be enabled the next time "
1907
"<application>apache2</application> is restarted."
1908
msgstr ""
1909
1910
#: serverguide/C/web-servers.xml:108(para)
1911
msgid ""
1912
"<emphasis>ports.conf:</emphasis> houses the directives that determine which "
1913
"TCP ports Apache2 is listening on."
1914
msgstr ""
1915
1916
#: serverguide/C/web-servers.xml:113(para)
1917
msgid ""
1918
"<emphasis>sites-available:</emphasis> this directory has configuration files "
1919
"for Apache2 <emphasis>Virtual Hosts</emphasis>. Virtual Hosts allow Apache2 "
1920
"to be configured for multiple sites that have separate configurations."
1921
msgstr ""
1922
1923
#: serverguide/C/web-servers.xml:119(para)
1924
msgid ""
1925
"<emphasis>sites-enabled:</emphasis> like mods-enabled, <filename "
1926
"role=\"directory\">sites-enabled</filename> contains symlinks to the "
1927
"<filename>/etc/apache2/sites-available</filename> directory. Similarly when "
1928
"a configuration file in sites-available is symlinked, the site configured by "
1929
"it will be active once Apache2 is restarted."
1930
msgstr ""
1931
1932
#: serverguide/C/web-servers.xml:127(para)
1933
msgid ""
1934
"In addition, other configuration files may be added using the "
1935
"<emphasis>Include</emphasis> directive, and wildcards can be used to include "
1936
"many configuration files. Any directive may be placed in any of these "
1937
"configuration files. Changes to the main configuration files are only "
1938
"recognized by Apache2 when it is started or restarted."
1939
msgstr ""
1940
1941
#: serverguide/C/web-servers.xml:136(para)
1942
msgid ""
1943
"The server also reads a file containing mime document types; the filename is "
1944
"set by the <emphasis>TypesConfig</emphasis> directive, and is "
1945
"<filename>/etc/mime.types</filename> by default."
1946
msgstr ""
1947
1948
#: serverguide/C/web-servers.xml:141(title)
1949
msgid "Basic Settings"
1950
msgstr ""
1951
1952
#: serverguide/C/web-servers.xml:142(para)
1953
msgid ""
1954
"This section explains Apache2 server essential configuration parameters. "
1955
"Refer to the <ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
1956
"Documentation</ulink> for more details."
1957
msgstr ""
1958
1959
#: serverguide/C/web-servers.xml:150(para)
1960
msgid ""
1961
"Apache2 ships with a virtual-host-friendly default configuration. That is, "
1962
"it is configured with a single default virtual host (using the "
1963
"<emphasis>VirtualHost</emphasis> directive) which can modified or used as-is "
1964
"if you have a single site, or used as a template for additional virtual "
1965
"hosts if you have multiple sites. If left alone, the default virtual host "
1966
"will serve as your default site, or the site users will see if the URL they "
1967
"enter does not match the <emphasis>ServerName</emphasis> directive of any of "
1968
"your custom sites. To modify the default virtual host, edit the file "
1969
"<filename>/etc/apache2/sites-available/default</filename>."
1970
msgstr ""
1971
1972
#: serverguide/C/web-servers.xml:163(para)
1973
msgid ""
1974
"The directives set for a virtual host only apply to that particular virtual "
1975
"host. If a directive is set server-wide and not defined within the virtual "
1976
"host settings, the default setting is used. For example, you can define a "
1977
"Webmaster email address and not define individual email addresses for each "
1978
"virtual host."
1979
msgstr ""
1980
1981
#: serverguide/C/web-servers.xml:171(para)
1982
msgid ""
1983
"If you wish to configure a new virtual host or site, copy that file into the "
1984
"same directory with a name you choose. For example:"
1985
msgstr ""
1986
1987
#: serverguide/C/web-servers.xml:177(command)
1988
msgid ""
1989
"sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-"
1990
"available/mynewsite"
1991
msgstr ""
1992
1993
#: serverguide/C/web-servers.xml:180(para)
1994
msgid ""
1995
"Edit the new file to configure the new site using some of the directives "
1996
"described below."
1997
msgstr ""
1998
1999
#: serverguide/C/web-servers.xml:187(para)
2000
msgid ""
2001
"The <emphasis>ServerAdmin</emphasis> directive specifies the email address "
2002
"to be advertised for the server's administrator. The default value is "
2003
"webmaster@localhost. This should be changed to an email address that is "
2004
"delivered to you (if you are the server's administrator). If your website "
2005
"has a problem, Apache2 will display an error message containing this email "
2006
"address to report the problem to. Find this directive in your site's "
2007
"configuration file in /etc/apache2/sites-available."
2008
msgstr ""
2009
2010
#: serverguide/C/web-servers.xml:198(para)
2011
msgid ""
2012
"The <emphasis>Listen</emphasis> directive specifies the port, and optionally "
2013
"the IP address, Apache2 should listen on. If the IP address is not "
2014
"specified, Apache2 will listen on all IP addresses assigned to the machine "
2015
"it runs on. The default value for the Listen directive is 80. Change this to "
2016
"127.0.0.1:80 to cause Apache2 to listen only on your loopback interface so "
2017
"that it will not be available to the Internet, to (for example) 81 to change "
2018
"the port that it listens on, or leave it as is for normal operation. This "
2019
"directive can be found and changed in its own file, "
2020
"<filename>/etc/apache2/ports.conf</filename>"
2021
msgstr ""
2022
2023
#: serverguide/C/web-servers.xml:211(para)
2024
msgid ""
2025
"The <emphasis>ServerName</emphasis> directive is optional and specifies what "
2026
"FQDN your site should answer to. The default virtual host has no ServerName "
2027
"directive specified, so it will respond to all requests that do not match a "
2028
"ServerName directive in another virtual host. If you have just acquired the "
2029
"domain name ubunturocks.com and wish to host it on your Ubuntu server, the "
2030
"value of the ServerName directive in your virtual host configuration file "
2031
"should be ubunturocks.com. Add this directive to the new virtual host file "
2032
"you created earlier (<filename>/etc/apache2/sites-"
2033
"available/mynewsite</filename>)."
2034
msgstr ""
2035
2036
#: serverguide/C/web-servers.xml:223(para)
2037
msgid ""
2038
"You may also want your site to respond to www.ubunturocks.com, since many "
2039
"users will assume the www prefix is appropriate. Use the "
2040
"<emphasis>ServerAlias</emphasis> directive for this. You may also use "
2041
"wildcards in the ServerAlias directive."
2042
msgstr ""
2043
2044
#: serverguide/C/web-servers.xml:230(para)
2045
msgid ""
2046
"For example, the following configuration will cause your site to respond to "
2047
"any domain request ending in <emphasis>.ubunturocks.com</emphasis>."
2048
msgstr ""
2049
2050
#: serverguide/C/web-servers.xml:236(programlisting)
2051
#, no-wrap
2052
msgid ""
2053
"\n"
2054
"ServerAlias *.ubunturocks.com\n"
2055
msgstr ""
2056
2057
#: serverguide/C/web-servers.xml:242(para)
2058
msgid ""
2059
"The <emphasis>DocumentRoot</emphasis> directive specifies where Apache2 "
2060
"should look for the files that make up the site. The default value is "
2061
"/var/www. No site is configured there, but if you uncomment the "
2062
"<emphasis>RedirectMatch</emphasis> directive in "
2063
"<filename>/etc/apache2/apache2.conf</filename> requests will be redirected "
2064
"to /var/www/apache2-default where the default Apache2 site awaits. Change "
2065
"this value in your site's virtual host file, and remember to create that "
2066
"directory if necessary!"
2067
msgstr ""
2068
2069
#: serverguide/C/web-servers.xml:254(para)
2070
msgid ""
2071
"The /etc/apache2/sites-available directory is <emphasis role=\"bold\"> "
2072
"not</emphasis> parsed by Apache2. Symbolic links in /etc/apache2/sites-"
2073
"enabled point to \"available\" sites."
2074
msgstr ""
2075
2076
#: serverguide/C/web-servers.xml:260(para)
2077
msgid ""
2078
"Enable the new <emphasis>VirtualHost</emphasis> using the "
2079
"<application>a2ensite</application> utility and restart Apache2:"
2080
msgstr ""
2081
2082
#: serverguide/C/web-servers.xml:266(command)
2083
msgid "sudo a2ensite mynewsite"
2084
msgstr ""
2085
2086
#: serverguide/C/web-servers.xml:267(command) serverguide/C/web-servers.xml:285(command) serverguide/C/web-servers.xml:538(command) serverguide/C/web-servers.xml:547(command) serverguide/C/web-servers.xml:606(command) serverguide/C/mail.xml:932(command) serverguide/C/lamp-applications.xml:228(command)
2087
msgid "sudo /etc/init.d/apache2 restart"
2088
msgstr ""
2089
2090
#: serverguide/C/web-servers.xml:271(para)
2091
msgid ""
2092
"Be sure to replace <emphasis>mynewsite</emphasis> with a more descriptive "
2093
"name for the VirtualHost. One method is to name the file after the "
2094
"<emphasis>ServerName</emphasis> directive of the VirtualHost."
2095
msgstr ""
2096
2097
#: serverguide/C/web-servers.xml:278(para)
2098
msgid ""
2099
"Similarly, use the <application>a2dissite</application> utility to disable "
2100
"sites. This is can be useful when troubleshooting configuration problems "
2101
"with multiple VirtualHosts:"
2102
msgstr ""
2103
2104
#: serverguide/C/web-servers.xml:284(command)
2105
msgid "sudo a2dissite mynewsite"
2106
msgstr ""
2107
2108
#: serverguide/C/web-servers.xml:290(title)
2109
msgid "Default Settings"
2110
msgstr ""
2111
2112
#: serverguide/C/web-servers.xml:292(para)
2113
msgid ""
2114
"This section explains configuration of the Apache2 server default settings. "
2115
"For example, if you add a virtual host, the settings you configure for the "
2116
"virtual host take precedence for that virtual host. For a directive not "
2117
"defined within the virtual host settings, the default value is used."
2118
msgstr ""
2119
2120
#: serverguide/C/web-servers.xml:304(para)
2121
msgid ""
2122
"The <emphasis>DirectoryIndex</emphasis> is the default page served by the "
2123
"server when a user requests an index of a directory by specifying a forward "
2124
"slash (/) at the end of the directory name."
2125
msgstr ""
2126
2127
#: serverguide/C/web-servers.xml:311(para)
2128
msgid ""
2129
"For example, when a user requests the page "
2130
"http://www.example.com/this_directory/, he or she will get either the "
2131
"DirectoryIndex page if it exists, a server-generated directory list if it "
2132
"does not and the Indexes option is specified, or a Permission Denied page if "
2133
"neither is true. The server will try to find one of the files listed in the "
2134
"DirectoryIndex directive and will return the first one it finds. If it does "
2135
"not find any of these files and if <emphasis>Options Indexes</emphasis> is "
2136
"set for that directory, the server will generate and return a list, in HTML "
2137
"format, of the subdirectories and files in the directory. The default value, "
2138
"found in <filename>/etc/apache2/mods-available/dir.conf</filename> is "
2139
"\"index.html index.cgi index.pl index.php index.xhtml index.htm\". Thus, if "
2140
"Apache2 finds a file in a requested directory matching any of these names, "
2141
"the first will be displayed."
2142
msgstr ""
2143
2144
#: serverguide/C/web-servers.xml:332(para)
2145
msgid ""
2146
"The <emphasis>ErrorDocument</emphasis> directive allows you to specify a "
2147
"file for Apache2 to use for specific error events. For example, if a user "
2148
"requests a resource that does not exist, a 404 error will occur, and per "
2149
"Apache2's default configuration, the file "
2150
"<filename>/usr/share/apache2/error/HTTP_NOT_FOUND.html.var </filename> will "
2151
"be displayed. That file is not in the server's DocumentRoot, but there is an "
2152
"Alias directive in <filename>/etc/apache2/apache2.conf</filename> that "
2153
"redirects requests to the /error directory to "
2154
"<filename>/usr/share/apache2/error/</filename>."
2155
msgstr ""
2156
2157
#: serverguide/C/web-servers.xml:344(para)
2158
msgid ""
2159
"To see a list of the default ErrorDocument directives, use this command:"
2160
msgstr ""
2161
2162
#: serverguide/C/web-servers.xml:350(command)
2163
msgid "grep ErrorDocument /etc/apache2/apache2.conf"
2164
msgstr ""
2165
2166
#: serverguide/C/web-servers.xml:355(para)
2167
msgid ""
2168
"By default, the server writes the transfer log to the file "
2169
"<filename>/var/log/apache2/access.log</filename>. You can change this on a "
2170
"per-site basis in your virtual host configuration files with the "
2171
"<emphasis>CustomLog</emphasis> directive, or omit it to accept the default, "
2172
"specified in <filename> /etc/apache2/apache2.conf</filename>. You may also "
2173
"specify the file to which errors are logged, via the "
2174
"<emphasis>ErrorLog</emphasis> directive, whose default is "
2175
"<filename>/var/log/apache2/error.log</filename>. These are kept separate "
2176
"from the transfer logs to aid in troubleshooting problems with your Apache2 "
2177
"server. You may also specify the <emphasis>LogLevel</emphasis> (the default "
2178
"value is \"warn\") and the <emphasis>LogFormat</emphasis> (see <filename> "
2179
"/etc/apache2/apache2.conf</filename> for the default value)."
2180
msgstr ""
2181
2182
#: serverguide/C/web-servers.xml:370(para)
2183
msgid ""
2184
"Some options are specified on a per-directory basis rather than per-server. "
2185
"<emphasis>Options</emphasis> is one of these directives. A Directory stanza "
2186
"is enclosed in XML-like tags, like so:"
2187
msgstr ""
2188
2189
#: serverguide/C/web-servers.xml:376(programlisting)
2190
#, no-wrap
2191
msgid ""
2192
"\n"
2193
"<Directory /var/www/mynewsite>\n"
2194
"...\n"
2195
"</Directory>\n"
2196
msgstr ""
2197
2198
#: serverguide/C/web-servers.xml:382(para)
2199
msgid ""
2200
"The <emphasis>Options</emphasis> directive within a Directory stanza accepts "
2201
"one or more of the following values (among others), separated by spaces:"
2202
msgstr ""
2203
2204
#: serverguide/C/web-servers.xml:394(para)
2205
msgid ""
2206
"Most files should not be executed as CGI scripts. This would be very "
2207
"dangerous. CGI scripts should kept in a directory separate from and outside "
2208
"your DocumentRoot, and only this directory should have the ExecCGI option "
2209
"set. This is the default, and the default location for CGI scripts is "
2210
"<filename>/usr/lib/cgi-bin</filename>."
2211
msgstr ""
2212
2213
#: serverguide/C/web-servers.xml:389(para)
2214
msgid ""
2215
"<emphasis role=\"bold\">ExecCGI</emphasis> - Allow execution of CGI scripts. "
2216
"CGI scripts are not executed if this option is not chosen. <placeholder-1/>"
2217
msgstr ""
2218
2219
#: serverguide/C/web-servers.xml:405(para)
2220
msgid ""
2221
"<emphasis role=\"bold\">Includes</emphasis> - Allow server-side includes. "
2222
"Server-side includes allow an HTML file to <emphasis> include</emphasis> "
2223
"other files. This is not a common option. See <ulink "
2224
"url=\"http://httpd.apache.org/docs/2.2/howto/ssi.html\">the Apache2 SSI "
2225
"HOWTO</ulink> for more information."
2226
msgstr ""
2227
2228
#: serverguide/C/web-servers.xml:414(para)
2229
msgid ""
2230
"<emphasis role=\"bold\">IncludesNOEXEC</emphasis> - Allow server-side "
2231
"includes, but disable the <emphasis>#exec</emphasis> and "
2232
"<emphasis>#include</emphasis> commands in CGI scripts."
2233
msgstr ""
2234
2235
#: serverguide/C/web-servers.xml:426(para)
2236
msgid ""
2237
"For security reasons, this should usually not be set, and certainly should "
2238
"not be set on your DocumentRoot directory. Enable this option carefully on a "
2239
"per-directory basis only if you are certain you want users to see the entire "
2240
"contents of the directory."
2241
msgstr ""
2242
2243
#: serverguide/C/web-servers.xml:421(para)
2244
msgid ""
2245
"<emphasis role=\"bold\">Indexes</emphasis> - Display a formatted list of the "
2246
"directory's contents, if no <emphasis>DirectoryIndex</emphasis> (such as "
2247
"index.html) exists in the requested directory. <placeholder-1/>"
2248
msgstr ""
2249
2250
#: serverguide/C/web-servers.xml:436(para)
2251
msgid ""
2252
"<emphasis role=\"bold\">Multiview</emphasis> - Support content-negotiated "
2253
"multiviews; this option is disabled by default for security reasons. See the "
2254
"<ulink "
2255
"url=\"http://httpd.apache.org/docs/2.2/mod/mod_negotiation.html#multiviews\">"
2256
"Apache2 documentation on this option</ulink>."
2257
msgstr ""
2258
2259
#: serverguide/C/web-servers.xml:444(para)
2260
msgid ""
2261
"<emphasis role=\"bold\">SymLinksIfOwnerMatch</emphasis> - Only follow "
2262
"symbolic links if the target file or directory has the same owner as the "
2263
"link."
2264
msgstr ""
2265
2266
#: serverguide/C/web-servers.xml:456(title)
2267
msgid "httpd Settings"
2268
msgstr ""
2269
2270
#: serverguide/C/web-servers.xml:458(para)
2271
msgid ""
2272
"This section explains some basic <application>httpd</application> daemon "
2273
"configuration settings."
2274
msgstr ""
2275
2276
#: serverguide/C/web-servers.xml:462(para)
2277
msgid ""
2278
"<emphasis role=\"bold\">LockFile</emphasis> - The LockFile directive sets "
2279
"the path to the lockfile used when the server is compiled with either "
2280
"USE_FCNTL_SERIALIZED_ACCEPT or USE_FLOCK_SERIALIZED_ACCEPT. It must be "
2281
"stored on the local disk. It should be left to the default value unless the "
2282
"logs directory is located on an NFS share. If this is the case, the default "
2283
"value should be changed to a location on the local disk and to a directory "
2284
"that is readable only by root."
2285
msgstr ""
2286
2287
#: serverguide/C/web-servers.xml:471(para)
2288
msgid ""
2289
"<emphasis role=\"bold\">PidFile</emphasis> - The PidFile directive sets the "
2290
"file in which the server records its process ID (pid). This file should only "
2291
"be readable by root. In most cases, it should be left to the default value."
2292
msgstr ""
2293
2294
#: serverguide/C/web-servers.xml:477(para)
2295
msgid ""
2296
"<emphasis role=\"bold\">User</emphasis> - The User directive sets the userid "
2297
"used by the server to answer requests. This setting determines the server's "
2298
"access. Any files inaccessible to this user will also be inaccessible to "
2299
"your website's visitors. The default value for User is www-data."
2300
msgstr ""
2301
2302
#: serverguide/C/web-servers.xml:484(para)
2303
msgid ""
2304
"Unless you know exactly what you are doing, do not set the User directive to "
2305
"root. Using root as the User will create large security holes for your Web "
2306
"server."
2307
msgstr ""
2308
2309
#: serverguide/C/web-servers.xml:490(para)
2310
msgid ""
2311
"The Group directive is similar to the User directive. Group sets the group "
2312
"under which the server will answer requests. The default group is also www-"
2313
"data."
2314
msgstr ""
2315
2316
#: serverguide/C/web-servers.xml:496(title)
2317
msgid "Apache2 Modules"
2318
msgstr ""
2319
2320
#: serverguide/C/web-servers.xml:498(para)
2321
msgid ""
2322
"Apache2 is a modular server. This implies that only the most basic "
2323
"functionality is included in the core server. Extended features are "
2324
"available through modules which can be loaded into Apache2. By default, a "
2325
"base set of modules is included in the server at compile-time. If the server "
2326
"is compiled to use dynamically loaded modules, then modules can be compiled "
2327
"separately, and added at any time using the LoadModule directive. Otherwise, "
2328
"Apache2 must be recompiled to add or remove modules."
2329
msgstr ""
2330
2331
#: serverguide/C/web-servers.xml:510(para)
2332
msgid ""
2333
"Ubuntu compiles Apache2 to allow the dynamic loading of modules. "
2334
"Configuration directives may be conditionally included on the presence of a "
2335
"particular module by enclosing them in an "
2336
"<emphasis><IfModule></emphasis> block."
2337
msgstr ""
2338
2339
#: serverguide/C/web-servers.xml:517(para)
2340
msgid ""
2341
"You can install additional Apache2 modules and use them with your Web "
2342
"server. For example, run the following command from a terminal prompt to "
2343
"install the <emphasis>MySQL Authentication</emphasis> module:"
2344
msgstr ""
2345
2346
#: serverguide/C/web-servers.xml:524(command)
2347
msgid "sudo apt-get install libapache2-mod-auth-mysql"
2348
msgstr ""
2349
2350
#: serverguide/C/web-servers.xml:527(para)
2351
msgid ""
2352
"See the <filename>/etc/apache2/mods-available</filename> directory, for "
2353
"additional modules."
2354
msgstr ""
2355
2356
#: serverguide/C/web-servers.xml:531(para)
2357
msgid ""
2358
"Use the <application>a2enmod</application> utility to enable a module:"
2359
msgstr ""
2360
2361
#: serverguide/C/web-servers.xml:537(command)
2362
msgid "sudo a2enmod auth_mysql"
2363
msgstr ""
2364
2365
#: serverguide/C/web-servers.xml:541(para)
2366
msgid "Similarly, <application>a2dismod</application> will disable a module:"
2367
msgstr ""
2368
2369
#: serverguide/C/web-servers.xml:546(command)
2370
msgid "sudo a2dismod auth_mysql"
2371
msgstr ""
2372
2373
#: serverguide/C/web-servers.xml:553(title)
2374
msgid "HTTPS Configuration"
2375
msgstr ""
2376
2377
#: serverguide/C/web-servers.xml:555(para)
2378
msgid ""
2379
"The <application>mod_ssl</application> module adds an important feature to "
2380
"the Apache2 server - the ability to encrypt communications. Thus, when your "
2381
"browser is communicating using SSL, the https:// prefix is used at the "
2382
"beginning of the Uniform Resource Locator (URL) in the browser navigation "
2383
"bar."
2384
msgstr ""
2385
2386
#: serverguide/C/web-servers.xml:564(para)
2387
msgid ""
2388
"The <application>mod_ssl</application> module is available in "
2389
"<application>apache2-common</application> package. Execute the following "
2390
"command from a terminal prompt to enable the "
2391
"<application>mod_ssl</application> module:"
2392
msgstr ""
2393
2394
#: serverguide/C/web-servers.xml:571(command)
2395
msgid "sudo a2enmod ssl"
2396
msgstr ""
2397
2398
#: serverguide/C/web-servers.xml:574(para)
2399
msgid ""
2400
"There is a default HTTPS configuration file in <filename>/etc/apache2/sites-"
2401
"available/default-ssl</filename>. In order for "
2402
"<application>Apache2</application> to provide HTTPS, a "
2403
"<emphasis>certificate</emphasis> and <emphasis>key</emphasis> file are also "
2404
"needed. The default HTTPS configuration will use a certificate and key "
2405
"generated by the <application>ssl-cert</application> package. They are good "
2406
"for testing, but the auto-generated certificate and key should be replaced "
2407
"by a certificate specific to the site or server. For information on "
2408
"generating a key and obtaining a certificate see <xref "
2409
"linkend=\"certificates-and-security\"/>"
2410
msgstr ""
2411
2412
#: serverguide/C/web-servers.xml:584(para)
2413
msgid ""
2414
"To configure <application>Apache2</application> for HTTPS, enter the "
2415
"following:"
2416
msgstr ""
2417
2418
#: serverguide/C/web-servers.xml:589(command)
2419
msgid "sudo a2ensite default-ssl"
2420
msgstr ""
2421
2422
#: serverguide/C/web-servers.xml:593(para)
2423
msgid ""
2424
"The directories <filename>/etc/ssl/certs</filename> and "
2425
"<filename>/etc/ssl/private</filename> are the default locations. If you "
2426
"install the certificate and key in another directory make sure to change "
2427
"<emphasis>SSLCertificateFile</emphasis> and "
2428
"<emphasis>SSLCertificateKeyFile</emphasis> appropriately."
2429
msgstr ""
2430
2431
#: serverguide/C/web-servers.xml:600(para)
2432
msgid ""
2433
"With Apache2 now configured for HTTPS, restart the service to enable the new "
2434
"settings:"
2435
msgstr ""
2436
2437
#: serverguide/C/web-servers.xml:611(para)
2438
msgid ""
2439
"Depending on how you obtained your certificate you may need to enter a "
2440
"passphrase when <application>Apache2</application> starts."
2441
msgstr ""
2442
2443
#: serverguide/C/web-servers.xml:617(para)
2444
msgid ""
2445
"You can access the secure server pages by typing https://your_hostname/url/ "
2446
"in your browser address bar."
2447
msgstr ""
2448
2449
#: serverguide/C/web-servers.xml:628(para)
2450
msgid ""
2451
"<ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
2452
"Documentation</ulink> contains in depth information on Apache2 configuration "
2453
"directives. Also, see the <application>apache2-doc</application> package for "
2454
"the official Apache2 docs."
2455
msgstr ""
2456
2457
#: serverguide/C/web-servers.xml:635(para)
2458
msgid ""
2459
"See the <ulink url=\"http://www.modssl.org/docs/\">Mod SSL "
2460
"Documentation</ulink> site for more SSL related information."
2461
msgstr ""
2462
2463
#: serverguide/C/web-servers.xml:641(para)
2464
msgid ""
2465
"O'Reilly's <ulink url=\"http://oreilly.com/catalog/9780596001919/\">Apache "
2466
"Cookbook</ulink> is a good resource for accomplishing specific Apache2 "
2467
"configurations."
2468
msgstr ""
2469
2470
#: serverguide/C/web-servers.xml:647(para)
2471
msgid ""
2472
"For Ubuntu specific Apache2 questions, ask in the <emphasis>#ubuntu-"
2473
"server</emphasis> IRC channel on <ulink "
2474
"url=\"http://freenode.net/\">freenode.net</ulink>."
2475
msgstr ""
2476
2477
#: serverguide/C/web-servers.xml:653(para)
2478
msgid ""
2479
"Usually integrated with PHP and MySQL the <ulink "
2480
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2481
"Ubuntu Wiki </ulink> page is a good resource."
2482
msgstr ""
2483
2484
#: serverguide/C/web-servers.xml:664(title)
2485
msgid "PHP5 - Scripting Language"
2486
msgstr ""
2487
2488
#: serverguide/C/web-servers.xml:665(para)
2489
msgid ""
2490
"PHP is a general-purpose scripting language suited for Web development. The "
2491
"PHP script can be embedded into HTML. This section explains how to install "
2492
"and configure PHP5 in Ubuntu System with Apache2 and MySQL."
2493
msgstr ""
2494
2495
#: serverguide/C/web-servers.xml:669(para)
2496
msgid ""
2497
"This section assumes you have installed and configured Apache2 Web Server "
2498
"and MySQL Database Server. You can refer to Apache2 section and MySQL "
2499
"sections in this document to install and configure Apache2 and MySQL "
2500
"respectively."
2501
msgstr ""
2502
2503
#: serverguide/C/web-servers.xml:676(para)
2504
msgid "The PHP5 is available in Ubuntu Linux."
2505
msgstr ""
2506
2507
#: serverguide/C/web-servers.xml:678(para)
2508
msgid ""
2509
"To install PHP5 you can enter the following command in the terminal prompt: "
2510
"<screen>\n"
2511
"<command>sudo apt-get install php5 libapache2-mod-php5</command>\n"
2512
"</screen>"
2513
msgstr ""
2514
2515
#: serverguide/C/web-servers.xml:687(para)
2516
msgid ""
2517
"You can run PHP5 scripts from command line. To run PHP5 scripts from command "
2518
"line you should install <application>php5-cli</application> package. To "
2519
"install <application>php5-cli</application> you can enter the following "
2520
"command in the terminal prompt: <screen>\n"
2521
"<command>sudo apt-get install php5-cli</command>\n"
2522
"</screen>"
2523
msgstr ""
2524
2525
#: serverguide/C/web-servers.xml:696(para)
2526
msgid ""
2527
"You can also execute PHP5 scripts without installing PHP5 Apache module. To "
2528
"accomplish this, you should install <application>php5-cgi</application> "
2529
"package. You can run the following command in a terminal prompt to install "
2530
"<application>php5-cgi</application> package: <screen>\n"
2531
"<command>sudo apt-get install php5-cgi</command>\n"
2532
"</screen>"
2533
msgstr ""
2534
2535
#: serverguide/C/web-servers.xml:706(para)
2536
msgid ""
2537
"To use <application>MySQL</application> with PHP5 you should install "
2538
"<application>php5-mysql</application> package. To install <application>php5-"
2539
"mysql</application> you can enter the following command in the terminal "
2540
"prompt: <screen>\n"
2541
"<command>sudo apt-get install php5-mysql</command>\n"
2542
"</screen>"
2543
msgstr ""
2544
2545
#: serverguide/C/web-servers.xml:714(para)
2546
msgid ""
2547
"Similarly, to use <application>PostgreSQL</application> with PHP5 you should "
2548
"install <application>php5-pgsql</application> package. To install "
2549
"<application>php5-pgsql</application> you can enter the following command in "
2550
"the terminal prompt: <screen>\n"
2551
"<command>sudo apt-get install php5-pgsql</command>\n"
2552
"</screen>"
2553
msgstr ""
2554
2555
#: serverguide/C/web-servers.xml:727(para)
2556
msgid ""
2557
"Once you install PHP5, you can run PHP5 scripts from your web browser. If "
2558
"you have installed <application>php5-cli</application> package, you can run "
2559
"PHP5 scripts from your command prompt."
2560
msgstr ""
2561
2562
#: serverguide/C/web-servers.xml:734(para)
2563
msgid ""
2564
"By default, the Apache 2 Web server is configured to run PHP5 scripts. In "
2565
"other words, the PHP5 module is enabled in Apache2 Web server automatically "
2566
"when you install the module. Please verify if the files "
2567
"<filename>/etc/apache2/mods-enabled/php5.conf</filename> and "
2568
"<filename>/etc/apache2/mods-enabled/php5.load</filename> exist. If they do "
2569
"not exists, you can enable the module using <command>a2enmod</command> "
2570
"command."
2571
msgstr ""
2572
2573
#: serverguide/C/web-servers.xml:745(para)
2574
msgid ""
2575
"Once you install PHP5 related packages and enabled PHP5 Apache 2 module, you "
2576
"should restart Apache2 Web server to run PHP5 scripts. You can run the "
2577
"following command at a terminal prompt to restart your web server: "
2578
"<screen><command>sudo /etc/init.d/apache2 restart</command> </screen>"
2579
msgstr ""
2580
2581
#: serverguide/C/web-servers.xml:753(title) serverguide/C/mail.xml:320(title) serverguide/C/mail.xml:1569(title) serverguide/C/dns.xml:343(title) serverguide/C/clustering.xml:184(title)
2582
msgid "Testing"
2583
msgstr ""
2584
2585
#: serverguide/C/web-servers.xml:754(para)
2586
msgid ""
2587
"To verify your installation, you can run following PHP5 phpinfo script:"
2588
msgstr ""
2589
2590
#: serverguide/C/web-servers.xml:757(programlisting)
2591
#, no-wrap
2592
msgid ""
2593
"\n"
2594
"<?php\n"
2595
" phpinfo();\n"
2596
"?>\n"
2597
msgstr ""
2598
2599
#: serverguide/C/web-servers.xml:762(para)
2600
msgid ""
2601
"You can save the content in a file <filename>phpinfo.php</filename> and "
2602
"place it under <command>DocumentRoot</command> directory of Apache2 Web "
2603
"server. When point your browser to "
2604
"<filename>http://hostname/phpinfo.php</filename>, it would display values of "
2605
"various PHP5 configuration parameters."
2606
msgstr ""
2607
2608
#: serverguide/C/web-servers.xml:776(para)
2609
msgid ""
2610
"For more in depth information see <ulink "
2611
"url=\"http://www.php.net/docs.php\">php.net</ulink> documentation."
2612
msgstr ""
2613
2614
#: serverguide/C/web-servers.xml:781(para)
2615
msgid ""
2616
"There are a plethora of books on PHP. Two good books from O'Reilly are "
2617
"<ulink url=\"http://oreilly.com/catalog/9780596005603/\">Learning PHP "
2618
"5</ulink> and the <ulink "
2619
"url=\"http://oreilly.com/catalog/9781565926813/\">PHP Cook Book</ulink>."
2620
msgstr ""
2621
2622
#: serverguide/C/web-servers.xml:788(para)
2623
msgid ""
2624
"Also, see the <ulink "
2625
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2626
"Ubuntu Wiki</ulink> page for more information."
2627
msgstr ""
2628
2629
#: serverguide/C/web-servers.xml:799(title)
2630
msgid "Squid - Proxy Server"
2631
msgstr ""
2632
2633
#: serverguide/C/web-servers.xml:800(para)
2634
msgid ""
2635
"Squid is a full-featured web proxy cache server application which provides "
2636
"proxy and cache services for Hyper Text Transport Protocol (HTTP), File "
2637
"Transfer Protocol (FTP), and other popular network protocols. Squid can "
2638
"implement caching and proxying of Secure Sockets Layer (SSL) requests and "
2639
"caching of Domain Name Server (DNS) lookups, and perform transparent "
2640
"caching. Squid also supports a wide variety of caching protocols, such as "
2641
"Internet Cache Protocol, (ICP) the Hyper Text Caching Protocol, (HTCP) the "
2642
"Cache Array Routing Protocol (CARP), and the Web Cache Coordination "
2643
"Protocol. (WCCP)"
2644
msgstr ""
2645
2646
#: serverguide/C/web-servers.xml:808(para)
2647
msgid ""
2648
"The Squid proxy cache server is an excellent solution to a variety of proxy "
2649
"and caching server needs, and scales from the branch office to enterprise "
2650
"level networks while providing extensive, granular access control mechanisms "
2651
"and monitoring of critical parameters via the Simple Network Management "
2652
"Protocol (SNMP). When selecting a computer system for use as a dedicated "
2653
"Squid proxy, or caching servers, ensure your system is configured with a "
2654
"large amount of physical memory, as Squid maintains an in-memory cache for "
2655
"increased performance."
2656
msgstr ""
2657
2658
#: serverguide/C/web-servers.xml:817(para)
2659
msgid ""
2660
"At a terminal prompt, enter the following command to install the Squid "
2661
"server:"
2662
msgstr ""
2663
2664
#: serverguide/C/web-servers.xml:822(command)
2665
msgid "sudo apt-get install squid"
2666
msgstr ""
2667
2668
#: serverguide/C/web-servers.xml:828(para)
2669
msgid ""
2670
"Squid is configured by editing the directives contained within the "
2671
"<filename>/etc/squid/squid.conf</filename> configuration file. The following "
2672
"examples illustrate some of the directives which may be modified to affect "
2673
"the behavior of the Squid server. For more in-depth configuration of Squid, "
2674
"see the References section."
2675
msgstr ""
2676
2677
#: serverguide/C/web-servers.xml:834(para)
2678
msgid ""
2679
"Prior to editing the configuration file, you should make a copy of the "
2680
"original file and protect it from writing so you will have the original "
2681
"settings as a reference, and to re-use as necessary."
2682
msgstr ""
2683
2684
#: serverguide/C/web-servers.xml:837(para)
2685
msgid ""
2686
"Copy the <filename>/etc/squid/squid.conf</filename> file and protect it from "
2687
"writing with the following commands entered at a terminal prompt:"
2688
msgstr ""
2689
2690
#: serverguide/C/web-servers.xml:842(command)
2691
msgid "sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original"
2692
msgstr ""
2693
2694
#: serverguide/C/web-servers.xml:843(command)
2695
msgid "sudo chmod a-w /etc/squid/squid.conf.original"
2696
msgstr ""
2697
2698
#: serverguide/C/web-servers.xml:849(para)
2699
msgid ""
2700
"To set your Squid server to listen on TCP port 8888 instead of the default "
2701
"TCP port 3128, change the http_port directive as such:"
2702
msgstr ""
2703
2704
#: serverguide/C/web-servers.xml:853(programlisting)
2705
#, no-wrap
2706
msgid ""
2707
"\n"
2708
"http_port 8888\n"
2709
msgstr ""
2710
2711
#: serverguide/C/web-servers.xml:858(para)
2712
msgid ""
2713
"Change the visible_hostname directive in order to give the Squid server a "
2714
"specific hostname. This hostname does not necessarily need to be the "
2715
"computer's hostname. In this example it is set to <emphasis>weezie</emphasis>"
2716
msgstr ""
2717
2718
#: serverguide/C/web-servers.xml:862(programlisting)
2719
#, no-wrap
2720
msgid ""
2721
"\n"
2722
"visible_hostname weezie\n"
2723
msgstr ""
2724
2725
#: serverguide/C/web-servers.xml:867(para)
2726
msgid ""
2727
"Using Squid's access control, you may configure use of Internet services "
2728
"proxied by Squid to be available only users with certain Internet Protocol "
2729
"(IP) addresses. For example, we will illustrate access by users of the "
2730
"192.168.42.0/24 subnetwork only:"
2731
msgstr ""
2732
2733
#: serverguide/C/web-servers.xml:872(para) serverguide/C/web-servers.xml:892(para)
2734
msgid ""
2735
"Add the following to the <emphasis role=\"bold\">bottom</emphasis> of the "
2736
"ACL section of your <filename>/etc/squid/squid.conf</filename> file:"
2737
msgstr ""
2738
2739
#: serverguide/C/web-servers.xml:875(programlisting)
2740
#, no-wrap
2741
msgid ""
2742
"\n"
2743
"acl fortytwo_network src 192.168.42.0/24\n"
2744
msgstr ""
2745
2746
#: serverguide/C/web-servers.xml:878(para) serverguide/C/web-servers.xml:899(para)
2747
msgid ""
2748
"Then, add the following to the <emphasis role=\"bold\">top</emphasis> of the "
2749
"http_access section of your <filename>/etc/squid/squid.conf</filename> file:"
2750
msgstr ""
2751
2752
#: serverguide/C/web-servers.xml:882(programlisting)
2753
#, no-wrap
2754
msgid ""
2755
"\n"
2756
"http_access allow fortytwo_network\n"
2757
msgstr ""
2758
2759
#: serverguide/C/web-servers.xml:887(para)
2760
msgid ""
2761
"Using the excellent access control features of Squid, you may configure use "
2762
"of Internet services proxied by Squid to be available only during normal "
2763
"business hours. For example, we'll illustrate access by employees of a "
2764
"business which is operating between 9:00AM and 5:00PM, Monday through "
2765
"Friday, and which uses the 10.1.42.0/42 subnetwork:"
2766
msgstr ""
2767
2768
#: serverguide/C/web-servers.xml:895(programlisting)
2769
#, no-wrap
2770
msgid ""
2771
"\n"
2772
"acl biz_network src 10.1.42.0/24\n"
2773
"acl biz_hours time M T W T F 9:00-17:00\n"
2774
msgstr ""
2775
2776
#: serverguide/C/web-servers.xml:903(programlisting)
2777
#, no-wrap
2778
msgid ""
2779
"\n"
2780
"http_access allow biz_network biz_hours\n"
2781
msgstr ""
2782
2783
#: serverguide/C/web-servers.xml:910(para)
2784
msgid ""
2785
"After making changes to the <filename>/etc/squid/squid.conf</filename> file, "
2786
"save the file and restart the <application>squid</application> server "
2787
"application to effect the changes using the following command entered at a "
2788
"terminal prompt:"
2789
msgstr ""
2790
2791
#: serverguide/C/web-servers.xml:917(command)
2792
msgid "sudo /etc/init.d/squid restart"
2793
msgstr ""
2794
2795
#: serverguide/C/web-servers.xml:924(ulink)
2796
msgid "Squid Website"
2797
msgstr ""
2798
2799
#: serverguide/C/web-servers.xml:926(para)
2800
msgid ""
2801
"<ulink url=\"https://help.ubuntu.com/community/Squid\">Ubuntu Wiki "
2802
"Squid</ulink> page."
2803
msgstr ""
2804
2805
#: serverguide/C/web-servers.xml:933(title)
2806
msgid "Ruby on Rails"
2807
msgstr ""
2808
2809
#: serverguide/C/web-servers.xml:934(para)
2810
msgid ""
2811
"Ruby on Rails is an open source web framework for developing database backed "
2812
"web applications. It is optimized for sustainable productivity of the "
2813
"programmer since it lets the programmer to write code by favouring "
2814
"convention over configuration."
2815
msgstr ""
2816
2817
#: serverguide/C/web-servers.xml:941(para)
2818
msgid ""
2819
"Before installing <application>Rails</application> you should install "
2820
"<application>Apache</application> and <application>MySQL</application>. To "
2821
"install the <application>Apache</application> package, please refer to <xref "
2822
"linkend=\"httpd\"/>. For instructions on installing "
2823
"<application>MySQL</application> refer to <xref linkend=\"mysql\"/>."
2824
msgstr ""
2825
2826
#: serverguide/C/web-servers.xml:949(para)
2827
msgid ""
2828
"Once you have <application>Apache</application> and "
2829
"<application>MySQL</application> packages installed, you are ready to "
2830
"install <application>Ruby on Rails</application> package."
2831
msgstr ""
2832
2833
#: serverguide/C/web-servers.xml:956(para)
2834
msgid ""
2835
"To install the <application>Ruby</application> base packages and "
2836
"<application>Ruby on Rails</application>, you can enter the following "
2837
"command in the terminal prompt:"
2838
msgstr ""
2839
2840
#: serverguide/C/web-servers.xml:962(command)
2841
msgid "sudo apt-get install rails"
2842
msgstr ""
2843
2844
#: serverguide/C/web-servers.xml:968(para)
2845
msgid ""
2846
"Modify the <filename>/etc/apache2/sites-available/default</filename> "
2847
"configuration file to setup your domains."
2848
msgstr ""
2849
2850
#: serverguide/C/web-servers.xml:972(para)
2851
msgid ""
2852
"The first thing to change is the <emphasis>DocumentRoot</emphasis> directive:"
2853
msgstr ""
2854
2855
#: serverguide/C/web-servers.xml:976(programlisting)
2856
#, no-wrap
2857
msgid ""
2858
"\n"
2859
"DocumentRoot /path/to/rails/application/public\n"
2860
msgstr ""
2861
2862
#: serverguide/C/web-servers.xml:979(para)
2863
msgid ""
2864
"Next, change the <Directory \"/path/to/rails/application/public\"> "
2865
"directive:"
2866
msgstr ""
2867
2868
#: serverguide/C/web-servers.xml:983(programlisting)
2869
#, no-wrap
2870
msgid ""
2871
"\n"
2872
"<Directory \"/path/to/rails/application/public\">\n"
2873
" Options Indexes FollowSymLinks MultiViews ExecCGI\n"
2874
" AllowOverride All\n"
2875
" Order allow,deny\n"
2876
" allow from all\n"
2877
" AddHandler cgi-script .cgi\n"
2878
"</Directory>\n"
2879
msgstr ""
2880
2881
#: serverguide/C/web-servers.xml:993(para)
2882
msgid ""
2883
"You should also enable the <application>mod_rewrite</application> module for "
2884
"Apache. To enable <application>mod_rewrite</application> module, please "
2885
"enter the following command in a terminal prompt:"
2886
msgstr ""
2887
2888
#: serverguide/C/web-servers.xml:999(command)
2889
msgid "sudo a2enmod rewrite"
2890
msgstr ""
2891
2892
#: serverguide/C/web-servers.xml:1002(para)
2893
msgid ""
2894
"Finally you will need to change the ownership of the "
2895
"<filename>/path/to/rails/application/public</filename> and "
2896
"<filename>/path/to/rails/application/tmp</filename> directories to the user "
2897
"used to run the <application>Apache</application> process:"
2898
msgstr ""
2899
2900
#: serverguide/C/web-servers.xml:1008(command)
2901
msgid "sudo chown -R www-data:www-data /path/to/rails/application/public"
2902
msgstr ""
2903
2904
#: serverguide/C/web-servers.xml:1009(command)
2905
msgid "sudo chown -R www-data:www-data /path/to/rails/application/tmp"
2906
msgstr ""
2907
2908
#: serverguide/C/web-servers.xml:1012(para)
2909
msgid ""
2910
"That's it! Now you have your Server ready for your <application>Ruby on "
2911
"Rails</application> applications."
2912
msgstr ""
2913
2914
#: serverguide/C/web-servers.xml:1021(para)
2915
msgid ""
2916
"See the <ulink url=\"http://rubyonrails.org/\">Ruby on Rails</ulink> website "
2917
"for more information."
2918
msgstr ""
2919
2920
#: serverguide/C/web-servers.xml:1026(para)
2921
msgid ""
2922
"Also <ulink url=\"http://pragprog.com/titles/rails3/agile-web-development-"
2923
"with-rails-third-edition\">Agile Development with Rails</ulink> is a great "
2924
"resource."
2925
msgstr ""
2926
2927
#: serverguide/C/web-servers.xml:1032(para)
2928
msgid ""
2929
"Another place for more information is the <ulink "
2930
"url=\"https://help.ubuntu.com/community/RubyOnRails\">Ruby on Rails Ubuntu "
2931
"Wiki</ulink> page."
2932
msgstr ""
2933
2934
#: serverguide/C/web-servers.xml:1043(title)
2935
msgid "Apache Tomcat"
2936
msgstr ""
2937
2938
#: serverguide/C/web-servers.xml:1044(para)
2939
msgid ""
2940
"Apache Tomcat is a web container that allows you to serve Java Servlets and "
2941
"JSP (Java Server Pages) web applications."
2942
msgstr ""
2943
2944
#: serverguide/C/web-servers.xml:1046(para)
2945
msgid ""
2946
"The <application>Tomcat 6.0</application> packages in Ubuntu support two "
2947
"different ways of running Tomcat. You can install them as a classic unique "
2948
"system-wide instance, that will be started at boot time and will run as the "
2949
"tomcat6 unpriviledged user. But you can also deploy private instances that "
2950
"will run with your own user rights, and that you should start and stop by "
2951
"yourself. This second way is particularly useful in a development server "
2952
"context where multiple users need to test on their own private Tomcat "
2953
"instances."
2954
msgstr ""
2955
2956
#: serverguide/C/web-servers.xml:1056(title)
2957
msgid "System-wide installation"
2958
msgstr ""
2959
2960
#: serverguide/C/web-servers.xml:1057(para)
2961
msgid ""
2962
"To install the <application>Tomcat</application> server, you can enter the "
2963
"following command in the terminal prompt:"
2964
msgstr ""
2965
2966
#: serverguide/C/web-servers.xml:1060(command)
2967
msgid "sudo apt-get install tomcat6"
2968
msgstr ""
2969
2970
#: serverguide/C/web-servers.xml:1062(para)
2971
msgid ""
2972
"This will install a Tomcat server with just a default ROOT webapp that "
2973
"displays a minimal \"It works\" page by default."
2974
msgstr ""
2975
2976
#: serverguide/C/web-servers.xml:1068(para)
2977
msgid ""
2978
"Tomcat configuration files can be found in "
2979
"<filename>/etc/tomcat6</filename>. Only a few common configuration tweaks "
2980
"will be described here, please see <ulink "
2981
"url=\"http://tomcat.apache.org/tomcat-6.0-doc/index.html\">Tomcat 6.0 "
2982
"documentation</ulink> for more."
2983
msgstr ""
2984
2985
#: serverguide/C/web-servers.xml:1074(title)
2986
msgid "Changing default ports"
2987
msgstr ""
2988
2989
#: serverguide/C/web-servers.xml:1075(para)
2990
msgid ""
2991
"By default Tomcat 6.0 runs a HTTP connector on port 8080 and an AJP "
2992
"connector on port 8009. You might want to change those default ports to "
2993
"avoid conflict with another server on the system. This is done by changing "
2994
"the following lines in <filename>/etc/tomcat6/server.xml</filename>:"
2995
msgstr ""
2996
2997
#: serverguide/C/web-servers.xml:1080(programlisting)
2998
#, no-wrap
2999
msgid ""
3000
"\n"
3001
"<Connector port=\"8080\" protocol=\"HTTP/1.1\" \n"
3002
" connectionTimeout=\"20000\" \n"
3003
" redirectPort=\"8443\" />\n"
3004
"...\n"
3005
"<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\" "
3006
"/>\n"
3007
msgstr ""
3008
3009
#: serverguide/C/web-servers.xml:1089(title)
3010
msgid "Changing JVM used"
3011
msgstr ""
3012
3013
#: serverguide/C/web-servers.xml:1090(para)
3014
msgid ""
3015
"By default Tomcat will run preferably with OpenJDK-6, then try Sun's JVM, "
3016
"then try some other JVMs. If you have various JVMs installed, you can set "
3017
"which should be used by setting JAVA_HOME in "
3018
"<filename>/etc/default/tomcat6</filename>:"
3019
msgstr ""
3020
3021
#: serverguide/C/web-servers.xml:1094(programlisting)
3022
#, no-wrap
3023
msgid ""
3024
"\n"
3025
"JAVA_HOME=/usr/lib/jvm/java-6-sun\n"
3026
msgstr ""
3027
3028
#: serverguide/C/web-servers.xml:1099(title)
3029
msgid "Declaring users and roles"
3030
msgstr ""
3031
3032
#: serverguide/C/web-servers.xml:1100(para)
3033
msgid ""
3034
"Usernames, passwords and roles (groups) can be defined centrally in a "
3035
"Servlet container. In Tomcat 6.0 this is done in the "
3036
"<filename>/etc/tomcat6/tomcat-users.xml</filename> file:"
3037
msgstr ""
3038
3039
#: serverguide/C/web-servers.xml:1103(programlisting)
3040
#, no-wrap
3041
msgid ""
3042
"\n"
3043
"<role rolename=\"admin\"/>\n"
3044
"<user username=\"tomcat\" password=\"s3cret\" roles=\"admin\"/>\n"
3045
msgstr ""
3046
3047
#: serverguide/C/web-servers.xml:1111(title)
3048
msgid "Using Tomcat standard webapps"
3049
msgstr ""
3050
3051
#: serverguide/C/web-servers.xml:1112(para)
3052
msgid ""
3053
"Tomcat is shipped with webapps that you can install for documentation, "
3054
"administration or demo purposes."
3055
msgstr ""
3056
3057
#: serverguide/C/web-servers.xml:1115(title)
3058
msgid "Tomcat documentation"
3059
msgstr ""
3060
3061
#: serverguide/C/web-servers.xml:1116(para)
3062
msgid ""
3063
"The <application>tomcat6-docs</application> package contains Tomcat 6.0 "
3064
"documentation, packaged as a webapp that you can access by default at "
3065
"http://yourserver:8080/docs. You can install it by entering the following "
3066
"command in the terminal prompt:"
3067
msgstr ""
3068
3069
#: serverguide/C/web-servers.xml:1121(command)
3070
msgid "sudo apt-get install tomcat6-docs"
3071
msgstr ""
3072
3073
#: serverguide/C/web-servers.xml:1125(title)
3074
msgid "Tomcat administration webapps"
3075
msgstr ""
3076
3077
#: serverguide/C/web-servers.xml:1126(para)
3078
msgid ""
3079
"The <application>tomcat6-admin</application> package contains two webapps "
3080
"that can be used to administer the Tomcat server using a web interface. You "
3081
"can install them by entering the following command in the terminal prompt:"
3082
msgstr ""
3083
3084
#: serverguide/C/web-servers.xml:1131(command)
3085
msgid "sudo apt-get install tomcat6-admin"
3086
msgstr ""
3087
3088
#: serverguide/C/web-servers.xml:1133(para)
3089
msgid ""
3090
"The first one is the <emphasis>manager</emphasis> webapp, which you can "
3091
"access by default at http://yourserver:8080/manager/html. It is primarily "
3092
"used to get server status and restart webapps."
3093
msgstr ""
3094
3095
#: serverguide/C/web-servers.xml:1136(para)
3096
msgid ""
3097
"Access to the <emphasis>manager</emphasis> application is protected by "
3098
"default: you need to define a user with the role \"manager\" in "
3099
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3100
msgstr ""
3101
3102
#: serverguide/C/web-servers.xml:1140(para)
3103
msgid ""
3104
"The second one is the <emphasis>host-manager</emphasis> webapp, which you "
3105
"can access by default at http://yourserver:8080/host-manager/html. It can be "
3106
"used to create virtual hosts dynamically."
3107
msgstr ""
3108
3109
#: serverguide/C/web-servers.xml:1144(para)
3110
msgid ""
3111
"Access to the <emphasis>host-manager</emphasis> application is also "
3112
"protected by default: you need to define a user with the role \"admin\" in "
3113
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3114
msgstr ""
3115
3116
#: serverguide/C/web-servers.xml:1149(para)
3117
msgid ""
3118
"For security reasons, the tomcat6 user cannot write to the "
3119
"<filename>/etc/tomcat6</filename> directory by default. Some features in "
3120
"these admin webapps (application deployment, virtual host creation) need "
3121
"write access to that directory. If you want to use these features execute "
3122
"the following, to give users in the tomcat6 group the necessary rights:"
3123
msgstr ""
3124
3125
#: serverguide/C/web-servers.xml:1156(command)
3126
msgid "sudo chgrp -R tomcat6 /etc/tomcat6"
3127
msgstr ""
3128
3129
#: serverguide/C/web-servers.xml:1157(command)
3130
msgid "sudo chmod -R g+w /etc/tomcat6"
3131
msgstr ""
3132
3133
#: serverguide/C/web-servers.xml:1162(title)
3134
msgid "Tomcat examples webapps"
3135
msgstr ""
3136
3137
#: serverguide/C/web-servers.xml:1163(para)
3138
msgid ""
3139
"The <application>tomcat6-examples</application> package contains two webapps "
3140
"that can be used to test or demonstrate Servlets and JSP features, which you "
3141
"can access them by default at http://yourserver:8080/examples. You can "
3142
"install them by entering the following command in the terminal prompt:"
3143
msgstr ""
3144
3145
#: serverguide/C/web-servers.xml:1169(command)
3146
msgid "sudo apt-get install tomcat6-examples"
3147
msgstr ""
3148
3149
#: serverguide/C/web-servers.xml:1175(title)
3150
msgid "Using private instances"
3151
msgstr ""
3152
3153
#: serverguide/C/web-servers.xml:1176(para)
3154
msgid ""
3155
"Tomcat is heavily used in development and testing scenarios where using a "
3156
"single system-wide instance doesn't meet the requirements of multiple users "
3157
"on a single system. The Tomcat 6.0 packages in Ubuntu come with tools to "
3158
"help deploy your own user-oriented instances, allowing every user on a "
3159
"system to run (without root rights) separate private instances while still "
3160
"using the system-installed libraries."
3161
msgstr ""
3162
3163
#: serverguide/C/web-servers.xml:1183(para)
3164
msgid ""
3165
"It is possible to run the system-wide instance and the private instances in "
3166
"parallel, as long as they do not use the same TCP ports."
3167
msgstr ""
3168
3169
#: serverguide/C/web-servers.xml:1187(title)
3170
msgid "Installing private instance support"
3171
msgstr ""
3172
3173
#: serverguide/C/web-servers.xml:1188(para)
3174
msgid ""
3175
"You can install everything necessary to run private instances by entering "
3176
"the following command in the terminal prompt:"
3177
msgstr ""
3178
3179
#: serverguide/C/web-servers.xml:1191(command)
3180
msgid "sudo apt-get install tomcat6-user"
3181
msgstr ""
3182
3183
#: serverguide/C/web-servers.xml:1195(title)
3184
msgid "Creating a private instance"
3185
msgstr ""
3186
3187
#: serverguide/C/web-servers.xml:1196(para)
3188
msgid ""
3189
"You can create a private instance directory by entering the following "
3190
"command in the terminal prompt:"
3191
msgstr ""
3192
3193
#: serverguide/C/web-servers.xml:1199(command)
3194
msgid "tomcat6-instance-create my-instance"
3195
msgstr ""
3196
3197
#: serverguide/C/web-servers.xml:1201(para)
3198
msgid ""
3199
"This will create a new <filename>my-instance</filename> directory with all "
3200
"the necessary subdirectories and scripts. You can for example install your "
3201
"common libraries in the <filename>lib/</filename> subdirectory and deploy "
3202
"your webapps in the <filename>webapps/</filename> subdirectory. No webapps "
3203
"are deployed by default."
3204
msgstr ""
3205
3206
#: serverguide/C/web-servers.xml:1209(title)
3207
msgid "Configuring your private instance"
3208
msgstr ""
3209
3210
#: serverguide/C/web-servers.xml:1210(para)
3211
msgid ""
3212
"You will find the classic Tomcat configuration files for your private "
3213
"instance in the <filename>conf/</filename> subdirectory. You should for "
3214
"example certainly edit the <filename>conf/server.xml</filename> file to "
3215
"change the default ports used by your private Tomcat instance to avoid "
3216
"conflict with other instances that might be running."
3217
msgstr ""
3218
3219
#: serverguide/C/web-servers.xml:1218(title)
3220
msgid "Starting/stopping your private instance"
3221
msgstr ""
3222
3223
#: serverguide/C/web-servers.xml:1219(para)
3224
msgid ""
3225
"You can start your private instance by entering the following command in the "
3226
"terminal prompt (supposing your instance is located in the <filename>my-"
3227
"instance</filename> directory):"
3228
msgstr ""
3229
3230
#: serverguide/C/web-servers.xml:1223(command)
3231
msgid "my-instance/bin/startup.sh"
3232
msgstr ""
3233
3234
#: serverguide/C/web-servers.xml:1225(para)
3235
msgid ""
3236
"You should check the <filename>logs/</filename> subdirectory for any error. "
3237
"If you have a <emphasis>java.net.BindException: Address already in "
3238
"use<null>:8080</emphasis> error, it means that the port you're using "
3239
"is already taken and that you should change it."
3240
msgstr ""
3241
3242
#: serverguide/C/web-servers.xml:1230(para)
3243
msgid ""
3244
"You can stop your instance by entering the following command in the terminal "
3245
"prompt (supposing your instance is located in the <filename>my-"
3246
"instance</filename> directory):"
3247
msgstr ""
3248
3249
#: serverguide/C/web-servers.xml:1234(command)
3250
msgid "my-instance/bin/shutdown.sh"
3251
msgstr ""
3252
3253
#: serverguide/C/web-servers.xml:1243(para)
3254
msgid ""
3255
"See the <ulink url=\"http://tomcat.apache.org/\">Apache Tomcat</ulink> "
3256
"website for more information."
3257
msgstr ""
3258
3259
#: serverguide/C/web-servers.xml:1248(para)
3260
msgid ""
3261
"<ulink url=\"http://oreilly.com/catalog/9780596003180/\">Tomcat: The "
3262
"Definitive Guide</ulink> is a good resource for building web applications "
3263
"with Tomcat."
3264
msgstr ""
3265
3266
#: serverguide/C/web-servers.xml:1254(para)
3267
msgid ""
3268
"For additional books see the <ulink "
3269
"url=\"http://wiki.apache.org/tomcat/Tomcat/Books\">Tomcat Books</ulink> list "
3270
"page."
3271
msgstr ""
3272
3273
#: serverguide/C/web-servers.xml:1259(para)
3274
msgid ""
3275
"Also, see the<ulink "
3276
"url=\"https://help.ubuntu.com/community/ApacheTomcat5\">Ubuntu Wiki Apache "
3277
"Tomcat</ulink> page."
3278
msgstr ""
3279
3280
#: serverguide/C/vpn.xml:13(title)
3281
msgid "VPN"
3282
msgstr ""
3283
3284
#: serverguide/C/vpn.xml:15(para)
3285
msgid ""
3286
"A Virtual Private Network, or <emphasis>VPN</emphasis>, is an encrypted "
3287
"network connection between two or more networks. There are several ways to "
3288
"create a VPN using software as well as dedicated hardware appliances. This "
3289
"chapter will cover installing and configuring "
3290
"<application>OpenVPN</application> to create a VPN between two servers."
3291
msgstr ""
3292
3293
#: serverguide/C/vpn.xml:23(title)
3294
msgid "OpenVPN"
3295
msgstr ""
3296
3297
#: serverguide/C/vpn.xml:25(para)
3298
msgid ""
3299
"OpenVPN uses Public Key Infrastructure (PKI) to encrypt VPN traffic between "
3300
"nodes. A simple way of setting up a VPN with OpenVPN is to connect the "
3301
"clients through a bridge interface on the VPN server. This guide will assume "
3302
"that one VPN node, the server in this case, has a bridge interface "
3303
"configured. For more information on setting up a bridge see <xref "
3304
"linkend=\"bridging\"/>."
3305
msgstr ""
3306
3307
#: serverguide/C/vpn.xml:35(para)
3308
msgid "To install <application>openvpn</application> in a terminal enter:"
3309
msgstr ""
3310
3311
#: serverguide/C/vpn.xml:41(command) serverguide/C/vpn.xml:257(command)
3312
msgid "sudo apt-get install openvpn"
3313
msgstr ""
3314
3315
#: serverguide/C/vpn.xml:45(title)
3316
msgid "Server Certificates"
3317
msgstr ""
3318
3319
#: serverguide/C/vpn.xml:47(para)
3320
msgid ""
3321
"Now that the <application>openvpn</application> package is installed, the "
3322
"certificates for the VPN server need to be created."
3323
msgstr ""
3324
3325
#: serverguide/C/vpn.xml:52(para)
3326
msgid ""
3327
"First, copy the <filename>easy-rsa</filename> directory to "
3328
"<filename>/etc/openvpn</filename>. This will ensure that any changes to the "
3329
"scripts will not be lost when the package is updated. You will also need to "
3330
"adjust permissions in the <filename>easy-rsa</filename> directory to allow "
3331
"the current user permission to create files. From a terminal enter:"
3332
msgstr ""
3333
3334
#: serverguide/C/vpn.xml:59(command)
3335
msgid "sudo mkdir /etc/openvpn/easy-rsa/"
3336
msgstr ""
3337
3338
#: serverguide/C/vpn.xml:60(command)
3339
msgid ""
3340
"sudo cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-"
3341
"rsa/"
3342
msgstr ""
3343
3344
#: serverguide/C/vpn.xml:61(command)
3345
msgid "sudo chown -R $USER /etc/openvpn/easy-rsa/"
3346
msgstr ""
3347
3348
#: serverguide/C/vpn.xml:64(para)
3349
msgid ""
3350
"Next, edit <filename>/etc/openvpn/easy-rsa/vars</filename> adjusting the "
3351
"following to your environment:"
3352
msgstr ""
3353
3354
#: serverguide/C/vpn.xml:68(programlisting)
3355
#, no-wrap
3356
msgid ""
3357
"\n"
3358
"export KEY_COUNTRY=\"US\"\n"
3359
"export KEY_PROVINCE=\"NC\"\n"
3360
"export KEY_CITY=\"Winston-Salem\"\n"
3361
"export KEY_ORG=\"Example Company\"\n"
3362
"export KEY_EMAIL=\"steve@example.com\"\n"
3363
msgstr ""
3364
3365
#: serverguide/C/vpn.xml:76(para)
3366
msgid "Enter the following to create the server certificates:"
3367
msgstr ""
3368
3369
#: serverguide/C/vpn.xml:81(command) serverguide/C/vpn.xml:102(command)
3370
msgid "cd /etc/openvpn/easy-rsa/"
3371
msgstr ""
3372
3373
#: serverguide/C/vpn.xml:82(command) serverguide/C/vpn.xml:103(command)
3374
msgid "source vars"
3375
msgstr ""
3376
3377
#: serverguide/C/vpn.xml:83(command)
3378
msgid "./clean-all"
3379
msgstr ""
3380
3381
#: serverguide/C/vpn.xml:84(command)
3382
msgid "./build-dh"
3383
msgstr ""
3384
3385
#: serverguide/C/vpn.xml:85(command)
3386
msgid "./pkitool --initca"
3387
msgstr ""
3388
3389
#: serverguide/C/vpn.xml:86(command)
3390
msgid "./pkitool --server server"
3391
msgstr ""
3392
3393
#: serverguide/C/vpn.xml:87(command)
3394
msgid "cd keys"
3395
msgstr ""
3396
3397
#: serverguide/C/vpn.xml:88(command)
3398
msgid "openvpn --genkey --secret ta.key"
3399
msgstr ""
3400
3401
#: serverguide/C/vpn.xml:89(command)
3402
msgid "sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/"
3403
msgstr ""
3404
3405
#: serverguide/C/vpn.xml:94(title)
3406
msgid "Client Certificates"
3407
msgstr ""
3408
3409
#: serverguide/C/vpn.xml:96(para)
3410
msgid ""
3411
"The VPN client will also need a certificate to authenticate itself to the "
3412
"server. To create the certificate, enter the following in a terminal:"
3413
msgstr ""
3414
3415
#: serverguide/C/vpn.xml:104(command)
3416
msgid "./pkitool hostname"
3417
msgstr ""
3418
3419
#: serverguide/C/vpn.xml:108(para)
3420
msgid ""
3421
"Replace <emphasis>hostname</emphasis> with the actual hostname of the "
3422
"machine connecting to the VPN."
3423
msgstr ""
3424
3425
#: serverguide/C/vpn.xml:113(para)
3426
msgid "Copy the following files to the client:"
3427
msgstr ""
3428
3429
#: serverguide/C/vpn.xml:118(para)
3430
msgid "/etc/openvpn/ca.crt"
3431
msgstr ""
3432
3433
#: serverguide/C/vpn.xml:119(para)
3434
msgid "/etc/openvpn/easy-rsa/keys/hostname.crt"
3435
msgstr ""
3436
3437
#: serverguide/C/vpn.xml:120(para)
3438
msgid "/etc/openvpn/easy-rsa/keys/hostname.key"
3439
msgstr ""
3440
3441
#: serverguide/C/vpn.xml:121(para)
3442
msgid "/etc/openvpn/ta.key"
3443
msgstr ""
3444
3445
#: serverguide/C/vpn.xml:125(para)
3446
msgid ""
3447
"Remember to adjust the above file names for your client machine's "
3448
"<emphasis>hostname</emphasis>."
3449
msgstr ""
3450
3451
#: serverguide/C/vpn.xml:130(para)
3452
msgid ""
3453
"It is best to use a secure method to copy the certificate and key files. The "
3454
"<application>scp</application> utility is a good choice, but copying the "
3455
"files to removable media then to the client, also works well."
3456
msgstr ""
3457
3458
#: serverguide/C/vpn.xml:141(title) serverguide/C/vcs.xml:107(title)
3459
msgid "Server Configuration"
3460
msgstr ""
3461
3462
#: serverguide/C/vpn.xml:143(para)
3463
msgid ""
3464
"Now configure the <application>openvpn</application> server by creating "
3465
"<filename>/etc/openvpn/server.conf</filename> from the example file. In a "
3466
"terminal enter:"
3467
msgstr ""
3468
3469
#: serverguide/C/vpn.xml:149(command)
3470
msgid ""
3471
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz "
3472
"/etc/openvpn/"
3473
msgstr ""
3474
3475
#: serverguide/C/vpn.xml:150(command)
3476
msgid "sudo gzip -d /etc/openvpn/server.conf.gz"
3477
msgstr ""
3478
3479
#: serverguide/C/vpn.xml:153(para)
3480
msgid ""
3481
"Edit <filename>/etc/openvpn/server.conf</filename> changing the following "
3482
"options to:"
3483
msgstr ""
3484
3485
#: serverguide/C/vpn.xml:157(programlisting)
3486
#, no-wrap
3487
msgid ""
3488
"\n"
3489
"local 172.18.100.101\n"
3490
"dev tap0\n"
3491
"up \"/etc/openvpn/up.sh br0\"\n"
3492
"down \"/etc/openvpn/down.sh br0\"\n"
3493
";server 10.8.0.0 255.255.255.0\n"
3494
"server-bridge 172.18.100.101 255.255.255.0 172.18.100.105 172.18.100.200\n"
3495
"push \"route 172.18.100.1 255.255.255.0\"\n"
3496
"push \"dhcp-option DNS 172.18.100.20\"\n"
3497
"push \"dhcp-option DOMAIN example.com\"\n"
3498
"tls-auth ta.key 0 # This file is secret\n"
3499
"user nobody\n"
3500
"group nogroup\n"
3501
msgstr ""
3502
3503
#: serverguide/C/vpn.xml:174(para)
3504
msgid ""
3505
"<emphasis>local</emphasis>: is the IP address of the bridge interface."
3506
msgstr ""
3507
3508
#: serverguide/C/vpn.xml:179(para)
3509
msgid ""
3510
"<emphasis>server-bridge</emphasis>: needed when the configuration uses "
3511
"bridging. The <emphasis>172.18.100.101 255.255.255.0</emphasis> portion is "
3512
"the bridge interface and mask. The IP range <emphasis>172.18.100.105 "
3513
"172.18.100.200</emphasis> is the range of IP addresses that will be assigned "
3514
"to clients."
3515
msgstr ""
3516
3517
#: serverguide/C/vpn.xml:186(para)
3518
msgid ""
3519
"<emphasis>push</emphasis>: are directives to add networking options for "
3520
"clients."
3521
msgstr ""
3522
3523
#: serverguide/C/vpn.xml:191(para)
3524
msgid ""
3525
"<emphasis>user and group</emphasis>: configure which user and group the "
3526
"<application>openvpn</application> daemon executes as."
3527
msgstr ""
3528
3529
#: serverguide/C/vpn.xml:198(para)
3530
msgid ""
3531
"Replace all IP addresses and domain names above with those of your network."
3532
msgstr ""
3533
3534
#: serverguide/C/vpn.xml:203(para)
3535
msgid ""
3536
"Next, create a couple of helper scripts to add the <emphasis>tap</emphasis> "
3537
"interface to the bridge. Create <filename>/etc/openvpn/up.sh</filename>:"
3538
msgstr ""
3539
3540
#: serverguide/C/vpn.xml:207(programlisting)
3541
#, no-wrap
3542
msgid ""
3543
"\n"
3544
"#!/bin/sh\n"
3545
"\n"
3546
"BR=$1\n"
3547
"DEV=$2\n"
3548
"MTU=$3\n"
3549
"/sbin/ifconfig $DEV mtu $MTU promisc up\n"
3550
"/usr/sbin/brctl addif $BR $DEV\n"
3551
msgstr ""
3552
3553
#: serverguide/C/vpn.xml:217(para)
3554
msgid "And <filename>/etc/openvpn/down.sh</filename>:"
3555
msgstr ""
3556
3557
#: serverguide/C/vpn.xml:221(programlisting)
3558
#, no-wrap
3559
msgid ""
3560
"\n"
3561
"#!/bin/sh\n"
3562
"\n"
3563
"BR=$1\n"
3564
"DEV=$2\n"
3565
"\n"
3566
"/usr/sbin/brctl delif $BR $DEV\n"
3567
"/sbin/ifconfig $DEV down\n"
3568
msgstr ""
3569
3570
#: serverguide/C/vpn.xml:231(para)
3571
msgid "Then make them executable:"
3572
msgstr ""
3573
3574
#: serverguide/C/vpn.xml:236(command)
3575
msgid "sudo chmod 755 /etc/openvpn/down.sh"
3576
msgstr ""
3577
3578
#: serverguide/C/vpn.xml:237(command)
3579
msgid "sudo chmod 755 /etc/openvpn/up.sh"
3580
msgstr ""
3581
3582
#: serverguide/C/vpn.xml:240(para)
3583
msgid ""
3584
"After configuring the server, restart <application>openvpn</application> by "
3585
"entering:"
3586
msgstr ""
3587
3588
#: serverguide/C/vpn.xml:245(command) serverguide/C/vpn.xml:293(command)
3589
msgid "sudo /etc/init.d/openvpn restart"
3590
msgstr ""
3591
3592
#: serverguide/C/vpn.xml:250(title)
3593
msgid "Client Configuration"
3594
msgstr ""
3595
3596
#: serverguide/C/vpn.xml:252(para)
3597
msgid "First, install <application>openvpn</application> on the client:"
3598
msgstr ""
3599
3600
#: serverguide/C/vpn.xml:260(para)
3601
msgid ""
3602
"Then with the server configured and the client certificates copied to the "
3603
"<filename>/etc/openvpn/</filename> directory, create a client configuration "
3604
"file by copying the example. In a terminal on the client machine enter:"
3605
msgstr ""
3606
3607
#: serverguide/C/vpn.xml:266(command)
3608
msgid ""
3609
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf "
3610
"/etc/openvpn"
3611
msgstr ""
3612
3613
#: serverguide/C/vpn.xml:269(para)
3614
msgid ""
3615
"Now edit <filename>/etc/openvpn/client.conf</filename> changing the "
3616
"following options:"
3617
msgstr ""
3618
3619
#: serverguide/C/vpn.xml:273(programlisting)
3620
#, no-wrap
3621
msgid ""
3622
"\n"
3623
"dev tap\n"
3624
"remote vpn.example.com 1194\n"
3625
"cert hostname.crt\n"
3626
"key hostname.key\n"
3627
"tls-auth ta.key 1\n"
3628
msgstr ""
3629
3630
#: serverguide/C/vpn.xml:282(para)
3631
msgid ""
3632
"Replace <emphasis>vpn.example.com</emphasis> with the hostname of your VPN "
3633
"server, and <emphasis>hostname.*</emphasis> with the actual certificate and "
3634
"key filenames."
3635
msgstr ""
3636
3637
#: serverguide/C/vpn.xml:288(para)
3638
msgid "Finally, restart <application>openvpn</application>:"
3639
msgstr ""
3640
3641
#: serverguide/C/vpn.xml:296(para)
3642
msgid "You should now be able to connect to the remote LAN through the VPN."
3643
msgstr ""
3644
3645
#: serverguide/C/vpn.xml:307(para)
3646
msgid ""
3647
"See the <ulink url=\"http://openvpn.net/\">OpenVPN</ulink> website for "
3648
"additional information."
3649
msgstr ""
3650
3651
#: serverguide/C/vpn.xml:312(para)
3652
msgid ""
3653
"Also, Pakt's <ulink url=\"http://www.packtpub.com/openvpn/book\">OpenVPN: "
3654
"Building and Integrating Virtual Private Networks</ulink> is a good resource."
3655
msgstr ""
3656
3657
#: serverguide/C/vpn.xml:318(para)
3658
msgid ""
3659
"Another source of further information is the <ulink "
3660
"url=\"https://help.ubuntu.com/community/OpenVPN\">Ubuntu Wiki "
3661
"OpenVPN</ulink> page."
3662
msgstr ""
3663
3664
#: serverguide/C/virtualization.xml:13(title)
3665
msgid "Virtualization"
3666
msgstr ""
3667
3668
#: serverguide/C/virtualization.xml:14(para)
3669
msgid ""
3670
"Virtualization is being adopted in many different environments and "
3671
"situations. If you are a developer, virtualization can provide you with a "
3672
"contained environment where you can safely do almost any sort of development "
3673
"safe from messing up your main working environment. If you are a systems "
3674
"administrator, you can use virtualization to more easily separate your "
3675
"services and move them around based on demand."
3676
msgstr ""
3677
3678
#: serverguide/C/virtualization.xml:20(para)
3679
msgid ""
3680
"The default virtualization technology supported in Ubuntu is "
3681
"<application>KVM</application>, a technology that takes advantage of "
3682
"virtualization extensions built into Intel and AMD hardware. For hardware "
3683
"without virtualization extensions <application>Xen</application> and "
3684
"<application>Qemu</application> are popular solutions."
3685
msgstr ""
3686
3687
#: serverguide/C/virtualization.xml:27(title)
3688
msgid "libvirt"
3689
msgstr ""
3690
3691
#: serverguide/C/virtualization.xml:28(para)
3692
msgid ""
3693
"The <application>libvirt</application> library is used to interface with "
3694
"different virtualization technologies. Before getting started with "
3695
"<application>libvirt</application> it is best to make sure your hardware "
3696
"supports the necessary virtualization extensions for "
3697
"<application>KVM</application>. Enter the following from a terminal prompt:"
3698
msgstr ""
3699
3700
#: serverguide/C/virtualization.xml:35(command)
3701
msgid "kvm-ok"
3702
msgstr ""
3703
3704
#: serverguide/C/virtualization.xml:37(para)
3705
msgid ""
3706
"A message will be printed informing you if your CPU "
3707
"<emphasis>does</emphasis> or <emphasis>does not</emphasis> support hardware "
3708
"virtualization."
3709
msgstr ""
3710
3711
#: serverguide/C/virtualization.xml:41(para)
3712
msgid ""
3713
"On most computer whose processor supports virtualization, it is necessary to "
3714
"activate an option in the BIOS to enable it."
3715
msgstr ""
3716
3717
#: serverguide/C/virtualization.xml:47(title)
3718
msgid "Virtual Networking"
3719
msgstr ""
3720
3721
#: serverguide/C/virtualization.xml:49(para)
3722
msgid ""
3723
"There are a few different ways to allow a virtual machine access to the "
3724
"external network. The default virtual network configuration is "
3725
"<emphasis>usermode</emphasis> networking, which uses the SLIRP protocol and "
3726
"traffic is NATed through the host interface to the outside network."
3727
msgstr ""
3728
3729
#: serverguide/C/virtualization.xml:54(para)
3730
msgid ""
3731
"To enable external hosts to directly access services on virtual machines a "
3732
"<emphasis>bridge</emphasis> needs to be configured. This allows the virtual "
3733
"interfaces to connect to the outside network through the physical interface, "
3734
"making them appear as normal hosts to the rest of the network. For "
3735
"information on setting up a bridge see <xref linkend=\"bridging\"/>."
3736
msgstr ""
3737
3738
#: serverguide/C/virtualization.xml:63(para)
3739
msgid "To install the necessary packages, from a terminal prompt enter:"
3740
msgstr ""
3741
3742
#: serverguide/C/virtualization.xml:67(command)
3743
msgid "sudo apt-get install kvm libvirt-bin"
3744
msgstr ""
3745
3746
#: serverguide/C/virtualization.xml:69(para)
3747
msgid ""
3748
"After installing <application>libvirt-bin</application>, the user used to "
3749
"manage virtual machines will need to be added to the "
3750
"<emphasis>libvirtd</emphasis> group. Doing so will grant the user access to "
3751
"the advanced networking options."
3752
msgstr ""
3753
3754
#: serverguide/C/virtualization.xml:73(para)
3755
msgid "In a terminal enter:"
3756
msgstr ""
3757
3758
#: serverguide/C/virtualization.xml:77(command)
3759
msgid "sudo adduser $USER libvirtd"
3760
msgstr ""
3761
3762
#: serverguide/C/virtualization.xml:80(para)
3763
msgid ""
3764
"If the user chosen is the current user, you will need to log out and back in "
3765
"for the new group membership to take effect."
3766
msgstr ""
3767
3768
#: serverguide/C/virtualization.xml:84(para)
3769
msgid ""
3770
"You are now ready to install a <emphasis>Guest</emphasis> operating system. "
3771
"Installing a virtual machine follows the same process as installing the "
3772
"operating system directly on the hardware. You either need a way to automate "
3773
"the installation, or a keyboard and monitor will need to be attached to the "
3774
"physical machine."
3775
msgstr ""
3776
3777
#: serverguide/C/virtualization.xml:89(para)
3778
msgid ""
3779
"In the case of virtual machines a Graphical User Interface (GUI) is "
3780
"analogous to using a physical keyboard and mouse. Instead of installing a "
3781
"GUI the <application>virt-viewer</application> application can be used to "
3782
"connect to a virtual machine's console using <application>VNC</application>. "
3783
"See <xref linkend=\"libvirt-virt-viewer\"/> for more information."
3784
msgstr ""
3785
3786
#: serverguide/C/virtualization.xml:94(para)
3787
msgid ""
3788
"There are several ways to automate the Ubuntu installation process, for "
3789
"example using preseeds, kickstart, etc. Refer to the <ulink "
3790
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
3791
"Installation Guide</ulink> for details."
3792
msgstr ""
3793
3794
#: serverguide/C/virtualization.xml:98(para)
3795
msgid ""
3796
"Yet another way to install an Ubuntu virtual machine is to use "
3797
"<application>ubuntu-vm-builder</application>. <application>ubuntu-vm-"
3798
"builder</application> allows you to setup advanced partitions, execute "
3799
"custom post-install scripts, etc. For details see <xref linkend=\"jeos-and-"
3800
"vmbuilder\"/>"
3801
msgstr ""
3802
3803
#: serverguide/C/virtualization.xml:104(title)
3804
msgid "virt-install"
3805
msgstr ""
3806
3807
#: serverguide/C/virtualization.xml:105(para)
3808
msgid ""
3809
"<application>virt-install</application> is part of the <application>python-"
3810
"virtinst</application> package. To install it, from a terminal prompt enter:"
3811
msgstr ""
3812
3813
#: serverguide/C/virtualization.xml:109(command)
3814
msgid "sudo apt-get install python-virtinst"
3815
msgstr ""
3816
3817
#: serverguide/C/virtualization.xml:111(para)
3818
msgid ""
3819
"There are several options available when using <application>virt-"
3820
"install</application>. For example:"
3821
msgstr ""
3822
3823
#: serverguide/C/virtualization.xml:115(command)
3824
msgid ""
3825
"sudo virt-install -n web_devel -r 256 -f web_devel.img \\ -s 4 -c jeos.iso --"
3826
"accelerate \\ --connect=qemu:///system --vnc \\ --noautoconsole -v"
3827
msgstr ""
3828
3829
#: serverguide/C/virtualization.xml:122(para)
3830
msgid ""
3831
"<emphasis>-n web_devel:</emphasis> the name of the new virtual machine will "
3832
"be <emphasis>web_devel</emphasis> in this example."
3833
msgstr ""
3834
3835
#: serverguide/C/virtualization.xml:127(para)
3836
msgid ""
3837
"<emphasis>-r 256:</emphasis> specifies the amount of memory the virtual "
3838
"machine will use."
3839
msgstr ""
3840
3841
#: serverguide/C/virtualization.xml:132(para)
3842
msgid ""
3843
"<emphasis>-f web_devel.img:</emphasis> indicates the path to the virtual "
3844
"disk which can be a file, partition, or logical volume. In this example a "
3845
"file named <filename>web_devel.img</filename>."
3846
msgstr ""
3847
3848
#: serverguide/C/virtualization.xml:138(para)
3849
msgid "<emphasis>-s 4:</emphasis> the size of the virtual disk."
3850
msgstr ""
3851
3852
#: serverguide/C/virtualization.xml:143(para)
3853
msgid ""
3854
"<emphasis>-c jeos.iso:</emphasis> file to be used as a virtual CDROM. The "
3855
"file can be either an ISO file or the path to the host's CDROM device."
3856
msgstr ""
3857
3858
#: serverguide/C/virtualization.xml:149(para)
3859
msgid ""
3860
"<emphasis>--accelerate:</emphasis> enables the kernel's acceleration "
3861
"technologies."
3862
msgstr ""
3863
3864
#: serverguide/C/virtualization.xml:154(para)
3865
msgid ""
3866
"<emphasis>--vnc:</emphasis> exports the guest's virtual console using VNC."
3867
msgstr ""
3868
3869
#: serverguide/C/virtualization.xml:159(para)
3870
msgid ""
3871
"<emphasis>--noautoconsole:</emphasis> will not automatically connect to the "
3872
"virtual machine's console."
3873
msgstr ""
3874
3875
#: serverguide/C/virtualization.xml:164(para)
3876
msgid "<emphasis>-v:</emphasis> creates a fully virtualized guest."
3877
msgstr ""
3878
3879
#: serverguide/C/virtualization.xml:169(para)
3880
msgid ""
3881
"After launching <application>virt-install</application> you can connect to "
3882
"the virtual machine's console either locally using a GUI or with the "
3883
"<application>virt-viewer</application> utility."
3884
msgstr ""
3885
3886
#: serverguide/C/virtualization.xml:175(title)
3887
msgid "virt-clone"
3888
msgstr ""
3889
3890
#: serverguide/C/virtualization.xml:176(para)
3891
msgid ""
3892
"The <application>virt-clone</application> application can be used to copy "
3893
"one virtual machine to another. For example:"
3894
msgstr ""
3895
3896
#: serverguide/C/virtualization.xml:180(command)
3897
msgid ""
3898
"sudo virt-clone -o web_devel -n database_devel -f "
3899
"/path/to/database_devel.img --connect=qemu:///system"
3900
msgstr ""
3901
3902
#: serverguide/C/virtualization.xml:184(para)
3903
msgid "<emphasis>-o:</emphasis> original virtual machine."
3904
msgstr ""
3905
3906
#: serverguide/C/virtualization.xml:189(para)
3907
msgid "<emphasis>-n:</emphasis> name of the new virtual machine."
3908
msgstr ""
3909
3910
#: serverguide/C/virtualization.xml:194(para)
3911
msgid ""
3912
"<emphasis>-f:</emphasis> path to the file, logical volume, or partition to "
3913
"be used by the new virtual machine."
3914
msgstr ""
3915
3916
#: serverguide/C/virtualization.xml:199(para)
3917
msgid ""
3918
"<emphasis>--connect:</emphasis> specifies which hypervisor to connect to."
3919
msgstr ""
3920
3921
#: serverguide/C/virtualization.xml:204(para)
3922
msgid ""
3923
"Also, use <emphasis>-d</emphasis> or <emphasis>--debug</emphasis> option to "
3924
"help troubleshoot problems with <application>virt-clone</application>."
3925
msgstr ""
3926
3927
#: serverguide/C/virtualization.xml:209(para)
3928
msgid ""
3929
"Replace <emphasis>web_devel</emphasis> and "
3930
"<emphasis>database_devel</emphasis> with appropriate virtual machine names."
3931
msgstr ""
3932
3933
#: serverguide/C/virtualization.xml:215(title)
3934
msgid "Virtual Machine Management"
3935
msgstr ""
3936
3937
#: serverguide/C/virtualization.xml:217(title)
3938
msgid "virsh"
3939
msgstr ""
3940
3941
#: serverguide/C/virtualization.xml:218(para)
3942
msgid ""
3943
"There are several utilities available to manage virtual machines and "
3944
"<application>libvirt</application>. The <application>virsh</application> "
3945
"utility can be used from the command line. Some examples:"
3946
msgstr ""
3947
3948
#: serverguide/C/virtualization.xml:224(para)
3949
msgid "To list running virtual machines:"
3950
msgstr ""
3951
3952
#: serverguide/C/virtualization.xml:228(command)
3953
msgid "virsh -c qemu:///system list"
3954
msgstr ""
3955
3956
#: serverguide/C/virtualization.xml:232(para)
3957
msgid "To start a virtual machine:"
3958
msgstr ""
3959
3960
#: serverguide/C/virtualization.xml:236(command)
3961
msgid "virsh -c qemu:///system start web_devel"
3962
msgstr ""
3963
3964
#: serverguide/C/virtualization.xml:240(para)
3965
msgid "Similarly, to start a virtual machine at boot:"
3966
msgstr ""
3967
3968
#: serverguide/C/virtualization.xml:244(command)
3969
msgid "virsh -c qemu:///system autostart web_devel"
3970
msgstr ""
3971
3972
#: serverguide/C/virtualization.xml:248(para)
3973
msgid "Reboot a virtual machine with:"
3974
msgstr ""
3975
3976
#: serverguide/C/virtualization.xml:252(command)
3977
msgid "virsh -c qemu:///system reboot web_devel"
3978
msgstr ""
3979
3980
#: serverguide/C/virtualization.xml:256(para)
3981
msgid ""
3982
"The <emphasis>state</emphasis> of virtual machines can be saved to a file in "
3983
"order to be restored later. The following will save the virtual machine "
3984
"state into a file named according to the date:"
3985
msgstr ""
3986
3987
#: serverguide/C/virtualization.xml:261(command)
3988
msgid "virsh -c qemu:///system save web_devel web_devel-022708.state"
3989
msgstr ""
3990
3991
#: serverguide/C/virtualization.xml:263(para)
3992
msgid "Once saved the virtual machine will no longer be running."
3993
msgstr ""
3994
3995
#: serverguide/C/virtualization.xml:268(para)
3996
msgid "A saved virtual machine can be restored using:"
3997
msgstr ""
3998
3999
#: serverguide/C/virtualization.xml:272(command)
4000
msgid "virsh -c qemu:///system restore web_devel-022708.state"
4001
msgstr ""
4002
4003
#: serverguide/C/virtualization.xml:276(para)
4004
msgid "To shutdown a virtual machine do:"
4005
msgstr ""
4006
4007
#: serverguide/C/virtualization.xml:280(command)
4008
msgid "virsh -c qemu:///system shutdown web_devel"
4009
msgstr ""
4010
4011
#: serverguide/C/virtualization.xml:284(para)
4012
msgid "A CDROM device can be mounted in a virtual machine by entering:"
4013
msgstr ""
4014
4015
#: serverguide/C/virtualization.xml:288(command)
4016
msgid "virsh -c qemu:///system attach-disk web_devel /dev/cdrom /media/cdrom"
4017
msgstr ""
4018
4019
#: serverguide/C/virtualization.xml:293(para)
4020
msgid ""
4021
"In the above examples replace <emphasis>web_devel</emphasis> with the "
4022
"appropriate virtual machine name, and <filename>web_devel-"
4023
"022708.state</filename> with a descriptive file name."
4024
msgstr ""
4025
4026
#: serverguide/C/virtualization.xml:300(title)
4027
msgid "Virtual Machine Manager"
4028
msgstr ""
4029
4030
#: serverguide/C/virtualization.xml:301(para)
4031
msgid ""
4032
"The <application>virt-manager</application> package contains a graphical "
4033
"utility to manage local and remote virtual machines. To install virt-manager "
4034
"enter:"
4035
msgstr ""
4036
4037
#: serverguide/C/virtualization.xml:306(command)
4038
msgid "sudo apt-get install virt-manager"
4039
msgstr ""
4040
4041
#: serverguide/C/virtualization.xml:308(para)
4042
msgid ""
4043
"Since <application>virt-manager</application> requires a Graphical User "
4044
"Interface (GUI) environment it is recommended to be installed on a "
4045
"workstation or test machine instead of a production server. To connect to "
4046
"the local <application>libvirt</application> service enter:"
4047
msgstr ""
4048
4049
#: serverguide/C/virtualization.xml:314(command)
4050
msgid "virt-manager -c qemu:///system"
4051
msgstr ""
4052
4053
#: serverguide/C/virtualization.xml:316(para)
4054
msgid ""
4055
"You can connect to the <application>libvirt</application> service running on "
4056
"another host by entering the following in a terminal prompt:"
4057
msgstr ""
4058
4059
#: serverguide/C/virtualization.xml:320(command)
4060
msgid "virt-manager -c qemu+ssh://virtnode1.mydomain.com/system"
4061
msgstr ""
4062
4063
#: serverguide/C/virtualization.xml:323(para)
4064
msgid ""
4065
"The above example assumes that <application>SSH</application> connectivity "
4066
"between the management system and virtnode1.mydomain.com has already been "
4067
"configured, and uses SSH keys for authentication. SSH "
4068
"<emphasis>keys</emphasis> are needed because "
4069
"<application>libvirt</application> sends the password prompt to another "
4070
"process. For details on configuring <application>SSH</application> see <xref "
4071
"linkend=\"openssh-server\"/>"
4072
msgstr ""
4073
4074
#: serverguide/C/virtualization.xml:333(title)
4075
msgid "Virtual Machine Viewer"
4076
msgstr ""
4077
4078
#: serverguide/C/virtualization.xml:334(para)
4079
msgid ""
4080
"The <application>virt-viewer</application> application allows you to connect "
4081
"to a virtual machine's console. <application>virt-viewer</application> does "
4082
"require a Graphical User Interface (GUI) to interface with the virtual "
4083
"machine."
4084
msgstr ""
4085
4086
#: serverguide/C/virtualization.xml:338(para)
4087
msgid ""
4088
"To install <application>virt-viewer</application> from a terminal enter:"
4089
msgstr ""
4090
4091
#: serverguide/C/virtualization.xml:342(command)
4092
msgid "sudo apt-get install virt-viewer"
4093
msgstr ""
4094
4095
#: serverguide/C/virtualization.xml:344(para)
4096
msgid ""
4097
"Once a virtual machine is installed and running you can connect to the "
4098
"virtual machine's console by using:"
4099
msgstr ""
4100
4101
#: serverguide/C/virtualization.xml:348(command)
4102
msgid "virt-viewer -c qemu:///system web_devel"
4103
msgstr ""
4104
4105
#: serverguide/C/virtualization.xml:350(para)
4106
msgid ""
4107
"Similar to <application>virt-manager</application>, <application>virt-"
4108
"viewer</application> can connect to a remote host using "
4109
"<emphasis>SSH</emphasis> with key authentication, as well:"
4110
msgstr ""
4111
4112
#: serverguide/C/virtualization.xml:355(command)
4113
msgid "virt-viewer -c qemu+ssh://virtnode1.mydomain.com/system web_devel"
4114
msgstr ""
4115
4116
#: serverguide/C/virtualization.xml:357(para)
4117
msgid ""
4118
"Be sure to replace <emphasis role=\"italic\">web_devel</emphasis> with the "
4119
"appropriate virtual machine name."
4120
msgstr ""
4121
4122
#: serverguide/C/virtualization.xml:360(para)
4123
msgid ""
4124
"If configured to use a <emphasis>bridged</emphasis> network interface you "
4125
"can also setup <application>SSH</application> access to the virtual machine. "
4126
"See <xref linkend=\"openssh-server\"/> and <xref linkend=\"bridging\"/> for "
4127
"more details."
4128
msgstr ""
4129
4130
#: serverguide/C/virtualization.xml:369(para)
4131
msgid ""
4132
"See the <ulink url=\"http://kvm.qumranet.com/kvmwiki\">KVM</ulink> home page "
4133
"for more details."
4134
msgstr ""
4135
4136
#: serverguide/C/virtualization.xml:374(para)
4137
msgid ""
4138
"For more information on <application>libvirt</application> see the <ulink "
4139
"url=\"http://libvirt.org/\">libvirt home page</ulink>"
4140
msgstr ""
4141
4142
#: serverguide/C/virtualization.xml:379(para)
4143
msgid ""
4144
"The <ulink url=\"http://virt-manager.et.redhat.com/\">Virtual Machine "
4145
"Manager</ulink> site has more information on <application>virt-"
4146
"manager</application> development."
4147
msgstr ""
4148
4149
#: serverguide/C/virtualization.xml:385(para)
4150
msgid ""
4151
"Also, stop by the <emphasis>#ubuntu-virt</emphasis> IRC channel on <ulink "
4152
"url=\"http://freenode.net/\">freenode</ulink> to discuss virtualization "
4153
"technology in Ubuntu."
4154
msgstr ""
4155
4156
#: serverguide/C/virtualization.xml:391(para)
4157
msgid ""
4158
"Another good resource is the <ulink "
4159
"url=\"https://help.ubuntu.com/community/KVM\">Ubuntu Wiki KVM</ulink> page."
4160
msgstr ""
4161
4162
#: serverguide/C/virtualization.xml:399(title)
4163
msgid "JeOS and vmbuilder"
4164
msgstr ""
4165
4166
#: serverguide/C/virtualization.xml:405(title)
4167
msgid "What is JeOS"
4168
msgstr ""
4169
4170
#: serverguide/C/virtualization.xml:407(para)
4171
msgid ""
4172
"Ubuntu <emphasis>JeOS</emphasis> (pronounced \"Juice\") is an efficient "
4173
"variant of the Ubuntu Server operating system, configured specifically for "
4174
"virtual appliances. No longer available as a CD-ROM ISO for download, but "
4175
"only as an option either:"
4176
msgstr ""
4177
4178
#: serverguide/C/virtualization.xml:414(para)
4179
msgid ""
4180
"While installing from the Server Edition ISO (pressing "
4181
"<emphasis>F4</emphasis> on the first screen will allow you to pick \"Minimal "
4182
"installation\", which is the package selection equivalent to JeOS)."
4183
msgstr ""
4184
4185
#: serverguide/C/virtualization.xml:420(para)
4186
msgid "Or to be built using Ubuntu's vmbuilder, which is described here."
4187
msgstr ""
4188
4189
#: serverguide/C/virtualization.xml:426(para)
4190
msgid ""
4191
"JeOS is a specialized installation of Ubuntu Server Edition with a tuned "
4192
"kernel that only contains the base elements needed to run within a "
4193
"virtualized environment."
4194
msgstr ""
4195
4196
#: serverguide/C/virtualization.xml:431(para)
4197
msgid ""
4198
"Ubuntu JeOS has been tuned to take advantage of key performance technologies "
4199
"in the latest virtualization products from VMware. This combination of "
4200
"reduced size and optimized performance ensures that Ubuntu JeOS Edition "
4201
"delivers a highly efficient use of server resources in large virtual "
4202
"deployments."
4203
msgstr ""
4204
4205
#: serverguide/C/virtualization.xml:437(para)
4206
msgid ""
4207
"Without unnecessary drivers, and only the minimal required packages, ISVs "
4208
"can configure their supporting OS exactly as they require. They have the "
4209
"peace of mind that updates, whether for security or enhancement reasons, "
4210
"will be limited to the bare minimum of what is required in their specific "
4211
"environment. In turn, users deploying virtual appliances built on top of "
4212
"JeOS will have to go through fewer updates and therefore less maintenance "
4213
"than they would have had to with a standard full installation of a server."
4214
msgstr ""
4215
4216
#: serverguide/C/virtualization.xml:446(title)
4217
msgid "What is vmbuilder"
4218
msgstr ""
4219
4220
#: serverguide/C/virtualization.xml:448(para)
4221
msgid ""
4222
"With vmbuilder, there is no need to download a JeOS ISO anymore. vmbuilder "
4223
"will fetch the various package and build a virtual machine tailored for your "
4224
"needs in about a minute. vmbuilder is a script that automates the process of "
4225
"creating a ready to use Linux based VM. The currently supported hypervisors "
4226
"are KVM and Xen."
4227
msgstr ""
4228
4229
#: serverguide/C/virtualization.xml:454(para)
4230
msgid ""
4231
"You can pass command line options to add extra packages, remove packages, "
4232
"choose which version of Ubuntu, which mirror etc. On recent hardware with "
4233
"plenty of RAM, tmpdir in <filename>/dev/shm</filename> or using a tmpfs, and "
4234
"a local mirror, you can bootstrap a VM in less than a minute."
4235
msgstr ""
4236
4237
#: serverguide/C/virtualization.xml:460(para)
4238
msgid ""
4239
"First introduced as a shell script in Ubuntu 8.04 LTS, <application>ubuntu-"
4240
"vm-builder</application> started with little emphasis as a hack to help "
4241
"developers test their new code in a virtual machine without having to "
4242
"restart from scratch each time. As a few Ubuntu administrators started to "
4243
"notice this script, a few of them went on improving it and adapting it for "
4244
"so many use case that Soren Hansen (the author of the script and Ubuntu "
4245
"virtualization specialist, not the golf player) decided to rewrite it from "
4246
"scratch for Intrepid as a python script with a few new design goals:"
4247
msgstr ""
4248
4249
#: serverguide/C/virtualization.xml:470(para)
4250
msgid "Develop it so that it can be reused by other distributions."
4251
msgstr ""
4252
4253
#: serverguide/C/virtualization.xml:475(para)
4254
msgid ""
4255
"Use a plugin mechanisms for all virtualization interactions so that others "
4256
"can easily add logic for other virtualization environments."
4257
msgstr ""
4258
4259
#: serverguide/C/virtualization.xml:480(para)
4260
msgid ""
4261
"Provide an easy to maintain web interface as an option to the command line "
4262
"interface."
4263
msgstr ""
4264
4265
#: serverguide/C/virtualization.xml:486(para)
4266
msgid "But the general principles and commands remain the same."
4267
msgstr ""
4268
4269
#: serverguide/C/virtualization.xml:493(title)
4270
msgid "Initial Setup"
4271
msgstr ""
4272
4273
#: serverguide/C/virtualization.xml:495(para)
4274
msgid ""
4275
"It is assumed that you have installed and configured "
4276
"<application>libvirt</application> and <application>KVM</application> "
4277
"locally on the machine you are using. For details on how to perform this, "
4278
"please refer to:"
4279
msgstr ""
4280
4281
#: serverguide/C/virtualization.xml:507(para)
4282
msgid ""
4283
"The <ulink url=\"https://help.ubuntu.com/community/KVM\">KVM</ulink> Wiki "
4284
"page."
4285
msgstr ""
4286
4287
#: serverguide/C/virtualization.xml:513(para)
4288
msgid ""
4289
"We also assume that you know how to use a text based text editor such as "
4290
"nano or vi. If you have not used any of them before, you can get an overview "
4291
"of the various text editors available by reading the <ulink "
4292
"url=\"https://help.ubuntu.com/community/PowerUsersTextEditors\">PowerUsersTex"
4293
"tEditors</ulink> page. This tutorial has been done on KVM, but the general "
4294
"principle should remain on other virtualization technologies."
4295
msgstr ""
4296
4297
#: serverguide/C/virtualization.xml:521(title)
4298
msgid "Install vmbuilder"
4299
msgstr ""
4300
4301
#: serverguide/C/virtualization.xml:523(para)
4302
msgid ""
4303
"The name of the package that we need to install is <application>python-vm-"
4304
"builder</application>. In a terminal prompt enter:"
4305
msgstr ""
4306
4307
#: serverguide/C/virtualization.xml:528(command)
4308
msgid "sudo apt-get install python-vm-builder"
4309
msgstr ""
4310
4311
#: serverguide/C/virtualization.xml:532(para)
4312
msgid ""
4313
"If you are running Hardy, you can still perform most of this using the older "
4314
"version of the package named <application>ubuntu-vm-builder</application>, "
4315
"there are only a few changes to the syntax of the tool."
4316
msgstr ""
4317
4318
#: serverguide/C/virtualization.xml:541(title)
4319
msgid "Defining Your Virtual Machine"
4320
msgstr ""
4321
4322
#: serverguide/C/virtualization.xml:543(para)
4323
msgid ""
4324
"Defining a virtual machine with Ubuntu's vmbuilder is quite simple, but here "
4325
"are a few thing to consider:"
4326
msgstr ""
4327
4328
#: serverguide/C/virtualization.xml:549(para)
4329
msgid ""
4330
"If you plan on shipping a virtual appliance, do not assume that the end-user "
4331
"will know how to extend disk size to fit their need, so either plan for a "
4332
"large virtual disk to allow for your appliance to grow, or explain fairly "
4333
"well in your documentation how to allocate more space. It might actually be "
4334
"a good idea to store data on some separate external storage."
4335
msgstr ""
4336
4337
#: serverguide/C/virtualization.xml:556(para)
4338
msgid ""
4339
"Given that RAM is much easier to allocate in a VM, RAM size should be set to "
4340
"whatever you think is a safe minimum for your appliance."
4341
msgstr ""
4342
4343
#: serverguide/C/virtualization.xml:562(para)
4344
msgid ""
4345
"The <application>vmbuilder</application> command has 2 main parameters: the "
4346
"<emphasis>virtualization technology (hypervisor)</emphasis> and the targeted "
4347
"<emphasis>distribution</emphasis>. Optional parameters are quite numerous "
4348
"and can be found using the following command:"
4349
msgstr ""
4350
4351
#: serverguide/C/virtualization.xml:568(command)
4352
msgid "vmbuilder --help"
4353
msgstr ""
4354
4355
#: serverguide/C/virtualization.xml:572(title)
4356
msgid "Base Parameters"
4357
msgstr ""
4358
4359
#: serverguide/C/virtualization.xml:574(para)
4360
msgid ""
4361
"As this example is based on <application>KVM</application> and Ubuntu 10.04 "
4362
"LTS (Lucid Lynx), and we are likely to rebuild the same virtual machine "
4363
"multiple time, we'll invoke vmbuilder with the following first parameters:"
4364
msgstr ""
4365
4366
#: serverguide/C/virtualization.xml:580(command)
4367
msgid ""
4368
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4369
"libvirt qemu:///system"
4370
msgstr ""
4371
4372
#: serverguide/C/virtualization.xml:583(para)
4373
msgid ""
4374
"The <emphasis>--suite</emphasis> defines the Ubuntu release, the <emphasis>--"
4375
"flavour</emphasis> specifies that we want to use the virtual kernel (that's "
4376
"the one used to build a JeOS image), the <emphasis>--arch</emphasis> tells "
4377
"that we want to use a 32 bit machine, the <emphasis>-o</emphasis> tells "
4378
"vmbuilder to overwrite the previous version of the VM and the <emphasis>--"
4379
"libvirt</emphasis> tells to inform the local virtualization environment to "
4380
"add the resulting VM to the list of available machines."
4381
msgstr ""
4382
4383
#: serverguide/C/virtualization.xml:591(para)
4384
msgid "Notes:"
4385
msgstr ""
4386
4387
#: serverguide/C/virtualization.xml:597(para)
4388
msgid ""
4389
"Because of the nature of operations performed by vmbuilder, it needs to have "
4390
"root privilege, hence the use of sudo."
4391
msgstr ""
4392
4393
#: serverguide/C/virtualization.xml:602(para)
4394
msgid ""
4395
"If your virtual machine needs to use more than 3Gb of ram, you should build "
4396
"a 64 bit machine (--arch amd64)."
4397
msgstr ""
4398
4399
#: serverguide/C/virtualization.xml:607(para)
4400
msgid ""
4401
"Until Ubuntu 8.10, the virtual kernel was only built for 32 bit "
4402
"architecture, so if you want to define an amd64 machine on Hardy, you should "
4403
"use <emphasis>--flavour</emphasis> server instead."
4404
msgstr ""
4405
4406
#: serverguide/C/virtualization.xml:615(title)
4407
msgid "JeOS Installation Parameters"
4408
msgstr ""
4409
4410
#: serverguide/C/virtualization.xml:618(title)
4411
msgid "JeOS Networking"
4412
msgstr ""
4413
4414
#: serverguide/C/virtualization.xml:621(title)
4415
msgid "Assigning a fixed IP address"
4416
msgstr ""
4417
4418
#: serverguide/C/virtualization.xml:623(para)
4419
msgid ""
4420
"As a virtual appliance that may be deployed on various very different "
4421
"networks, it is very difficult to know what the actual network will look "
4422
"like. In order to simplify configuration, it is a good idea to take an "
4423
"approach similar to what network hardware vendors usually do, namely "
4424
"assigning an initial fixed IP address to the appliance in a private class "
4425
"network that you will provide in your documentation. An address in the range "
4426
"192.168.0.0/255 is usually a good choice."
4427
msgstr ""
4428
4429
#: serverguide/C/virtualization.xml:630(para)
4430
msgid "To do this we'll use the following parameters:"
4431
msgstr ""
4432
4433
#: serverguide/C/virtualization.xml:636(para)
4434
msgid ""
4435
"<emphasis>--ip ADDRESS</emphasis>: IP address in dotted form (defaults to "
4436
"dhcp if not specified)"
4437
msgstr ""
4438
4439
#: serverguide/C/virtualization.xml:641(para)
4440
msgid ""
4441
"<emphasis>--mask VALUE</emphasis>: IP mask in dotted form (default: "
4442
"255.255.255.0)"
4443
msgstr ""
4444
4445
#: serverguide/C/virtualization.xml:646(para)
4446
msgid "<emphasis>--net VALUE</emphasis>: IP net address (default: X.X.X.0)"
4447
msgstr ""
4448
4449
#: serverguide/C/virtualization.xml:651(para)
4450
msgid "<emphasis>--bcast VALUE</emphasis>: IP broadcast (default: X.X.X.255)"
4451
msgstr ""
4452
4453
#: serverguide/C/virtualization.xml:656(para)
4454
msgid "<emphasis>--gw ADDRESS</emphasis>: Gateway address (default: X.X.X.1)"
4455
msgstr ""
4456
4457
#: serverguide/C/virtualization.xml:661(para)
4458
msgid ""
4459
"<emphasis>--dns ADDRESS</emphasis>: Name server address (default: X.X.X.1)"
4460
msgstr ""
4461
4462
#: serverguide/C/virtualization.xml:667(para)
4463
msgid ""
4464
"We assume for now that default values are good enough, so the resulting "
4465
"invocation becomes:"
4466
msgstr ""
4467
4468
#: serverguide/C/virtualization.xml:672(command)
4469
msgid ""
4470
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4471
"libvirt qemu:///system --ip 192.168.0.100"
4472
msgstr ""
4473
4474
#: serverguide/C/virtualization.xml:677(title)
4475
msgid "Modifying the libvirt Template to use Bridging"
4476
msgstr ""
4477
4478
#: serverguide/C/virtualization.xml:679(para)
4479
msgid ""
4480
"Because our appliance will be likely to need to be accessed by remote hosts, "
4481
"we need to configure libvirt so that the appliance uses bridge networking. "
4482
"To do this we use vmbuilder template mechanism to modify the default one."
4483
msgstr ""
4484
4485
#: serverguide/C/virtualization.xml:684(para)
4486
msgid ""
4487
"In our working directory we create the template hierarchy and copy the "
4488
"default template:"
4489
msgstr ""
4490
4491
#: serverguide/C/virtualization.xml:689(command)
4492
msgid "mkdir -p VMBuilder/plugins/libvirt/templates"
4493
msgstr ""
4494
4495
#: serverguide/C/virtualization.xml:690(command)
4496
msgid "cp /etc/vmbuilder/libvirt/* VMBuilder/plugins/libvirt/templates/"
4497
msgstr ""
4498
4499
#: serverguide/C/virtualization.xml:693(para)
4500
msgid ""
4501
"We can then edit "
4502
"<filename>VMBuilder/plugins/libvirt/templates/libvirtxml.tmpl</filename> to "
4503
"change:"
4504
msgstr ""
4505
4506
#: serverguide/C/virtualization.xml:697(programlisting)
4507
#, no-wrap
4508
msgid ""
4509
"\n"
4510
" <interface type='network'>\n"
4511
" <source network='default'/>\n"
4512
" </interface>\n"
4513
msgstr ""
4514
4515
#: serverguide/C/virtualization.xml:703(para)
4516
msgid "To:"
4517
msgstr ""
4518
4519
#: serverguide/C/virtualization.xml:707(programlisting)
4520
#, no-wrap
4521
msgid ""
4522
"\n"
4523
" <interface type='bridge'>\n"
4524
" <source bridge='br0'/>\n"
4525
" </interface>\n"
4526
msgstr ""
4527
4528
#: serverguide/C/virtualization.xml:717(title) serverguide/C/installation.xml:459(title)
4529
msgid "Partitioning"
4530
msgstr ""
4531
4532
#: serverguide/C/virtualization.xml:719(para)
4533
msgid ""
4534
"Partitioning of the virtual appliance will have to take into consideration "
4535
"what you are planning to do with is. Because most appliances want to have a "
4536
"separate storage for data, having a separate <filename>/var</filename> would "
4537
"make sense."
4538
msgstr ""
4539
4540
#: serverguide/C/virtualization.xml:724(para)
4541
msgid ""
4542
"In order to do this vmbuilder provides us with <emphasis>--part</emphasis>:"
4543
msgstr ""
4544
4545
#: serverguide/C/virtualization.xml:728(programlisting)
4546
#, no-wrap
4547
msgid ""
4548
"\n"
4549
"--part PATH\n"
4550
" Allows you to specify a partition table in a partition file, located at "
4551
"PATH. Each line of the partition file should specify\n"
4552
" (root first):\n"
4553
" mountpoint size\n"
4554
" where size is in megabytes. You can have up to 4 virtual disks, a new "
4555
"disk starts on a\n"
4556
" line with ’---’. ie :\n"
4557
" root 1000\n"
4558
" /opt 1000\n"
4559
" swap 256\n"
4560
" ---\n"
4561
" /var 2000\n"
4562
" /log 1500\n"
4563
msgstr ""
4564
4565
#: serverguide/C/virtualization.xml:743(para)
4566
msgid ""
4567
"In our case we will define a text file name "
4568
"<filename>vmbuilder.partition</filename> which will contain the following:"
4569
msgstr ""
4570
4571
#: serverguide/C/virtualization.xml:747(programlisting)
4572
#, no-wrap
4573
msgid ""
4574
"\n"
4575
"root 8000\n"
4576
"swap 4000\n"
4577
"---\n"
4578
"/var 20000\n"
4579
msgstr ""
4580
4581
#: serverguide/C/virtualization.xml:755(para)
4582
msgid ""
4583
"Note that as we are using virtual disk images, the actual sizes that we put "
4584
"here are maximum sizes for these volumes."
4585
msgstr ""
4586
4587
#: serverguide/C/virtualization.xml:760(para)
4588
msgid "Our command line now looks like:"
4589
msgstr ""
4590
4591
#: serverguide/C/virtualization.xml:765(command)
4592
msgid ""
4593
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4594
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition"
4595
msgstr ""
4596
4597
#: serverguide/C/virtualization.xml:770(para)
4598
msgid ""
4599
"Using a \"\\\" in a command will allow long command strings to wrap to the "
4600
"next line."
4601
msgstr ""
4602
4603
#: serverguide/C/virtualization.xml:777(title)
4604
msgid "User and Password"
4605
msgstr ""
4606
4607
#: serverguide/C/virtualization.xml:779(para)
4608
msgid ""
4609
"Again setting up a virtual appliance, you will need to provide a default "
4610
"user and password that is generic so that you can include it in your "
4611
"documentation. We will see later on in this tutorial how we will provide "
4612
"some security by defining a script that will be run the first time a user "
4613
"actually logs in the appliance, that will, among other things, ask him to "
4614
"change his password. In this example I will use <emphasis>'user'</emphasis> "
4615
"as my user name, and <emphasis>'default'</emphasis> as the password."
4616
msgstr ""
4617
4618
#: serverguide/C/virtualization.xml:787(para)
4619
msgid "To do this we use the following optional parameters:"
4620
msgstr ""
4621
4622
#: serverguide/C/virtualization.xml:793(para)
4623
msgid ""
4624
"<emphasis>--user USERNAME:</emphasis> Sets the name of the user to be added. "
4625
"Default: ubuntu."
4626
msgstr ""
4627
4628
#: serverguide/C/virtualization.xml:798(para)
4629
msgid ""
4630
"<emphasis>--name FULLNAME:</emphasis> Sets the full name of the user to be "
4631
"added. Default: Ubuntu."
4632
msgstr ""
4633
4634
#: serverguide/C/virtualization.xml:803(para)
4635
msgid ""
4636
"<emphasis>--pass PASSWORD:</emphasis> Sets the password for the user. "
4637
"Default: ubuntu."
4638
msgstr ""
4639
4640
#: serverguide/C/virtualization.xml:809(para)
4641
msgid "Our resulting command line becomes:"
4642
msgstr ""
4643
4644
#: serverguide/C/virtualization.xml:814(command)
4645
msgid ""
4646
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4647
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition \\ --"
4648
"user user --name user --pass default"
4649
msgstr ""
4650
4651
#: serverguide/C/virtualization.xml:822(title)
4652
msgid "Installing Required Packages"
4653
msgstr ""
4654
4655
#: serverguide/C/virtualization.xml:824(para)
4656
msgid ""
4657
"In this example we will be installing a package "
4658
"<application>(Limesurvey)</application> that accesses a "
4659
"<application>MySQL</application> database and has a web interface. We will "
4660
"therefore require our OS to provide us with:"
4661
msgstr ""
4662
4663
#: serverguide/C/virtualization.xml:831(para)
4664
msgid "Apache"
4665
msgstr ""
4666
4667
#: serverguide/C/virtualization.xml:832(para)
4668
msgid "PHP"
4669
msgstr ""
4670
4671
#: serverguide/C/virtualization.xml:833(para) serverguide/C/databases.xml:19(trademark) serverguide/C/databases.xml:31(title)
4672
msgid "MySQL"
4673
msgstr ""
4674
4675
#: serverguide/C/virtualization.xml:834(para) serverguide/C/remote-administration.xml:20(title)
4676
msgid "OpenSSH Server"
4677
msgstr ""
4678
4679
#: serverguide/C/virtualization.xml:835(para)
4680
msgid "Limesurvey (as an example application that we have packaged)"
4681
msgstr ""
4682
4683
#: serverguide/C/virtualization.xml:838(para)
4684
msgid ""
4685
"This is done using vmbuilder by specifying the --addpkg option multiple "
4686
"times:"
4687
msgstr ""
4688
4689
#: serverguide/C/virtualization.xml:842(programlisting)
4690
#, no-wrap
4691
msgid ""
4692
"\n"
4693
"--addpkg PKG\n"
4694
" Install PKG into the guest (can be specfied multiple times)\n"
4695
msgstr ""
4696
4697
#: serverguide/C/virtualization.xml:847(para)
4698
msgid ""
4699
"However, due to the way vmbuilder operates, packages that have to ask "
4700
"questions to the user during the post install phase are not supported and "
4701
"should instead be installed while interactivity can occur. This is the case "
4702
"of Limesurvey, which we will have to install later, once the user logs in."
4703
msgstr ""
4704
4705
#: serverguide/C/virtualization.xml:853(para)
4706
msgid ""
4707
"Other packages that ask simple debconf question, such as <application>mysql-"
4708
"server</application> asking to set a password, the package can be installed "
4709
"immediately, but we will have to reconfigure it the first time the user logs "
4710
"in."
4711
msgstr ""
4712
4713
#: serverguide/C/virtualization.xml:859(para)
4714
msgid ""
4715
"If some packages that we need to install are not in main, we need to enable "
4716
"the additional repositories using --comp and --ppa:"
4717
msgstr ""
4718
4719
#: serverguide/C/virtualization.xml:863(programlisting)
4720
#, no-wrap
4721
msgid ""
4722
"\n"
4723
"--components COMP1,COMP2,...,COMPN\n"
4724
" A comma separated list of distro components to include (e.g. "
4725
"main,universe). This defaults\n"
4726
" to \"main\"\n"
4727
"--ppa=PPA Add ppa belonging to PPA to the vm's sources.list.\n"
4728
msgstr ""
4729
4730
#: serverguide/C/virtualization.xml:870(para)
4731
msgid ""
4732
"Limesurvey not being part of the archive at the moment, we'll specify it's "
4733
"PPA (personal package archive) address so that it is added to the VM "
4734
"<filename>/etc/apt/source.list</filename>, so we add the following options "
4735
"to the command line:"
4736
msgstr ""
4737
4738
#: serverguide/C/virtualization.xml:876(command)
4739
msgid ""
4740
"--addpkg apache2 --addpkg apache2-mpm-prefork --addpkg apache2-utils --"
4741
"addpkg apache2.2-common \\ --addpkg dbconfig-common --addpkg libapache2-mod-"
4742
"php5 --addpkg mysql-client --addpkg php5-cli \\ --addpkg php5-gd --addpkg "
4743
"php5-ldap --addpkg php5-mysql --addpkg wwwconfig-common \\ --addpkg mysql-"
4744
"server --ppa nijaba"
4745
msgstr ""
4746
4747
#: serverguide/C/virtualization.xml:883(title)
4748
msgid "OpenSSH"
4749
msgstr ""
4750
4751
#: serverguide/C/virtualization.xml:885(para)
4752
msgid ""
4753
"Another convenient tool that we want to have on our appliance is OpenSSH, as "
4754
"it will allow our admins to access the appliance remotely. However, pushing "
4755
"in the wild an appliance with a pre-installed OpenSSH server is a big "
4756
"security risk as all these server will share the same secret key, making it "
4757
"very easy for hackers to target our appliance with all the tools they need "
4758
"to crack it open in a breeze. As for the user password, we will instead rely "
4759
"on a script that will install OpenSSH the first time a user logs in so that "
4760
"the key generated will be different for each appliance. For this we'll use a "
4761
"<emphasis>--firstboot</emphasis> script, as it does not need any user "
4762
"interaction."
4763
msgstr ""
4764
4765
#: serverguide/C/virtualization.xml:897(title)
4766
msgid "Speed Considerations"
4767
msgstr ""
4768
4769
#: serverguide/C/virtualization.xml:900(title)
4770
msgid "Package Caching"
4771
msgstr ""
4772
4773
#: serverguide/C/virtualization.xml:902(para)
4774
msgid ""
4775
"When vmbuilder creates builds your system, it has to go fetch each one of "
4776
"the packages that composes it over the network to one of the official "
4777
"repositories, which, depending on your internet connection speed and the "
4778
"load of the mirror, can have a big impact on the actual build time. In order "
4779
"to reduce this, it is recommended to either have a local repository (which "
4780
"can be created using <application>apt-mirror</application>) or using a "
4781
"caching proxy such as <application>apt-proxy</application>. The later option "
4782
"being much simpler to implement and requiring less disk space, it is the one "
4783
"we will pick in this tutorial. To install it, simply type:"
4784
msgstr ""
4785
4786
#: serverguide/C/virtualization.xml:912(command)
4787
msgid "sudo apt-get install apt-proxy"
4788
msgstr ""
4789
4790
#: serverguide/C/virtualization.xml:915(para)
4791
msgid ""
4792
"Once this is complete, your (empty) proxy is ready for use on "
4793
"http://mirroraddress:9999 and will find ubuntu repository under /ubuntu. For "
4794
"vmbuilder to use it, we'll have to use the <emphasis>--mirror</emphasis> "
4795
"option:"
4796
msgstr ""
4797
4798
#: serverguide/C/virtualization.xml:920(programlisting)
4799
#, no-wrap
4800
msgid ""
4801
"\n"
4802
"--mirror=URL Use Ubuntu mirror at URL instead of the default, which\n"
4803
" is http://archive.ubuntu.com/ubuntu for official\n"
4804
" arches and http://ports.ubuntu.com/ubuntu-ports\n"
4805
" otherwise\n"
4806
msgstr ""
4807
4808
#: serverguide/C/virtualization.xml:927(para)
4809
msgid "So we add to the command line:"
4810
msgstr ""
4811
4812
#: serverguide/C/virtualization.xml:932(command)
4813
msgid "--mirror http://mirroraddress:9999/ubuntu"
4814
msgstr ""
4815
4816
#: serverguide/C/virtualization.xml:936(para)
4817
msgid ""
4818
"The mirror address specified here will also be used in the "
4819
"<filename>/etc/apt/sources.list</filename> of the newly created guest, so it "
4820
"is useful to specify here an address that can be resolved by the guest or to "
4821
"plan on reseting this address later on, such as in a <emphasis>--"
4822
"firstboot</emphasis> script."
4823
msgstr ""
4824
4825
#: serverguide/C/virtualization.xml:945(title)
4826
msgid "Install a Local Mirror"
4827
msgstr ""
4828
4829
#: serverguide/C/virtualization.xml:947(para)
4830
msgid ""
4831
"If we are in a larger environment, it may make sense to setup a local mirror "
4832
"of the Ubuntu repositories. The package apt-mirror provides you with a "
4833
"script that will handle the mirroring for you. You should plan on having "
4834
"about 20 gigabyte of free space per supported release and architecture."
4835
msgstr ""
4836
4837
#: serverguide/C/virtualization.xml:953(para)
4838
msgid ""
4839
"By default, <application>apt-mirror</application> uses the configuration "
4840
"file in <filename>/etc/apt/mirror.list</filename>. As it is set up, it will "
4841
"replicate only the architecture of the local machine. If you would like to "
4842
"support other architectures on your mirror, simply duplicate the lines "
4843
"starting with “deb”, replacing the deb keyword by /deb-{arch} where arch can "
4844
"be i386, amd64, etc... For example, on an amd64 machine, to have the i386 "
4845
"archives as well, you will have:"
4846
msgstr ""
4847
4848
#: serverguide/C/virtualization.xml:960(programlisting)
4849
#, no-wrap
4850
msgid ""
4851
"\n"
4852
"deb http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4853
"multiverse \n"
4854
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4855
"multiverse\n"
4856
"\n"
4857
"deb http://archive.ubuntu.com/ubuntu lucid-updates main restricted universe "
4858
"multiverse \n"
4859
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-updates main restricted "
4860
"universe multiverse \n"
4861
"\n"
4862
"deb http://archive.ubuntu.com/ubuntu/ lucid-backports main restricted "
4863
"universe multiverse \n"
4864
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-backports main restricted "
4865
"universe multiverse \n"
4866
"\n"
4867
"deb http://security.ubuntu.com/ubuntu lucid-security main restricted "
4868
"universe multiverse \n"
4869
"/deb-i386 http://security.ubuntu.com/ubuntu lucid-security main restricted "
4870
"universe multiverse \n"
4871
"\n"
4872
"deb http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4873
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4874
"installer \n"
4875
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4876
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4877
"installer \n"
4878
msgstr ""
4879
4880
#: serverguide/C/virtualization.xml:977(para)
4881
msgid ""
4882
"Notice that the source packages are not mirrored as they are seldom used "
4883
"compared to the binaries and they do take a lot more space, but they can be "
4884
"easily added to the list."
4885
msgstr ""
4886
4887
#: serverguide/C/virtualization.xml:982(para)
4888
msgid ""
4889
"Once the mirror has finished replicating (and this can be quite long), you "
4890
"need to configure Apache so that your mirror files (in "
4891
"<filename>/var/spool/apt-mirror</filename> if you did not change the "
4892
"default), are published by your Apache server. For more information on "
4893
"Apache see <xref linkend=\"httpd\"/>."
4894
msgstr ""
4895
4896
#: serverguide/C/virtualization.xml:991(title)
4897
msgid "Installing in a RAM Disk"
4898
msgstr ""
4899
4900
#: serverguide/C/virtualization.xml:993(para)
4901
msgid ""
4902
"As you can easily imagine, writing to RAM is a <emphasis>LOT</emphasis> "
4903
"faster than writing to disk. If you have some free memory, letting vmbuilder "
4904
"perform its operation in a RAMdisk will help a lot and the option <emphasis>-"
4905
"-tmpfs</emphasis> will help you do just that:"
4906
msgstr ""
4907
4908
#: serverguide/C/virtualization.xml:999(programlisting)
4909
#, no-wrap
4910
msgid ""
4911
"\n"
4912
"--tmpfs OPTS Use a tmpfs as the working directory, specifying its\n"
4913
" size or \"-\" to use tmpfs default (suid,dev,size=1G).\n"
4914
msgstr ""
4915
4916
#: serverguide/C/virtualization.xml:1004(para)
4917
msgid ""
4918
"So adding <command>--tmpfs -</command> sounds like a very good idea if you "
4919
"have 1G of free ram."
4920
msgstr ""
4921
4922
#: serverguide/C/virtualization.xml:1011(title)
4923
msgid "Package the Application"
4924
msgstr ""
4925
4926
#: serverguide/C/virtualization.xml:1013(para)
4927
msgid "Two option are available to us:"
4928
msgstr ""
4929
4930
#: serverguide/C/virtualization.xml:1019(para)
4931
msgid ""
4932
"The recommended method to do so is to make a <emphasis>Debian</emphasis> "
4933
"package. Since this is outside of the scope of this tutorial, we will not "
4934
"perform this here and invite the reader to read the documentation on how to "
4935
"do this in the <ulink url=\"https://wiki.ubuntu.com/PackagingGuide\">Ubuntu "
4936
"Packaging Guide</ulink>. In this case it is also a good idea to setup a "
4937
"repository for your package so that updates can be conveniently pulled from "
4938
"it. See the <ulink url=\"http://www.debian-"
4939
"administration.org/articles/286\">Debian Administration</ulink> article for "
4940
"a tutorial on this."
4941
msgstr ""
4942
4943
#: serverguide/C/virtualization.xml:1028(para)
4944
msgid ""
4945
"Manually install the application under <filename>/opt</filename> as "
4946
"recommended by the <ulink url=\"http://www.pathname.com/fhs/\">FHS "
4947
"guidelines</ulink>."
4948
msgstr ""
4949
4950
#: serverguide/C/virtualization.xml:1035(para)
4951
msgid ""
4952
"In our case we'll use <application>Limesurvey</application> as example web "
4953
"application for which we wish to provide a virtual appliance. As noted "
4954
"before, we've made a version of the package available in a PPA (Personal "
4955
"Package Archive)."
4956
msgstr ""
4957
4958
#: serverguide/C/virtualization.xml:1042(title)
4959
msgid "Finishing Install"
4960
msgstr ""
4961
4962
#: serverguide/C/virtualization.xml:1045(title)
4963
msgid "First Boot"
4964
msgstr ""
4965
4966
#: serverguide/C/virtualization.xml:1047(para)
4967
msgid ""
4968
"As we mentioned earlier, the first time the machine boots we'll need to "
4969
"install <application>openssh-server</application> so that the key generated "
4970
"for it is unique for each machine. To do this, we'll write a script called "
4971
"<filename>boot.sh</filename> as follows:"
4972
msgstr ""
4973
4974
#: serverguide/C/virtualization.xml:1053(programlisting)
4975
#, no-wrap
4976
msgid ""
4977
"\n"
4978
"# This script will run the first time the virtual machine boots\n"
4979
"# It is ran as root.\n"
4980
"\n"
4981
"apt-get update\n"
4982
"apt-get install -qqy --force-yes openssh-server\n"
4983
msgstr ""
4984
4985
#: serverguide/C/virtualization.xml:1061(para)
4986
msgid ""
4987
"And we add the <command>--firstboot boot.sh</command> option to our command "
4988
"line."
4989
msgstr ""
4990
4991
#: serverguide/C/virtualization.xml:1067(title)
4992
msgid "First Login"
4993
msgstr ""
4994
4995
#: serverguide/C/virtualization.xml:1069(para)
4996
msgid ""
4997
"Mysql and Limesurvey needing some user interaction during their setup, we'll "
4998
"set them up the first time a user logs in using a script named login.sh. "
4999
"We'll also use this script to let the user specify:"
5000
msgstr ""
5001
5002
#: serverguide/C/virtualization.xml:1075(para)
5003
msgid "His own password"
5004
msgstr ""
5005
5006
#: serverguide/C/virtualization.xml:1076(para)
5007
msgid "Define the keyboard and other locale info he wants to use"
5008
msgstr ""
5009
5010
#: serverguide/C/virtualization.xml:1079(para)
5011
msgid "So we'll define <filename>login.sh</filename> as follows:"
5012
msgstr ""
5013
5014
#: serverguide/C/virtualization.xml:1083(programlisting)
5015
#, no-wrap
5016
msgid ""
5017
"\n"
5018
"# This script is ran the first time a user logs in\n"
5019
"\n"
5020
"echo \"Your appliance is about to be finished to be set up.\"\n"
5021
"echo \"In order to do it, we'll need to ask you a few questions,\"\n"
5022
"echo \"starting by changing your user password.\"\n"
5023
"\n"
5024
"passwd\n"
5025
"\n"
5026
"#give the opportunity to change the keyboard\n"
5027
"sudo dpkg-reconfigure console-setup\n"
5028
"\n"
5029
"#configure the mysql server root password\n"
5030
"sudo dpkg-reconfigure mysql-server-5.0\n"
5031
"\n"
5032
"#install limesurvey\n"
5033
"sudo apt-get install -qqy --force-yes limesurvey\n"
5034
"\n"
5035
"echo \"Your appliance is now configured. To use it point your\"\n"
5036
"echo \"browser to http://serverip/limesurvey/admin\"\n"
5037
msgstr ""
5038
5039
#: serverguide/C/virtualization.xml:1105(para)
5040
msgid ""
5041
"And we add the <command>--firstlogin login.sh</command> option to our "
5042
"command line."
5043
msgstr ""
5044
5045
#: serverguide/C/virtualization.xml:1112(title)
5046
msgid "Useful Additions"
5047
msgstr ""
5048
5049
#: serverguide/C/virtualization.xml:1115(title)
5050
msgid "Configuring Automatic Updates"
5051
msgstr ""
5052
5053
#: serverguide/C/virtualization.xml:1117(para)
5054
msgid ""
5055
"To have your system be configured to update itself on a regular basis, we "
5056
"will just install <application>unattended-upgrades</application>, so we add "
5057
"the following option to our command line:"
5058
msgstr ""
5059
5060
#: serverguide/C/virtualization.xml:1123(command)
5061
msgid "--addpkg unattended-upgrades"
5062
msgstr ""
5063
5064
#: serverguide/C/virtualization.xml:1126(para)
5065
msgid ""
5066
"As we have put our application package in a PPA, the process will update not "
5067
"only the system, but also the application each time we update the version in "
5068
"the PPA."
5069
msgstr ""
5070
5071
#: serverguide/C/virtualization.xml:1133(title)
5072
msgid "ACPI Event Handling"
5073
msgstr ""
5074
5075
#: serverguide/C/virtualization.xml:1135(para)
5076
msgid ""
5077
"For your virtual machine to be able to handle restart and shutdown events it "
5078
"is being sent, it is a good idea to install the acpid package as well. To do "
5079
"this we just add the following option:"
5080
msgstr ""
5081
5082
#: serverguide/C/virtualization.xml:1141(command)
5083
msgid "--addpkg acpid"
5084
msgstr ""
5085
5086
#: serverguide/C/virtualization.xml:1147(title)
5087
msgid "Final Command"
5088
msgstr ""
5089
5090
#: serverguide/C/virtualization.xml:1149(para)
5091
msgid "Here is the command with all the options discussed above:"
5092
msgstr ""
5093
5094
#: serverguide/C/virtualization.xml:1154(command)
5095
msgid ""
5096
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o \\ -"
5097
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition --user "
5098
"user \\ --name user --pass default --addpkg apache2 --addpkg apache2-mpm-"
5099
"prefork \\ --addpkg apache2-utils --addpkg apache2.2-common --addpkg "
5100
"dbconfig-common \\ --addpkg libapache2-mod-php5 --addpkg mysql-client --"
5101
"addpkg php5-cli \\ --addpkg php5-gd --addpkg php5-ldap --addpkg php5-mysql --"
5102
"addpkg wwwconfig-common \\ --addpkg mysql-server --addpkg unattended-"
5103
"upgrades --addpkg acpid --ppa nijaba \\ --mirror "
5104
"http://mirroraddress:9999/ubuntu --tmpfs - --firstboot boot.sh \\ --"
5105
"firstlogin login.sh es"
5106
msgstr ""
5107
5108
#: serverguide/C/virtualization.xml:1169(para)
5109
msgid ""
5110
"If you are interested in learning more, have questions or suggestions, "
5111
"please contact the Ubuntu Server Team at:"
5112
msgstr ""
5113
5114
#: serverguide/C/virtualization.xml:1174(para)
5115
msgid "IRC: #ubuntu-server on freenode"
5116
msgstr ""
5117
5118
#: serverguide/C/virtualization.xml:1179(para)
5119
msgid ""
5120
"Mailing list: <ulink url=\"https://lists.ubuntu.com/mailman/listinfo/ubuntu-"
5121
"server\">ubuntu-server at lists.ubuntu.com</ulink>"
5122
msgstr ""
5123
5124
#: serverguide/C/virtualization.xml:1184(para)
5125
msgid ""
5126
"Also, see the <ulink "
5127
"url=\"https://help.ubuntu.com/community/JeOSVMBuilder\">JeOSVMBuilder Ubuntu "
5128
"Wiki</ulink> page."
5129
msgstr ""
5130
5131
#: serverguide/C/virtualization.xml:1192(title)
5132
msgid "UEC"
5133
msgstr ""
5134
5135
#: serverguide/C/virtualization.xml:1195(title) serverguide/C/network-auth.xml:2026(title) serverguide/C/monitoring.xml:15(title) serverguide/C/lamp-applications.xml:17(title) serverguide/C/installation.xml:928(title) serverguide/C/dns.xml:64(title) serverguide/C/chat.xml:17(title) serverguide/C/backups.xml:541(title)
5136
msgid "Overview"
5137
msgstr ""
5138
5139
#: serverguide/C/virtualization.xml:1197(para)
5140
msgid ""
5141
"This tutorial covers <application>UEC</application> installation from the "
5142
"Ubuntu 10.04 LTS Server Edition CD, and assumes a basic network topology, "
5143
"with a single system serving as the <emphasis>\"all-in-one "
5144
"controller\"</emphasis>, and one or more nodes attached."
5145
msgstr ""
5146
5147
#: serverguide/C/virtualization.xml:1202(para)
5148
msgid ""
5149
"From this Tutorial you will learn how to install, configure, register and "
5150
"perform several operations on a basic <application>UEC</application> setup "
5151
"that results in a cloud with a one controller <emphasis>\"front-"
5152
"end\"</emphasis> and one or several node(s) for running Virtual Machine (VM) "
5153
"instances. You will also use examples to help get you started using your own "
5154
"private compute cloud."
5155
msgstr ""
5156
5157
#: serverguide/C/virtualization.xml:1210(title)
5158
msgid "Prerequisites"
5159
msgstr ""
5160
5161
#: serverguide/C/virtualization.xml:1212(para)
5162
msgid ""
5163
"To deploy a minimal cloud infrastructure, you’ll need at least "
5164
"<emphasis>two</emphasis> dedicated systems:"
5165
msgstr ""
5166
5167
#: serverguide/C/virtualization.xml:1218(para)
5168
msgid "A front end."
5169
msgstr ""
5170
5171
#: serverguide/C/virtualization.xml:1223(para)
5172
msgid "One or more node(s)."
5173
msgstr ""
5174
5175
#: serverguide/C/virtualization.xml:1229(para)
5176
msgid ""
5177
"The following are recommendations, rather than fixed requirements. However, "
5178
"our experience in developing this documentation indicated the following "
5179
"suggestions."
5180
msgstr ""
5181
5182
#: serverguide/C/virtualization.xml:1234(title)
5183
msgid "Front End Requirements"
5184
msgstr ""
5185
5186
#: serverguide/C/virtualization.xml:1236(para)
5187
msgid "Use the following table for a system that will run one or more of:"
5188
msgstr ""
5189
5190
#: serverguide/C/virtualization.xml:1241(para)
5191
msgid "Cloud Controller (CLC)"
5192
msgstr ""
5193
5194
#: serverguide/C/virtualization.xml:1242(para)
5195
msgid "Cluster Controller (CC)"
5196
msgstr ""
5197
5198
#: serverguide/C/virtualization.xml:1243(para)
5199
msgid "Walrus (the S3-like storage service)"
5200
msgstr ""
5201
5202
#: serverguide/C/virtualization.xml:1244(para)
5203
msgid "Storage Controller (SC)"
5204
msgstr ""
5205
5206
#: serverguide/C/virtualization.xml:1248(title)
5207
msgid "UEC Front End Requirements"
5208
msgstr ""
5209
5210
#: serverguide/C/virtualization.xml:1256(para) serverguide/C/virtualization.xml:1318(para)
5211
msgid "Hardware"
5212
msgstr ""
5213
5214
#: serverguide/C/virtualization.xml:1257(para) serverguide/C/virtualization.xml:1319(para)
5215
msgid "Minimum"
5216
msgstr ""
5217
5218
#: serverguide/C/virtualization.xml:1258(para) serverguide/C/virtualization.xml:1320(para)
5219
msgid "Suggested"
5220
msgstr ""
5221
5222
#: serverguide/C/virtualization.xml:1259(para) serverguide/C/virtualization.xml:1321(para)
5223
msgid "Notes"
5224
msgstr ""
5225
5226
#: serverguide/C/virtualization.xml:1264(para) serverguide/C/virtualization.xml:1326(para)
5227
msgid "CPU"
5228
msgstr ""
5229
5230
#: serverguide/C/virtualization.xml:1265(para)
5231
msgid "1 GHz"
5232
msgstr ""
5233
5234
#: serverguide/C/virtualization.xml:1266(para)
5235
msgid "2 x 2 GHz"
5236
msgstr ""
5237
5238
#: serverguide/C/virtualization.xml:1267(para)
5239
msgid ""
5240
"For an <emphasis>all-in-one</emphasis> front end, it helps to have at least "
5241
"a dual core processor."
5242
msgstr ""
5243
5244
#: serverguide/C/virtualization.xml:1270(para) serverguide/C/virtualization.xml:1332(para)
5245
msgid "Memory"
5246
msgstr ""
5247
5248
#: serverguide/C/virtualization.xml:1271(para)
5249
msgid "512 MB"
5250
msgstr ""
5251
5252
#: serverguide/C/virtualization.xml:1272(para)
5253
msgid "2 GB"
5254
msgstr ""
5255
5256
#: serverguide/C/virtualization.xml:1273(para)
5257
msgid "The Java web front end benefits from lots of available memory."
5258
msgstr ""
5259
5260
#: serverguide/C/virtualization.xml:1276(para) serverguide/C/virtualization.xml:1338(para)
5261
msgid "Disk"
5262
msgstr ""
5263
5264
#: serverguide/C/virtualization.xml:1277(para) serverguide/C/virtualization.xml:1339(para)
5265
msgid "5400 RPM IDE"
5266
msgstr ""
5267
5268
#: serverguide/C/virtualization.xml:1278(para)
5269
msgid "7200 RPM SATA"
5270
msgstr ""
5271
5272
#: serverguide/C/virtualization.xml:1279(para)
5273
msgid ""
5274
"Slower disks will work, but will yield much longer instance startup times."
5275
msgstr ""
5276
5277
#: serverguide/C/virtualization.xml:1282(para) serverguide/C/virtualization.xml:1344(para)
5278
msgid "Disk Space"
5279
msgstr ""
5280
5281
#: serverguide/C/virtualization.xml:1283(para) serverguide/C/virtualization.xml:1345(para)
5282
msgid "40 GB"
5283
msgstr ""
5284
5285
#: serverguide/C/virtualization.xml:1284(para)
5286
msgid "200 GB"
5287
msgstr ""
5288
5289
#: serverguide/C/virtualization.xml:1285(para)
5290
msgid ""
5291
"40GB is only enough space for only a single image, cache, etc., Eucalyptus "
5292
"does not like to run out of disk space."
5293
msgstr ""
5294
5295
#: serverguide/C/virtualization.xml:1288(para) serverguide/C/virtualization.xml:1350(para) serverguide/C/network-config.xml:13(title)
5296
msgid "Networking"
5297
msgstr ""
5298
5299
#: serverguide/C/virtualization.xml:1289(para) serverguide/C/virtualization.xml:1351(para)
5300
msgid "100 Mbps"
5301
msgstr ""
5302
5303
#: serverguide/C/virtualization.xml:1290(para) serverguide/C/virtualization.xml:1352(para)
5304
msgid "1000 Mbps"
5305
msgstr ""
5306
5307
#: serverguide/C/virtualization.xml:1291(para) serverguide/C/virtualization.xml:1353(para)
5308
msgid ""
5309
"Machine images are hundreds of MB, and need to be copied over the network to "
5310
"nodes."
5311
msgstr ""
5312
5313
#: serverguide/C/virtualization.xml:1299(title)
5314
msgid "Node Requirements"
5315
msgstr ""
5316
5317
#: serverguide/C/virtualization.xml:1301(para)
5318
msgid "The other system(s) are <emphasis>nodes</emphasis>, which will run::"
5319
msgstr ""
5320
5321
#: serverguide/C/virtualization.xml:1306(para)
5322
msgid "the Node Controller (NC)"
5323
msgstr ""
5324
5325
#: serverguide/C/virtualization.xml:1310(title)
5326
msgid "UEC Node Requirements"
5327
msgstr ""
5328
5329
#: serverguide/C/virtualization.xml:1327(para)
5330
msgid "VT Extensions"
5331
msgstr ""
5332
5333
#: serverguide/C/virtualization.xml:1328(para)
5334
msgid "VT, 64-bit, Multicore"
5335
msgstr ""
5336
5337
#: serverguide/C/virtualization.xml:1329(para)
5338
msgid ""
5339
"64-bit can run both i386, and amd64 instances; by default, Eucalyptus will "
5340
"only run 1 VM per CPU core on a Node."
5341
msgstr ""
5342
5343
#: serverguide/C/virtualization.xml:1333(para)
5344
msgid "1 GB"
5345
msgstr ""
5346
5347
#: serverguide/C/virtualization.xml:1334(para)
5348
msgid "4 GB"
5349
msgstr ""
5350
5351
#: serverguide/C/virtualization.xml:1335(para)
5352
msgid "Additional memory means more, and larger guests."
5353
msgstr ""
5354
5355
#: serverguide/C/virtualization.xml:1340(para)
5356
msgid "7200 RPM SATA or SCSI"
5357
msgstr ""
5358
5359
#: serverguide/C/virtualization.xml:1341(para)
5360
msgid ""
5361
"Eucalyptus nodes are disk-intensive; I/O wait will likely be the performance "
5362
"bottleneck."
5363
msgstr ""
5364
5365
#: serverguide/C/virtualization.xml:1346(para)
5366
msgid "100 GB"
5367
msgstr ""
5368
5369
#: serverguide/C/virtualization.xml:1347(para)
5370
msgid ""
5371
"Images will be cached locally, Eucalyptus does not like to run out of disk "
5372
"space."
5373
msgstr ""
5374
5375
#: serverguide/C/virtualization.xml:1363(title)
5376
msgid "Installing the Cloud/Cluster/Storage/Walrus Front End Server"
5377
msgstr ""
5378
5379
#: serverguide/C/virtualization.xml:1367(para)
5380
msgid "Download the Ubuntu 10.04 LTS Server ISO file, and burn it to a CD."
5381
msgstr ""
5382
5383
#: serverguide/C/virtualization.xml:1372(para) serverguide/C/virtualization.xml:1418(para)
5384
msgid ""
5385
"When you boot, select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5386
msgstr ""
5387
5388
#: serverguide/C/virtualization.xml:1377(para)
5389
msgid ""
5390
"When asked whether you want a <emphasis>“Cluster”</emphasis> or a "
5391
"<emphasis>“Node”</emphasis> install, select <emphasis>“Cluster”</emphasis>."
5392
msgstr ""
5393
5394
#: serverguide/C/virtualization.xml:1383(para)
5395
msgid ""
5396
"It will ask two other cloud-specific questions during the course of the "
5397
"install:"
5398
msgstr ""
5399
5400
#: serverguide/C/virtualization.xml:1388(para)
5401
msgid "Name of your cluster."
5402
msgstr ""
5403
5404
#: serverguide/C/virtualization.xml:1391(para)
5405
msgid "e.g. <emphasis>cluster1</emphasis>."
5406
msgstr ""
5407
5408
#: serverguide/C/virtualization.xml:1394(para)
5409
msgid ""
5410
"A range of public IP addresses on the LAN that the cloud can allocate to "
5411
"instances."
5412
msgstr ""
5413
5414
#: serverguide/C/virtualization.xml:1397(para)
5415
msgid "e.g. <emphasis>192.168.1.200-192.168.1.249</emphasis>."
5416
msgstr ""
5417
5418
#: serverguide/C/virtualization.xml:1405(title)
5419
msgid "Installing the Node Controller(s)"
5420
msgstr ""
5421
5422
#: serverguide/C/virtualization.xml:1407(para)
5423
msgid ""
5424
"The node controller install is even simpler. Just make sure that you are "
5425
"connected to the network on which the cloud/cluster controller is already "
5426
"running."
5427
msgstr ""
5428
5429
#: serverguide/C/virtualization.xml:1413(para)
5430
msgid "Boot from the same ISO on the node(s)."
5431
msgstr ""
5432
5433
#: serverguide/C/virtualization.xml:1423(para)
5434
msgid "Select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5435
msgstr ""
5436
5437
#: serverguide/C/virtualization.xml:1428(para)
5438
msgid ""
5439
"It should detect the Cluster and preselect <emphasis>“Node”</emphasis> "
5440
"install for you."
5441
msgstr ""
5442
5443
#: serverguide/C/virtualization.xml:1433(para)
5444
msgid "Confirm the partitioning scheme."
5445
msgstr ""
5446
5447
#: serverguide/C/virtualization.xml:1438(para)
5448
msgid ""
5449
"The rest of the installation should proceed uninterrupted; complete the "
5450
"installation and reboot the node."
5451
msgstr ""
5452
5453
#: serverguide/C/virtualization.xml:1446(title)
5454
msgid "Register the Node(s)"
5455
msgstr ""
5456
5457
#: serverguide/C/virtualization.xml:1448(para)
5458
msgid ""
5459
"Nodes are the physical systems within <application>UEC</application> that "
5460
"actually run the virtual machine instances of the cloud."
5461
msgstr ""
5462
5463
#: serverguide/C/virtualization.xml:1452(para)
5464
msgid ""
5465
"Once one or more Ubuntu Server node(s) are installed and running the "
5466
"<application>eucalyptus-nc</application> service, log onto the "
5467
"<emphasis>Cloud Controller (CLC)</emphasis> and run:"
5468
msgstr ""
5469
5470
#: serverguide/C/virtualization.xml:1458(command)
5471
msgid "sudo euca_conf --no-rsync --discover-nodes"
5472
msgstr ""
5473
5474
#: serverguide/C/virtualization.xml:1461(para)
5475
msgid ""
5476
"This will discover the systems on the network running the "
5477
"<application>eucalyptus-nc</application> service, and the administrator can "
5478
"confirm the registration of each node by its IP address."
5479
msgstr ""
5480
5481
#: serverguide/C/virtualization.xml:1467(para)
5482
msgid ""
5483
"If you get prompted for passwords, or receive errors from scp, you may need "
5484
"to revisit the key synchronization instructions at <ulink "
5485
"url=\"https://help.ubuntu.com/community/UEC/NodeInstallation\">UEC/NodeInstal"
5486
"lation</ulink>."
5487
msgstr ""
5488
5489
#: serverguide/C/virtualization.xml:1475(title)
5490
msgid "Obtain Credentials"
5491
msgstr ""
5492
5493
#: serverguide/C/virtualization.xml:1477(para)
5494
msgid ""
5495
"After installing and booting the <emphasis>Cloud Controller</emphasis>, "
5496
"users of the cloud will need to retrieve their credentials. This can be done "
5497
"either through a web browser, or at the command line."
5498
msgstr ""
5499
5500
#: serverguide/C/virtualization.xml:1483(title)
5501
msgid "From a Web Browser"
5502
msgstr ""
5503
5504
#: serverguide/C/virtualization.xml:1487(para)
5505
msgid ""
5506
"From your web browser (either remotely or on your Ubuntu server) access the "
5507
"following URL:"
5508
msgstr ""
5509
5510
#: serverguide/C/virtualization.xml:1490(programlisting) serverguide/C/virtualization.xml:1743(programlisting)
5511
#, no-wrap
5512
msgid ""
5513
"\n"
5514
"https://<cloud-controller-ip-address>:8443/\n"
5515
msgstr ""
5516
5517
#: serverguide/C/virtualization.xml:1495(para)
5518
msgid ""
5519
"You must use a secure connection, so make sure you use \"https\" not "
5520
"\"http\" in your URL. You will get a security certificate warning. You will "
5521
"have to add an exception to view the page. If you do not accept it you will "
5522
"not be able to view the Eucalyptus configuration page."
5523
msgstr ""
5524
5525
#: serverguide/C/virtualization.xml:1503(para)
5526
msgid ""
5527
"Use username <emphasis>'admin'</emphasis> and password "
5528
"<emphasis>'admin'</emphasis> for the first time login (you will be prompted "
5529
"to change your password)."
5530
msgstr ""
5531
5532
#: serverguide/C/virtualization.xml:1509(para)
5533
msgid ""
5534
"Then follow the on-screen instructions to update the admin password and "
5535
"email address."
5536
msgstr ""
5537
5538
#: serverguide/C/virtualization.xml:1514(para)
5539
msgid ""
5540
"Once the first time configuration process is completed, click the "
5541
"<emphasis>'credentials'</emphasis> tab located in the top-left portion of "
5542
"the screen."
5543
msgstr ""
5544
5545
#: serverguide/C/virtualization.xml:1520(para)
5546
msgid ""
5547
"Click the <emphasis>'Download Credentials'</emphasis> button to get your "
5548
"certificates."
5549
msgstr ""
5550
5551
#: serverguide/C/virtualization.xml:1525(para)
5552
msgid "Save them to <filename>~/.euca</filename>."
5553
msgstr ""
5554
5555
#: serverguide/C/virtualization.xml:1530(para)
5556
msgid ""
5557
"Unzip the downloaded zip file into a safe location "
5558
"(<filename>~/.euca</filename>)."
5559
msgstr ""
5560
5561
#: serverguide/C/virtualization.xml:1534(command)
5562
msgid "unzip -d ~/.euca mycreds.zip"
5563
msgstr ""
5564
5565
#: serverguide/C/virtualization.xml:1541(title)
5566
msgid "From a Command Line"
5567
msgstr ""
5568
5569
#: serverguide/C/virtualization.xml:1545(para)
5570
msgid ""
5571
"Alternatively, if you are on the command line of the <emphasis>Cloud "
5572
"Controller</emphasis>, you can run:"
5573
msgstr ""
5574
5575
#: serverguide/C/virtualization.xml:1549(command)
5576
msgid "mkdir -p ~/.euca"
5577
msgstr ""
5578
5579
#: serverguide/C/virtualization.xml:1550(command)
5580
msgid "chmod 700 ~/.euca"
5581
msgstr ""
5582
5583
#: serverguide/C/virtualization.xml:1551(command)
5584
msgid "cd ~/.euca"
5585
msgstr ""
5586
5587
#: serverguide/C/virtualization.xml:1552(command)
5588
msgid "sudo euca_conf --get-credentials mycreds.zip"
5589
msgstr ""
5590
5591
#: serverguide/C/virtualization.xml:1553(command)
5592
msgid "unzip mycreds.zip"
5593
msgstr ""
5594
5595
#: serverguide/C/virtualization.xml:1554(command)
5596
msgid "cd -"
5597
msgstr ""
5598
5599
#: serverguide/C/virtualization.xml:1561(title)
5600
msgid "Extracting and Using Your Credentials"
5601
msgstr ""
5602
5603
#: serverguide/C/virtualization.xml:1563(para)
5604
msgid ""
5605
"Now you will need to setup EC2 API and AMI tools on your server using X.509 "
5606
"certificates."
5607
msgstr ""
5608
5609
#: serverguide/C/virtualization.xml:1569(para)
5610
msgid ""
5611
"Source the included <emphasis>\"eucarc\"</emphasis> file to set up your "
5612
"Eucalyptus environment:"
5613
msgstr ""
5614
5615
#: serverguide/C/virtualization.xml:1573(command) serverguide/C/virtualization.xml:1600(command)
5616
msgid ". ~/.euca/eucarc"
5617
msgstr ""
5618
5619
#: serverguide/C/virtualization.xml:1577(para)
5620
msgid ""
5621
"You may additionally wish to add this command to your "
5622
"<filename>~/.bashrc</filename> file so that your Eucalyptus environment is "
5623
"set up automatically when you log in. Eucalyptus treats this set of "
5624
"credentials as <emphasis>'administrator'</emphasis> credentials that allow "
5625
"the holder global privileges across the cloud. As such, they should be "
5626
"protected in the same way that other elevated-priority access is protected "
5627
"(e.g. should not be made visible to the general user population)."
5628
msgstr ""
5629
5630
#: serverguide/C/virtualization.xml:1584(command)
5631
msgid ""
5632
"echo \"[ -r ~/.euca/eucarc ] && . ~/.euca/eucarc\" >> ~/.bashrc"
5633
msgstr ""
5634
5635
#: serverguide/C/virtualization.xml:1588(para)
5636
msgid "Install the required cloud user tools:"
5637
msgstr ""
5638
5639
#: serverguide/C/virtualization.xml:1592(command)
5640
msgid "sudo apt-get install euca2ools"
5641
msgstr ""
5642
5643
#: serverguide/C/virtualization.xml:1596(para)
5644
msgid ""
5645
"To validate that everything is working correctly, get the local cluster "
5646
"availability details:"
5647
msgstr ""
5648
5649
#: serverguide/C/virtualization.xml:1601(command)
5650
msgid "euca-describe-availability-zones verbose"
5651
msgstr ""
5652
5653
#: serverguide/C/virtualization.xml:1602(computeroutput)
5654
#, no-wrap
5655
msgid ""
5656
"AVAILABILITYZONE myowncloud 192.168.1.1\n"
5657
"AVAILABILITYZONE |- vm types free / max cpu ram disk\n"
5658
"AVAILABILITYZONE |- m1.small 0004 / 0004 1 128 2\n"
5659
"AVAILABILITYZONE |- c1.medium 0004 / 0004 1 256 5\n"
5660
"AVAILABILITYZONE |- m1.large 0002 / 0002 2 512 10\n"
5661
"AVAILABILITYZONE |- m1.xlarge 0002 / 0002 2 1024 20\n"
5662
"AVAILABILITYZONE |- c1.xlarge 0001 / 0001 4 2048 20"
5663
msgstr ""
5664
5665
#: serverguide/C/virtualization.xml:1612(para)
5666
msgid "Your output from the above command will vary."
5667
msgstr ""
5668
5669
#: serverguide/C/virtualization.xml:1622(title)
5670
msgid "Running an Image"
5671
msgstr ""
5672
5673
#: serverguide/C/virtualization.xml:1624(para)
5674
msgid "There are multiple ways to instantiate an image in UEC:"
5675
msgstr ""
5676
5677
#: serverguide/C/virtualization.xml:1629(para)
5678
msgid "Use the command line."
5679
msgstr ""
5680
5681
#: serverguide/C/virtualization.xml:1630(para)
5682
msgid ""
5683
"Use one of the UEC compatible management tools such as "
5684
"<emphasis>Landscape</emphasis>."
5685
msgstr ""
5686
5687
#: serverguide/C/virtualization.xml:1632(para)
5688
msgid ""
5689
"Use the <ulink "
5690
"url=\"https://help.ubuntu.com/community/UEC/ElasticFox\">ElasticFox</ulink> "
5691
"extension to Firefox."
5692
msgstr ""
5693
5694
#: serverguide/C/virtualization.xml:1638(para)
5695
msgid "Here we will describe the process from the command line:"
5696
msgstr ""
5697
5698
#: serverguide/C/virtualization.xml:1644(para)
5699
msgid ""
5700
"Before running an instance of your image, you should first create a "
5701
"<emphasis>keypair</emphasis> (ssh key) that you can use to log into your "
5702
"instance as root, once it boots. The key is stored, so you will only have to "
5703
"do this once."
5704
msgstr ""
5705
5706
#: serverguide/C/virtualization.xml:1648(para)
5707
msgid "Run the following command:"
5708
msgstr ""
5709
5710
#: serverguide/C/virtualization.xml:1651(programlisting)
5711
#, no-wrap
5712
msgid ""
5713
"\n"
5714
"if [ ! -e ~/.euca/mykey.priv ]; then\n"
5715
" touch ~/.euca/mykey.priv\n"
5716
" chmod 0600 ~/.euca/mykey.priv\n"
5717
" euca-add-keypair mykey > ~/.euca/mykey.priv\n"
5718
"fi\n"
5719
msgstr ""
5720
5721
#: serverguide/C/virtualization.xml:1659(para)
5722
msgid ""
5723
"You can call your key whatever you like (in this example, the key is called "
5724
"<emphasis>'mykey'</emphasis>), but remember what it is called. If you "
5725
"forget, you can always run <command>euca-describe-keypairs</command> to get "
5726
"a list of created keys stored in the system."
5727
msgstr ""
5728
5729
#: serverguide/C/virtualization.xml:1666(para)
5730
msgid "You must also allow access to port 22 in your instances:"
5731
msgstr ""
5732
5733
#: serverguide/C/virtualization.xml:1670(command)
5734
msgid "euca-describe-groups"
5735
msgstr ""
5736
5737
#: serverguide/C/virtualization.xml:1671(command)
5738
msgid "euca-authorize default -P tcp -p 22 -s 0.0.0.0/0"
5739
msgstr ""
5740
5741
#: serverguide/C/virtualization.xml:1675(para)
5742
msgid "Next, you can create instances of your registered image:"
5743
msgstr ""
5744
5745
#: serverguide/C/virtualization.xml:1679(command)
5746
msgid "euca-run-instances $EMI -k mykey -t c1.medium"
5747
msgstr ""
5748
5749
#: serverguide/C/virtualization.xml:1682(para)
5750
msgid ""
5751
"If you receive an error regarding <emphasis>image_id</emphasis>, you may "
5752
"find it by viewing Images page or click <emphasis>\"How to Run\"</emphasis> "
5753
"on the <emphasis>Store</emphasis> page to see the sample command."
5754
msgstr ""
5755
5756
#: serverguide/C/virtualization.xml:1689(para)
5757
msgid ""
5758
"The first time you run an instance, the system will be setting up caches for "
5759
"the image from which it will be created. This can often take some time the "
5760
"first time an instance is run given that VM images are usually quite large."
5761
msgstr ""
5762
5763
#: serverguide/C/virtualization.xml:1693(para)
5764
msgid "To monitor the state of your instance, run:"
5765
msgstr ""
5766
5767
#: serverguide/C/virtualization.xml:1697(command)
5768
msgid "watch -n5 euca-describe-instances"
5769
msgstr ""
5770
5771
#: serverguide/C/virtualization.xml:1699(para)
5772
msgid ""
5773
"In the output, you should see information about the instance, including its "
5774
"state. While first-time caching is being performed, the instance's state "
5775
"will be <emphasis>'pending'</emphasis>."
5776
msgstr ""
5777
5778
#: serverguide/C/virtualization.xml:1705(para)
5779
msgid ""
5780
"When the instance is fully started, the above state will become "
5781
"<emphasis>'running'</emphasis>. Look at the IP address assigned to your "
5782
"instance in the output, then connect to it:"
5783
msgstr ""
5784
5785
#: serverguide/C/virtualization.xml:1710(command)
5786
msgid ""
5787
"IPADDR=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | awk "
5788
"'{print $4}')"
5789
msgstr ""
5790
5791
#: serverguide/C/virtualization.xml:1711(command)
5792
msgid "ssh -i ~/.euca/mykey.priv ubuntu@$IPADDR"
5793
msgstr ""
5794
5795
#: serverguide/C/virtualization.xml:1715(para)
5796
msgid ""
5797
"And when you are done with this instance, exit your SSH connection, then "
5798
"terminate your instance:"
5799
msgstr ""
5800
5801
#: serverguide/C/virtualization.xml:1719(command)
5802
msgid ""
5803
"INSTANCEID=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | "
5804
"awk '{print $2}')"
5805
msgstr ""
5806
5807
#: serverguide/C/virtualization.xml:1720(command)
5808
msgid "euca-terminate-instances $INSTANCEID"
5809
msgstr ""
5810
5811
#: serverguide/C/virtualization.xml:1727(title)
5812
msgid "Install an Image from the Store"
5813
msgstr ""
5814
5815
#: serverguide/C/virtualization.xml:1729(para)
5816
msgid ""
5817
"The following is by far the simplest way to install an image. However, "
5818
"advanced users may be interested in learning how to <ulink "
5819
"url=\"https://help.ubuntu.com/community/UEC/BundlingImages\">Bundle their "
5820
"own image</ulink>."
5821
msgstr ""
5822
5823
#: serverguide/C/virtualization.xml:1734(para)
5824
msgid ""
5825
"The simplest way to add an image to <application>UEC</application> is to "
5826
"install it from the Image Store on the UEC web interface."
5827
msgstr ""
5828
5829
#: serverguide/C/virtualization.xml:1740(para)
5830
msgid ""
5831
"Access the web interface at the following URL (Make sure you specify https):"
5832
msgstr ""
5833
5834
#: serverguide/C/virtualization.xml:1748(para)
5835
msgid ""
5836
"Enter your login and password (if requested, as you may still be logged in "
5837
"from earlier)."
5838
msgstr ""
5839
5840
#: serverguide/C/virtualization.xml:1753(para)
5841
msgid "Click on the <emphasis>Store</emphasis> tab."
5842
msgstr ""
5843
5844
#: serverguide/C/virtualization.xml:1758(para)
5845
msgid "Browse available images."
5846
msgstr ""
5847
5848
#: serverguide/C/virtualization.xml:1763(para)
5849
msgid "Click on <emphasis>install</emphasis> for the image you want."
5850
msgstr ""
5851
5852
#: serverguide/C/virtualization.xml:1769(para)
5853
msgid ""
5854
"Once the image has been downloaded and installed, you can click on "
5855
"<emphasis>\"How to run?\"</emphasis> that will be displayed below the image "
5856
"button to view the command to execute to instantiate (start) this image. The "
5857
"image will also appear on the list given on the <emphasis>Image</emphasis> "
5858
"tab."
5859
msgstr ""
5860
5861
#: serverguide/C/virtualization.xml:1777(title) serverguide/C/dns.xml:619(title)
5862
msgid "More Information"
5863
msgstr ""
5864
5865
#: serverguide/C/virtualization.xml:1779(para)
5866
msgid ""
5867
"How to use the <ulink "
5868
"url=\"https://help.ubuntu.com/community/UEC/StorageController\">Storage "
5869
"Controller</ulink>"
5870
msgstr ""
5871
5872
#: serverguide/C/virtualization.xml:1783(para)
5873
msgid "Controlling eucalyptus services:"
5874
msgstr ""
5875
5876
#: serverguide/C/virtualization.xml:1788(para)
5877
msgid ""
5878
"sudo service eucalyptus [start|stop|restart] (on the CLC/CC/SC/Walrus side)"
5879
msgstr ""
5880
5881
#: serverguide/C/virtualization.xml:1789(para)
5882
msgid "sudo service eucalyptus-nc [start|stop|restart] (on the Node side)"
5883
msgstr ""
5884
5885
#: serverguide/C/virtualization.xml:1792(para)
5886
msgid "Locations of some important files:"
5887
msgstr ""
5888
5889
#: serverguide/C/virtualization.xml:1799(emphasis)
5890
msgid "Log files:"
5891
msgstr ""
5892
5893
#: serverguide/C/virtualization.xml:1802(para)
5894
msgid "/var/log/eucalyptus"
5895
msgstr ""
5896
5897
#: serverguide/C/virtualization.xml:1807(emphasis)
5898
msgid "Configuration files:"
5899
msgstr ""
5900
5901
#: serverguide/C/virtualization.xml:1810(para)
5902
msgid "/etc/eucalyptus"
5903
msgstr ""
5904
5905
#: serverguide/C/virtualization.xml:1815(emphasis)
5906
msgid "Database:"
5907
msgstr ""
5908
5909
#: serverguide/C/virtualization.xml:1818(para)
5910
msgid "/var/lib/eucalyptus/db"
5911
msgstr ""
5912
5913
#: serverguide/C/virtualization.xml:1823(emphasis)
5914
msgid "Keys:"
5915
msgstr ""
5916
5917
#: serverguide/C/virtualization.xml:1826(para)
5918
msgid "/var/lib/eucalyptus"
5919
msgstr ""
5920
5921
#: serverguide/C/virtualization.xml:1827(para)
5922
msgid "/var/lib/eucalyptus/.ssh"
5923
msgstr ""
5924
5925
#: serverguide/C/virtualization.xml:1833(para)
5926
msgid ""
5927
"Don't forget to source your <filename>~/.euca/eucarc</filename> before "
5928
"running the client tools."
5929
msgstr ""
5930
5931
#: serverguide/C/virtualization.xml:1844(para)
5932
msgid ""
5933
"For information on loading instances see the <ulink "
5934
"url=\"https://help.ubuntu.com/community/Eucalyptus\">Eucalyptus Wiki</ulink> "
5935
"page."
5936
msgstr ""
5937
5938
#: serverguide/C/virtualization.xml:1849(para)
5939
msgid ""
5940
"<ulink url=\"http://open.eucalyptus.com/\">Eucalyptus Project Site (forums, "
5941
"documentation, downloads)</ulink>."
5942
msgstr ""
5943
5944
#: serverguide/C/virtualization.xml:1854(para)
5945
msgid ""
5946
"<ulink url=\"https://launchpad.net/eucalyptus/\">Eucalyptus on Launchpad "
5947
"(bugs, code)</ulink>."
5948
msgstr ""
5949
5950
#: serverguide/C/virtualization.xml:1859(para)
5951
msgid ""
5952
"<ulink "
5953
"url=\"http://open.eucalyptus.com/wiki/EucalyptusTroubleshooting_v1.5\">Eucaly"
5954
"ptus Troubleshooting (1.5)</ulink>."
5955
msgstr ""
5956
5957
#: serverguide/C/virtualization.xml:1864(para)
5958
msgid ""
5959
"<ulink url=\"http://support.rightscale.com/2._References/02-"
5960
"Cloud_Infrastructures/Eucalyptus/03-"
5961
"Administration_Guide/Register_with_RightScale\"> Register your cloud with "
5962
"RightScale</ulink>."
5963
msgstr ""
5964
5965
#: serverguide/C/virtualization.xml:1870(para)
5966
msgid ""
5967
"You can also find help in the <emphasis>#ubuntu-virt</emphasis>, "
5968
"<emphasis>#eucalyptus</emphasis>, and <emphasis>#ubuntu-server</emphasis> "
5969
"IRC channels on <ulink url=\"http://freenode.net\">Freenode</ulink>."
5970
msgstr ""
5971
5972
#: serverguide/C/virtualization.xml:1879(title)
5973
msgid "Glossary"
5974
msgstr ""
5975
5976
#: serverguide/C/virtualization.xml:1881(para)
5977
msgid ""
5978
"The Ubuntu Enterprise Cloud documentation uses terminology that might be "
5979
"unfamiliar to some readers. This page is intended to provide a glossary of "
5980
"such terms and acronyms."
5981
msgstr ""
5982
5983
#: serverguide/C/virtualization.xml:1888(para)
5984
msgid ""
5985
"<emphasis>Cloud</emphasis> - A federated set of physical machines that offer "
5986
"computing resources through virtual machines, provisioned and recollected "
5987
"dynamically."
5988
msgstr ""
5989
5990
#: serverguide/C/virtualization.xml:1894(para)
5991
msgid ""
5992
"<emphasis>Cloud Controller (CLC)</emphasis> - Eucalyptus component that "
5993
"provides the web UI (an https server on port 8443), and implements the "
5994
"Amazon EC2 API. There should be only one Cloud Controller in an installation "
5995
"of UEC. This service is provided by the Ubuntu <application>eucalyptus-"
5996
"cloud</application> package."
5997
msgstr ""
5998
5999
#: serverguide/C/virtualization.xml:1901(para)
6000
msgid ""
6001
"<emphasis>Cluster</emphasis> - A collection of nodes, associated with a "
6002
"Cluster Controller. There can be more than one Cluster in an installation of "
6003
"UEC. Clusters are sometimes physically separate sets of nodes. (e.g. floor1, "
6004
"floor2, floor2)."
6005
msgstr ""
6006
6007
#: serverguide/C/virtualization.xml:1907(para)
6008
msgid ""
6009
"<emphasis>Cluster Controller (CC)</emphasis> - Eucalyptus component that "
6010
"manages collections of node resources. This service is provided by the "
6011
"Ubuntu <application>eucalyptus-cc</application> package."
6012
msgstr ""
6013
6014
#: serverguide/C/virtualization.xml:1913(para)
6015
msgid "<emphasis>EBS</emphasis> - Elastic Block Storage."
6016
msgstr ""
6017
6018
#: serverguide/C/virtualization.xml:1918(para)
6019
msgid ""
6020
"<emphasis>EC2</emphasis> - Elastic Compute Cloud. Amazon's pay-by-the-hour, "
6021
"pay-by-the-gigabyte public cloud computing offering."
6022
msgstr ""
6023
6024
#: serverguide/C/virtualization.xml:1923(para)
6025
msgid "<emphasis>EKI</emphasis> - Eucalyptus Kernel Image."
6026
msgstr ""
6027
6028
#: serverguide/C/virtualization.xml:1928(para)
6029
msgid "<emphasis>EMI</emphasis> - Eucalyptus Machine Image."
6030
msgstr ""
6031
6032
#: serverguide/C/virtualization.xml:1933(para)
6033
msgid "<emphasis>ERI</emphasis> - Eucalyptus Ramdisk Image."
6034
msgstr ""
6035
6036
#: serverguide/C/virtualization.xml:1938(para)
6037
msgid ""
6038
"<emphasis>Eucalyptus</emphasis> - Elastic Utility Computing Architecture for "
6039
"Linking Your Programs To Useful Systems. An open source project originally "
6040
"from the University of California at Santa Barbara, now supported by "
6041
"Eucalyptus Systems, a Canonical Partner."
6042
msgstr ""
6043
6044
#: serverguide/C/virtualization.xml:1945(para)
6045
msgid ""
6046
"<emphasis>Front-end</emphasis> - Physical machine hosting one (or more) of "
6047
"the high level Eucalyptus components (cloud, walrus, storage controller, "
6048
"cluster controller)."
6049
msgstr ""
6050
6051
#: serverguide/C/virtualization.xml:1951(para)
6052
msgid ""
6053
"<emphasis>Node</emphasis> - A node is a physical machine that's capable of "
6054
"running virtual machines, running a node controller. Within Ubuntu, this "
6055
"generally means that the CPU has VT extensions, and can run the KVM "
6056
"hypervisor."
6057
msgstr ""
6058
6059
#: serverguide/C/virtualization.xml:1957(para)
6060
msgid ""
6061
"<emphasis>Node Controller (NC)</emphasis> - Eucalyptus component that runs "
6062
"on nodes which host the virtual machines that comprise the cloud. This "
6063
"service is provided by the Ubuntu package <application>eucalyptus-"
6064
"nc</application>."
6065
msgstr ""
6066
6067
#: serverguide/C/virtualization.xml:1963(para)
6068
msgid ""
6069
"<emphasis>S3</emphasis> - Simple Storage Service. Amazon's pay-by-the-"
6070
"gigabyte persistent storage solution for EC2."
6071
msgstr ""
6072
6073
#: serverguide/C/virtualization.xml:1968(para)
6074
msgid ""
6075
"<emphasis>Storage Controller (SC)</emphasis> - Eucalyptus component that "
6076
"manages dynamic block storage services (EBS). Each 'cluster' in a Eucalyptus "
6077
"installation can have its own Storage Controller. This component is provided "
6078
"by the <application>eucalyptus-sc</application> package."
6079
msgstr ""
6080
6081
#: serverguide/C/virtualization.xml:1975(para)
6082
msgid ""
6083
"<emphasis>UEC</emphasis> - Ubuntu Enterprise Cloud. Ubuntu's cloud computing "
6084
"solution, based on Eucalyptus."
6085
msgstr ""
6086
6087
#: serverguide/C/virtualization.xml:1980(para)
6088
msgid "<emphasis>VM</emphasis> - Virtual Machine."
6089
msgstr ""
6090
6091
#: serverguide/C/virtualization.xml:1985(para)
6092
msgid ""
6093
"<emphasis>VT</emphasis> - Virtualization Technology. An optional feature of "
6094
"some modern CPUs, allowing for accelerated virtual machine hosting."
6095
msgstr ""
6096
6097
#: serverguide/C/virtualization.xml:1990(para)
6098
msgid ""
6099
"<emphasis>Walrus</emphasis> - Eucalyptus component that implements the "
6100
"Amazon S3 API, used for storing VM images and user storage using S3 bucket "
6101
"put/get abstractions."
6102
msgstr ""
6103
6104
#: serverguide/C/virtualization.xml:2000(title)
6105
msgid "OpenNebula"
6106
msgstr ""
6107
6108
#: serverguide/C/virtualization.xml:2002(para)
6109
msgid ""
6110
"<application>OpenNebula</application> allows virtual machines to be placed "
6111
"and re-placed dynamically on a pool of physical resources. This allows a "
6112
"virtual machine to be hosted from any location available."
6113
msgstr ""
6114
6115
#: serverguide/C/virtualization.xml:2007(para)
6116
msgid ""
6117
"This section will detail configuring an OpenNebula cluster using three "
6118
"machines: one <emphasis>Front-End</emphasis> host, and two <emphasis>Compute "
6119
"Nodes</emphasis> used to run the virtual machines. The Compute Nodes will "
6120
"also need a bridge configured to allow the virtual machines access to the "
6121
"local network. For details see <xref linkend=\"bridging\"/>."
6122
msgstr ""
6123
6124
#: serverguide/C/virtualization.xml:2016(para)
6125
msgid "First, from a terminal on the Front-End enter:"
6126
msgstr ""
6127
6128
#: serverguide/C/virtualization.xml:2021(command)
6129
msgid "sudo apt-get install opennebula"
6130
msgstr ""
6131
6132
#: serverguide/C/virtualization.xml:2024(para)
6133
msgid "On each Compute Node install:"
6134
msgstr ""
6135
6136
#: serverguide/C/virtualization.xml:2029(command)
6137
msgid "sudo apt-get install opennebula-node"
6138
msgstr ""
6139
6140
#: serverguide/C/virtualization.xml:2032(para)
6141
msgid ""
6142
"In order to copy SSH keys, the <emphasis>oneadmin</emphasis> user will need "
6143
"to have a password. On each machine execute:"
6144
msgstr ""
6145
6146
#: serverguide/C/virtualization.xml:2037(command)
6147
msgid "sudo passwd oneadmin"
6148
msgstr ""
6149
6150
#: serverguide/C/virtualization.xml:2040(para)
6151
msgid ""
6152
"Next, copy the <emphasis>oneadmin</emphasis> user's SSH key to the Compute "
6153
"Nodes, and to the Front-End's <filename>authorized_keys</filename> file:"
6154
msgstr ""
6155
6156
#: serverguide/C/virtualization.xml:2045(command)
6157
msgid ""
6158
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6159
"oneadmin@node01:/var/lib/one/.ssh/authorized_keys"
6160
msgstr ""
6161
6162
#: serverguide/C/virtualization.xml:2046(command)
6163
msgid ""
6164
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6165
"oneadmin@node02:/var/lib/one/.ssh/authorized_keys"
6166
msgstr ""
6167
6168
#: serverguide/C/virtualization.xml:2047(command)
6169
msgid ""
6170
"sudo sh -c \"cat /var/lib/one/.ssh/id_rsa.pub >> "
6171
"/var/lib/one/.ssh/authorized_keys\""
6172
msgstr ""
6173
6174
#: serverguide/C/virtualization.xml:2050(para)
6175
msgid ""
6176
"The SSH key for the Compute Nodes needs to be added to the "
6177
"<filename>/etc/ssh/ssh_known_hosts</filename> file on the Front-End host. To "
6178
"accomplish this <application>ssh</application> to each Compute Node as a "
6179
"user other than <emphasis>oneadmin</emphasis>. Then exit from the SSH "
6180
"session, and execute the following to copy the SSH key from "
6181
"<filename>~/.ssh/known_hosts</filename> to "
6182
"<filename>/etc/ssh/ssh_known_hosts</filename>:"
6183
msgstr ""
6184
6185
#: serverguide/C/virtualization.xml:2057(command)
6186
msgid ""
6187
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node01 1>> "
6188
"/etc/ssh/ssh_known_hosts\""
6189
msgstr ""
6190
6191
#: serverguide/C/virtualization.xml:2058(command)
6192
msgid ""
6193
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node02 1>> "
6194
"/etc/ssh/ssh_known_hosts\""
6195
msgstr ""
6196
6197
#: serverguide/C/virtualization.xml:2062(para)
6198
msgid ""
6199
"Replace <emphasis>node01</emphasis> and <emphasis>node02</emphasis> with the "
6200
"appropriate host names."
6201
msgstr ""
6202
6203
#: serverguide/C/virtualization.xml:2067(para)
6204
msgid ""
6205
"This allows the <emphasis>oneadmin</emphasis> to use "
6206
"<application>scp</application>, without a password or manual intervention, "
6207
"to deploy an image to the Compute Nodes."
6208
msgstr ""
6209
6210
#: serverguide/C/virtualization.xml:2072(para)
6211
msgid ""
6212
"On the Front-End create a directory to store the VM images, giving the "
6213
"<emphasis>oneadmin</emphasis> user access to the directory:"
6214
msgstr ""
6215
6216
#: serverguide/C/virtualization.xml:2077(command)
6217
msgid "sudo mkdir /var/lib/one/images"
6218
msgstr ""
6219
6220
#: serverguide/C/virtualization.xml:2078(command)
6221
msgid "sudo chown oneadmin /var/lib/one/images/"
6222
msgstr ""
6223
6224
#: serverguide/C/virtualization.xml:2081(para)
6225
msgid ""
6226
"Finally, copy a virtual machine disk file into "
6227
"<filename>/var/lib/one/images</filename>. You can create an Ubuntu virtual "
6228
"machine using <application>vmbuilder</application>, see <xref linkend=\"jeos-"
6229
"and-vmbuilder\"/> for details."
6230
msgstr ""
6231
6232
#: serverguide/C/virtualization.xml:2090(para)
6233
msgid ""
6234
"The <emphasis>OpenNebula Cluster</emphasis> is now ready to be configured, "
6235
"and virtual machines added to the cluster."
6236
msgstr ""
6237
6238
#: serverguide/C/virtualization.xml:2094(para)
6239
msgid "From a terminal prompt enter:"
6240
msgstr ""
6241
6242
#: serverguide/C/virtualization.xml:2099(command)
6243
msgid "onehost create node01 im_kvm vmm_kvm tm_ssh"
6244
msgstr ""
6245
6246
#: serverguide/C/virtualization.xml:2100(command)
6247
msgid "onehost create node02 im_kvm vmm_kvm tm_ssh"
6248
msgstr ""
6249
6250
#: serverguide/C/virtualization.xml:2103(para)
6251
msgid ""
6252
"Next, create a <emphasis>Virtual Network</emphasis> template file named "
6253
"<filename>vnet01.template</filename>:"
6254
msgstr ""
6255
6256
#: serverguide/C/virtualization.xml:2107(programlisting)
6257
#, no-wrap
6258
msgid ""
6259
"\n"
6260
"NAME = \"LAN\"\n"
6261
"TYPE = RANGED\n"
6262
"BRIDGE = br0\n"
6263
"NETWORK_SIZE = C\n"
6264
"NETWORK_ADDRESS = 192.168.0.0\n"
6265
msgstr ""
6266
6267
#: serverguide/C/virtualization.xml:2116(para)
6268
msgid ""
6269
"Be sure to change <emphasis>192.168.0.0</emphasis> to your local network."
6270
msgstr ""
6271
6272
#: serverguide/C/virtualization.xml:2121(para)
6273
msgid ""
6274
"Using the <application>onevnet</application> utility, add the virtual "
6275
"network to OpenNebula:"
6276
msgstr ""
6277
6278
#: serverguide/C/virtualization.xml:2126(command)
6279
msgid "onevnet create vnet01.template"
6280
msgstr ""
6281
6282
#: serverguide/C/virtualization.xml:2129(para)
6283
msgid ""
6284
"Now create a <emphasis>VM Template</emphasis> file named "
6285
"<filename>vm01.template</filename>:"
6286
msgstr ""
6287
6288
#: serverguide/C/virtualization.xml:2133(programlisting)
6289
#, no-wrap
6290
msgid ""
6291
"\n"
6292
"NAME = vm01\n"
6293
"CPU = 0.5\n"
6294
"MEMORY = 512\n"
6295
"\n"
6296
"OS = [ BOOT = hd ]\n"
6297
"\n"
6298
"DISK = [\n"
6299
" source = \"/var/lib/one/images/vm01.qcow2\",\n"
6300
" target = \"hda\",\n"
6301
" readonly = \"no\" ]\n"
6302
"\n"
6303
"NIC = [ NETWORK=\"LAN\" ]\n"
6304
"\n"
6305
"GRAPHICS = [type=\"vnc\",listen=\"127.0.0.1\",port=\"-1\"]\n"
6306
msgstr ""
6307
6308
#: serverguide/C/virtualization.xml:2150(para)
6309
msgid "Start the virtual machine using <application>onevm</application>:"
6310
msgstr ""
6311
6312
#: serverguide/C/virtualization.xml:2155(command)
6313
msgid "onevm submit vm01.template"
6314
msgstr ""
6315
6316
#: serverguide/C/virtualization.xml:2158(para)
6317
msgid ""
6318
"Use the <application>onevm list</application> option to view information "
6319
"about virtual machines. Also, the <application>onevm show vm01</application> "
6320
"option will display more details about a specific virtual machine."
6321
msgstr ""
6322
6323
#: serverguide/C/virtualization.xml:2169(para)
6324
msgid ""
6325
"See the <ulink "
6326
"url=\"http://www.opennebula.org/doku.php?id=start\">OpenNebula website</ulink"
6327
"> for more information."
6328
msgstr ""
6329
6330
#: serverguide/C/virtualization.xml:2174(para)
6331
msgid ""
6332
"You can also find help in the <emphasis>#ubuntu-virt</emphasis> and "
6333
"<emphasis>#ubuntu-server</emphasis> IRC channels on <ulink "
6334
"url=\"http://freenode.net\">Freenode</ulink>."
6335
msgstr ""
6336
6337
#: serverguide/C/virtualization.xml:2180(para)
6338
msgid ""
6339
"Also, the <ulink "
6340
"url=\"https://help.ubuntu.com/community/OpenNebula\">OpenNebula Ubuntu "
6341
"Wiki</ulink> page has more details."
6342
msgstr ""
6343
6344
#: serverguide/C/vcs.xml:13(title)
6345
msgid "Version Control System"
6346
msgstr ""
6347
6348
#: serverguide/C/vcs.xml:14(para)
6349
msgid ""
6350
"Version control is the art of managing changes to information. It has long "
6351
"been a critical tool for programmers, who typically spend their time making "
6352
"small changes to software and then undoing those changes the next day. But "
6353
"the usefulness of version control software extends far beyond the bounds of "
6354
"the software development world. Anywhere you can find people using computers "
6355
"to manage information that changes often, there is room for version control."
6356
msgstr ""
6357
6358
#: serverguide/C/vcs.xml:17(title)
6359
msgid "Bazaar"
6360
msgstr ""
6361
6362
#: serverguide/C/vcs.xml:18(para)
6363
msgid ""
6364
"Bazaar is a new version control system sponsored by Canonical, the "
6365
"commercial company behind Ubuntu. Unlike Subversion and CVS that only "
6366
"support a central repository model, Bazaar also supports "
6367
"<emphasis>distributed version control</emphasis>, giving people the ability "
6368
"to collaborate more efficiently. In particular, Bazaar is designed to "
6369
"maximize the level of community participation in open source projects."
6370
msgstr ""
6371
6372
#: serverguide/C/vcs.xml:29(para)
6373
msgid ""
6374
"At a terminal prompt, enter the following command to install "
6375
"<application>bzr</application>: <screen>\n"
6376
"<command>sudo apt-get install bzr</command>\n"
6377
"</screen>"
6378
msgstr ""
6379
6380
#: serverguide/C/vcs.xml:40(para)
6381
msgid ""
6382
"To introduce yourself to <application>bzr</application>, use the "
6383
"<emphasis>whoami</emphasis> command like this: <screen>\n"
6384
"<command>$ bzr whoami 'Joe Doe <joe.doe@gmail.com>'</command>\n"
6385
"</screen>"
6386
msgstr ""
6387
6388
#: serverguide/C/vcs.xml:49(title)
6389
msgid "Learning Bazaar"
6390
msgstr ""
6391
6392
#: serverguide/C/vcs.xml:50(para)
6393
msgid ""
6394
"Bazaar comes with bundled documentation installed into "
6395
"<application>/usr/share/doc/bzr/html</application> by default. The tutorial "
6396
"is a good place to start. The <application>bzr</application> command also "
6397
"comes with built-in help: <screen>\n"
6398
"<command>$ bzr help</command>\n"
6399
"</screen>"
6400
msgstr ""
6401
6402
#: serverguide/C/vcs.xml:60(para)
6403
msgid ""
6404
"To learn more about the <emphasis>foo</emphasis> command: <screen>\n"
6405
"<command>$ bzr help foo</command>\n"
6406
"</screen>"
6407
msgstr ""
6408
6409
#: serverguide/C/vcs.xml:68(title)
6410
msgid "Launchpad Integration"
6411
msgstr ""
6412
6413
#: serverguide/C/vcs.xml:69(para)
6414
msgid ""
6415
"While highly useful as a stand-alone system, Bazaar has good, optional "
6416
"integration with <ulink url=\"https://launchpad.net/\">Launchpad</ulink>, "
6417
"the collaborative development system used by Canonical and the broader open "
6418
"source community to manage and extend Ubuntu itself. For information on how "
6419
"Bazaar can be used with Launchpad to collaborate on open source projects, "
6420
"see <ulink url=\"http://bazaar-vcs.org/LaunchpadIntegration/\"> "
6421
"http://bazaar-vcs.org/LaunchpadIntegration</ulink>."
6422
msgstr ""
6423
6424
#: serverguide/C/vcs.xml:81(title)
6425
msgid "Subversion"
6426
msgstr ""
6427
6428
#: serverguide/C/vcs.xml:82(para)
6429
msgid ""
6430
"Subversion is an open source version control system. Using Subversion, you "
6431
"can record the history of source files and documents. It manages files and "
6432
"directories over time. A tree of files is placed into a central repository. "
6433
"The repository is much like an ordinary file server, except that it "
6434
"remembers every change ever made to files and directories."
6435
msgstr ""
6436
6437
#: serverguide/C/vcs.xml:87(para)
6438
msgid ""
6439
"To access Subversion repository using the HTTP protocol, you must install "
6440
"and configure a web server. Apache2 is proven to work with Subversion. "
6441
"Please refer to the HTTP subsection in the Apache2 section to install and "
6442
"configure Apache2. To access the Subversion repository using the HTTPS "
6443
"protocol, you must install and configure a digital certificate in your "
6444
"Apache 2 web server. Please refer to the HTTPS subsection in the Apache2 "
6445
"section to install and configure the digital certificate."
6446
msgstr ""
6447
6448
#: serverguide/C/vcs.xml:96(para)
6449
msgid ""
6450
"To install Subversion, run the following command from a terminal prompt:"
6451
msgstr ""
6452
6453
#: serverguide/C/vcs.xml:101(command)
6454
msgid "sudo apt-get install subversion libapache2-svn"
6455
msgstr ""
6456
6457
#: serverguide/C/vcs.xml:108(para)
6458
msgid ""
6459
"This step assumes you have installed above mentioned packages on your "
6460
"system. This section explains how to create a Subversion repository and "
6461
"access the project."
6462
msgstr ""
6463
6464
#: serverguide/C/vcs.xml:111(title)
6465
msgid "Create Subversion Repository"
6466
msgstr ""
6467
6468
#: serverguide/C/vcs.xml:112(para)
6469
msgid ""
6470
"The Subversion repository can be created using the following command from a "
6471
"terminal prompt:"
6472
msgstr ""
6473
6474
#: serverguide/C/vcs.xml:116(command)
6475
msgid "svnadmin create /path/to/repos/project"
6476
msgstr ""
6477
6478
#: serverguide/C/vcs.xml:121(title)
6479
msgid "Importing Files"
6480
msgstr ""
6481
6482
#: serverguide/C/vcs.xml:122(para)
6483
msgid ""
6484
"Once you create the repository you can <emphasis>import</emphasis> files "
6485
"into the repository. To import a directory, enter the following from a "
6486
"terminal prompt: <screen>\n"
6487
"<command>svn import /path/to/import/directory "
6488
"file:///path/to/repos/project</command>\n"
6489
"</screen>"
6490
msgstr ""
6491
6492
#: serverguide/C/vcs.xml:134(title) serverguide/C/vcs.xml:139(title)
6493
msgid "Access Methods"
6494
msgstr ""
6495
6496
#: serverguide/C/vcs.xml:135(para)
6497
msgid ""
6498
"Subversion repositories can be accessed (checked out) through many different "
6499
"methods --on local disk, or through various network protocols. A repository "
6500
"location, however, is always a URL. The table describes how different URL "
6501
"schemes map to the available access methods."
6502
msgstr ""
6503
6504
#: serverguide/C/vcs.xml:146(para)
6505
msgid "Schema"
6506
msgstr ""
6507
6508
#: serverguide/C/vcs.xml:147(para)
6509
msgid "Access Method"
6510
msgstr ""
6511
6512
#: serverguide/C/vcs.xml:152(para)
6513
msgid "file://"
6514
msgstr ""
6515
6516
#: serverguide/C/vcs.xml:153(para)
6517
msgid "direct repository access (on local disk)"
6518
msgstr ""
6519
6520
#: serverguide/C/vcs.xml:156(para)
6521
msgid "http://"
6522
msgstr ""
6523
6524
#: serverguide/C/vcs.xml:157(para)
6525
msgid "Access via WebDAV protocol to Subversion-aware Apache2 web server"
6526
msgstr ""
6527
6528
#: serverguide/C/vcs.xml:160(para)
6529
msgid "https://"
6530
msgstr ""
6531
6532
#: serverguide/C/vcs.xml:161(para)
6533
msgid "Same as http://, but with SSL encryption"
6534
msgstr ""
6535
6536
#: serverguide/C/vcs.xml:164(para)
6537
msgid "svn://"
6538
msgstr ""
6539
6540
#: serverguide/C/vcs.xml:165(para)
6541
msgid "Access via custom protocol to an svnserve server"
6542
msgstr ""
6543
6544
#: serverguide/C/vcs.xml:168(para)
6545
msgid "svn+ssh://"
6546
msgstr ""
6547
6548
#: serverguide/C/vcs.xml:169(para)
6549
msgid "Same as svn://, but through an SSH tunnel"
6550
msgstr ""
6551
6552
#: serverguide/C/vcs.xml:175(para)
6553
msgid ""
6554
"In this section, we will see how to configure Subversion for all these "
6555
"access methods. Here, we cover the basics. For more advanced usage details, "
6556
"refer to the <ulink url=\"http://svnbook.red-bean.com/\">svn book</ulink>."
6557
msgstr ""
6558
6559
#: serverguide/C/vcs.xml:182(title)
6560
msgid "Direct repository access (file://)"
6561
msgstr ""
6562
6563
#: serverguide/C/vcs.xml:183(para)
6564
msgid ""
6565
"This is the simplest of all access methods. It does not require any "
6566
"Subversion server process to be running. This access method is used to "
6567
"access Subversion from the same machine. The syntax of the command, entered "
6568
"at a terminal prompt, is as follows:"
6569
msgstr ""
6570
6571
#: serverguide/C/vcs.xml:190(command)
6572
msgid "svn co file:///path/to/repos/project"
6573
msgstr ""
6574
6575
#: serverguide/C/vcs.xml:193(para)
6576
msgid "or"
6577
msgstr ""
6578
6579
#: serverguide/C/vcs.xml:196(command)
6580
msgid "svn co file://localhost/path/to/repos/project"
6581
msgstr ""
6582
6583
#: serverguide/C/vcs.xml:200(para)
6584
msgid ""
6585
"If you do not specify the hostname, there are three forward slashes (///) -- "
6586
"two for the protocol (file, in this case) plus the leading slash in the "
6587
"path. If you specify the hostname, you must use two forward slashes (//)."
6588
msgstr ""
6589
6590
#: serverguide/C/vcs.xml:202(para)
6591
msgid ""
6592
"The repository permissions depend on filesystem permissions. If the user has "
6593
"read/write permission, he can checkout from and commit to the repository."
6594
msgstr ""
6595
6596
#: serverguide/C/vcs.xml:205(title)
6597
msgid "Access via WebDAV protocol (http://)"
6598
msgstr ""
6599
6600
#: serverguide/C/vcs.xml:206(para)
6601
msgid ""
6602
"To access the Subversion repository via WebDAV protocol, you must configure "
6603
"your Apache 2 web server. Add the following snippet between the "
6604
"<emphasis><VirtualHost></emphasis> and "
6605
"<emphasis></VirtualHost></emphasis> elements in "
6606
"<filename>/etc/apache2/sites-available/default</filename>, or another "
6607
"VirtualHost file:"
6608
msgstr ""
6609
6610
#: serverguide/C/vcs.xml:212(programlisting)
6611
#, no-wrap
6612
msgid ""
6613
"\n"
6614
" <Location /svn>\n"
6615
" DAV svn\n"
6616
" SVNPath /home/svn\n"
6617
" AuthType Basic\n"
6618
" AuthName \"Your repository name\"\n"
6619
" AuthUserFile /etc/subversion/passwd\n"
6620
" Require valid-user\n"
6621
" </Location> \n"
6622
msgstr ""
6623
6624
#: serverguide/C/vcs.xml:223(para)
6625
msgid ""
6626
"The above configuration snippet assumes that Subversion repositories are "
6627
"created under <filename>/home/svn/</filename> directory using "
6628
"<command>svnadmin</command> command. They can be accessible using "
6629
"<command>http://hostname/svn/repos_name</command> url."
6630
msgstr ""
6631
6632
#: serverguide/C/vcs.xml:229(para)
6633
msgid ""
6634
"To import or commit files to your Subversion repository over HTTP, the "
6635
"repository should be owned by the HTTP user. In Ubuntu systems, normally the "
6636
"HTTP user is <command>www-data</command>. To change the ownership of the "
6637
"repository files enter the following command from terminal prompt:"
6638
msgstr ""
6639
6640
#: serverguide/C/vcs.xml:238(command)
6641
msgid "sudo chown -R www-data:www-data /path/to/repos"
6642
msgstr ""
6643
6644
#: serverguide/C/vcs.xml:241(para)
6645
msgid ""
6646
"By changing the ownership of repository as <command>www-data</command> you "
6647
"will not be able to import or commit files into the repository by running "
6648
"<command>svn import file:///</command> command as any user other than "
6649
"<command>www-data</command>."
6650
msgstr ""
6651
6652
#: serverguide/C/vcs.xml:250(para)
6653
msgid ""
6654
"Next, you must create the <filename>/etc/subversion/passwd</filename> file "
6655
"that will contain user authentication details. To create a file issue the "
6656
"following command at a command prompt (which will create the file and add "
6657
"the first user):"
6658
msgstr ""
6659
6660
#: serverguide/C/vcs.xml:256(command)
6661
msgid "sudo htpasswd -c /etc/subversion/passwd user_name"
6662
msgstr ""
6663
6664
#: serverguide/C/vcs.xml:259(para)
6665
msgid ""
6666
"To add additional users omit the <emphasis>\"-c\"</emphasis> option as this "
6667
"option replaces the old file. Instead use this form:"
6668
msgstr ""
6669
6670
#: serverguide/C/vcs.xml:264(command)
6671
msgid "sudo htpasswd /etc/subversion/password user_name"
6672
msgstr ""
6673
6674
#: serverguide/C/vcs.xml:268(para)
6675
msgid ""
6676
"This command will prompt you to enter the password. Once you enter the "
6677
"password, the user is added. Now, to access the repository you can run the "
6678
"following command:"
6679
msgstr ""
6680
6681
#: serverguide/C/vcs.xml:269(command)
6682
msgid "svn co http://servername/svn"
6683
msgstr ""
6684
6685
#: serverguide/C/vcs.xml:271(para)
6686
msgid ""
6687
"The password is transmitted as plain text. If you are worried about password "
6688
"snooping, you are advised to use SSL encryption. For details, please refer "
6689
"next section."
6690
msgstr ""
6691
6692
#: serverguide/C/vcs.xml:277(title)
6693
msgid "Access via WebDAV protocol with SSL encryption (https://)"
6694
msgstr ""
6695
6696
#: serverguide/C/vcs.xml:278(para)
6697
msgid ""
6698
"Accessing Subversion repository via WebDAV protocol with SSL encryption "
6699
"(https://) is similar to http:// except that you must install and configure "
6700
"the digital certificate in your Apache2 web server. To use SSL with "
6701
"Subversion add the above Apache2 configuration to "
6702
"<filename>/etc/apache2/sites-available/default-ssl</filename>. For more "
6703
"information on setting up Apache2 with SSL see <xref linkend=\"https-"
6704
"configuration\"/>."
6705
msgstr ""
6706
6707
#: serverguide/C/vcs.xml:287(para)
6708
msgid ""
6709
"You can install a digital certificate issued by a signing authority. "
6710
"Alternatively, you can install your own self-signed certificate."
6711
msgstr ""
6712
6713
#: serverguide/C/vcs.xml:292(para)
6714
msgid ""
6715
"This step assumes you have installed and configured a digital certificate in "
6716
"your Apache 2 web server. Now, to access the Subversion repository, please "
6717
"refer to the above section! The access methods are exactly the same, except "
6718
"the protocol. You must use https:// to access the Subversion repository."
6719
msgstr ""
6720
6721
#: serverguide/C/vcs.xml:302(title)
6722
msgid "Access via custom protocol (svn://)"
6723
msgstr ""
6724
6725
#: serverguide/C/vcs.xml:303(para)
6726
msgid ""
6727
"Once the Subversion repository is created, you can configure the access "
6728
"control. You can edit the <filename> "
6729
"/path/to/repos/project/conf/svnserve.conf</filename> file to configure the "
6730
"access control. For example, to set up authentication, you can uncomment the "
6731
"following lines in the configuration file:"
6732
msgstr ""
6733
6734
#: serverguide/C/vcs.xml:310(programlisting)
6735
#, no-wrap
6736
msgid ""
6737
"# [general]\n"
6738
"# password-db = passwd"
6739
msgstr ""
6740
6741
#: serverguide/C/vcs.xml:313(para)
6742
msgid ""
6743
"After uncommenting the above lines, you can maintain the user list in the "
6744
"passwd file. So, edit the file <filename>passwd </filename> in the same "
6745
"directory and add the new user. The syntax is as follows:"
6746
msgstr ""
6747
6748
#: serverguide/C/vcs.xml:319(programlisting)
6749
#, no-wrap
6750
msgid "username = password"
6751
msgstr ""
6752
6753
#: serverguide/C/vcs.xml:320(para)
6754
msgid "For more details, please refer to the file."
6755
msgstr ""
6756
6757
#: serverguide/C/vcs.xml:324(para)
6758
msgid ""
6759
"Now, to access Subversion via the svn:// custom protocol, either from the "
6760
"same machine or a different machine, you can run svnserver using svnserve "
6761
"command. The syntax is as follows:"
6762
msgstr ""
6763
6764
#: serverguide/C/vcs.xml:329(programlisting)
6765
#, no-wrap
6766
msgid ""
6767
"$ svnserve -d --foreground -r /path/to/repos\n"
6768
"# -d -- daemon mode\n"
6769
"# --foreground -- run in foreground (useful for debugging)\n"
6770
"# -r -- root of directory to serve\n"
6771
"\n"
6772
"For more usage details, please refer to:\n"
6773
"$ svnserve --help"
6774
msgstr ""
6775
6776
#: serverguide/C/vcs.xml:337(para)
6777
msgid ""
6778
"Once you run this command, Subversion starts listening on default port "
6779
"(3690). To access the project repository, you must run the following command "
6780
"from a terminal prompt:"
6781
msgstr ""
6782
6783
#: serverguide/C/vcs.xml:340(command)
6784
msgid "svn co svn://hostname/project project --username user_name"
6785
msgstr ""
6786
6787
#: serverguide/C/vcs.xml:343(para)
6788
msgid ""
6789
"Based on server configuration, it prompts for password. Once you are "
6790
"authenticated, it checks out the code from Subversion repository. To "
6791
"synchronize the project repository with the local copy, you can run the "
6792
"<command>update</command> sub-command. The syntax of the command, entered at "
6793
"a terminal prompt, is as follows:"
6794
msgstr ""
6795
6796
#: serverguide/C/vcs.xml:351(command)
6797
msgid "cd project_dir ; svn update"
6798
msgstr ""
6799
6800
#: serverguide/C/vcs.xml:354(para)
6801
msgid ""
6802
"For more details about using each Subversion sub-command, you can refer to "
6803
"the manual. For example, to learn more about the co (checkout) command, "
6804
"please run the following command from a terminal prompt:"
6805
msgstr ""
6806
6807
#: serverguide/C/vcs.xml:358(command)
6808
msgid "svn co help"
6809
msgstr ""
6810
6811
#: serverguide/C/vcs.xml:362(title)
6812
msgid "Access via custom protocol with SSL encryption (svn+ssh://)"
6813
msgstr ""
6814
6815
#: serverguide/C/vcs.xml:363(para)
6816
msgid ""
6817
"The configuration and server process is same as in the svn:// method. For "
6818
"details, please refer to the above section. This step assumes you have "
6819
"followed the above step and started the Subversion server using "
6820
"<application>svnserve</application> command."
6821
msgstr ""
6822
6823
#: serverguide/C/vcs.xml:369(para)
6824
msgid ""
6825
"It is also assumed that the ssh server is running on that machine and that "
6826
"it is allowing incoming connections. To confirm, please try to login to that "
6827
"machine using ssh. If you can login, everything is perfect. If you cannot "
6828
"login, please address it before continuing further."
6829
msgstr ""
6830
6831
#: serverguide/C/vcs.xml:375(para)
6832
msgid ""
6833
"The svn+ssh:// protocol is used to access the Subversion repository using "
6834
"SSL encryption. The data transfer is encrypted using this method. To access "
6835
"the project repository (for example with a checkout), you must use the "
6836
"following command syntax:"
6837
msgstr ""
6838
6839
#: serverguide/C/vcs.xml:382(command)
6840
msgid "svn co svn+ssh://hostname/var/svn/repos/project"
6841
msgstr ""
6842
6843
#: serverguide/C/vcs.xml:386(para)
6844
msgid ""
6845
"You must use the full path (/path/to/repos/project) to access the Subversion "
6846
"repository using this access method."
6847
msgstr ""
6848
6849
#: serverguide/C/vcs.xml:389(para)
6850
msgid ""
6851
"Based on server configuration, it prompts for password. You must enter the "
6852
"password you use to login via ssh. Once you are authenticated, it checks out "
6853
"the code from the Subversion repository."
6854
msgstr ""
6855
6856
#: serverguide/C/vcs.xml:399(title)
6857
msgid "CVS Server"
6858
msgstr ""
6859
6860
#: serverguide/C/vcs.xml:400(para)
6861
msgid ""
6862
"CVS is a version control system. You can use it to record the history of "
6863
"source files."
6864
msgstr ""
6865
6866
#: serverguide/C/vcs.xml:406(para)
6867
msgid ""
6868
"To install <application>CVS</application>, run the following command from a "
6869
"terminal prompt: <screen>\n"
6870
"<command>sudo apt-get install cvs</command>\n"
6871
"</screen> After you install <application>cvs</application>, you should "
6872
"install <application>xinetd</application> to start/stop the cvs server. At "
6873
"the prompt, enter the following command to install "
6874
"<application>xinetd</application>: <screen>\n"
6875
"<command>sudo apt-get install xinetd</command>\n"
6876
"</screen>"
6877
msgstr ""
6878
6879
#: serverguide/C/vcs.xml:439(programlisting)
6880
#, no-wrap
6881
msgid ""
6882
"\n"
6883
"service cvspserver\n"
6884
"{\n"
6885
" port = 2401\n"
6886
" socket_type = stream\n"
6887
" protocol = tcp\n"
6888
" user = root\n"
6889
" wait = no\n"
6890
" type = UNLISTED\n"
6891
" server = /usr/bin/cvs\n"
6892
" server_args = -f --allow-root /var/lib/cvs pserver\n"
6893
" disable = no\n"
6894
"}\n"
6895
msgstr ""
6896
6897
#: serverguide/C/vcs.xml:455(para)
6898
msgid ""
6899
"Be sure to edit the repository if you have changed the default repository "
6900
"(<application>/var/lib/cvs</application>) directory."
6901
msgstr ""
6902
6903
#: serverguide/C/vcs.xml:424(para)
6904
msgid ""
6905
"Once you install cvs, the repository will be automatically initialized. By "
6906
"default, the repository resides under the "
6907
"<application>/var/lib/cvs</application> directory. You can change this path "
6908
"by running following command: <screen>\n"
6909
"<command>cvs -d /your/new/cvs/repo init</command>\n"
6910
"</screen> Once the initial repository is set up, you can configure "
6911
"<application>xinetd</application> to start the CVS server. You can copy the "
6912
"following lines to the <filename> /etc/xinetd.d/cvspserver</filename> file. "
6913
"<placeholder-1/><placeholder-2/> Once you have configured "
6914
"<application>xinetd</application> you can start the cvs server by running "
6915
"following command: <screen>\n"
6916
"<command>sudo /etc/init.d/xinetd restart</command>\n"
6917
"</screen>"
6918
msgstr ""
6919
6920
#: serverguide/C/vcs.xml:468(para)
6921
msgid ""
6922
"You can confirm that the CVS server is running by issuing the following "
6923
"command:"
6924
msgstr ""
6925
6926
#: serverguide/C/vcs.xml:475(command)
6927
msgid "sudo netstat -tap | grep cvs"
6928
msgstr ""
6929
6930
#: serverguide/C/vcs.xml:479(para) serverguide/C/databases.xml:65(para)
6931
msgid ""
6932
"When you run this command, you should see the following line or something "
6933
"similar:"
6934
msgstr ""
6935
6936
#: serverguide/C/vcs.xml:484(programlisting)
6937
#, no-wrap
6938
msgid ""
6939
"\n"
6940
"tcp 0 0 *:cvspserver *:* LISTEN \n"
6941
msgstr ""
6942
6943
#: serverguide/C/vcs.xml:488(para)
6944
msgid ""
6945
"From here you can continue to add users, add new projects, and manage the "
6946
"CVS server."
6947
msgstr ""
6948
6949
#: serverguide/C/vcs.xml:493(para)
6950
msgid ""
6951
"CVS allows the user to add users independently of the underlying OS "
6952
"installation. Probably the easiest way is to use the Linux Users for CVS, "
6953
"although it has potential security issues. Please refer to the CVS manual "
6954
"for details."
6955
msgstr ""
6956
6957
#: serverguide/C/vcs.xml:503(title)
6958
msgid "Add Projects"
6959
msgstr ""
6960
6961
#: serverguide/C/vcs.xml:515(para)
6962
msgid ""
6963
"You can use the CVSROOT environment variable to store the CVS root "
6964
"directory. Once you export the CVSROOT environment variable, you can avoid "
6965
"using -d option in the above cvs command."
6966
msgstr ""
6967
6968
#: serverguide/C/vcs.xml:527(para)
6969
msgid ""
6970
"When you add a new project, the CVS user you use must have write access to "
6971
"the CVS repository (<application>/var/lib/cvs</application>). By default, "
6972
"the <application>src</application> group has write access to the CVS "
6973
"repository. So, you can add the user to this group, and he can then add and "
6974
"manage projects in the CVS repository."
6975
msgstr ""
6976
6977
#: serverguide/C/vcs.xml:504(para)
6978
msgid ""
6979
"This section explains how to add new project to the CVS repository. Create "
6980
"the directory and add necessary document and source files to the directory. "
6981
"Now, run the following command to add this project to CVS repository: "
6982
"<screen>\n"
6983
"<command>cd your/project</command>\n"
6984
"<command>cvs -d :pserver:username@hostname.com:/var/lib/cvs import -m "
6985
"\"Importing my project to CVS repository\" . new_project start</command>\n"
6986
"</screen><placeholder-1/> The string <emphasis>new_project</emphasis> is a "
6987
"vendor tag, and <emphasis>start</emphasis> is a release tag. They serve no "
6988
"purpose in this context, but since CVS requires them, they must be present. "
6989
"<placeholder-2/>"
6990
msgstr ""
6991
6992
#: serverguide/C/vcs.xml:540(ulink)
6993
msgid "Bazaar Home Page"
6994
msgstr ""
6995
6996
#: serverguide/C/vcs.xml:541(ulink)
6997
msgid "Launchpad"
6998
msgstr ""
6999
7000
#: serverguide/C/vcs.xml:542(ulink)
7001
msgid "Subversion Home Page"
7002
msgstr ""
7003
7004
#: serverguide/C/vcs.xml:543(ulink)
7005
msgid "Subversion Book"
7006
msgstr ""
7007
7008
#: serverguide/C/vcs.xml:545(ulink)
7009
msgid "CVS Manual"
7010
msgstr ""
7011
7012
#: serverguide/C/vcs.xml:546(ulink)
7013
msgid "Easy Bazaar Ubuntu Wiki page"
7014
msgstr ""
7015
7016
#: serverguide/C/vcs.xml:547(ulink)
7017
msgid "Ubuntu Wiki Subversion page"
7018
msgstr ""
7019
7020
#: serverguide/C/serverguide.xml:3(title) serverguide/C/bookinfo.xml:3(title)
7021
msgid "Credits and License"
7022
msgstr ""
7023
7024
#: serverguide/C/serverguide.xml:4(para) serverguide/C/bookinfo.xml:4(para)
7025
msgid ""
7026
"This document is maintained by the Ubuntu documentation team "
7027
"(https://wiki.ubuntu.com/DocumentationTeam). For a list of contributors, see "
7028
"the <ulink url=\"../../libs/C/contributors.xml\">contributors page</ulink>"
7029
msgstr ""
7030
7031
#: serverguide/C/serverguide.xml:5(para) serverguide/C/bookinfo.xml:5(para)
7032
msgid ""
7033
"This document is made available under the Creative Commons ShareAlike 2.5 "
7034
"License (CC-BY-SA)."
7035
msgstr ""
7036
7037
#: serverguide/C/serverguide.xml:6(para) serverguide/C/bookinfo.xml:6(para)
7038
msgid ""
7039
"You are free to modify, extend, and improve the Ubuntu documentation source "
7040
"code under the terms of this license. All derivative works must be released "
7041
"under this license."
7042
msgstr ""
7043
7044
#: serverguide/C/serverguide.xml:8(para) serverguide/C/bookinfo.xml:8(para)
7045
msgid ""
7046
"This documentation is distributed in the hope that it will be useful, but "
7047
"WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY "
7048
"or FITNESS FOR A PARTICULAR PURPOSE AS DESCRIBED IN THE DISCLAIMER."
7049
msgstr ""
7050
7051
#: serverguide/C/serverguide.xml:11(para) serverguide/C/bookinfo.xml:11(para)
7052
msgid ""
7053
"A copy of the license is available here: <ulink url=\"/usr/share/ubuntu-"
7054
"docs/libs/C/ccbysa.xml\">Creative Commons ShareAlike License</ulink>."
7055
msgstr ""
7056
7057
#: serverguide/C/serverguide.xml:14(year) serverguide/C/bookinfo.xml:14(year)
7058
msgid "2008"
7059
msgstr ""
7060
7061
#: serverguide/C/serverguide.xml:15(ulink) serverguide/C/bookinfo.xml:15(ulink)
7062
msgid "Ubuntu Documentation Project"
7063
msgstr ""
7064
7065
#: serverguide/C/serverguide.xml:15(holder) serverguide/C/bookinfo.xml:15(holder)
7066
msgid "Canonical Ltd. and members of the <placeholder-1/>"
7067
msgstr ""
7068
7069
#: serverguide/C/serverguide.xml:18(publishername) serverguide/C/bookinfo.xml:18(publishername)
7070
msgid "The Ubuntu Documentation Project"
7071
msgstr ""
7072
7073
#: serverguide/C/serverguide.xml:17(para)
7074
msgid ""
7075
"Welcome to the <emphasis>Ubuntu Server Guide</emphasis>! It contains "
7076
"information on how to install and configure various server applications on "
7077
"your Ubuntu system to fit your needs. It is a step-by-step, task-oriented "
7078
"guide for configuring and customizing your system."
7079
msgstr ""
7080
7081
#: serverguide/C/security.xml:13(title)
7082
msgid "Security"
7083
msgstr ""
7084
7085
#: serverguide/C/security.xml:14(para)
7086
msgid ""
7087
"Security should always be considered when installing, deploying, and using "
7088
"any type of computer system. Although a fresh installation of Ubuntu is "
7089
"relatively safe for immediate use on the Internet, it is important to have a "
7090
"balanced understanding of your systems security posture based on how it will "
7091
"be used after deployment."
7092
msgstr ""
7093
7094
#: serverguide/C/security.xml:17(para)
7095
msgid ""
7096
"This chapter provides an overview of security related topics as they pertain "
7097
"to Ubuntu 10.04 LTS Server Edition, and outlines simple measures you may use "
7098
"to protect your server and network from any number of potential security "
7099
"threats."
7100
msgstr ""
7101
7102
#: serverguide/C/security.xml:21(title)
7103
msgid "User Management"
7104
msgstr ""
7105
7106
#: serverguide/C/security.xml:22(para)
7107
msgid ""
7108
"User management is a critical part of maintaining a secure system. "
7109
"Ineffective user and privilege management often lead many systems into being "
7110
"compromised. Therefore, it is important that you understand how you can "
7111
"protect your server through simple and effective user account management "
7112
"techniques."
7113
msgstr ""
7114
7115
#: serverguide/C/security.xml:26(title)
7116
msgid "Where is root?"
7117
msgstr ""
7118
7119
#: serverguide/C/security.xml:27(para)
7120
msgid ""
7121
"Ubuntu developers made a conscientious decision to disable the "
7122
"administrative root account by default in all Ubuntu installations. This "
7123
"does not mean that the root account has been deleted or that it may not be "
7124
"accessed. It merely has been given a password which matches no possible "
7125
"encrypted value, therefore may not log in directly by itself."
7126
msgstr ""
7127
7128
#: serverguide/C/security.xml:30(para)
7129
msgid ""
7130
"Instead, users are encouraged to make use of a tool by the name of "
7131
"<application>sudo</application> to carry out system administrative duties. "
7132
"<application>Sudo</application> allows an authorized user to temporarily "
7133
"elevate their privileges using their own password instead of having to know "
7134
"the password belonging to the root account. This simple yet effective "
7135
"methodology provides accountability for all user actions, and gives the "
7136
"administrator granular control over which actions a user can perform with "
7137
"said privileges."
7138
msgstr ""
7139
7140
#: serverguide/C/security.xml:35(para)
7141
msgid ""
7142
"If for some reason you wish to enable the root account, simply give it a "
7143
"password:"
7144
msgstr ""
7145
7146
#: serverguide/C/security.xml:39(command)
7147
msgid "sudo passwd"
7148
msgstr ""
7149
7150
#: serverguide/C/security.xml:41(para)
7151
msgid ""
7152
"Sudo will prompt you for your password, and then ask you to supply a new "
7153
"password for root as shown below:"
7154
msgstr ""
7155
7156
#: serverguide/C/security.xml:44(userinput)
7157
#, no-wrap
7158
msgid "(enter your own password)"
7159
msgstr ""
7160
7161
#: serverguide/C/security.xml:45(userinput)
7162
#, no-wrap
7163
msgid "(enter a new password for root)"
7164
msgstr ""
7165
7166
#: serverguide/C/security.xml:46(userinput)
7167
#, no-wrap
7168
msgid "(repeat new password for root)"
7169
msgstr ""
7170
7171
#: serverguide/C/security.xml:44(computeroutput)
7172
#, no-wrap
7173
msgid ""
7174
"[sudo] password for username: <placeholder-1/>\n"
7175
"Enter new UNIX password: <placeholder-2/>\n"
7176
"Retype new UNIX password: <placeholder-3/>\n"
7177
"passwd: password updated successfully"
7178
msgstr ""
7179
7180
#: serverguide/C/security.xml:51(para)
7181
msgid "To disable the root account, use the following passwd syntax:"
7182
msgstr ""
7183
7184
#: serverguide/C/security.xml:55(command)
7185
msgid "sudo passwd -l root"
7186
msgstr ""
7187
7188
#: serverguide/C/security.xml:59(para)
7189
msgid ""
7190
"You should read more on <application>Sudo</application> by checking out it's "
7191
"man page:"
7192
msgstr ""
7193
7194
#: serverguide/C/security.xml:63(command)
7195
msgid "man sudo"
7196
msgstr ""
7197
7198
#: serverguide/C/security.xml:67(para)
7199
msgid ""
7200
"By default, the initial user created by the Ubuntu installer is a member of "
7201
"the group \"admin\" which is added to the file "
7202
"<filename>/etc/sudoers</filename> as an authorized sudo user. If you wish to "
7203
"give any other account full root access through "
7204
"<application>sudo</application>, simply add them to the admin group."
7205
msgstr ""
7206
7207
#: serverguide/C/security.xml:73(title)
7208
msgid "Adding and Deleting Users"
7209
msgstr ""
7210
7211
#: serverguide/C/security.xml:74(para)
7212
msgid ""
7213
"The process for managing local users and groups is straight forward and "
7214
"differs very little from most other GNU/Linux operating systems. Ubuntu and "
7215
"other Debian based distributions, encourage the use of the \"adduser\" "
7216
"package for account management."
7217
msgstr ""
7218
7219
#: serverguide/C/security.xml:79(para)
7220
msgid ""
7221
"To add a user account, use the following syntax, and follow the prompts to "
7222
"give the account a password and identifiable characteristics such as a full "
7223
"name, phone number, etc."
7224
msgstr ""
7225
7226
#: serverguide/C/security.xml:83(command)
7227
msgid "sudo adduser username"
7228
msgstr ""
7229
7230
#: serverguide/C/security.xml:87(para)
7231
msgid ""
7232
"To delete a user account and its primary group, use the following syntax:"
7233
msgstr ""
7234
7235
#: serverguide/C/security.xml:91(command)
7236
msgid "sudo deluser username"
7237
msgstr ""
7238
7239
#: serverguide/C/security.xml:93(para)
7240
msgid ""
7241
"Deleting an account does not remove their respective home folder. It is up "
7242
"to you whether or not you wish to delete the folder manually or keep it "
7243
"according to your desired retention policies."
7244
msgstr ""
7245
7246
#: serverguide/C/security.xml:96(para)
7247
msgid ""
7248
"Remember, any user added later on with the same UID/GID as the previous "
7249
"owner will now have access to this folder if you have not taken the "
7250
"necessary precautions."
7251
msgstr ""
7252
7253
#: serverguide/C/security.xml:99(para)
7254
msgid ""
7255
"You may want to change these UID/GID values to something more appropriate, "
7256
"such as the root account, and perhaps even relocate the folder to avoid "
7257
"future conflicts:"
7258
msgstr ""
7259
7260
#: serverguide/C/security.xml:103(command)
7261
msgid "sudo chown -R root:root /home/username/"
7262
msgstr ""
7263
7264
#: serverguide/C/security.xml:104(command)
7265
msgid "sudo mkdir /home/archived_users/"
7266
msgstr ""
7267
7268
#: serverguide/C/security.xml:105(command)
7269
msgid "sudo mv /home/username /home/archived_users/"
7270
msgstr ""
7271
7272
#: serverguide/C/security.xml:109(para)
7273
msgid ""
7274
"To temporarily lock or unlock a user account, use the following syntax, "
7275
"respectively:"
7276
msgstr ""
7277
7278
#: serverguide/C/security.xml:113(command)
7279
msgid "sudo passwd -l username"
7280
msgstr ""
7281
7282
#: serverguide/C/security.xml:114(command)
7283
msgid "sudo passwd -u username"
7284
msgstr ""
7285
7286
#: serverguide/C/security.xml:118(para)
7287
msgid ""
7288
"To add or delete a personalized group, use the following syntax, "
7289
"respectively:"
7290
msgstr ""
7291
7292
#: serverguide/C/security.xml:122(command)
7293
msgid "sudo addgroup groupname"
7294
msgstr ""
7295
7296
#: serverguide/C/security.xml:123(command)
7297
msgid "sudo delgroup groupname"
7298
msgstr ""
7299
7300
#: serverguide/C/security.xml:127(para)
7301
msgid "To add a user to a group, use the following syntax:"
7302
msgstr ""
7303
7304
#: serverguide/C/security.xml:131(command)
7305
msgid "sudo adduser username groupname"
7306
msgstr ""
7307
7308
#: serverguide/C/security.xml:138(title)
7309
msgid "User Profile Security"
7310
msgstr ""
7311
7312
#: serverguide/C/security.xml:139(para)
7313
msgid ""
7314
"When a new user is created, the adduser utility creates a brand new home "
7315
"directory named <filename class=\"directory\">/home/username</filename>, "
7316
"respectively. The default profile is modeled after the contents found in the "
7317
"directory of <filename class=\"directory\">/etc/skel</filename>, which "
7318
"includes all profile basics."
7319
msgstr ""
7320
7321
#: serverguide/C/security.xml:142(para)
7322
msgid ""
7323
"If your server will be home to multiple users, you should pay close "
7324
"attention to the user home directory permissions to ensure confidentiality. "
7325
"By default, user home directories in Ubuntu are created with world "
7326
"read/execute permissions. This means that all users can browse and access "
7327
"the contents of other users home directories. This may not be suitable for "
7328
"your environment."
7329
msgstr ""
7330
7331
#: serverguide/C/security.xml:147(para)
7332
msgid ""
7333
"To verify your current users home directory permissions, use the following "
7334
"syntax:"
7335
msgstr ""
7336
7337
#: serverguide/C/security.xml:151(command) serverguide/C/security.xml:183(command)
7338
msgid "ls -ld /home/username"
7339
msgstr ""
7340
7341
#: serverguide/C/security.xml:153(para)
7342
msgid ""
7343
"The following output shows that the directory <filename "
7344
"class=\"directory\">/home/username</filename> has world readable permissions:"
7345
msgstr ""
7346
7347
#: serverguide/C/security.xml:156(computeroutput)
7348
#, no-wrap
7349
msgid "drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username"
7350
msgstr ""
7351
7352
#: serverguide/C/security.xml:160(para)
7353
msgid ""
7354
"You can remove the world readable permissions using the following syntax:"
7355
msgstr ""
7356
7357
#: serverguide/C/security.xml:164(command)
7358
msgid "sudo chmod 0750 /home/username"
7359
msgstr ""
7360
7361
#: serverguide/C/security.xml:167(para)
7362
msgid ""
7363
"Some people tend to use the recursive option (-R) indiscriminately which "
7364
"modifies all child folders and files, but this is not necessary, and may "
7365
"yield other undesirable results. The parent directory alone is sufficient "
7366
"for preventing unauthorized access to anything below the parent."
7367
msgstr ""
7368
7369
#: serverguide/C/security.xml:171(para)
7370
msgid ""
7371
"A much more efficient approach to the matter would be to modify the "
7372
"<application>adduser</application> global default permissions when creating "
7373
"user home folders. Simply edit the file "
7374
"<filename>/etc/adduser.conf</filename> and modify the "
7375
"<varname>DIR_MODE</varname> variable to something appropriate, so that all "
7376
"new home directories will receive the correct permissions."
7377
msgstr ""
7378
7379
#: serverguide/C/security.xml:174(programlisting)
7380
#, no-wrap
7381
msgid ""
7382
"\n"
7383
"DIR_MODE=0750\n"
7384
msgstr ""
7385
7386
#: serverguide/C/security.xml:179(para)
7387
msgid ""
7388
"After correcting the directory permissions using any of the previously "
7389
"mentioned techniques, verify the results using the following syntax:"
7390
msgstr ""
7391
7392
#: serverguide/C/security.xml:185(para)
7393
msgid ""
7394
"The results below show that world readable permissions have been removed:"
7395
msgstr ""
7396
7397
#: serverguide/C/security.xml:188(computeroutput)
7398
#, no-wrap
7399
msgid "drwxr-x--- 2 username username 4096 2007-10-02 20:03 username"
7400
msgstr ""
7401
7402
#: serverguide/C/security.xml:195(title)
7403
msgid "Password Policy"
7404
msgstr ""
7405
7406
#: serverguide/C/security.xml:196(para)
7407
msgid ""
7408
"A strong password policy is one of the most important aspects of your "
7409
"security posture. Many successful security breaches involve simple brute "
7410
"force and dictionary attacks against weak passwords. If you intend to offer "
7411
"any form of remote access involving your local password system, make sure "
7412
"you adequately address minimum password complexity requirements, maximum "
7413
"password lifetimes, and frequent audits of your authentication systems."
7414
msgstr ""
7415
7416
#: serverguide/C/security.xml:200(title)
7417
msgid "Minimum Password Length"
7418
msgstr ""
7419
7420
#: serverguide/C/security.xml:201(para)
7421
msgid ""
7422
"By default, Ubuntu requires a minimum password length of 4 characters, as "
7423
"well as some basic entropy checks. These values are controlled in the file "
7424
"<filename>/etc/pam.d/common-password</filename>, which is outlined below."
7425
msgstr ""
7426
7427
#: serverguide/C/security.xml:204(programlisting)
7428
#, no-wrap
7429
msgid ""
7430
"\n"
7431
"password required pam_unix.so nullok obscure min=4 max=8 md5\n"
7432
msgstr ""
7433
7434
#: serverguide/C/security.xml:207(para)
7435
msgid ""
7436
"If you would like to adjust the minimum length to 6 characters, change the "
7437
"appropriate variable to min=6. The modification is outlined below."
7438
msgstr ""
7439
7440
#: serverguide/C/security.xml:210(programlisting)
7441
#, no-wrap
7442
msgid ""
7443
"\n"
7444
"password required pam_unix.so nullok obscure min=6 max=8 md5\n"
7445
msgstr ""
7446
7447
#: serverguide/C/security.xml:214(para)
7448
msgid ""
7449
"The <varname>max=8</varname> variable does not represent the maximum length "
7450
"of a password. It only means that complexity requirements will not be "
7451
"checked on passwords over 8 characters. You may want to look at the "
7452
"<application>libpam-cracklib</application> package for additional password "
7453
"entropy assistance."
7454
msgstr ""
7455
7456
#: serverguide/C/security.xml:220(title)
7457
msgid "Password Expiration"
7458
msgstr ""
7459
7460
#: serverguide/C/security.xml:221(para)
7461
msgid ""
7462
"When creating user accounts, you should make it a policy to have a minimum "
7463
"and maximum password age forcing users to change their passwords when they "
7464
"expire."
7465
msgstr ""
7466
7467
#: serverguide/C/security.xml:226(para)
7468
msgid ""
7469
"To easily view the current status of a user account, use the following "
7470
"syntax:"
7471
msgstr ""
7472
7473
#: serverguide/C/security.xml:230(command) serverguide/C/security.xml:263(command)
7474
msgid "sudo chage -l username"
7475
msgstr ""
7476
7477
#: serverguide/C/security.xml:232(para)
7478
msgid ""
7479
"The output below shows interesting facts about the user account, namely that "
7480
"there are no policies applied:"
7481
msgstr ""
7482
7483
#: serverguide/C/security.xml:235(computeroutput)
7484
#, no-wrap
7485
msgid ""
7486
"Last password change : Jan 20, 2008\n"
7487
"Password expires : never\n"
7488
"Password inactive : never\n"
7489
"Account expires : never\n"
7490
"Minimum number of days between password change : 0\n"
7491
"Maximum number of days between password change : 99999\n"
7492
"Number of days of warning before password expires : 7"
7493
msgstr ""
7494
7495
#: serverguide/C/security.xml:245(para)
7496
msgid ""
7497
"To set any of these values, simply use the following syntax, and follow the "
7498
"interactive prompts:"
7499
msgstr ""
7500
7501
#: serverguide/C/security.xml:249(command)
7502
msgid "sudo chage username"
7503
msgstr ""
7504
7505
#: serverguide/C/security.xml:251(para)
7506
msgid ""
7507
"The following is also an example of how you can manually change the explicit "
7508
"expiration date (-E) to 01/31/2008, minimum password age (-m) of 5 days, "
7509
"maximum password age (-M) of 90 days, inactivity period (-I) of 5 days after "
7510
"password expiration, and a warning time period (-W) of 14 days before "
7511
"password expiration."
7512
msgstr ""
7513
7514
#: serverguide/C/security.xml:255(command)
7515
msgid "sudo chage -E 01/31/2008 -m 5 -M 90 -I 30 -W 14 username"
7516
msgstr ""
7517
7518
#: serverguide/C/security.xml:259(para)
7519
msgid "To verify changes, use the same syntax as mentioned previously:"
7520
msgstr ""
7521
7522
#: serverguide/C/security.xml:265(para)
7523
msgid ""
7524
"The output below shows the new policies that have been established for the "
7525
"account:"
7526
msgstr ""
7527
7528
#: serverguide/C/security.xml:268(computeroutput)
7529
#, no-wrap
7530
msgid ""
7531
"Last password change : Jan 20, 2008\n"
7532
"Password expires : Apr 19, 2008\n"
7533
"Password inactive : May 19, 2008\n"
7534
"Account expires : Jan 31, 2008\n"
7535
"Minimum number of days between password change : 5\n"
7536
"Maximum number of days between password change : 90\n"
7537
"Number of days of warning before password expires : 14"
7538
msgstr ""
7539
7540
#: serverguide/C/security.xml:284(title)
7541
msgid "Other Security Considerations"
7542
msgstr ""
7543
7544
#: serverguide/C/security.xml:285(para)
7545
msgid ""
7546
"Many applications use alternate authentication mechanisms that can be easily "
7547
"overlooked by even experienced system administrators. Therefore, it is "
7548
"important to understand and control how users authenticate and gain access "
7549
"to services and applications on your server."
7550
msgstr ""
7551
7552
#: serverguide/C/security.xml:290(title)
7553
msgid "SSH Access by Disabled Users"
7554
msgstr ""
7555
7556
#: serverguide/C/security.xml:291(para)
7557
msgid ""
7558
"Simply disabling/locking a user account will not prevent a user from logging "
7559
"into your server remotely if they have previously set up RSA public key "
7560
"authentication. They will still be able to gain shell access to the server, "
7561
"without the need for any password. Remember to check the users home "
7562
"directory for files that will allow for this type of authenticated SSH "
7563
"access. e.g. <filename>/home/username/.ssh/authorized_keys</filename>."
7564
msgstr ""
7565
7566
#: serverguide/C/security.xml:294(para)
7567
msgid ""
7568
"Remove or rename the directory <filename "
7569
"class=\"directory\">.ssh/</filename> in the user's home folder to prevent "
7570
"further SSH authentication capabilities."
7571
msgstr ""
7572
7573
#: serverguide/C/security.xml:297(para)
7574
msgid ""
7575
"Be sure to check for any established SSH connections by the disabled user, "
7576
"as it is possible they may have existing inbound or outbound connections. "
7577
"Kill any that are found."
7578
msgstr ""
7579
7580
#: serverguide/C/security.xml:300(para)
7581
msgid ""
7582
"Restrict SSH access to only user accounts that should have it. For example, "
7583
"you may create a group called \"sshlogin\" and add the group name as the "
7584
"value associated with the <varname>AllowGroups</varname> variable located in "
7585
"the file <filename>/etc/ssh/sshd_config</filename>."
7586
msgstr ""
7587
7588
#: serverguide/C/security.xml:303(programlisting)
7589
#, no-wrap
7590
msgid ""
7591
"\n"
7592
"AllowGroups sshlogin\n"
7593
msgstr ""
7594
7595
#: serverguide/C/security.xml:306(para)
7596
msgid ""
7597
"Then add your permitted SSH users to the group \"sshlogin\", and restart the "
7598
"SSH service."
7599
msgstr ""
7600
7601
#: serverguide/C/security.xml:310(command)
7602
msgid "sudo adduser username sshlogin"
7603
msgstr ""
7604
7605
#: serverguide/C/security.xml:311(command) serverguide/C/remote-administration.xml:150(command)
7606
msgid "sudo /etc/init.d/ssh restart"
7607
msgstr ""
7608
7609
#: serverguide/C/security.xml:315(title)
7610
msgid "External User Database Authentication"
7611
msgstr ""
7612
7613
#: serverguide/C/security.xml:316(para)
7614
msgid ""
7615
"Most enterprise networks require centralized authentication and access "
7616
"controls for all system resources. If you have configured your server to "
7617
"authenticate users against external databases, be sure to disable the user "
7618
"accounts both externally and locally, this way you ensure that local "
7619
"fallback authentication is not possible."
7620
msgstr ""
7621
7622
#: serverguide/C/security.xml:325(title)
7623
msgid "Console Security"
7624
msgstr ""
7625
7626
#: serverguide/C/security.xml:326(para)
7627
msgid ""
7628
"As with any other security barrier you put in place to protect your server, "
7629
"it is pretty tough to defend against untold damage caused by someone with "
7630
"physical access to your environment, for example, theft of hard drives, "
7631
"power or service disruption and so on. Therefore, console security should be "
7632
"addressed merely as one component of your overall physical security "
7633
"strategy. A locked \"screen door\" may deter a casual criminal, or at the "
7634
"very least slow down a determined one, so it is still advisable to perform "
7635
"basic precautions with regard to console security."
7636
msgstr ""
7637
7638
#: serverguide/C/security.xml:329(para)
7639
msgid ""
7640
"The following instructions will help defend your server against issues that "
7641
"could otherwise yield very serious consequences."
7642
msgstr ""
7643
7644
#: serverguide/C/security.xml:334(title)
7645
msgid "Disable Ctrl+Alt+Delete"
7646
msgstr ""
7647
7648
#: serverguide/C/security.xml:335(para)
7649
msgid ""
7650
"First and foremost, anyone that has physical access to the keyboard can "
7651
"simply use the "
7652
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7653
"eycombo> key combination to reboot the server without having to log on. "
7654
"Sure, someone could simply unplug the power source, but you should still "
7655
"prevent the use of this key combination on a production server. This forces "
7656
"an attacker to take more drastic measures to reboot the server, and will "
7657
"prevent accidental reboots at the same time."
7658
msgstr ""
7659
7660
#: serverguide/C/security.xml:340(para)
7661
msgid ""
7662
"To disable the reboot action taken by pressing the "
7663
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7664
"eycombo> key combination, comment out the following line in the file "
7665
"<filename>/etc/init/control-alt-delete.conf</filename>."
7666
msgstr ""
7667
7668
#: serverguide/C/security.xml:343(programlisting)
7669
#, no-wrap
7670
msgid ""
7671
"\n"
7672
"#exec shutdown -r now \"Control-Alt-Delete pressed\"\n"
7673
msgstr ""
7674
7675
#: serverguide/C/security.xml:352(title)
7676
msgid "Firewall"
7677
msgstr ""
7678
7679
#: serverguide/C/security.xml:355(para)
7680
msgid ""
7681
"The Linux kernel includes the <emphasis>Netfilter</emphasis> subsystem, "
7682
"which is used to manipulate or decide the fate of network traffic headed "
7683
"into or through your server. All modern Linux firewall solutions use this "
7684
"system for packet filtering."
7685
msgstr ""
7686
7687
#: serverguide/C/security.xml:360(para)
7688
msgid ""
7689
"The kernel's packet filtering system would be of little use to "
7690
"administrators without a userspace interface to manage it. This is the "
7691
"purpose of iptables. When a packet reaches your server, it will be handed "
7692
"off to the Netfilter subsystem for acceptance, manipulation, or rejection "
7693
"based on the rules supplied to it from userspace via iptables. Thus, "
7694
"iptables is all you need to manage your firewall if you're familiar with it, "
7695
"but many frontends are available to simplify the task."
7696
msgstr ""
7697
7698
#: serverguide/C/security.xml:370(title)
7699
msgid "ufw - Uncomplicated Firewall"
7700
msgstr ""
7701
7702
#: serverguide/C/security.xml:371(para)
7703
msgid ""
7704
"The default firewall configuration tool for Ubuntu is "
7705
"<application>ufw</application>. Developed to ease iptables firewall "
7706
"configuration, <application>ufw</application> provides a user friendly way "
7707
"to create an IPv4 or IPv6 host-based firewall."
7708
msgstr ""
7709
7710
#: serverguide/C/security.xml:375(para)
7711
msgid ""
7712
"<application>ufw</application> by default is initially disabled. From the "
7713
"<application>ufw</application> man page:"
7714
msgstr ""
7715
7716
#: serverguide/C/security.xml:379(quote)
7717
msgid ""
7718
"ufw is not intended to provide complete firewall functionality via its "
7719
"command interface, but instead provides an easy way to add or remove simple "
7720
"rules. It is currently mainly used for host-based firewalls."
7721
msgstr ""
7722
7723
#: serverguide/C/security.xml:383(para)
7724
msgid ""
7725
"The following are some examples of how to use <application>ufw</application>:"
7726
msgstr ""
7727
7728
#: serverguide/C/security.xml:388(para)
7729
msgid ""
7730
"First, <application>ufw</application> needs to be enabled. From a terminal "
7731
"prompt enter:"
7732
msgstr ""
7733
7734
#: serverguide/C/security.xml:392(command)
7735
msgid "sudo ufw enable"
7736
msgstr ""
7737
7738
#: serverguide/C/security.xml:396(para)
7739
msgid "To open a port (ssh in this example):"
7740
msgstr ""
7741
7742
#: serverguide/C/security.xml:400(command)
7743
msgid "sudo ufw allow 22"
7744
msgstr ""
7745
7746
#: serverguide/C/security.xml:404(para)
7747
msgid "Rules can also be added using a <emphasis>numbered</emphasis> format:"
7748
msgstr ""
7749
7750
#: serverguide/C/security.xml:408(command)
7751
msgid "sudo ufw insert 1 allow 80"
7752
msgstr ""
7753
7754
#: serverguide/C/security.xml:412(para)
7755
msgid "Similarly, to close an opened port:"
7756
msgstr ""
7757
7758
#: serverguide/C/security.xml:416(command)
7759
msgid "sudo ufw deny 22"
7760
msgstr ""
7761
7762
#: serverguide/C/security.xml:420(para)
7763
msgid "To remove a rule, use delete followed by the rule:"
7764
msgstr ""
7765
7766
#: serverguide/C/security.xml:424(command)
7767
msgid "sudo ufw delete deny 22"
7768
msgstr ""
7769
7770
#: serverguide/C/security.xml:428(para)
7771
msgid ""
7772
"It is also possible to allow access from specific hosts or networks to a "
7773
"port. The following example allows ssh access from host 192.168.0.2 to any "
7774
"ip address on this host:"
7775
msgstr ""
7776
7777
#: serverguide/C/security.xml:433(command)
7778
msgid "sudo ufw allow proto tcp from 192.168.0.2 to any port 22"
7779
msgstr ""
7780
7781
#: serverguide/C/security.xml:435(para)
7782
msgid ""
7783
"Replace 192.168.0.2 with 192.168.0.0/24 to allow ssh access from the entire "
7784
"subnet."
7785
msgstr ""
7786
7787
#: serverguide/C/security.xml:441(para)
7788
msgid ""
7789
"Adding the <emphasis>--dry-run</emphasis> option to a "
7790
"<emphasis>ufw</emphasis> command will output the resulting rules, but not "
7791
"apply them. For example, the following is what would be applied if opening "
7792
"the HTTP port:"
7793
msgstr ""
7794
7795
#: serverguide/C/security.xml:447(command)
7796
msgid "sudo ufw --dry-run allow http"
7797
msgstr ""
7798
7799
#: serverguide/C/security.xml:451(computeroutput)
7800
#, no-wrap
7801
msgid ""
7802
"*filter\n"
7803
":ufw-user-input - [0:0]\n"
7804
":ufw-user-output - [0:0]\n"
7805
":ufw-user-forward - [0:0]\n"
7806
":ufw-user-limit - [0:0]\n"
7807
":ufw-user-limit-accept - [0:0]\n"
7808
"### RULES ###\n"
7809
"\n"
7810
"### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0\n"
7811
"-A ufw-user-input -p tcp --dport 80 -j ACCEPT\n"
7812
"\n"
7813
"### END RULES ###\n"
7814
"-A ufw-user-input -j RETURN\n"
7815
"-A ufw-user-output -j RETURN\n"
7816
"-A ufw-user-forward -j RETURN\n"
7817
"-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix \"[UFW "
7818
"LIMIT]: \"\n"
7819
"-A ufw-user-limit -j REJECT\n"
7820
"-A ufw-user-limit-accept -j ACCEPT\n"
7821
"COMMIT\n"
7822
"Rules updated"
7823
msgstr ""
7824
7825
#: serverguide/C/security.xml:475(para)
7826
msgid "<application>ufw</application> can be disabled by:"
7827
msgstr ""
7828
7829
#: serverguide/C/security.xml:479(command)
7830
msgid "sudo ufw disable"
7831
msgstr ""
7832
7833
#: serverguide/C/security.xml:483(para)
7834
msgid "To see the firewall status, enter:"
7835
msgstr ""
7836
7837
#: serverguide/C/security.xml:487(command)
7838
msgid "sudo ufw status"
7839
msgstr ""
7840
7841
#: serverguide/C/security.xml:491(para)
7842
msgid "And for more verbose status information use:"
7843
msgstr ""
7844
7845
#: serverguide/C/security.xml:495(command)
7846
msgid "sudo ufw status verbose"
7847
msgstr ""
7848
7849
#: serverguide/C/security.xml:499(para)
7850
msgid "To view the <emphasis>numbered</emphasis> format:"
7851
msgstr ""
7852
7853
#: serverguide/C/security.xml:503(command)
7854
msgid "sudo ufw status numbered"
7855
msgstr ""
7856
7857
#: serverguide/C/security.xml:508(para)
7858
msgid ""
7859
"If the port you want to open or close is defined in "
7860
"<filename>/etc/services</filename>, you can use the port name instead of the "
7861
"number. In the above examples, replace <emphasis>22</emphasis> with "
7862
"<emphasis>ssh</emphasis>."
7863
msgstr ""
7864
7865
#: serverguide/C/security.xml:514(para)
7866
msgid ""
7867
"This is a quick introduction to using <application>ufw</application>. Please "
7868
"refer to the <application>ufw</application> man page for more information."
7869
msgstr ""
7870
7871
#: serverguide/C/security.xml:520(title)
7872
msgid "ufw Application Integration"
7873
msgstr ""
7874
7875
#: serverguide/C/security.xml:522(para)
7876
msgid ""
7877
"Applications that open ports can include an <application>ufw</application> "
7878
"profile, which details the ports needed for the application to function "
7879
"properly. The profiles are kept in <filename "
7880
"role=\"directory\">/etc/ufw/applications.d</filename>, and can be edited if "
7881
"the default ports have been changed."
7882
msgstr ""
7883
7884
#: serverguide/C/security.xml:531(para)
7885
msgid ""
7886
"To view which applications have installed a profile, enter the following in "
7887
"a terminal:"
7888
msgstr ""
7889
7890
#: serverguide/C/security.xml:536(command)
7891
msgid "sudo ufw app list"
7892
msgstr ""
7893
7894
#: serverguide/C/security.xml:542(para)
7895
msgid ""
7896
"Similar to allowing traffic to a port, using an application profile is "
7897
"accomplished by entering:"
7898
msgstr ""
7899
7900
#: serverguide/C/security.xml:547(command)
7901
msgid "sudo ufw allow Samba"
7902
msgstr ""
7903
7904
#: serverguide/C/security.xml:553(para)
7905
msgid "An extended syntax is available as well:"
7906
msgstr ""
7907
7908
#: serverguide/C/security.xml:558(command)
7909
msgid "ufw allow from 192.168.0.0/24 to any app Samba"
7910
msgstr ""
7911
7912
#: serverguide/C/security.xml:561(para)
7913
msgid ""
7914
"Replace <emphasis>Samba</emphasis> and <emphasis>192.168.0.0/24</emphasis> "
7915
"with the application profile you are using and the IP range for your network."
7916
msgstr ""
7917
7918
#: serverguide/C/security.xml:567(para)
7919
msgid ""
7920
"There is no need to specify the <emphasis>protocol</emphasis> for the "
7921
"application, because that information is detailed in the profile. Also, note "
7922
"that the <emphasis>app</emphasis> name replaces the "
7923
"<emphasis>port</emphasis> number."
7924
msgstr ""
7925
7926
#: serverguide/C/security.xml:576(para)
7927
msgid ""
7928
"To view details about which ports, protocols, etc are defined for an "
7929
"application, enter:"
7930
msgstr ""
7931
7932
#: serverguide/C/security.xml:581(command)
7933
msgid "sudo ufw app info Samba"
7934
msgstr ""
7935
7936
#: serverguide/C/security.xml:587(para)
7937
msgid ""
7938
"Not all applications that require opening a network port come with "
7939
"<application>ufw</application> profiles, but if you have profiled an "
7940
"application and want the file to be included with the package, please file a "
7941
"bug against the package in <ulink "
7942
"url=\"https://launchpad.net/\">Launchpad</ulink>."
7943
msgstr ""
7944
7945
#: serverguide/C/security.xml:596(title)
7946
msgid "IP Masquerading"
7947
msgstr ""
7948
7949
#: serverguide/C/security.xml:597(para)
7950
msgid ""
7951
"The purpose of IP Masquerading is to allow machines with private, non-"
7952
"routable IP addresses on your network to access the Internet through the "
7953
"machine doing the masquerading. Traffic from your private network destined "
7954
"for the Internet must be manipulated for replies to be routable back to the "
7955
"machine that made the request. To do this, the kernel must modify the "
7956
"<emphasis>source</emphasis> IP address of each packet so that replies will "
7957
"be routed back to it, rather than to the private IP address that made the "
7958
"request, which is impossible over the Internet. Linux uses "
7959
"<emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which "
7960
"connections belong to which machines and reroute each return packet "
7961
"accordingly. Traffic leaving your private network is thus \"masqueraded\" as "
7962
"having originated from your Ubuntu gateway machine. This process is referred "
7963
"to in Microsoft documentation as Internet Connection Sharing."
7964
msgstr ""
7965
7966
#: serverguide/C/security.xml:613(title)
7967
msgid "ufw Masquerading"
7968
msgstr ""
7969
7970
#: serverguide/C/security.xml:614(para)
7971
msgid ""
7972
"IP Masquerading can be achieved using custom <application>ufw</application> "
7973
"rules. This is possible because the current back-end for "
7974
"<application>ufw</application> is <application>iptables-"
7975
"restore</application> with the rules files located in "
7976
"<filename>/etc/ufw/*.rules</filename>. These files are a great place to add "
7977
"legacy iptables rules used without <application>ufw</application>, and rules "
7978
"that are more network gateway or bridge related."
7979
msgstr ""
7980
7981
#: serverguide/C/security.xml:620(para)
7982
msgid ""
7983
"The rules are split into two different files, rules that should be executed "
7984
"before <application>ufw</application> command line rules, and rules that are "
7985
"executed after <application>ufw</application> command line rules."
7986
msgstr ""
7987
7988
#: serverguide/C/security.xml:626(para)
7989
msgid ""
7990
"First, packet forwarding needs to be enabled in "
7991
"<application>ufw</application>. Two configuration files will need to be "
7992
"adjusted, in <filename>/etc/default/ufw</filename> change the "
7993
"<emphasis>DEFAULT_FORWARD_POLICY</emphasis> to <quote>ACCEPT</quote>:"
7994
msgstr ""
7995
7996
#: serverguide/C/security.xml:630(programlisting)
7997
#, no-wrap
7998
msgid ""
7999
"\n"
8000
"DEFAULT_FORWARD_POLICY=\"ACCEPT\"\n"
8001
msgstr ""
8002
8003
#: serverguide/C/security.xml:633(para)
8004
msgid "Then edit <filename>/etc/ufw/sysctl.conf</filename> and uncomment:"
8005
msgstr ""
8006
8007
#: serverguide/C/security.xml:636(programlisting)
8008
#, no-wrap
8009
msgid ""
8010
"\n"
8011
"net/ipv4/ip_forward=1\n"
8012
msgstr ""
8013
8014
#: serverguide/C/security.xml:639(para)
8015
msgid "Similarly, for IPv6 forwarding uncomment:"
8016
msgstr ""
8017
8018
#: serverguide/C/security.xml:642(programlisting)
8019
#, no-wrap
8020
msgid ""
8021
"\n"
8022
"net/ipv6/conf/default/forwarding=1\n"
8023
msgstr ""
8024
8025
#: serverguide/C/security.xml:647(para)
8026
msgid ""
8027
"Now we will add rules to the <filename>/etc/ufw/before.rules</filename> "
8028
"file. The default rules only configure the <emphasis>filter</emphasis> "
8029
"table, and to enable masquerading the <emphasis>nat</emphasis> table will "
8030
"need to be configured. Add the following to the top of the file just after "
8031
"the header comments:"
8032
msgstr ""
8033
8034
#: serverguide/C/security.xml:652(programlisting)
8035
#, no-wrap
8036
msgid ""
8037
"\n"
8038
"# nat Table rules\n"
8039
"*nat\n"
8040
":POSTROUTING ACCEPT [0:0]\n"
8041
"\n"
8042
"# Forward traffic from eth1 through eth0.\n"
8043
"-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE\n"
8044
"\n"
8045
"# don't delete the 'COMMIT' line or these nat table rules won't be "
8046
"processed\n"
8047
"COMMIT\n"
8048
msgstr ""
8049
8050
#: serverguide/C/security.xml:663(para)
8051
msgid ""
8052
"The comments are not strictly necessary, but it is considered good practice "
8053
"to document your configuration. Also, when modifying any of the "
8054
"<emphasis>rules</emphasis> files in <filename "
8055
"class=\"directory\">/etc/ufw</filename>, make sure these lines are the last "
8056
"line for each table modified:"
8057
msgstr ""
8058
8059
#: serverguide/C/security.xml:669(programlisting)
8060
#, no-wrap
8061
msgid ""
8062
"\n"
8063
"# don't delete the 'COMMIT' line or these rules won't be processed\n"
8064
"COMMIT\n"
8065
msgstr ""
8066
8067
#: serverguide/C/security.xml:674(para)
8068
msgid ""
8069
"For each <emphasis>Table</emphasis> a corresponding "
8070
"<emphasis>COMMIT</emphasis> statement is required. In these examples only "
8071
"the <emphasis>nat</emphasis> and <emphasis>filter</emphasis> tables are "
8072
"shown, but you can also add rules for the <emphasis>raw</emphasis> and "
8073
"<emphasis>mangle</emphasis> tables."
8074
msgstr ""
8075
8076
#: serverguide/C/security.xml:681(para)
8077
msgid ""
8078
"In the above example replace <emphasis>eth0</emphasis>, "
8079
"<emphasis>eth1</emphasis>, and <emphasis>192.168.0.0/24</emphasis> with the "
8080
"appropriate interfaces and IP range for your network."
8081
msgstr ""
8082
8083
#: serverguide/C/security.xml:689(para)
8084
msgid ""
8085
"Finally, disable and re-enable <application>ufw</application> to apply the "
8086
"changes:"
8087
msgstr ""
8088
8089
#: serverguide/C/security.xml:693(command)
8090
msgid "sudo ufw disable && sudo ufw enable"
8091
msgstr ""
8092
8093
#: serverguide/C/security.xml:697(para)
8094
msgid ""
8095
"IP Masquerading should now be enabled. You can also add any additional "
8096
"FORWARD rules to the <filename>/etc/ufw/before.rules</filename>. It is "
8097
"recommended that these additional rules be added to the <emphasis>ufw-before-"
8098
"forward</emphasis> chain."
8099
msgstr ""
8100
8101
#: serverguide/C/security.xml:704(title)
8102
msgid "iptables Masquerading"
8103
msgstr ""
8104
8105
#: serverguide/C/security.xml:705(para)
8106
msgid ""
8107
"<application>iptables</application> can also be used to enable masquerading."
8108
msgstr ""
8109
8110
#: serverguide/C/security.xml:710(para)
8111
msgid ""
8112
"Similar to <application>ufw</application>, the first step is to enable IPv4 "
8113
"packet forwarding by editing <filename>/etc/sysctl.conf</filename> and "
8114
"uncomment the following line"
8115
msgstr ""
8116
8117
#: serverguide/C/security.xml:714(programlisting)
8118
#, no-wrap
8119
msgid ""
8120
"\n"
8121
"net.ipv4.ip_forward=1\n"
8122
msgstr ""
8123
8124
#: serverguide/C/security.xml:717(para)
8125
msgid "If you wish to enable IPv6 forwarding also uncomment:"
8126
msgstr ""
8127
8128
#: serverguide/C/security.xml:720(programlisting)
8129
#, no-wrap
8130
msgid ""
8131
"\n"
8132
"net.ipv6.conf.default.forwarding=1\n"
8133
msgstr ""
8134
8135
#: serverguide/C/security.xml:725(para)
8136
msgid ""
8137
"Next, execute the <application>sysctl</application> command to enable the "
8138
"new settings in the configuration file:"
8139
msgstr ""
8140
8141
#: serverguide/C/security.xml:729(command)
8142
msgid "sudo sysctl -p"
8143
msgstr ""
8144
8145
#: serverguide/C/security.xml:733(para)
8146
msgid ""
8147
"IP Masquerading can now be accomplished with a single iptables rule, which "
8148
"may differ slightly based on your network configuration:"
8149
msgstr ""
8150
8151
#: serverguide/C/security.xml:736(screen)
8152
#, no-wrap
8153
msgid ""
8154
"\n"
8155
"sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8156
msgstr ""
8157
8158
#: serverguide/C/security.xml:739(para)
8159
msgid ""
8160
"The above command assumes that your private address space is 192.168.0.0/16 "
8161
"and that your Internet-facing device is ppp0. The syntax is broken down as "
8162
"follows:"
8163
msgstr ""
8164
8165
#: serverguide/C/security.xml:744(para)
8166
msgid "-t nat -- the rule is to go into the nat table"
8167
msgstr ""
8168
8169
#: serverguide/C/security.xml:745(para)
8170
msgid ""
8171
"-A POSTROUTING -- the rule is to be appended (-A) to the POSTROUTING chain"
8172
msgstr ""
8173
8174
#: serverguide/C/security.xml:746(para)
8175
msgid ""
8176
"-s 192.168.0.0/16 -- the rule applies to traffic originating from the "
8177
"specified address space"
8178
msgstr ""
8179
8180
#: serverguide/C/security.xml:747(para)
8181
msgid ""
8182
"-o ppp0 -- the rule applies to traffic scheduled to be routed through the "
8183
"specified network device"
8184
msgstr ""
8185
8186
#: serverguide/C/security.xml:749(para)
8187
msgid ""
8188
"-j MASQUERADE -- traffic matching this rule is to \"jump\" (-j) to the "
8189
"MASQUERADE target to be manipulated as described above"
8190
msgstr ""
8191
8192
#: serverguide/C/security.xml:757(para)
8193
msgid ""
8194
"Also, each chain in the filter table (the default table, and where most or "
8195
"all packet filtering occurs) has a default <emphasis>policy</emphasis> of "
8196
"ACCEPT, but if you are creating a firewall in addition to a gateway device, "
8197
"you may have set the policies to DROP or REJECT, in which case your "
8198
"masqueraded traffic needs to be allowed through the FORWARD chain for the "
8199
"above rule to work:"
8200
msgstr ""
8201
8202
#: serverguide/C/security.xml:764(screen)
8203
#, no-wrap
8204
msgid ""
8205
"\n"
8206
"sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT\n"
8207
"sudo iptables -A FORWARD -d 192.168.0.0/16 -m state --state "
8208
"ESTABLISHED,RELATED -i ppp0 -j ACCEPT\n"
8209
msgstr ""
8210
8211
#: serverguide/C/security.xml:768(para)
8212
msgid ""
8213
"The above commands will allow all connections from your local network to the "
8214
"Internet and all traffic related to those connections to return to the "
8215
"machine that initiated them."
8216
msgstr ""
8217
8218
#: serverguide/C/security.xml:775(para)
8219
msgid ""
8220
"If you want masquerading to be enabled on reboot, which you probably do, "
8221
"edit <filename>/etc/rc.local</filename> and add any commands used above. For "
8222
"example add the first command with no filtering:"
8223
msgstr ""
8224
8225
#: serverguide/C/security.xml:779(screen)
8226
#, no-wrap
8227
msgid ""
8228
"\n"
8229
"iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8230
msgstr ""
8231
8232
#: serverguide/C/security.xml:787(title)
8233
msgid "Logs"
8234
msgstr ""
8235
8236
#: serverguide/C/security.xml:788(para)
8237
msgid ""
8238
"Firewall logs are essential for recognizing attacks, troubleshooting your "
8239
"firewall rules, and noticing unusual activity on your network. You must "
8240
"include logging rules in your firewall for them to be generated, though, and "
8241
"logging rules must come before any applicable terminating rule (a rule with "
8242
"a target that decides the fate of the packet, such as ACCEPT, DROP, or "
8243
"REJECT)."
8244
msgstr ""
8245
8246
#: serverguide/C/security.xml:795(para)
8247
msgid ""
8248
"If you are using <application>ufw</application>, you can turn on logging by "
8249
"entering the following in a terminal:"
8250
msgstr ""
8251
8252
#: serverguide/C/security.xml:799(command)
8253
msgid "sudo ufw logging on"
8254
msgstr ""
8255
8256
#: serverguide/C/security.xml:801(para)
8257
msgid ""
8258
"To turn logging off in <application>ufw</application>, simply replace "
8259
"<emphasis role=\"italic\">on</emphasis> with <emphasis "
8260
"role=\"italic\">off</emphasis> in the above command."
8261
msgstr ""
8262
8263
#: serverguide/C/security.xml:804(para)
8264
msgid ""
8265
"If using <application>iptables</application> instead of "
8266
"<application>ufw</application>, enter:"
8267
msgstr ""
8268
8269
#: serverguide/C/security.xml:807(screen)
8270
#, no-wrap
8271
msgid ""
8272
"\n"
8273
"sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j LOG --log-"
8274
"prefix \"NEW_HTTP_CONN: \"\n"
8275
msgstr ""
8276
8277
#: serverguide/C/security.xml:810(para)
8278
msgid ""
8279
"A request on port 80 from the local machine, then, would generate a log in "
8280
"dmesg that looks like this:"
8281
msgstr ""
8282
8283
#: serverguide/C/security.xml:815(programlisting)
8284
#, no-wrap
8285
msgid ""
8286
"[4304885.870000] NEW_HTTP_CONN: IN=lo OUT= "
8287
"MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 "
8288
"LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=58288 DF PROTO=TCP SPT=53981 DPT=80 "
8289
"WINDOW=32767 RES=0x00 SYN URGP=0"
8290
msgstr ""
8291
8292
#: serverguide/C/security.xml:817(para)
8293
msgid ""
8294
"The above log will also appear in <filename>/var/log/messages</filename>, "
8295
"<filename>/var/log/syslog</filename>, and "
8296
"<filename>/var/log/kern.log</filename>. This behavior can be modified by "
8297
"editing <filename>/etc/syslog.conf</filename> appropriately or by installing "
8298
"and configuring <application>ulogd</application> and using the ULOG target "
8299
"instead of LOG. The <application>ulogd</application> daemon is a userspace "
8300
"server that listens for logging instructions from the kernel specifically "
8301
"for firewalls, and can log to any file you like, or even to a "
8302
"<application>PostgreSQL</application> or <application>MySQL</application> "
8303
"database. Making sense of your firewall logs can be simplified by using a "
8304
"log analyzing tool such as <application>fwanalog</application>, "
8305
"<application> fwlogwatch</application>, or <application>lire</application>."
8306
msgstr ""
8307
8308
#: serverguide/C/security.xml:832(title)
8309
msgid "Other Tools"
8310
msgstr ""
8311
8312
#: serverguide/C/security.xml:833(para)
8313
msgid ""
8314
"There are many tools available to help you construct a complete firewall "
8315
"without intimate knowledge of iptables. For the GUI-inclined:"
8316
msgstr ""
8317
8318
#: serverguide/C/security.xml:839(para)
8319
msgid ""
8320
"<ulink url=\"http://www.fs-security.com/\">Firestarter</ulink> is quite "
8321
"popular and easy to use."
8322
msgstr ""
8323
8324
#: serverguide/C/security.xml:844(para)
8325
msgid ""
8326
"<ulink url=\"http://www.fwbuilder.org/\">fwbuilder</ulink> is very powerful "
8327
"and will look familiar to an administrator who has used a commercial "
8328
"firewall utility such as <application>Checkpoint FireWall-1</application>."
8329
msgstr ""
8330
8331
#: serverguide/C/security.xml:850(para)
8332
msgid ""
8333
"If you prefer a command-line tool with plain-text configuration files:"
8334
msgstr ""
8335
8336
#: serverguide/C/security.xml:855(para)
8337
msgid ""
8338
"<ulink url=\"http://www.shorewall.net/\">Shorewall</ulink> is a very "
8339
"powerful solution to help you configure an advanced firewall for any network."
8340
msgstr ""
8341
8342
#: serverguide/C/security.xml:861(para)
8343
msgid ""
8344
"<ulink url=\"http://www.linuxkungfu.org/\">ipkungfu</ulink> should give you "
8345
"a working firewall \"out of the box\" with zero configuration, and will "
8346
"allow you to easily set up a more advanced firewall by editing simple, well-"
8347
"documented configuration files."
8348
msgstr ""
8349
8350
#: serverguide/C/security.xml:868(para)
8351
msgid ""
8352
"<ulink url=\"http://fireflier.sourceforge.net/\">fireflier</ulink> is "
8353
"designed to be a desktop firewall application. It is made up of a server "
8354
"(fireflier-server) and your choice of GUI clients (GTK or QT), and behaves "
8355
"like many popular interactive firewall applications for Windows."
8356
msgstr ""
8357
8358
#: serverguide/C/security.xml:880(para)
8359
msgid ""
8360
"The <ulink url=\"https://wiki.ubuntu.com/UbuntuFirewall\">Ubuntu "
8361
"Firewall</ulink> wiki page contains information on the development of "
8362
"<application>ufw</application>."
8363
msgstr ""
8364
8365
#: serverguide/C/security.xml:886(para)
8366
msgid ""
8367
"Also, the <application>ufw</application> manual page contains some very "
8368
"useful information: <command>man ufw</command>."
8369
msgstr ""
8370
8371
#: serverguide/C/security.xml:891(para)
8372
msgid ""
8373
"See the <ulink url=\"http://www.netfilter.org/documentation/HOWTO/packet-"
8374
"filtering-HOWTO.html\">packet-filtering-HOWTO</ulink> for more information "
8375
"on using <application>iptables</application>."
8376
msgstr ""
8377
8378
#: serverguide/C/security.xml:897(para)
8379
msgid ""
8380
"The <ulink url=\"http://www.netfilter.org/documentation/HOWTO/NAT-"
8381
"HOWTO.html\">nat-HOWTO</ulink> contains further details on masquerading."
8382
msgstr ""
8383
8384
#: serverguide/C/security.xml:903(para)
8385
msgid ""
8386
"The <ulink url=\"https://help.ubuntu.com/community/IptablesHowTo\">IPTables "
8387
"HowTo</ulink> in the Ubuntu wiki is a great resource."
8388
msgstr ""
8389
8390
#: serverguide/C/security.xml:911(title)
8391
msgid "AppArmor"
8392
msgstr ""
8393
8394
#: serverguide/C/security.xml:912(para)
8395
msgid ""
8396
"<application>AppArmor</application> is a Linux Security Module "
8397
"implementation of name-based mandatory access controls. AppArmor confines "
8398
"individual programs to a set of listed files and posix 1003.1e draft "
8399
"capabilities."
8400
msgstr ""
8401
8402
#: serverguide/C/security.xml:916(para)
8403
msgid ""
8404
"<application>AppArmor</application> is installed and loaded by default. It "
8405
"uses <emphasis>profiles</emphasis> of an application to determine what files "
8406
"and permissions the application requires. Some packages will install their "
8407
"own profiles, and additional profiles can be found in the "
8408
"<application>apparmor-profiles</application> package."
8409
msgstr ""
8410
8411
#: serverguide/C/security.xml:921(para)
8412
msgid ""
8413
"To install the <application>apparmor-profiles</application> package from a "
8414
"terminal prompt:"
8415
msgstr ""
8416
8417
#: serverguide/C/security.xml:927(para)
8418
msgid "AppArmor profiles have two modes of execution:"
8419
msgstr ""
8420
8421
#: serverguide/C/security.xml:932(para)
8422
msgid ""
8423
"Complaining/Learning: profile violations are permitted and logged. Useful "
8424
"for testing and developing new profiles."
8425
msgstr ""
8426
8427
#: serverguide/C/security.xml:937(para)
8428
msgid ""
8429
"Enforced/Confined: enforces profile policy as well as logging the violation."
8430
msgstr ""
8431
8432
#: serverguide/C/security.xml:943(title)
8433
msgid "Using AppArmor"
8434
msgstr ""
8435
8436
#: serverguide/C/security.xml:944(para)
8437
msgid ""
8438
"The <application>apparmor-utils</application> package contains command line "
8439
"utilities that you can use to change the <application>AppArmor</application> "
8440
"execution mode, find the status of a profile, create new profiles, etc."
8441
msgstr ""
8442
8443
#: serverguide/C/security.xml:950(para)
8444
msgid ""
8445
"<application>apparmor_status</application> is used to view the current "
8446
"status of AppArmor profiles."
8447
msgstr ""
8448
8449
#: serverguide/C/security.xml:954(command)
8450
msgid "sudo apparmor_status"
8451
msgstr ""
8452
8453
#: serverguide/C/security.xml:958(para)
8454
msgid ""
8455
"<application>aa-complain</application> places a profile into "
8456
"<emphasis>complain</emphasis> mode."
8457
msgstr ""
8458
8459
#: serverguide/C/security.xml:962(command)
8460
msgid "sudo aa-complain /path/to/bin"
8461
msgstr ""
8462
8463
#: serverguide/C/security.xml:966(para)
8464
msgid ""
8465
"<application>aa-enforce</application> places a profile into "
8466
"<emphasis>enforce</emphasis> mode."
8467
msgstr ""
8468
8469
#: serverguide/C/security.xml:970(command)
8470
msgid "sudo aa-enforce /path/to/bin"
8471
msgstr ""
8472
8473
#: serverguide/C/security.xml:974(para)
8474
msgid ""
8475
"The <filename>/etc/apparmor.d</filename> directory is where the AppArmor "
8476
"profiles are located. It can be used to manipulate the "
8477
"<emphasis>mode</emphasis> of all profiles."
8478
msgstr ""
8479
8480
#: serverguide/C/security.xml:978(para)
8481
msgid "Enter the following to place all profiles into complain mode:"
8482
msgstr ""
8483
8484
#: serverguide/C/security.xml:982(command)
8485
msgid "sudo aa-complain /etc/apparmor.d/*"
8486
msgstr ""
8487
8488
#: serverguide/C/security.xml:984(para)
8489
msgid "To place all profiles in enforce mode:"
8490
msgstr ""
8491
8492
#: serverguide/C/security.xml:988(command)
8493
msgid "sudo aa-enforce /etc/apparmor.d/*"
8494
msgstr ""
8495
8496
#: serverguide/C/security.xml:992(para)
8497
msgid ""
8498
"<application>apparmor_parser</application> is used to load a profile into "
8499
"the kernel. It can also be used to reload a currently loaded profile using "
8500
"the <emphasis>-r</emphasis> option. To load a profile:"
8501
msgstr ""
8502
8503
#: serverguide/C/security.xml:997(command) serverguide/C/security.xml:1029(command)
8504
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a"
8505
msgstr ""
8506
8507
#: serverguide/C/security.xml:999(para)
8508
msgid "To reload a profile:"
8509
msgstr ""
8510
8511
#: serverguide/C/security.xml:1003(command)
8512
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r"
8513
msgstr ""
8514
8515
#: serverguide/C/security.xml:1007(para)
8516
msgid ""
8517
"<filename>/etc/init.d/apparmor</filename> can be used to "
8518
"<emphasis>reload</emphasis> all profiles:"
8519
msgstr ""
8520
8521
#: serverguide/C/security.xml:1011(command) serverguide/C/network-auth.xml:632(command)
8522
msgid "sudo /etc/init.d/apparmor reload"
8523
msgstr ""
8524
8525
#: serverguide/C/security.xml:1015(para)
8526
msgid ""
8527
"The <filename>/etc/apparmor.d/disable</filename> directory can be used along "
8528
"with the <application>apparmor_parser -R</application> option to "
8529
"<emphasis>disable</emphasis> a profile."
8530
msgstr ""
8531
8532
#: serverguide/C/security.xml:1020(command)
8533
msgid "sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/"
8534
msgstr ""
8535
8536
#: serverguide/C/security.xml:1021(command)
8537
msgid "sudo apparmor_parser -R /etc/apparmor.d/profile.name"
8538
msgstr ""
8539
8540
#: serverguide/C/security.xml:1023(para)
8541
msgid ""
8542
"To <emphasis>re-enable</emphasis> a disabled profile remove the symbolic "
8543
"link to the profile in <filename>/etc/apparmor.d/disable/</filename>. Then "
8544
"load the profile using the <emphasis>-a</emphasis> option."
8545
msgstr ""
8546
8547
#: serverguide/C/security.xml:1028(command)
8548
msgid "sudo rm /etc/apparmor.d/disable/profile.name"
8549
msgstr ""
8550
8551
#: serverguide/C/security.xml:1033(para)
8552
msgid ""
8553
"<application>AppArmor</application> can be disabled, and the kernel module "
8554
"unloaded by entering the following:"
8555
msgstr ""
8556
8557
#: serverguide/C/security.xml:1037(command)
8558
msgid "sudo /etc/init.d/apparmor stop"
8559
msgstr ""
8560
8561
#: serverguide/C/security.xml:1038(command)
8562
msgid "sudo update-rc.d -f apparmor remove"
8563
msgstr ""
8564
8565
#: serverguide/C/security.xml:1042(para)
8566
msgid "To re-enable <application>AppArmor</application> enter:"
8567
msgstr ""
8568
8569
#: serverguide/C/security.xml:1046(command)
8570
msgid "sudo /etc/init.d/apparmor start"
8571
msgstr ""
8572
8573
#: serverguide/C/security.xml:1047(command)
8574
msgid "sudo update-rc.d apparmor defaults"
8575
msgstr ""
8576
8577
#: serverguide/C/security.xml:1052(para)
8578
msgid ""
8579
"Replace <emphasis>profile.name</emphasis> with the name of the profile you "
8580
"want to manipulate. Also, replace <filename>/path/to/bin/</filename> with "
8581
"the actual executable file path. For example for the "
8582
"<application>ping</application> command use <filename>/bin/ping</filename>"
8583
msgstr ""
8584
8585
#: serverguide/C/security.xml:1060(title)
8586
msgid "Profiles"
8587
msgstr ""
8588
8589
#: serverguide/C/security.xml:1061(para)
8590
msgid ""
8591
"<application>AppArmor</application> profiles are simple text files located "
8592
"in <filename>/etc/apparmor.d/</filename>. The files are named after the full "
8593
"path to the executable they profile replacing the \"/\" with \".\". For "
8594
"example <filename>/etc/apparmor.d/bin.ping</filename> is the AppArmor "
8595
"profile for the <filename>/bin/ping</filename> command."
8596
msgstr ""
8597
8598
#: serverguide/C/security.xml:1067(para)
8599
msgid "There are two main type of rules used in profiles:"
8600
msgstr ""
8601
8602
#: serverguide/C/security.xml:1072(para)
8603
msgid ""
8604
"<emphasis>Path entries:</emphasis> which detail which files an application "
8605
"can access in the file system."
8606
msgstr ""
8607
8608
#: serverguide/C/security.xml:1077(para)
8609
msgid ""
8610
"<emphasis>Capability entries:</emphasis> determine what privileges a "
8611
"confined process is allowed to use."
8612
msgstr ""
8613
8614
#: serverguide/C/security.xml:1082(para)
8615
msgid ""
8616
"As an example take a look at <filename>/etc/apparmor.d/bin.ping</filename>:"
8617
msgstr ""
8618
8619
#: serverguide/C/security.xml:1085(programlisting)
8620
#, no-wrap
8621
msgid ""
8622
"\n"
8623
"#include <tunables/global>\n"
8624
"/bin/ping flags=(complain) {\n"
8625
" #include <abstractions/base>\n"
8626
" #include <abstractions/consoles>\n"
8627
" #include <abstractions/nameservice>\n"
8628
"\n"
8629
" capability net_raw,\n"
8630
" capability setuid,\n"
8631
" network inet raw,\n"
8632
" \n"
8633
" /bin/ping mixr,\n"
8634
" /etc/modules.conf r,\n"
8635
"}\n"
8636
msgstr ""
8637
8638
#: serverguide/C/security.xml:1102(para)
8639
msgid ""
8640
"<emphasis>#include <tunables/global>:</emphasis> include statements "
8641
"from other files. This allows statements pertaining to multiple applications "
8642
"to be placed in a common file."
8643
msgstr ""
8644
8645
#: serverguide/C/security.xml:1108(para)
8646
msgid ""
8647
"<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled "
8648
"program, also setting the mode to <emphasis>complain</emphasis>."
8649
msgstr ""
8650
8651
#: serverguide/C/security.xml:1114(para)
8652
msgid ""
8653
"<emphasis>capability net_raw,:</emphasis> allows the application access to "
8654
"the CAP_NET_RAW Posix.1e capability."
8655
msgstr ""
8656
8657
#: serverguide/C/security.xml:1119(para)
8658
msgid ""
8659
"<emphasis>/bin/ping mixr,:</emphasis> allows the application read and "
8660
"execute access to the file."
8661
msgstr ""
8662
8663
#: serverguide/C/security.xml:1125(para)
8664
msgid ""
8665
"After editing a profile file the profile must be reloaded. See <xref "
8666
"linkend=\"apparmor-usage\"/> for details."
8667
msgstr ""
8668
8669
#: serverguide/C/security.xml:1130(title)
8670
msgid "Creating a Profile"
8671
msgstr ""
8672
8673
#: serverguide/C/security.xml:1133(para)
8674
msgid ""
8675
"<emphasis>Design a test plan:</emphasis> Try to think about how the "
8676
"application should be exercised. The test plan should be divided into small "
8677
"test cases. Each test case should have a small description and list the "
8678
"steps to follow."
8679
msgstr ""
8680
8681
#: serverguide/C/security.xml:1137(para)
8682
msgid "Some standard test cases are:"
8683
msgstr ""
8684
8685
#: serverguide/C/security.xml:1142(para)
8686
msgid "Starting the program."
8687
msgstr ""
8688
8689
#: serverguide/C/security.xml:1147(para)
8690
msgid "Stopping the program."
8691
msgstr ""
8692
8693
#: serverguide/C/security.xml:1152(para)
8694
msgid "Reloading the program."
8695
msgstr ""
8696
8697
#: serverguide/C/security.xml:1157(para)
8698
msgid "Testing all the commands supported by the init script."
8699
msgstr ""
8700
8701
#: serverguide/C/security.xml:1164(para)
8702
msgid ""
8703
"<emphasis>Generate the new profile:</emphasis> Use <application>aa-"
8704
"genprof</application> to generate a new profile. From a terminal:"
8705
msgstr ""
8706
8707
#: serverguide/C/security.xml:1169(command)
8708
msgid "sudo aa-genprof executable"
8709
msgstr ""
8710
8711
#: serverguide/C/security.xml:1171(para)
8712
msgid "For example:"
8713
msgstr ""
8714
8715
#: serverguide/C/security.xml:1175(command)
8716
msgid "sudo aa-genprof slapd"
8717
msgstr ""
8718
8719
#: serverguide/C/security.xml:1179(para)
8720
msgid ""
8721
"To get your new profile included in the <application>apparmor-"
8722
"profiles</application> package, file a bug in <emphasis>Launchpad</emphasis> "
8723
"against the <ulink "
8724
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug\">AppArmor<"
8725
"/ulink> package:"
8726
msgstr ""
8727
8728
#: serverguide/C/security.xml:1186(para)
8729
msgid "Include your test plan and test cases."
8730
msgstr ""
8731
8732
#: serverguide/C/security.xml:1191(para)
8733
msgid "Attach your new profile to the bug."
8734
msgstr ""
8735
8736
#: serverguide/C/security.xml:1200(title)
8737
msgid "Updating Profiles"
8738
msgstr ""
8739
8740
#: serverguide/C/security.xml:1201(para)
8741
msgid ""
8742
"When the program is misbehaving, audit messages are sent to the log files. "
8743
"The program <application>aa-logprof</application> can be used to scan log "
8744
"files for <application>AppArmor</application> audit messages, review them "
8745
"and update the profiles. From a terminal:"
8746
msgstr ""
8747
8748
#: serverguide/C/security.xml:1206(command)
8749
msgid "sudo aa-logprof"
8750
msgstr ""
8751
8752
#: serverguide/C/security.xml:1214(para)
8753
msgid ""
8754
"See the <ulink "
8755
"url=\"http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/ind"
8756
"ex.html?page=/documentation/apparmor/apparmor201_sp10_admin/data/book_apparmo"
8757
"r_admin.html\">AppArmor Administration Guide</ulink> for advanced "
8758
"configuration options."
8759
msgstr ""
8760
8761
#: serverguide/C/security.xml:1221(para)
8762
msgid ""
8763
"For details using AppArmor with other Ubuntu releases see the <ulink "
8764
"url=\"https://help.ubuntu.com/community/AppArmor\"> AppArmor Community "
8765
"Wiki</ulink> page."
8766
msgstr ""
8767
8768
#: serverguide/C/security.xml:1229(para)
8769
msgid ""
8770
"The <ulink url=\"http://en.opensuse.org/AppArmor\">OpenSUSE AppArmor</ulink> "
8771
"page is another introduction to AppArmor."
8772
msgstr ""
8773
8774
#: serverguide/C/security.xml:1236(para)
8775
msgid ""
8776
"A great place to ask for <application>AppArmor</application> assistance, and "
8777
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
8778
"server</emphasis> IRC channel on <ulink "
8779
"url=\"http://freenode.net\">freenode</ulink>."
8780
msgstr ""
8781
8782
#: serverguide/C/security.xml:1246(title)
8783
msgid "Certificates"
8784
msgstr ""
8785
8786
#: serverguide/C/security.xml:1247(para)
8787
msgid ""
8788
"One of the most common forms of cryptography today is <emphasis>public-"
8789
"key</emphasis> cryptography. Public-key cryptography utilizes a "
8790
"<emphasis>public key</emphasis> and a <emphasis>private key</emphasis>. The "
8791
"system works by <emphasis>encrypting</emphasis> information using the public "
8792
"key. The information can then only be <emphasis>decrypted</emphasis> using "
8793
"the private key."
8794
msgstr ""
8795
8796
#: serverguide/C/security.xml:1253(para)
8797
msgid ""
8798
"A common use for public-key cryptography is encrypting application traffic "
8799
"using a Secure Socket Layer (SSL) or Transport Layer Security (TLS) "
8800
"connection. For example, configuring Apache to provide "
8801
"<emphasis>HTTPS</emphasis>, the HTTP protocol over SSL. This allows a way to "
8802
"encrypt traffic using a protocol that does not itself provide encryption."
8803
msgstr ""
8804
8805
#: serverguide/C/security.xml:1258(para)
8806
msgid ""
8807
"A <emphasis>Certificate</emphasis> is a method used to distribute a "
8808
"<emphasis>public key</emphasis> and other information about a server and the "
8809
"organization who is responsible for it. Certificates can be digitally signed "
8810
"by a <emphasis>Certification Authority</emphasis> or CA. A CA is a trusted "
8811
"third party that has confirmed that the information contained in the "
8812
"certificate is accurate."
8813
msgstr ""
8814
8815
#: serverguide/C/security.xml:1265(title)
8816
msgid "Types of Certificates"
8817
msgstr ""
8818
8819
#: serverguide/C/security.xml:1266(para)
8820
msgid ""
8821
"To set up a secure server using public-key cryptography, in most cases, you "
8822
"send your certificate request (including your public key), proof of your "
8823
"company's identity, and payment to a CA. The CA verifies the certificate "
8824
"request and your identity, and then sends back a certificate for your secure "
8825
"server. Alternatively, you can create your own <emphasis>self-"
8826
"signed</emphasis> certificate."
8827
msgstr ""
8828
8829
#: serverguide/C/security.xml:1276(para)
8830
msgid ""
8831
"Note, that self-signed certificates should not be used in most production "
8832
"environments."
8833
msgstr ""
8834
8835
#: serverguide/C/security.xml:1280(para)
8836
msgid ""
8837
"Continuing the HTTPS example, a CA-signed certificate provides two important "
8838
"capabilities that a self-signed certificate does not:"
8839
msgstr ""
8840
8841
#: serverguide/C/security.xml:1287(para)
8842
msgid ""
8843
"Browsers (usually) automatically recognize the certificate and allow a "
8844
"secure connection to be made without prompting the user."
8845
msgstr ""
8846
8847
#: serverguide/C/security.xml:1294(para)
8848
msgid ""
8849
"When a CA issues a signed certificate, it is guaranteeing the identity of "
8850
"the organization that is providing the web pages to the browser."
8851
msgstr ""
8852
8853
#: serverguide/C/security.xml:1302(para)
8854
msgid ""
8855
"Most Web browsers, and computers, that support SSL have a list of CAs whose "
8856
"certificates they automatically accept. If a browser encounters a "
8857
"certificate whose authorizing CA is not in the list, the browser asks the "
8858
"user to either accept or decline the connection. Also, other applications "
8859
"may generate an error message when using a self-singed certificate."
8860
msgstr ""
8861
8862
#: serverguide/C/security.xml:1310(para)
8863
msgid ""
8864
"The process of getting a certificate from a CA is fairly easy. A quick "
8865
"overview is as follows:"
8866
msgstr ""
8867
8868
#: serverguide/C/security.xml:1317(para)
8869
msgid "Create a private and public encryption key pair."
8870
msgstr ""
8871
8872
#: serverguide/C/security.xml:1320(para)
8873
msgid ""
8874
"Create a certificate request based on the public key. The certificate "
8875
"request contains information about your server and the company hosting it."
8876
msgstr ""
8877
8878
#: serverguide/C/security.xml:1325(para)
8879
msgid ""
8880
"Send the certificate request, along with documents proving your identity, to "
8881
"a CA. We cannot tell you which certificate authority to choose. Your "
8882
"decision may be based on your past experiences, or on the experiences of "
8883
"your friends or colleagues, or purely on monetary factors."
8884
msgstr ""
8885
8886
#: serverguide/C/security.xml:1331(para)
8887
msgid ""
8888
"Once you have decided upon a CA, you need to follow the instructions they "
8889
"provide on how to obtain a certificate from them."
8890
msgstr ""
8891
8892
#: serverguide/C/security.xml:1336(para)
8893
msgid ""
8894
"When the CA is satisfied that you are indeed who you claim to be, they send "
8895
"you a digital certificate."
8896
msgstr ""
8897
8898
#: serverguide/C/security.xml:1340(para)
8899
msgid ""
8900
"Install this certificate on your secure server, and configure the "
8901
"appropriate applications to use the certificate."
8902
msgstr ""
8903
8904
#: serverguide/C/security.xml:1349(title)
8905
msgid "Generating a Certificate Signing Request (CSR)"
8906
msgstr ""
8907
8908
#: serverguide/C/security.xml:1351(para)
8909
msgid ""
8910
"Whether you are getting a certificate from a CA or generating your own self-"
8911
"signed certificate, the first step is to generate a key."
8912
msgstr ""
8913
8914
#: serverguide/C/security.xml:1356(para)
8915
msgid ""
8916
"If the certificate will be used by service daemons, such as Apache, Postfix, "
8917
"Dovecot, etc, a key without a passphrase is often appropriate. Not having a "
8918
"passphrase allows the services to start without manual intervention, usually "
8919
"the preferred way to start a daemon."
8920
msgstr ""
8921
8922
#: serverguide/C/security.xml:1362(para)
8923
msgid ""
8924
"This section will cover generating a key with a passphrase, and one without. "
8925
"The non-passphrase key will then be used to generate a certificate that can "
8926
"be used with various service daemons."
8927
msgstr ""
8928
8929
#: serverguide/C/security.xml:1368(para)
8930
msgid ""
8931
"Running your secure service without a passphrase is convenient because you "
8932
"will not need to enter the passphrase every time you start your secure "
8933
"service. But it is insecure and a compromise of the key means a compromise "
8934
"of the server as well."
8935
msgstr ""
8936
8937
#: serverguide/C/security.xml:1375(para)
8938
msgid ""
8939
"To generate the <emphasis>keys</emphasis> for the Certificate Signing "
8940
"Request (CSR) run the following command from a terminal prompt:"
8941
msgstr ""
8942
8943
#: serverguide/C/security.xml:1381(command)
8944
msgid "openssl genrsa -des3 -out server.key 1024"
8945
msgstr ""
8946
8947
#: serverguide/C/security.xml:1384(programlisting)
8948
#, no-wrap
8949
msgid ""
8950
"\n"
8951
"Generating RSA private key, 1024 bit long modulus\n"
8952
".....................++++++\n"
8953
".................++++++\n"
8954
"unable to write 'random state'\n"
8955
"e is 65537 (0x10001)\n"
8956
"Enter pass phrase for server.key:\n"
8957
msgstr ""
8958
8959
#: serverguide/C/security.xml:1393(para)
8960
msgid ""
8961
"You can now enter your passphrase. For best security, it should at least "
8962
"contain eight characters. The minimum length when specifying -des3 is four "
8963
"characters. It should include numbers and/or punctuation and not be a word "
8964
"in a dictionary. Also remember that your passphrase is case-sensitive."
8965
msgstr ""
8966
8967
#: serverguide/C/security.xml:1401(para)
8968
msgid ""
8969
"Re-type the passphrase to verify. Once you have re-typed it correctly, the "
8970
"server key is generated and stored in the <filename>server.key</filename> "
8971
"file."
8972
msgstr ""
8973
8974
#: serverguide/C/security.xml:1407(para)
8975
msgid ""
8976
"Now create the insecure key, the one without a passphrase, and shuffle the "
8977
"key names:"
8978
msgstr ""
8979
8980
#: serverguide/C/security.xml:1413(command)
8981
msgid "openssl rsa -in server.key -out server.key.insecure"
8982
msgstr ""
8983
8984
#: serverguide/C/security.xml:1414(command)
8985
msgid "mv server.key server.key.secure"
8986
msgstr ""
8987
8988
#: serverguide/C/security.xml:1415(command)
8989
msgid "mv server.key.insecure server.key"
8990
msgstr ""
8991
8992
#: serverguide/C/security.xml:1418(para)
8993
msgid ""
8994
"The insecure key is now named <filename>server.key</filename>, and you can "
8995
"use this file to generate the CSR without passphrase."
8996
msgstr ""
8997
8998
#: serverguide/C/security.xml:1423(para)
8999
msgid "To create the CSR, run the following command at a terminal prompt:"
9000
msgstr ""
9001
9002
#: serverguide/C/security.xml:1428(command)
9003
msgid "openssl req -new -key server.key -out server.csr"
9004
msgstr ""
9005
9006
#: serverguide/C/security.xml:1431(para)
9007
msgid ""
9008
"It will prompt you enter the passphrase. If you enter the correct "
9009
"passphrase, it will prompt you to enter Company Name, Site Name, Email Id, "
9010
"etc. Once you enter all these details, your CSR will be created and it will "
9011
"be stored in the <filename>server.csr</filename> file."
9012
msgstr ""
9013
9014
#: serverguide/C/security.xml:1439(para)
9015
msgid ""
9016
"You can now submit this CSR file to a CA for processing. The CA will use "
9017
"this CSR file and issue the certificate. On the other hand, you can create "
9018
"self-signed certificate using this CSR."
9019
msgstr ""
9020
9021
#: serverguide/C/security.xml:1447(title)
9022
msgid "Creating a Self-Signed Certificate"
9023
msgstr ""
9024
9025
#: serverguide/C/security.xml:1448(para)
9026
msgid ""
9027
"To create the self-signed certificate, run the following command at a "
9028
"terminal prompt:"
9029
msgstr ""
9030
9031
#: serverguide/C/security.xml:1453(command)
9032
msgid ""
9033
"openssl x509 -req -days 365 -in server.csr -signkey server.key -out "
9034
"server.crt"
9035
msgstr ""
9036
9037
#: serverguide/C/security.xml:1456(para)
9038
msgid ""
9039
"The above command will prompt you to enter the passphrase. Once you enter "
9040
"the correct passphrase, your certificate will be created and it will be "
9041
"stored in the <filename>server.crt</filename> file."
9042
msgstr ""
9043
9044
#: serverguide/C/security.xml:1461(para)
9045
msgid ""
9046
"If your secure server is to be used in a production environment, you "
9047
"probably need a CA-signed certificate. It is not recommended to use self-"
9048
"signed certificate."
9049
msgstr ""
9050
9051
#: serverguide/C/security.xml:1469(title)
9052
msgid "Installing the Certificate"
9053
msgstr ""
9054
9055
#: serverguide/C/security.xml:1471(para)
9056
msgid ""
9057
"You can install the key file <filename>server.key</filename> and certificate "
9058
"file <filename>server.crt</filename>, or the certificate file issued by your "
9059
"CA, by running following commands at a terminal prompt:"
9060
msgstr ""
9061
9062
#: serverguide/C/security.xml:1477(command)
9063
msgid "sudo cp server.crt /etc/ssl/certs"
9064
msgstr ""
9065
9066
#: serverguide/C/security.xml:1478(command)
9067
msgid "sudo cp server.key /etc/ssl/private"
9068
msgstr ""
9069
9070
#: serverguide/C/security.xml:1480(para)
9071
msgid ""
9072
"Now simply configure any applications, with the ability to use public-key "
9073
"cryptography, to use the <emphasis>certificate</emphasis> and "
9074
"<emphasis>key</emphasis> files. For example, "
9075
"<application>Apache</application> can provide HTTPS, "
9076
"<application>Dovecot</application> can provide IMAPS and POP3S, etc."
9077
msgstr ""
9078
9079
#: serverguide/C/security.xml:1487(title)
9080
msgid "Certification Authority"
9081
msgstr ""
9082
9083
#: serverguide/C/security.xml:1489(para)
9084
msgid ""
9085
"If the services on your network require more than a few self-signed "
9086
"certificates it may be worth the additional effort to setup your own "
9087
"internal <emphasis>Certification Authority (CA)</emphasis>. Using "
9088
"certificates signed by your own CA, allows the various services using the "
9089
"certificates to easily trust other services using certificates issued from "
9090
"the same CA."
9091
msgstr ""
9092
9093
#: serverguide/C/security.xml:1499(para)
9094
msgid ""
9095
"First, create the directories to hold the CA certificate and related files:"
9096
msgstr ""
9097
9098
#: serverguide/C/security.xml:1504(command)
9099
msgid "sudo mkdir /etc/ssl/CA"
9100
msgstr ""
9101
9102
#: serverguide/C/security.xml:1505(command)
9103
msgid "sudo mkdir /etc/ssl/newcerts"
9104
msgstr ""
9105
9106
#: serverguide/C/security.xml:1511(para)
9107
msgid ""
9108
"The CA needs a few additional files to operate, one to keep track of the "
9109
"last serial number used by the CA, each certificate must have a unique "
9110
"serial number, and another file to record which certificates have been "
9111
"issued:"
9112
msgstr ""
9113
9114
#: serverguide/C/security.xml:1518(command)
9115
msgid "sudo sh -c \"echo '01' > /etc/ssl/CA/serial\""
9116
msgstr ""
9117
9118
#: serverguide/C/security.xml:1519(command)
9119
msgid "sudo touch /etc/ssl/CA/index.txt"
9120
msgstr ""
9121
9122
#: serverguide/C/security.xml:1525(para)
9123
msgid ""
9124
"The third file is a CA configuration file. Though not strictly necessary, it "
9125
"is very convenient when issuing multiple certificates. Edit "
9126
"<filename>/etc/ssl/openssl.cnf</filename>, and in the <emphasis>[ CA_default "
9127
"]</emphasis> change:"
9128
msgstr ""
9129
9130
#: serverguide/C/security.xml:1531(programlisting)
9131
#, no-wrap
9132
msgid ""
9133
"\n"
9134
"dir = /etc/ssl/ # Where everything is kept\n"
9135
"database = $dir/CA/index.txt # database index file.\n"
9136
"certificate = $dir/certs/cacert.pem # The CA certificate\n"
9137
"serial = $dir/CA/serial # The current serial number\n"
9138
"private_key = $dir/private/cakey.pem# The private key\n"
9139
msgstr ""
9140
9141
#: serverguide/C/security.xml:1542(para)
9142
msgid "Next, create the self-singed root certificate:"
9143
msgstr ""
9144
9145
#: serverguide/C/security.xml:1547(command)
9146
msgid ""
9147
"openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -"
9148
"days 3650"
9149
msgstr ""
9150
9151
#: serverguide/C/security.xml:1550(para)
9152
msgid "You will then be asked to enter the details about the certificate."
9153
msgstr ""
9154
9155
#: serverguide/C/security.xml:1557(para)
9156
msgid "Now install the root certificate and key:"
9157
msgstr ""
9158
9159
#: serverguide/C/security.xml:1562(command)
9160
msgid "sudo mv cakey.pem /etc/ssl/private/"
9161
msgstr ""
9162
9163
#: serverguide/C/security.xml:1563(command)
9164
msgid "sudo mv cacert.pem /etc/ssl/certs/"
9165
msgstr ""
9166
9167
#: serverguide/C/security.xml:1569(para)
9168
msgid ""
9169
"You are now ready to start signing certificates. The first item needed is a "
9170
"Certificate Signing Request (CSR), see <xref linkend=\"generating-a-csr\"/> "
9171
"for details. Once you have a CSR, enter the following to generate a "
9172
"certificate signed by the CA:"
9173
msgstr ""
9174
9175
#: serverguide/C/security.xml:1576(command)
9176
msgid "sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf"
9177
msgstr ""
9178
9179
#: serverguide/C/security.xml:1579(para)
9180
msgid ""
9181
"After entering the password for the CA key, you will be prompted to sign the "
9182
"certificate, and again to commit the new certificate. You should then see a "
9183
"somewhat large amount of output related to the certificate creation."
9184
msgstr ""
9185
9186
#: serverguide/C/security.xml:1588(para)
9187
msgid ""
9188
"There should now be a new file, "
9189
"<filename>/etc/ssl/newcerts/01.pem</filename>, containing the same output. "
9190
"Copy and paste everything between the <emphasis>-----BEGIN CERTIFICATE-----"
9191
"</emphasis> and <emphasis>----END CERTIFICATE-----</emphasis> lines to a "
9192
"file named after the hostname of the server where the certificate will be "
9193
"installed. For example <filename>mail.example.com.crt</filename>, is a nice "
9194
"descriptive name."
9195
msgstr ""
9196
9197
#: serverguide/C/security.xml:1596(para)
9198
msgid ""
9199
"Subsequent certificates will be named <filename>02.pem</filename>, "
9200
"<filename>03.pem</filename>, etc."
9201
msgstr ""
9202
9203
#: serverguide/C/security.xml:1601(para)
9204
msgid ""
9205
"Replace <emphasis>mail.example.com.crt</emphasis> with your own descriptive "
9206
"name."
9207
msgstr ""
9208
9209
#: serverguide/C/security.xml:1609(para)
9210
msgid ""
9211
"Finally, copy the new certificate to the host that needs it, and configure "
9212
"the appropriate applications to use it. The default location to install "
9213
"certificates is <filename role=\"directory\">/etc/ssl/certs</filename>. This "
9214
"enables multiple services to use the same certificate without overly "
9215
"complicated file permissions."
9216
msgstr ""
9217
9218
#: serverguide/C/security.xml:1615(para)
9219
msgid ""
9220
"For applications that can be configured to use a CA certificate, you should "
9221
"also copy the <filename>/etc/ssl/certs/cacert.pem</filename> file to the "
9222
"<filename role=\"directory\">/etc/ssl/certs/</filename> directory on each "
9223
"server."
9224
msgstr ""
9225
9226
#: serverguide/C/security.xml:1629(para)
9227
msgid ""
9228
"For more detailed instructions on using cryptography see the <ulink "
9229
"url=\"http://tldp.org/HOWTO/SSL-Certificates-HOWTO/index.html\">SSL "
9230
"Certificates HOWTO</ulink> by tlpd.org"
9231
msgstr ""
9232
9233
#: serverguide/C/security.xml:1635(para)
9234
msgid ""
9235
"<ulink url=\"http://www.pki-page.org/\">The PKI Page</ulink> contains a list "
9236
"of Certificate Authorities."
9237
msgstr ""
9238
9239
#: serverguide/C/security.xml:1640(para)
9240
msgid ""
9241
"The Wikipedia <ulink "
9242
"url=\"http://en.wikipedia.org/wiki/Https\">HTTPS</ulink> page has more "
9243
"information regarding HTTPS."
9244
msgstr ""
9245
9246
#: serverguide/C/security.xml:1645(para)
9247
msgid ""
9248
"For more information on <emphasis>OpenSSL</emphasis> see the <ulink "
9249
"url=\"http://www.openssl.org/\">OpenSSL Home Page</ulink>."
9250
msgstr ""
9251
9252
#: serverguide/C/security.xml:1650(para)
9253
msgid ""
9254
"Also, O'Reilly's <ulink "
9255
"url=\"http://oreilly.com/catalog/9780596002701/\">Network Security with "
9256
"OpenSSL</ulink> is a good in depth reference."
9257
msgstr ""
9258
9259
#: serverguide/C/security.xml:1659(title)
9260
msgid "eCryptfs"
9261
msgstr ""
9262
9263
#: serverguide/C/security.xml:1661(para)
9264
msgid ""
9265
"<emphasis>eCryptfs</emphasis> is a POSIX-compliant enterprise-class stacked "
9266
"cryptographic filesystem for Linux. Layering on top of the filesystem layer "
9267
"<emphasis>eCryptfs</emphasis> protects files no matter the underlying "
9268
"filesystem, partition type, etc."
9269
msgstr ""
9270
9271
#: serverguide/C/security.xml:1667(para)
9272
msgid ""
9273
"During installation there is an option to encrypt the <filename "
9274
"role=\"directory\">/home</filename> partition. This will automatically "
9275
"configure everything needed to encrypt and mount the partition."
9276
msgstr ""
9277
9278
#: serverguide/C/security.xml:1672(para)
9279
msgid ""
9280
"As an example, this section will cover configuring <filename "
9281
"role=\"directory\">/srv</filename> to be encrypted using eCryptfs."
9282
msgstr ""
9283
9284
#: serverguide/C/security.xml:1677(title)
9285
msgid "Using eCryptfs"
9286
msgstr ""
9287
9288
#: serverguide/C/security.xml:1679(para)
9289
msgid "First, install the necessary packages. From a terminal prompt enter:"
9290
msgstr ""
9291
9292
#: serverguide/C/security.xml:1684(command)
9293
msgid "sudo apt-get install ecryptfs-utils"
9294
msgstr ""
9295
9296
#: serverguide/C/security.xml:1687(para)
9297
msgid "Now mount the partition to be encrypted:"
9298
msgstr ""
9299
9300
#: serverguide/C/security.xml:1692(command)
9301
msgid "sudo mount -t ecryptfs /srv /srv"
9302
msgstr ""
9303
9304
#: serverguide/C/security.xml:1695(para)
9305
msgid ""
9306
"You will then be prompted for some details on how "
9307
"<application>ecryptfs</application> should encrypt the data."
9308
msgstr ""
9309
9310
#: serverguide/C/security.xml:1699(para)
9311
msgid ""
9312
"To test that files placed in <filename>/srv</filename> are indeed encrypted "
9313
"copy the <filename>/etc/default</filename> folder to "
9314
"<filename>/srv</filename>:"
9315
msgstr ""
9316
9317
#: serverguide/C/security.xml:1705(command) serverguide/C/clustering.xml:192(command)
9318
msgid "sudo cp -r /etc/default /srv"
9319
msgstr ""
9320
9321
#: serverguide/C/security.xml:1708(para)
9322
msgid "Now unmount <filename>/srv</filename>, and try to view a file:"
9323
msgstr ""
9324
9325
#: serverguide/C/security.xml:1713(command) serverguide/C/installation.xml:1138(command) serverguide/C/clustering.xml:200(command)
9326
msgid "sudo umount /srv"
9327
msgstr ""
9328
9329
#: serverguide/C/security.xml:1714(command)
9330
msgid "cat /srv/default/cron"
9331
msgstr ""
9332
9333
#: serverguide/C/security.xml:1717(para)
9334
msgid ""
9335
"Remounting <filename>/srv</filename> using "
9336
"<application>ecryptfs</application> will make the data viewable once again."
9337
msgstr ""
9338
9339
#: serverguide/C/security.xml:1723(title)
9340
msgid "Automatically Mounting Encrypted Partitions"
9341
msgstr ""
9342
9343
#: serverguide/C/security.xml:1725(para)
9344
msgid ""
9345
"There are a couple of ways to automatically mount an "
9346
"<application>ecryptfs</application> encrypted filesystem at boot. This "
9347
"example will use a <filename>/root/.ecryptfsrc</filename> file containing "
9348
"mount options, along with a passphrase file residing on a USB key."
9349
msgstr ""
9350
9351
#: serverguide/C/security.xml:1731(para)
9352
msgid "First, create <filename>/root/.ecryptfsrc</filename> containing:"
9353
msgstr ""
9354
9355
#: serverguide/C/security.xml:1735(programlisting)
9356
#, no-wrap
9357
msgid ""
9358
"\n"
9359
"key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt\n"
9360
"ecryptfs_sig=5826dd62cf81c615\n"
9361
"ecryptfs_cipher=aes\n"
9362
"ecryptfs_key_bytes=16\n"
9363
"ecryptfs_passthrough=n\n"
9364
"ecryptfs_enable_filename_crypto=n\n"
9365
msgstr ""
9366
9367
#: serverguide/C/security.xml:1745(para)
9368
msgid ""
9369
"Adjust the <emphasis>ecryptfs_sig</emphasis> to the signature in "
9370
"<filename>/root/.ecryptfs/sig-cache.txt</filename>."
9371
msgstr ""
9372
9373
#: serverguide/C/security.xml:1750(para)
9374
msgid ""
9375
"Next, create the <filename>/mnt/usb/passwd_file.txt</filename> passphrase "
9376
"file:"
9377
msgstr ""
9378
9379
#: serverguide/C/security.xml:1754(programlisting)
9380
#, no-wrap
9381
msgid ""
9382
"\n"
9383
"passphrase_passwd=[secrets]\n"
9384
msgstr ""
9385
9386
#: serverguide/C/security.xml:1758(para)
9387
msgid "Now add the necessary lines to <filename>/etc/fstab</filename>:"
9388
msgstr ""
9389
9390
#: serverguide/C/security.xml:1762(programlisting)
9391
#, no-wrap
9392
msgid ""
9393
"\n"
9394
"/dev/sdb1 /mnt/usb ext3 ro 0 0\n"
9395
"/srv /srv ecryptfs defaults 0 0\n"
9396
msgstr ""
9397
9398
#: serverguide/C/security.xml:1767(para)
9399
msgid "Make sure the USB drive is mounted before the encrypted partition."
9400
msgstr ""
9401
9402
#: serverguide/C/security.xml:1771(para)
9403
msgid ""
9404
"Finally, reboot and the <filename>/srv</filename> should be mounted using "
9405
"ecryptfs."
9406
msgstr ""
9407
9408
#: serverguide/C/security.xml:1779(para)
9409
msgid ""
9410
"The <application>ecryptfs-utils</application> package includes several other "
9411
"useful utilities:"
9412
msgstr ""
9413
9414
#: serverguide/C/security.xml:1785(para)
9415
msgid ""
9416
"<emphasis>ecryptfs-setup-private:</emphasis> creates a "
9417
"<filename>~/Private</filename> directory to contain encrypted information. "
9418
"This utility can be run by unprivileged users to keep data private from "
9419
"other users on the system."
9420
msgstr ""
9421
9422
#: serverguide/C/security.xml:1792(para)
9423
msgid ""
9424
"<emphasis>ecryptfs-mount-private and ecryptfs-umount-private:</emphasis> "
9425
"will mount and unmount respectively, a users <filename>~/Private</filename> "
9426
"directory."
9427
msgstr ""
9428
9429
#: serverguide/C/security.xml:1798(para)
9430
msgid ""
9431
"<emphasis>ecryptfs-add-passphrase:</emphasis> adds a new passphrase to the "
9432
"kernel keyring."
9433
msgstr ""
9434
9435
#: serverguide/C/security.xml:1803(para)
9436
msgid ""
9437
"<emphasis>ecryptfs-manager:</emphasis> manages "
9438
"<application>eCryptfs</application> objects such as keys."
9439
msgstr ""
9440
9441
#: serverguide/C/security.xml:1808(para)
9442
msgid ""
9443
"<emphasis>ecryptfs-stat:</emphasis> allows you to view the "
9444
"<application>ecryptfs</application> meta information for a file."
9445
msgstr ""
9446
9447
#: serverguide/C/security.xml:1821(para)
9448
msgid ""
9449
"For more information on eCryptfs see the <ulink "
9450
"url=\"https://launchpad.net/ecryptfs\">Launchpad project page</ulink>."
9451
msgstr ""
9452
9453
#: serverguide/C/security.xml:1826(para)
9454
msgid ""
9455
"There is also a <ulink "
9456
"url=\"http://www.linuxjournal.com/article/9400\">Linux Journal</ulink> "
9457
"article covering eCryptfs."
9458
msgstr ""
9459
9460
#: serverguide/C/security.xml:1831(para)
9461
msgid ""
9462
"Also, for more <application>ecryptfs</application> options see the <ulink "
9463
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/ecryptfs.7.html\">ecr"
9464
"yptfs man page</ulink>."
9465
msgstr ""
9466
9467
#: serverguide/C/security.xml:1837(para)
9468
msgid ""
9469
"The <ulink url=\"https://help.ubuntu.com/community/eCryptfs\">eCryptfs "
9470
"Ubuntu Wiki</ulink> page also has more details."
9471
msgstr ""
9472
9473
#: serverguide/C/reporting-bugs.xml:13(title)
9474
msgid "Appendix"
9475
msgstr ""
9476
9477
#: serverguide/C/reporting-bugs.xml:16(title)
9478
msgid "Reporting Bugs in Ubuntu Server Edition"
9479
msgstr ""
9480
9481
#: serverguide/C/reporting-bugs.xml:18(para)
9482
msgid ""
9483
"While the Ubuntu Project attempts to release software with as few bugs as "
9484
"possible, they do occur. You can help fix these bugs by reporting ones that "
9485
"you find to the project. The Ubuntu Project uses <ulink "
9486
"url=\"https://launchpad.net/\">Launchpad</ulink> to track its bug reports. "
9487
"In order to file a bug about Ubuntu Server on Launchpad, you will need to "
9488
"<ulink url=\"https://help.launchpad.net/YourAccount/NewAccount\">create an "
9489
"account</ulink>."
9490
msgstr ""
9491
9492
#: serverguide/C/reporting-bugs.xml:30(title)
9493
msgid "Reporting Bugs With ubuntu-bug"
9494
msgstr ""
9495
9496
#: serverguide/C/reporting-bugs.xml:32(para)
9497
msgid ""
9498
"The preferred way to report a bug is with the <application>ubuntu-"
9499
"bug</application> command. The ubuntu-bug tool gathers information about the "
9500
"system useful to developers in diagnosing the reported problem that will "
9501
"then be included in the bug report filed on Launchpad. Bug reports in Ubuntu "
9502
"need to be filed against a specific software package, thus the name of the "
9503
"package that the bug occurs in needs to be given to ubuntu-bug:"
9504
msgstr ""
9505
9506
#: serverguide/C/reporting-bugs.xml:43(command)
9507
msgid "ubuntu-bug PACKAGENAME"
9508
msgstr ""
9509
9510
#: serverguide/C/reporting-bugs.xml:46(para)
9511
msgid ""
9512
"For example, to file a bug against the openssh-server package, you would do:"
9513
msgstr ""
9514
9515
#: serverguide/C/reporting-bugs.xml:51(command)
9516
msgid "ubuntu-bug openssh-server"
9517
msgstr ""
9518
9519
#: serverguide/C/reporting-bugs.xml:54(para)
9520
msgid ""
9521
"You can specify either a binary package or the source package for ubuntu-"
9522
"bug. Again using openssh-server as an example, you could also generate the "
9523
"report against the source package for openssh-server, openssh:"
9524
msgstr ""
9525
9526
#: serverguide/C/reporting-bugs.xml:62(command)
9527
msgid "ubuntu-bug openssh"
9528
msgstr ""
9529
9530
#: serverguide/C/reporting-bugs.xml:66(para)
9531
msgid ""
9532
"See <xref linkend=\"package-management\"/> for more information about "
9533
"packages in Ubuntu."
9534
msgstr ""
9535
9536
#: serverguide/C/reporting-bugs.xml:72(para)
9537
msgid ""
9538
"The ubuntu-bug command will gather information about the system in question, "
9539
"possibly including information specific to the specified package, and then "
9540
"ask you what you would like to do with collected information:"
9541
msgstr ""
9542
9543
#: serverguide/C/reporting-bugs.xml:80(command)
9544
msgid "ubuntu-bug postgresql"
9545
msgstr ""
9546
9547
#: serverguide/C/reporting-bugs.xml:79(screen)
9548
#, no-wrap
9549
msgid ""
9550
"\n"
9551
"<placeholder-1/>\n"
9552
"\n"
9553
"*** Collecting problem information\n"
9554
"\n"
9555
"The collected information can be sent to the developers to improve the\n"
9556
"application. This might take a few minutes.\n"
9557
"..........\n"
9558
"\n"
9559
"*** Send problem report to the developers?\n"
9560
"\n"
9561
"After the problem report has been sent, please fill out the form in the\n"
9562
"automatically opened web browser.\n"
9563
"\n"
9564
"What would you like to do? Your options are:\n"
9565
" S: Send report (1.7 KiB)\n"
9566
" V: View report\n"
9567
" K: Keep report file for sending later or copying to somewhere else\n"
9568
" C: Cancel\n"
9569
"Please choose (S/V/K/C):\n"
9570
msgstr ""
9571
9572
#: serverguide/C/reporting-bugs.xml:101(para)
9573
msgid "The options available are:"
9574
msgstr ""
9575
9576
#: serverguide/C/reporting-bugs.xml:108(para)
9577
msgid ""
9578
"<emphasis role=\"bold\">Send Report</emphasis> Selecting Send Report submits "
9579
"the collected information to Launchpad as part of the the process of filing "
9580
"a bug report. You will be given the opportunity to describe the situation "
9581
"that led up to the occurrance of the bug."
9582
msgstr ""
9583
9584
#: serverguide/C/reporting-bugs.xml:115(screen)
9585
#, no-wrap
9586
msgid ""
9587
"\n"
9588
"*** Uploading problem information\n"
9589
"\n"
9590
"The collected information is being sent to the bug tracking system.\n"
9591
"This might take a few minutes.\n"
9592
"91%\n"
9593
"\n"
9594
"*** To continue, you must visit the following URL:\n"
9595
"\n"
9596
" https://bugs.launchpad.net/ubuntu/+source/postgresql-"
9597
"8.4/+filebug/kc6eSnTLnLxF8u0t3e56EukFeqJ?\n"
9598
"\n"
9599
"You can launch a browser now, or copy this URL into a browser on another\n"
9600
"computer.\n"
9601
"\n"
9602
"Choices:\n"
9603
" 1: Launch a browser now\n"
9604
" C: Cancel\n"
9605
"Please choose (1/C):\n"
9606
msgstr ""
9607
9608
#: serverguide/C/reporting-bugs.xml:135(para)
9609
msgid ""
9610
"If you choose to start a browser, by default the text based web browser "
9611
"<application>w3m</application> will be used to finish filing the bug report. "
9612
"Alternately, you can copy the given URL to a currently running web browser."
9613
msgstr ""
9614
9615
#: serverguide/C/reporting-bugs.xml:144(para)
9616
msgid ""
9617
"<emphasis role=\"bold\">View Report</emphasis> Selecting View Report causes "
9618
"the collected information to be displayed to the terminal for review."
9619
msgstr ""
9620
9621
#: serverguide/C/reporting-bugs.xml:150(screen)
9622
#, no-wrap
9623
msgid ""
9624
"\n"
9625
"Package: postgresql 8.4.2-2\n"
9626
"PackageArchitecture: all\n"
9627
"Tags: lucid\n"
9628
"ProblemType: Bug\n"
9629
"ProcEnviron:\n"
9630
" LANG=en_US.UTF-8\n"
9631
" SHELL=/bin/bash\n"
9632
"Uname: Linux 2.6.32-16-server x86_64\n"
9633
"Dependencies:\n"
9634
" adduser 3.112ubuntu1\n"
9635
" base-files 5.0.0ubuntu10\n"
9636
" base-passwd 3.5.22\n"
9637
" coreutils 7.4-2ubuntu2\n"
9638
"...\n"
9639
msgstr ""
9640
9641
#: serverguide/C/reporting-bugs.xml:167(para)
9642
msgid ""
9643
"After viewing the report, you will be brought back to the same menu asking "
9644
"what you would like to do with the report."
9645
msgstr ""
9646
9647
#: serverguide/C/reporting-bugs.xml:174(para)
9648
msgid ""
9649
"<emphasis role=\"bold\">Keep Report File</emphasis> Selecting Keep Report "
9650
"File causes the gathered information to be written to a file. This file can "
9651
"then be used to later file a bug report or transferred to a different Ubuntu "
9652
"system for reporting. To submit the report file, simply give it as an "
9653
"argument to the ubuntu-bug command:"
9654
msgstr ""
9655
9656
#: serverguide/C/reporting-bugs.xml:189(userinput)
9657
#, no-wrap
9658
msgid "k"
9659
msgstr ""
9660
9661
#: serverguide/C/reporting-bugs.xml:192(command)
9662
msgid "ubuntu-bug /tmp/apport.postgresql.v4MQas.apport"
9663
msgstr ""
9664
9665
#: serverguide/C/reporting-bugs.xml:183(screen)
9666
#, no-wrap
9667
msgid ""
9668
"\n"
9669
"What would you like to do? Your options are:\n"
9670
" S: Send report (1.7 KiB)\n"
9671
" V: View report\n"
9672
" K: Keep report file for sending later or copying to somewhere else\n"
9673
" C: Cancel\n"
9674
"Please choose (S/V/K/C): <placeholder-1/>\n"
9675
"Problem report file: /tmp/apport.postgresql.v4MQas.apport\n"
9676
"\n"
9677
"<placeholder-2/>\n"
9678
"\n"
9679
"*** Send problem report to the developers?\n"
9680
"...\n"
9681
msgstr ""
9682
9683
#: serverguide/C/reporting-bugs.xml:200(para)
9684
msgid ""
9685
"<emphasis role=\"bold\">Cancel</emphasis> Selecting Cancel causes the "
9686
"collected information to be discarded."
9687
msgstr ""
9688
9689
#: serverguide/C/reporting-bugs.xml:210(title)
9690
msgid "Reporting Application Crashes"
9691
msgstr ""
9692
9693
#: serverguide/C/reporting-bugs.xml:212(para)
9694
msgid ""
9695
"The software package that provides the ubuntu-bug utility, "
9696
"<application>apport</application>, can be configured to trigger when "
9697
"applications crash. This is disabled by default, as capturing a crash can be "
9698
"resource intensive depending on how much memory the application that crashed "
9699
"was using as apport captures and processes the core dump."
9700
msgstr ""
9701
9702
#: serverguide/C/reporting-bugs.xml:221(para)
9703
msgid ""
9704
"Configuring apport to capture information about crashing applications "
9705
"requires a couple of steps. First, <application>gdb</application> needs to "
9706
"be installed; it is not installed by default in Ubuntu Server Edition."
9707
msgstr ""
9708
9709
#: serverguide/C/reporting-bugs.xml:229(command)
9710
msgid "sudo apt-get install gdb"
9711
msgstr ""
9712
9713
#: serverguide/C/reporting-bugs.xml:232(para)
9714
msgid ""
9715
"See <xref linkend=\"package-management\"/> for more information about "
9716
"managing packages in Ubuntu."
9717
msgstr ""
9718
9719
#: serverguide/C/reporting-bugs.xml:237(para)
9720
msgid ""
9721
"Once you have ensured that gdb is installed, open the file "
9722
"<filename>/etc/default/apport</filename> in your text editor, and change the "
9723
"<emphasis>enabled</emphasis> setting to be <emphasis "
9724
"role=\"bold\">1</emphasis> like so:"
9725
msgstr ""
9726
9727
#: serverguide/C/reporting-bugs.xml:244(programlisting)
9728
#, no-wrap
9729
msgid ""
9730
"\n"
9731
"# set this to 0 to disable apport, or to 1 to enable it\n"
9732
"# you can temporarily override this with\n"
9733
"# sudo service apport start force_start=1\n"
9734
"enabled=<userinput>1</userinput>\n"
9735
"\n"
9736
"# set maximum core dump file size (default: 209715200 bytes == 200 MB)\n"
9737
"maxsize=209715200\n"
9738
msgstr ""
9739
9740
#: serverguide/C/reporting-bugs.xml:254(para)
9741
msgid ""
9742
"Once you have completed editing <filename>/etc/default/apport</filename>, "
9743
"start the apport service:"
9744
msgstr ""
9745
9746
#: serverguide/C/reporting-bugs.xml:261(command)
9747
msgid "sudo start apport"
9748
msgstr ""
9749
9750
#: serverguide/C/reporting-bugs.xml:264(para)
9751
msgid ""
9752
"After an application crashes, use the <application>apport-cli</application> "
9753
"command to search for the existing saved crash report information:"
9754
msgstr ""
9755
9756
#: serverguide/C/reporting-bugs.xml:271(command)
9757
msgid "apport-cli"
9758
msgstr ""
9759
9760
#: serverguide/C/reporting-bugs.xml:270(screen)
9761
#, no-wrap
9762
msgid ""
9763
"\n"
9764
"<placeholder-1/>\n"
9765
"\n"
9766
"*** dash closed unexpectedly on 2010-03-11 at 21:40:59.\n"
9767
"\n"
9768
"If you were not doing anything confidential (entering passwords or other\n"
9769
"private information), you can help to improve the application by\n"
9770
"reporting\n"
9771
"the problem.\n"
9772
"\n"
9773
"What would you like to do? Your options are:\n"
9774
" R: Report Problem...\n"
9775
" I: Cancel and ignore future crashes of this program version\n"
9776
" C: Cancel\n"
9777
"Please choose (R/I/C):\n"
9778
msgstr ""
9779
9780
#: serverguide/C/reporting-bugs.xml:287(para)
9781
msgid ""
9782
"Selecting <emphasis>Report Problem</emphasis> will walk you through similar "
9783
"steps as when using ubuntu-bug. One important difference is that a crash "
9784
"report will be marked as private when filed on Launchpad, meaning that it "
9785
"will be visible to only a limited set of bug triagers. These triagers will "
9786
"review the gathered data for private information before making the bug "
9787
"report publicly visible."
9788
msgstr ""
9789
9790
#: serverguide/C/reporting-bugs.xml:307(para)
9791
msgid ""
9792
"See the <ulink "
9793
"url=\"https://help.ubuntu.com/community/ReportingBugs\">Reporting "
9794
"Bugs</ulink> Ubuntu wiki page."
9795
msgstr ""
9796
9797
#: serverguide/C/reporting-bugs.xml:313(para)
9798
msgid ""
9799
"Also, the <ulink url=\"https://wiki.ubuntu.com/Apport\">Apport</ulink> page "
9800
"has some useful information. Though some of it pertains to using a GUI."
9801
msgstr ""
9802
9803
#: serverguide/C/remote-administration.xml:13(title)
9804
msgid "Remote Administration"
9805
msgstr ""
9806
9807
#: serverguide/C/remote-administration.xml:14(para)
9808
msgid ""
9809
"There are many ways to remotely administer a Linux server. This chapter will "
9810
"cover one of the most popular <application>SSH</application> as well as "
9811
"<application>eBox</application>, a web based administration framework."
9812
msgstr ""
9813
9814
#: serverguide/C/remote-administration.xml:23(para)
9815
msgid ""
9816
"This section of the Ubuntu Server Guide introduces a powerful collection of "
9817
"tools for the remote control of networked computers and transfer of data "
9818
"between networked computers, called <emphasis>OpenSSH</emphasis>. You will "
9819
"also learn about some of the configuration settings possible with the "
9820
"OpenSSH server application and how to change them on your Ubuntu system."
9821
msgstr ""
9822
9823
#: serverguide/C/remote-administration.xml:30(para)
9824
msgid ""
9825
"OpenSSH is a freely available version of the Secure Shell (SSH) protocol "
9826
"family of tools for remotely controlling a computer or transferring files "
9827
"between computers. Traditional tools used to accomplish these functions, "
9828
"such as <application>telnet</application> or <application>rcp</application>, "
9829
"are insecure and transmit the user's password in cleartext when used. "
9830
"OpenSSH provides a server daemon and client tools to facilitate secure, "
9831
"encrypted remote control and file transfer operations, effectively replacing "
9832
"the legacy tools."
9833
msgstr ""
9834
9835
#: serverguide/C/remote-administration.xml:39(para)
9836
msgid ""
9837
"The OpenSSH server component, <application>sshd</application>, listens "
9838
"continuously for client connections from any of the client tools. When a "
9839
"connection request occurs, <application>sshd</application> sets up the "
9840
"correct connection depending on the type of client tool connecting. For "
9841
"example, if the remote computer is connecting with the "
9842
"<application>ssh</application> client application, the OpenSSH server sets "
9843
"up a remote control session after authentication. If a remote user connects "
9844
"to an OpenSSH server with <application>scp</application>, the OpenSSH server "
9845
"daemon initiates a secure copy of files between the server and client after "
9846
"authentication. OpenSSH can use many authentication methods, including plain "
9847
"password, public key, and <application>Kerberos</application> tickets."
9848
msgstr ""
9849
9850
#: serverguide/C/remote-administration.xml:53(para)
9851
msgid ""
9852
"Installation of the OpenSSH client and server applications is simple. To "
9853
"install the OpenSSH client applications on your Ubuntu system, use this "
9854
"command at a terminal prompt:"
9855
msgstr ""
9856
9857
#: serverguide/C/remote-administration.xml:59(command)
9858
msgid "sudo apt-get install openssh-client"
9859
msgstr ""
9860
9861
#: serverguide/C/remote-administration.xml:61(para)
9862
msgid ""
9863
"To install the OpenSSH server application, and related support files, use "
9864
"this command at a terminal prompt:"
9865
msgstr ""
9866
9867
#: serverguide/C/remote-administration.xml:66(command)
9868
msgid "sudo apt-get install openssh-server"
9869
msgstr ""
9870
9871
#: serverguide/C/remote-administration.xml:68(para)
9872
msgid ""
9873
"The <application>openssh-server</application> package can also be selected "
9874
"to install during the Server Edition installation process."
9875
msgstr ""
9876
9877
#: serverguide/C/remote-administration.xml:75(para)
9878
msgid ""
9879
"You may configure the default behavior of the OpenSSH server application, "
9880
"<application>sshd</application>, by editing the file "
9881
"<filename>/etc/ssh/sshd_config</filename>. For information about the "
9882
"configuration directives used in this file, you may view the appropriate "
9883
"manual page with the following command, issued at a terminal prompt:"
9884
msgstr ""
9885
9886
#: serverguide/C/remote-administration.xml:83(command)
9887
msgid "man sshd_config"
9888
msgstr ""
9889
9890
#: serverguide/C/remote-administration.xml:85(para)
9891
msgid ""
9892
"There are many directives in the <application>sshd</application> "
9893
"configuration file controlling such things as communication settings and "
9894
"authentication modes. The following are examples of configuration directives "
9895
"that can be changed by editing the <filename>/etc/ssh/sshd_config</filename> "
9896
"file."
9897
msgstr ""
9898
9899
#: serverguide/C/remote-administration.xml:92(para)
9900
msgid ""
9901
"Prior to editing the configuration file, you should make a copy of the "
9902
"original file and protect it from writing so you will have the original "
9903
"settings as a reference and to reuse as necessary."
9904
msgstr ""
9905
9906
#: serverguide/C/remote-administration.xml:96(para)
9907
msgid ""
9908
"Copy the <filename>/etc/ssh/sshd_config</filename> file and protect it from "
9909
"writing with the following commands, issued at a terminal prompt:"
9910
msgstr ""
9911
9912
#: serverguide/C/remote-administration.xml:101(command)
9913
msgid "sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original"
9914
msgstr ""
9915
9916
#: serverguide/C/remote-administration.xml:102(command)
9917
msgid "sudo chmod a-w /etc/ssh/sshd_config.original"
9918
msgstr ""
9919
9920
#: serverguide/C/remote-administration.xml:104(para)
9921
msgid ""
9922
"The following are examples of configuration directives you may change:"
9923
msgstr ""
9924
9925
#: serverguide/C/remote-administration.xml:109(para)
9926
msgid ""
9927
"To set your OpenSSH to listen on TCP port 2222 instead of the default TCP "
9928
"port 22, change the Port directive as such:"
9929
msgstr ""
9930
9931
#: serverguide/C/remote-administration.xml:113(para)
9932
msgid "Port 2222"
9933
msgstr ""
9934
9935
#: serverguide/C/remote-administration.xml:118(para)
9936
msgid ""
9937
"To have <application>sshd</application> allow public key-based login "
9938
"credentials, simply add or modify the line:"
9939
msgstr ""
9940
9941
#: serverguide/C/remote-administration.xml:122(para)
9942
msgid "PubkeyAuthentication yes"
9943
msgstr ""
9944
9945
#: serverguide/C/remote-administration.xml:125(para)
9946
msgid ""
9947
"In the <filename>/etc/ssh/sshd_config</filename> file, or if already "
9948
"present, ensure the line is not commented out."
9949
msgstr ""
9950
9951
#: serverguide/C/remote-administration.xml:131(para)
9952
msgid ""
9953
"To make your OpenSSH server display the contents of the "
9954
"<filename>/etc/issue.net</filename> file as a pre-login banner, simply add "
9955
"or modify the line:"
9956
msgstr ""
9957
9958
#: serverguide/C/remote-administration.xml:136(para)
9959
msgid "Banner /etc/issue.net"
9960
msgstr ""
9961
9962
#: serverguide/C/remote-administration.xml:139(para)
9963
msgid "In the <filename>/etc/ssh/sshd_config</filename> file."
9964
msgstr ""
9965
9966
#: serverguide/C/remote-administration.xml:144(para)
9967
msgid ""
9968
"After making changes to the <filename>/etc/ssh/sshd_config</filename> file, "
9969
"save the file, and restart the <application>sshd</application> server "
9970
"application to effect the changes using the following command at a terminal "
9971
"prompt:"
9972
msgstr ""
9973
9974
#: serverguide/C/remote-administration.xml:153(para)
9975
msgid ""
9976
"Many other configuration directives for <application>sshd</application> are "
9977
"available for changing the server application's behavior to fit your needs. "
9978
"Be advised, however, if your only method of access to a server is "
9979
"<application>ssh</application>, and you make a mistake in configuring "
9980
"<application>sshd</application> via the "
9981
"<filename>/etc/ssh/sshd_config</filename> file, you may find you are locked "
9982
"out of the server upon restarting it, or that the "
9983
"<application>sshd</application> server refuses to start due to an incorrect "
9984
"configuration directive, so be extra careful when editing this file on a "
9985
"remote server."
9986
msgstr ""
9987
9988
#: serverguide/C/remote-administration.xml:168(title)
9989
msgid "SSH Keys"
9990
msgstr ""
9991
9992
#: serverguide/C/remote-administration.xml:169(para)
9993
msgid ""
9994
"SSH <emphasis>keys</emphasis> allow authentication between two hosts without "
9995
"the need of a password. SSH key authentication uses two keys a "
9996
"<emphasis>private</emphasis> key and a <emphasis>public</emphasis> key."
9997
msgstr ""
9998
9999
#: serverguide/C/remote-administration.xml:173(para)
10000
msgid "To generate the keys, from a terminal prompt enter:"
10001
msgstr ""
10002
10003
#: serverguide/C/remote-administration.xml:177(command)
10004
msgid "ssh-keygen -t dsa"
10005
msgstr ""
10006
10007
#: serverguide/C/remote-administration.xml:179(para)
10008
msgid ""
10009
"This will generate the keys using a <emphasis>DSA</emphasis> authentication "
10010
"identity of the user. During the process you will be prompted for a "
10011
"password. Simply hit <emphasis>Enter</emphasis> when prompted to create the "
10012
"key."
10013
msgstr ""
10014
10015
#: serverguide/C/remote-administration.xml:183(para)
10016
msgid ""
10017
"By default the <emphasis>public</emphasis> key is saved in the file "
10018
"<filename>~/.ssh/id_dsa.pub</filename>, while "
10019
"<filename>~/.ssh/id_dsa</filename> is the <emphasis>private</emphasis> key. "
10020
"Now copy the <filename>id_dsa.pub</filename> file to the remote host and "
10021
"append it to <filename>~/.ssh/authorized_keys</filename> by entering:"
10022
msgstr ""
10023
10024
#: serverguide/C/remote-administration.xml:189(command)
10025
msgid "ssh-copy-id username@remotehost"
10026
msgstr ""
10027
10028
#: serverguide/C/remote-administration.xml:191(para)
10029
msgid ""
10030
"Finally, double check the permissions on the "
10031
"<filename>authorized_keys</filename> file, only the authenticated user "
10032
"should have read and write permissions. If the permissions are not correct "
10033
"change them by:"
10034
msgstr ""
10035
10036
#: serverguide/C/remote-administration.xml:196(command)
10037
msgid "chmod 600 .ssh/authorized_keys"
10038
msgstr ""
10039
10040
#: serverguide/C/remote-administration.xml:198(para)
10041
msgid ""
10042
"You should now be able to SSH to the host without being prompted for a "
10043
"password."
10044
msgstr ""
10045
10046
#: serverguide/C/remote-administration.xml:207(para)
10047
msgid ""
10048
"<ulink url=\"https://help.ubuntu.com/community/SSH\">Ubuntu Wiki SSH</ulink> "
10049
"page."
10050
msgstr ""
10051
10052
#: serverguide/C/remote-administration.xml:213(ulink)
10053
msgid "OpenSSH Website"
10054
msgstr ""
10055
10056
#: serverguide/C/remote-administration.xml:218(ulink)
10057
msgid "Advanced OpenSSH Wiki Page"
10058
msgstr ""
10059
10060
#: serverguide/C/remote-administration.xml:226(title)
10061
msgid "eBox"
10062
msgstr ""
10063
10064
#: serverguide/C/remote-administration.xml:227(para)
10065
msgid ""
10066
"<application>eBox</application> is a web framework used to manage server "
10067
"application configuration. The modular design of eBox allows you to pick and "
10068
"choose which services you want to configure using eBox."
10069
msgstr ""
10070
10071
#: serverguide/C/remote-administration.xml:234(para)
10072
msgid ""
10073
"The different <application>eBox</application> modules are split into "
10074
"different packages, allowing you to only install those necessary. One way to "
10075
"view the available packages is to enter the following from a terminal:"
10076
msgstr ""
10077
10078
#: serverguide/C/remote-administration.xml:240(command)
10079
msgid "apt-cache rdepends ebox | uniq"
10080
msgstr ""
10081
10082
#: serverguide/C/remote-administration.xml:242(para)
10083
msgid ""
10084
"To install the <application>ebox</application> package, which contains the "
10085
"default modules, enter the following:"
10086
msgstr ""
10087
10088
#: serverguide/C/remote-administration.xml:247(command)
10089
msgid "sudo apt-get install ebox"
10090
msgstr ""
10091
10092
#: serverguide/C/remote-administration.xml:250(para)
10093
msgid ""
10094
"During the installation you will be asked to supply a password for the ebox "
10095
"user. After installing eBox the web interface can be accessed from: "
10096
"<emphasis>https://yourserver/ebox</emphasis>."
10097
msgstr ""
10098
10099
#: serverguide/C/remote-administration.xml:259(para)
10100
msgid ""
10101
"An important thing to remember when using <application>eBox</application> is "
10102
"that when configuring most modules there is a <emphasis>Change</emphasis> "
10103
"button that implements the new configuration. After clicking the Change "
10104
"button most, but not all, modules will then need to be "
10105
"<emphasis>Saved</emphasis>. To save the new configuration click on the "
10106
"<quote>Save changes</quote> link in the top right hand corner."
10107
msgstr ""
10108
10109
#: serverguide/C/remote-administration.xml:267(para)
10110
msgid ""
10111
"Once you make a change that requires a Save, the link will change from green "
10112
"to red."
10113
msgstr ""
10114
10115
#: serverguide/C/remote-administration.xml:273(title)
10116
msgid "eBox Modules"
10117
msgstr ""
10118
10119
#: serverguide/C/remote-administration.xml:274(para)
10120
msgid ""
10121
"By default all eBox <emphasis>Modules</emphasis> are not enabled, and when a "
10122
"new module is installed it will not be automatically enabled."
10123
msgstr ""
10124
10125
#: serverguide/C/remote-administration.xml:278(para)
10126
msgid ""
10127
"To enable a disabled module click on the <emphasis>Module status</emphasis> "
10128
"link in the left hand menu. Then <emphasis role=\"italic\">check</emphasis> "
10129
"which modules you would like to enable and click the <quote>Save</quote> "
10130
"link."
10131
msgstr ""
10132
10133
#: serverguide/C/remote-administration.xml:284(title)
10134
msgid "Default Modules"
10135
msgstr ""
10136
10137
#: serverguide/C/remote-administration.xml:285(para)
10138
msgid ""
10139
"This section provides a quick summary of the default "
10140
"<application>eBox</application> modules."
10141
msgstr ""
10142
10143
#: serverguide/C/remote-administration.xml:291(para)
10144
msgid ""
10145
"<emphasis>System:</emphasis> contains options allowing configuration of "
10146
"general eBox items."
10147
msgstr ""
10148
10149
#: serverguide/C/remote-administration.xml:297(para)
10150
msgid ""
10151
"<emphasis>General:</emphasis> allows you to set the language, port number, "
10152
"and contains a change password form."
10153
msgstr ""
10154
10155
#: serverguide/C/remote-administration.xml:303(para)
10156
msgid ""
10157
"<emphasis>Disk Usage:</emphasis> displays a graph detailing information "
10158
"about disk usage."
10159
msgstr ""
10160
10161
#: serverguide/C/remote-administration.xml:309(para)
10162
msgid ""
10163
"<emphasis>Backup:</emphasis> is used to backup "
10164
"<application>eBox</application> configuration information, and the "
10165
"<emphasis>Full Backup</emphasis> option allows you to save all eBox "
10166
"information not included in the <emphasis>Configuration</emphasis> option "
10167
"such as log files."
10168
msgstr ""
10169
10170
#: serverguide/C/remote-administration.xml:317(para)
10171
msgid ""
10172
"<emphasis>Halt/Reboot:</emphasis> will shutdown the system or reboot it."
10173
msgstr ""
10174
10175
#: serverguide/C/remote-administration.xml:322(para)
10176
msgid ""
10177
"<emphasis>Bug Report:</emphasis> creates a file containing details helpful "
10178
"when reporting bugs to the eBox developers."
10179
msgstr ""
10180
10181
#: serverguide/C/remote-administration.xml:330(para)
10182
msgid ""
10183
"<emphasis>Logs:</emphasis> allows <application>eBox</application> logs to be "
10184
"queried depending on the purge time configured."
10185
msgstr ""
10186
10187
#: serverguide/C/remote-administration.xml:336(para)
10188
msgid ""
10189
"<emphasis>Events:</emphasis> this module has the ability to send alerts "
10190
"through rss, jabber, and log file."
10191
msgstr ""
10192
10193
#: serverguide/C/remote-administration.xml:343(emphasis)
10194
msgid "Available Events:"
10195
msgstr ""
10196
10197
#: serverguide/C/remote-administration.xml:347(para)
10198
msgid ""
10199
"<emphasis>Free Storage Space:</emphasis> will send alert if free disk space "
10200
"drops below a configured percentage, 10% by default."
10201
msgstr ""
10202
10203
#: serverguide/C/remote-administration.xml:353(para)
10204
msgid ""
10205
"<emphasis>Log Observer:</emphasis> sends an alert when a configured logger "
10206
"has logged something."
10207
msgstr ""
10208
10209
#: serverguide/C/remote-administration.xml:359(para)
10210
msgid ""
10211
"<emphasis>RAID:</emphasis> will monitor the RAID system and send alerts if "
10212
"any issues arise."
10213
msgstr ""
10214
10215
#: serverguide/C/remote-administration.xml:365(para)
10216
msgid ""
10217
"<emphasis>Service:</emphasis> sends alerts if a service restarts multiple "
10218
"times in a short time period."
10219
msgstr ""
10220
10221
#: serverguide/C/remote-administration.xml:371(para)
10222
msgid ""
10223
"<emphasis>State:</emphasis> alerts on the state of "
10224
"<application>eBox</application>, either up or down."
10225
msgstr ""
10226
10227
#: serverguide/C/remote-administration.xml:380(emphasis)
10228
msgid "Dispatchers:"
10229
msgstr ""
10230
10231
#: serverguide/C/remote-administration.xml:384(para)
10232
msgid ""
10233
"<emphasis>Log:</emphasis> this dispatcher will send event messages to the "
10234
"<application>eBox</application> log file "
10235
"<filename>/var/log/ebox/ebox.log</filename>."
10236
msgstr ""
10237
10238
#: serverguide/C/remote-administration.xml:391(para)
10239
msgid ""
10240
"<emphasis>Jabber:</emphasis> before enabling this dispatcher you must first "
10241
"configure it by clicking on the <quote>Configure</quote> icon."
10242
msgstr ""
10243
10244
#: serverguide/C/remote-administration.xml:397(para)
10245
msgid ""
10246
"<emphasis>RSS:</emphasis> once this dispatcher is configured you can "
10247
"subscribe to the link in order to view event alerts."
10248
msgstr ""
10249
10250
#: serverguide/C/remote-administration.xml:410(title)
10251
msgid "Additional Modules"
10252
msgstr ""
10253
10254
#: serverguide/C/remote-administration.xml:411(para)
10255
msgid ""
10256
"Here is a quick description of other available "
10257
"<application>eBox</application> modules:"
10258
msgstr ""
10259
10260
#: serverguide/C/remote-administration.xml:416(para)
10261
msgid ""
10262
"<emphasis>Network:</emphasis> allows configuration of the server's network "
10263
"options through eBox."
10264
msgstr ""
10265
10266
#: serverguide/C/remote-administration.xml:422(para)
10267
msgid ""
10268
"<emphasis>Firewall:</emphasis> configures firewall options for the eBox host."
10269
msgstr ""
10270
10271
#: serverguide/C/remote-administration.xml:427(para)
10272
msgid ""
10273
"<emphasis>UsersandGroups:</emphasis> this module will manage users and "
10274
"groups contained in an <application>OpenLDAP</application> LDAP directory."
10275
msgstr ""
10276
10277
#: serverguide/C/remote-administration.xml:433(para)
10278
msgid ""
10279
"<emphasis>DHCP:</emphasis> provides an interface for configuring a DHCP "
10280
"server."
10281
msgstr ""
10282
10283
#: serverguide/C/remote-administration.xml:438(para)
10284
msgid ""
10285
"<emphasis>DNS:</emphasis> provides <application>BIND9</application> DNS "
10286
"server configuration options."
10287
msgstr ""
10288
10289
#: serverguide/C/remote-administration.xml:444(para)
10290
msgid ""
10291
"<emphasis>Objects:</emphasis> allow configuration of eBox <emphasis>Network "
10292
"Objects</emphasis>, which allow you to assign a name to an IP address or "
10293
"group of IPs."
10294
msgstr ""
10295
10296
#: serverguide/C/remote-administration.xml:451(para)
10297
msgid ""
10298
"<emphasis>Services:</emphasis> displays configuration information for "
10299
"services that are available to the network."
10300
msgstr ""
10301
10302
#: serverguide/C/remote-administration.xml:457(para)
10303
msgid ""
10304
"<emphasis>Squid:</emphasis> configuration options for the "
10305
"<application>Squid</application> proxy server."
10306
msgstr ""
10307
10308
#: serverguide/C/remote-administration.xml:463(para)
10309
msgid ""
10310
"<emphasis>CA:</emphasis> configures a Certificate Authority for the server."
10311
msgstr ""
10312
10313
#: serverguide/C/remote-administration.xml:468(para)
10314
msgid "<emphasis>NTP:</emphasis> set Network Time Protocol options."
10315
msgstr ""
10316
10317
#: serverguide/C/remote-administration.xml:473(para)
10318
msgid "<emphasis>Printers:</emphasis> allows the configuration of printers."
10319
msgstr ""
10320
10321
#: serverguide/C/remote-administration.xml:478(para)
10322
msgid "<emphasis>Samba:</emphasis> configuration options for Samba."
10323
msgstr ""
10324
10325
#: serverguide/C/remote-administration.xml:483(para)
10326
msgid ""
10327
"<emphasis>OpenVPN:</emphasis> setup options for OpenVPN Virtual Private "
10328
"Network application."
10329
msgstr ""
10330
10331
#: serverguide/C/remote-administration.xml:494(para)
10332
msgid ""
10333
"The <ulink url=\"https://help.ubuntu.com/community/eBox\">eBox Ubuntu "
10334
"Wiki</ulink> page has more details."
10335
msgstr ""
10336
10337
#: serverguide/C/remote-administration.xml:499(para)
10338
msgid ""
10339
"For more information also see the <ulink url=\"http://ebox-"
10340
"platform.com/\">eBox Home Page</ulink>."
10341
msgstr ""
10342
10343
#: serverguide/C/package-management.xml:13(title)
10344
msgid "Package Management"
10345
msgstr "Менаџмент на пакети"
10346
10347
#: serverguide/C/package-management.xml:14(para)
10348
msgid ""
10349
"Ubuntu features a comprehensive package management system for the "
10350
"installation, upgrade, configuration, and removal of software. In addition "
10351
"to providing access to an organized base of over 24,000 software packages "
10352
"for your Ubuntu computer, the package management facilities also feature "
10353
"dependency resolution capabilities and software update checking."
10354
msgstr ""
10355
10356
#: serverguide/C/package-management.xml:16(para)
10357
msgid ""
10358
"Several tools are available for interacting with Ubuntu's package management "
10359
"system, from simple command-line utilities which may be easily automated by "
10360
"system administrators, to a simple graphical interface which is easy to use "
10361
"by those new to Ubuntu."
10362
msgstr ""
10363
"Достапни се неколку алатки за интеракција со системот за менаџирање на "
10364
"пакетите во Ubuntu, од едноставни конзолни програми кои лесно можат да се "
10365
"автоматизираат од систем администраторите до програми со графички интерфејс "
10366
"кои можат лесно да се користат од страна на оние кои се нови во Ubuntu."
10367
10368
#: serverguide/C/package-management.xml:21(para)
10369
msgid ""
10370
"Ubuntu's package management system is derived from the same system used by "
10371
"the Debian GNU/Linux distribution. The package files contain all of the "
10372
"necessary files, meta-data, and instructions to implement a particular "
10373
"functionality or software application on your Ubuntu computer."
10374
msgstr ""
10375
"Системот за менаџирање со пакети на Ubuntu е изведен од истиот систем што се "
10376
"користи кај Debian GNU/Linux дистрибуцијата. Датотеките на пакетот ги "
10377
"содржат сите потребни датотеки, мета-податоци, како и инструкции за "
10378
"имплементирање на одредена функционалност или софтверска апликација на "
10379
"вашиот Ubuntu компјутер."
10380
10381
#: serverguide/C/package-management.xml:24(para)
10382
msgid ""
10383
"Debian package files typically have the extension '.deb', and typically "
10384
"exist in <emphasis role=\"italics\">repositories</emphasis> which are "
10385
"collections of packages found on various media, such as CD-ROM discs, or "
10386
"online. Packages are normally of the pre-compiled binary format; thus "
10387
"installation is quick and requires no compiling of software."
10388
msgstr ""
10389
"Debian пакетите вообичаено ја имаат наставката „.deb“ и постојат во "
10390
"таканаречени <emphasis role=\"italics\">репозиториуми</emphasis> кои "
10391
"претставуваат колекции од пакети кои се наоѓаат на различни медиуми, како "
10392
"што се CD-ROM дискови или пак на Интернет мрежата. Пакетите се "
10393
"искомпајлирани во бинарен формат, што значи дека нивната инсталација е брза "
10394
"и не побарува компајлирање на софтверот."
10395
10396
#: serverguide/C/package-management.xml:27(para)
10397
msgid ""
10398
"Many complex packages use the concept of <emphasis "
10399
"role=\"italics\">dependencies</emphasis>. Dependencies are additional "
10400
"packages required by the principal package in order to function properly. "
10401
"For example, the speech synthesis package "
10402
"<application>Festival</application> depends upon the package "
10403
"<application>libasound2</application>, which is a package supplying the "
10404
"<application>ALSA</application> sound library needed for audio playback. In "
10405
"order for <application>Festival</application> to function, it and all of its "
10406
"dependencies must be installed. The software management tools in Ubuntu will "
10407
"do this automatically."
10408
msgstr ""
10409
10410
#: serverguide/C/package-management.xml:32(title)
10411
msgid "dpkg"
10412
msgstr ""
10413
10414
#: serverguide/C/package-management.xml:34(para)
10415
msgid ""
10416
"<application>dpkg</application> is a package manager for "
10417
"<emphasis>Debian</emphasis> based systems. It can install, remove, and build "
10418
"packages, but unlike other package management system's it can not "
10419
"automatically download and install packages and their dependencies. This "
10420
"section covers using <application>dpkg</application> to manage locally "
10421
"installed packages:"
10422
msgstr ""
10423
10424
#: serverguide/C/package-management.xml:43(para)
10425
msgid ""
10426
"To list all packages installed on the system, from a terminal prompt enter:"
10427
msgstr ""
10428
10429
#: serverguide/C/package-management.xml:48(command)
10430
msgid "dpkg -l"
10431
msgstr ""
10432
10433
#: serverguide/C/package-management.xml:54(para)
10434
msgid ""
10435
"Depending on the amount of packages on your system, this can generate a "
10436
"large amount of output. Pipe the output through "
10437
"<application>grep</application> to see if a specific package is installed:"
10438
msgstr ""
10439
10440
#: serverguide/C/package-management.xml:60(command)
10441
msgid "dpkg -l | grep apache2"
10442
msgstr ""
10443
10444
#: serverguide/C/package-management.xml:63(para)
10445
msgid ""
10446
"Replace <emphasis>apache2</emphasis> with any package name, part of a "
10447
"package name, or other regular expression."
10448
msgstr ""
10449
10450
#: serverguide/C/package-management.xml:70(para)
10451
msgid ""
10452
"To list the files installed by a package, in this case the "
10453
"<application>ufw</application> package, enter:"
10454
msgstr ""
10455
10456
#: serverguide/C/package-management.xml:75(command)
10457
msgid "dpkg -L ufw"
10458
msgstr ""
10459
10460
#: serverguide/C/package-management.xml:81(para)
10461
msgid ""
10462
"If you are not sure which package installed a file, <application>dpkg -"
10463
"S</application> may be able to tell you. For example:"
10464
msgstr ""
10465
10466
#: serverguide/C/package-management.xml:87(command)
10467
msgid "dpkg -S /etc/host.conf"
10468
msgstr ""
10469
10470
#: serverguide/C/package-management.xml:88(computeroutput)
10471
#, no-wrap
10472
msgid "base-files: /etc/host.conf"
10473
msgstr ""
10474
10475
#: serverguide/C/package-management.xml:91(para)
10476
msgid ""
10477
"The output shows that the <filename>/etc/host.conf</filename> belongs to the "
10478
"<application>base-files</application> package."
10479
msgstr ""
10480
10481
#: serverguide/C/package-management.xml:96(para)
10482
msgid ""
10483
"Many files are automatically generated during the package install process, "
10484
"and even though they are on the filesystem <command>dpkg -S</command> may "
10485
"not know which package they belong to."
10486
msgstr ""
10487
10488
#: serverguide/C/package-management.xml:105(para)
10489
msgid "You can install a local <emphasis>.deb</emphasis> file by entering:"
10490
msgstr ""
10491
10492
#: serverguide/C/package-management.xml:110(command)
10493
msgid "sudo dpkg -i zip_2.32-1_i386.deb"
10494
msgstr ""
10495
10496
#: serverguide/C/package-management.xml:113(para)
10497
msgid ""
10498
"Change <filename>zip_2.32-1_i386.deb</filename> to the actual file name of "
10499
"the local .deb file."
10500
msgstr ""
10501
10502
#: serverguide/C/package-management.xml:120(para)
10503
msgid "Uninstalling a package can be accomplished by:"
10504
msgstr ""
10505
10506
#: serverguide/C/package-management.xml:125(command)
10507
msgid "sudo dpkg -r zip"
10508
msgstr ""
10509
10510
#: serverguide/C/package-management.xml:129(para)
10511
msgid ""
10512
"Uninstalling packages using <application>dpkg</application>, in most cases, "
10513
"is <emphasis>NOT</emphasis> recommended. It is better to use a package "
10514
"manager that handles dependencies, to ensure that the system is in a "
10515
"consistent state. For example using <command>dpkg -r</command> you can "
10516
"remove the <application>zip</application> package, but any packages that "
10517
"depend on it will still be installed and may no longer function correctly."
10518
msgstr ""
10519
10520
#: serverguide/C/package-management.xml:140(para)
10521
msgid ""
10522
"For more <application>dpkg</application> options see the man page: "
10523
"<command>man dpkg</command>."
10524
msgstr ""
10525
10526
#: serverguide/C/package-management.xml:146(title)
10527
msgid "Apt-Get"
10528
msgstr "Apt-Get"
10529
10530
#: serverguide/C/package-management.xml:147(para)
10531
msgid ""
10532
"The <application>apt-get</application> command is a powerful command-line "
10533
"tool used to work with Ubuntu's <emphasis>Advanced Packaging Tool</emphasis> "
10534
"(APT) performing such functions as installation of new software packages, "
10535
"upgrade of existing software packages, updating of the package list index, "
10536
"and even upgrading the entire Ubuntu system."
10537
msgstr ""
10538
10539
#: serverguide/C/package-management.xml:150(para)
10540
msgid ""
10541
"Being a simple command-line tool, <application>apt-get</application> has "
10542
"numerous advantages over other package management tools available in Ubuntu "
10543
"for server administrators. Some of these advantages include ease of use over "
10544
"simple terminal connections (SSH) and the ability to be used in system "
10545
"administration scripts, which can in turn be automated by the "
10546
"<application>cron</application> scheduling utility."
10547
msgstr ""
10548
"Како едноставна конзолна алатка, <application>apt-get</application> има "
10549
"многу предности, кои се однесуваат за серверска администрација, во однос на "
10550
"другите менаџери на пакети кои се достапни во Ubuntu. Некои од овие "
10551
"предности се: едноставноста при користење на терминални конекции (SSH) и "
10552
"можноста да се користи во системските административни скрипти, кои можат да "
10553
"бидат автоматизирани со помош на <application>cron</application> алатката."
10554
10555
#: serverguide/C/package-management.xml:157(para)
10556
msgid ""
10557
"<emphasis role=\"bold\">Install a Package</emphasis>: Installation of "
10558
"packages using the <application>apt-get</application> tool is quite simple. "
10559
"For example, to install the network scanner <emphasis "
10560
"role=\"italics\">nmap</emphasis>, type the following: <screen>\n"
10561
"<command>sudo apt-get install nmap</command>\n"
10562
"</screen>"
10563
msgstr ""
10564
"<emphasis role=\"bold\">Инсталирање на пакет</emphasis>: Инсталацијата на "
10565
"пакети со помош на алатката <application>apt-get</application> е прилично "
10566
"едноставна. На пример, за инсталирање на мрежниот скенер <emphasis "
10567
"role=\"italics\">nmap</emphasis>, внесете ја следната команда: <screen>\n"
10568
"<command>sudo apt-get install nmap</command>\n"
10569
"</screen>"
10570
10571
#: serverguide/C/package-management.xml:165(para)
10572
msgid ""
10573
"<emphasis role=\"bold\">Remove a Package</emphasis>: Removal of a package or "
10574
"packages is also a straightforward and simple process. To remove the nmap "
10575
"package installed in the previous example, type the following: <screen>\n"
10576
"<command>sudo apt-get remove nmap</command>\n"
10577
"</screen>"
10578
msgstr ""
10579
"<emphasis role=\"bold\">Бришење на пакет</emphasis>: Бришењето на пакет или "
10580
"пакети е исто така едноставен процес. За бришење на пакетот nmap кој го "
10581
"инсталиравме во претходниот пример, внесете ја следната команда: <screen>\n"
10582
"<command>sudo apt-get remove nmap</command>\n"
10583
"</screen>"
10584
10585
#: serverguide/C/package-management.xml:172(para)
10586
msgid ""
10587
"<emphasis role=\"bold\">Multiple Packages</emphasis>: You may specify "
10588
"multiple packages to be installed or removed, separated by spaces."
10589
msgstr ""
10590
10591
#: serverguide/C/package-management.xml:175(para)
10592
msgid ""
10593
"Also, adding the <emphasis>--purge</emphasis> options to <command>apt-get "
10594
"remove</command> will remove the package configuration files as well. This "
10595
"may or may not be the desired effect so use with caution."
10596
msgstr ""
10597
10598
#: serverguide/C/package-management.xml:181(para)
10599
msgid ""
10600
"<emphasis role=\"bold\">Update the Package Index</emphasis>: The APT package "
10601
"index is essentially a database of available packages from the repositories "
10602
"defined in the <filename>/etc/apt/sources.list</filename> file. To update "
10603
"the local package index with the latest changes made in repositories, type "
10604
"the following: <screen>\n"
10605
"<command>sudo apt-get update</command>\n"
10606
"</screen>"
10607
msgstr ""
10608
"<emphasis role=\"bold\">Ажурирање на индексот на пакетите</emphasis>: APT "
10609
"индексот на пакети претставува база од пакети кои се достапни во "
10610
"репозиториумите кои се дефинирани во датотеката "
10611
"<filename>/etc/apt/sources.list</filename>. За ажурирање на локалниот индекс "
10612
"на пакети кој ги содржи последните промени направени во репозиториумите, "
10613
"внесете ја следната команда: <screen>\n"
10614
"<command>sudo apt-get update</command>\n"
10615
"</screen>"
10616
10617
#: serverguide/C/package-management.xml:189(para)
10618
msgid ""
10619
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: Over time, updated "
10620
"versions of packages currently installed on your computer may become "
10621
"available from the package repositories (for example security updates). To "
10622
"upgrade your system, first update your package index as outlined above, and "
10623
"then type: <screen>\n"
10624
"<command>sudo apt-get upgrade</command>\n"
10625
"</screen>"
10626
msgstr ""
10627
10628
#: serverguide/C/package-management.xml:195(para)
10629
msgid ""
10630
"For information on upgrading to a new Ubuntu release see <xref "
10631
"linkend=\"installing-upgrading\"/>."
10632
msgstr ""
10633
10634
#: serverguide/C/package-management.xml:153(para)
10635
msgid ""
10636
"Some examples of popular uses for the <application>apt-get</application> "
10637
"utility: <placeholder-1/>"
10638
msgstr ""
10639
"Неколку популарни примери за користење на алатката <application>apt-"
10640
"get</application>: <placeholder-1/>"
10641
10642
#: serverguide/C/package-management.xml:201(para)
10643
msgid ""
10644
"Actions of the <application>apt-get</application> command, such as "
10645
"installation and removal of packages, are logged in the /var/log/dpkg.log "
10646
"log file."
10647
msgstr ""
10648
"Акциите направени со <application>apt-get</application> командата, како што "
10649
"се инсталирање или бришење на пакети се запишуваат во датотеката со логови "
10650
"/var/log/dpkg.log."
10651
10652
#: serverguide/C/package-management.xml:204(para)
10653
msgid ""
10654
"For further information about the use of <application>APT</application>, "
10655
"read the comprehensive <ulink url=\"http://www.debian.org/doc/user-"
10656
"manuals#apt-howto\">Debian APT User Manual</ulink> or type: <screen>apt-get "
10657
"help</screen>"
10658
msgstr ""
10659
10660
#: serverguide/C/package-management.xml:208(title)
10661
msgid "Aptitude"
10662
msgstr "Aptitude"
10663
10664
#: serverguide/C/package-management.xml:209(para)
10665
msgid ""
10666
"<application>Aptitude</application> is a menu-driven, text-based front-end "
10667
"to the <emphasis>Advanced Packaging Tool</emphasis> (APT) system. Many of "
10668
"the common package management functions, such as installation, removal, and "
10669
"upgrade, are performed in <application>Aptitude</application> with single-"
10670
"key commands, which are typically lowercase letters."
10671
msgstr ""
10672
10673
#: serverguide/C/package-management.xml:212(para)
10674
msgid ""
10675
"<application>Aptitude</application> is best suited for use in a non-"
10676
"graphical terminal environment to ensure proper functioning of the command "
10677
"keys. You may start <application>Aptitude</application> as a normal user "
10678
"with the following command at a terminal prompt: <screen>\n"
10679
"<command>sudo aptitude</command>\n"
10680
"</screen>"
10681
msgstr ""
10682
10683
#: serverguide/C/package-management.xml:219(para)
10684
msgid ""
10685
"When <application>Aptitude</application> starts, you will see a menu bar at "
10686
"the top of the screen and two panes below the menu bar. The top pane "
10687
"contains package categories, such as <emphasis role=\"italics\">New "
10688
"Packages</emphasis> and <emphasis role=\"italics\">Not Installed "
10689
"Packages</emphasis>. The bottom pane contains information related to the "
10690
"packages and package categories."
10691
msgstr ""
10692
"Кога ќе се стартува <application>Aptitude</application>, ќе добиете мени при "
10693
"врвот на екранот со два панели под него. Горниот панел ги содржи категориите "
10694
"на пакети, како што се <emphasis role=\"italics\">New Packages (Нови "
10695
"пакети)</emphasis> and <emphasis role=\"italics\">Not Installed "
10696
"Packages(Неинсталирани пакети)</emphasis>. Долниот панел содржи информации "
10697
"кои се однесуваат на пакетите или на категориите од пакети."
10698
10699
#: serverguide/C/package-management.xml:222(para)
10700
msgid ""
10701
"Using <application>Aptitude</application> for package management is "
10702
"relatively straightforward, and the user interface makes common tasks simple "
10703
"to perform. The following are examples of common package management "
10704
"functions as performed in <application>Aptitude</application>:"
10705
msgstr ""
10706
10707
#: serverguide/C/package-management.xml:226(para)
10708
msgid ""
10709
"<emphasis role=\"bold\">Install Packages</emphasis>: To install a package, "
10710
"locate the package via the Not Installed Packages package category, for "
10711
"example, by using the keyboard arrow keys and the <keycap>ENTER</keycap> "
10712
"key, and highlight the package you wish to install. After highlighting the "
10713
"package you wish to install, press the <keycap>+</keycap> key, and the "
10714
"package entry should turn <emphasis role=\"italics\">green</emphasis>, "
10715
"indicating it has been marked for installation. Now press <keycap>g</keycap> "
10716
"to be presented with a summary of package actions. Press <keycap>g</keycap> "
10717
"again, and you will be prompted to become root to complete the installation. "
10718
"Press <keycap>ENTER</keycap> which will result in a Password: prompt. Enter "
10719
"your user password to become root. Finally, press <keycap>g</keycap> once "
10720
"more and you'll be prompted to download the package. Press "
10721
"<keycap>ENTER</keycap> on the <emphasis role=\"italics\">Continue</emphasis> "
10722
"prompt, and downloading and installation of the package will commence."
10723
msgstr ""
10724
"<emphasis role=\"bold\">Инсталирање на пакети</emphasis>: За инсталирање на "
10725
"пакет, најпрвин лоцирајте го пакетот во категоријата Not Installed Packages "
10726
"(неисталирани пакети), на пример, со користење на стрелките на тастатурата и "
10727
"со <keycap>ENTER</keycap> копчето и изберете го пакетот што сакате да го "
10728
"инсталирате. По избирањето на пакетот притиснете го <keycap>+</keycap> "
10729
"копчето и ставката за пакетот ќе стане <emphasis "
10730
"role=\"italics\">зелена</emphasis>, индицирајќи со тоа дека пакетот бил "
10731
"означен за инсталирање. Сега можете да го притиснете копчето "
10732
"<keycap>g</keycap> со што ќе ви биде претставен екран на кој ќе биде испишан "
10733
"извештај за акциите кои ќе се извршат со пакетите. Со повторно притискање на "
10734
"копчето <keycap>g</keycap>, ќе ви се појави дијалог добивање на root "
10735
"привилегии заради завршување на инсталацијата. Притискањето на "
10736
"<keycap>ENTER</keycap> ќе резултира со дијалот за лозинка. Со внесување на "
10737
"лозинката ќе станете root. На крај со притискање уште еднашка на копето "
10738
"<keycap>g</keycap> ќе бидете известени за преземање на пактот. Притиснте го "
10739
"<keycap>ENTER</keycap> на <emphasis role=\"italics\">Continue "
10740
"(продолжи)</emphasis> дијалогот и преземањето и инсталацијата на пакетот ќе "
10741
"започнат со извршување, а потоа и комплетирање."
10742
10743
#: serverguide/C/package-management.xml:230(para)
10744
msgid ""
10745
"<emphasis role=\"bold\">Remove Packages</emphasis>: To remove a package, "
10746
"locate the package via the Installed Packages package category, for example, "
10747
"by using the keyboard arrow keys and the <keycap>ENTER</keycap> key, and "
10748
"highlight the package you wish to remove. After highlighting the package you "
10749
"wish to install, press the <keycap>-</keycap> key, and the package entry "
10750
"should turn <emphasis role=\"italics\">pink</emphasis>, indicating it has "
10751
"been marked for removal. Now press <keycap>g</keycap> to be presented with a "
10752
"summary of package actions. Press <keycap>g</keycap> again, and you will be "
10753
"prompted to become root to complete the installation. Press "
10754
"<keycap>ENTER</keycap> which will result in a Password: prompt. Enter your "
10755
"user password to become root. Finally, press <keycap>g</keycap> once more, "
10756
"and you'll be prompted to download the package. Press <keycap>ENTER</keycap> "
10757
"on the <emphasis role=\"italics\">Continue</emphasis> prompt, and removal of "
10758
"the package will commence."
10759
msgstr ""
10760
10761
#: serverguide/C/package-management.xml:234(para)
10762
msgid ""
10763
"<emphasis role=\"bold\">Update Package Index</emphasis>: To update the "
10764
"package index, simply press the <keycap>u</keycap> key and you will be "
10765
"prompted to become root to complete the update. Press <keycap>ENTER</keycap> "
10766
"which will result in a Password: prompt. Enter your user password to become "
10767
"root. Updating of the package index will commence. Press "
10768
"<keycap>ENTER</keycap> on the OK prompt when the download dialog is "
10769
"presented to complete the process."
10770
msgstr ""
10771
10772
#: serverguide/C/package-management.xml:238(para)
10773
msgid ""
10774
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: To upgrade packages, "
10775
"perform the update of the package index as detailed above, and then press "
10776
"the <keycap>U</keycap> key to mark all packages with updates. Now press "
10777
"<keycap>g</keycap> whereby you'll be presented with a summary of package "
10778
"actions. Press <keycap>g</keycap> again, and you will be prompted to become "
10779
"root to complete the installation. Press <keycap>ENTER</keycap> which will "
10780
"result in a Password: prompt. Enter your user password to become root. "
10781
"Finally, press <keycap>g</keycap> once more, and you'll be prompted to "
10782
"download the packages. Press <keycap>ENTER</keycap> on the <emphasis "
10783
"role=\"italics\">Continue</emphasis> prompt, and upgrade of the packages "
10784
"will commence."
10785
msgstr ""
10786
10787
#: serverguide/C/package-management.xml:245(para)
10788
msgid "<emphasis role=\"bold\">i</emphasis>: Installed package"
10789
msgstr ""
10790
10791
#: serverguide/C/package-management.xml:250(para)
10792
msgid ""
10793
"<emphasis role=\"bold\">c</emphasis>: Package not installed, but package "
10794
"configuration remains on system"
10795
msgstr ""
10796
10797
#: serverguide/C/package-management.xml:254(para)
10798
msgid "<emphasis role=\"bold\">p</emphasis>: Purged from system"
10799
msgstr ""
10800
10801
#: serverguide/C/package-management.xml:258(para)
10802
msgid "<emphasis role=\"bold\">v</emphasis>: Virtual package"
10803
msgstr ""
10804
10805
#: serverguide/C/package-management.xml:262(para)
10806
msgid "<emphasis role=\"bold\">B</emphasis>: Broken package"
10807
msgstr ""
10808
10809
#: serverguide/C/package-management.xml:266(para)
10810
msgid ""
10811
"<emphasis role=\"bold\">u</emphasis>: Unpacked files, but package not yet "
10812
"configured"
10813
msgstr ""
10814
10815
#: serverguide/C/package-management.xml:270(para)
10816
msgid ""
10817
"<emphasis role=\"bold\">C</emphasis>: Half-configured - Configuration failed "
10818
"and requires fix"
10819
msgstr ""
10820
10821
#: serverguide/C/package-management.xml:274(para)
10822
msgid ""
10823
"<emphasis role=\"bold\">H</emphasis>: Half-installed - Removal failed and "
10824
"requires fix"
10825
msgstr ""
10826
10827
#: serverguide/C/package-management.xml:242(para)
10828
msgid ""
10829
"The first column of information displayed in the package list in the top "
10830
"pane, when actually viewing packages lists the current state of the package, "
10831
"and uses the following key to describe the state of the package: "
10832
"<placeholder-1/>"
10833
msgstr ""
10834
10835
#: serverguide/C/package-management.xml:280(para)
10836
msgid ""
10837
"To exit Aptitude, simply press the <keycap>q</keycap> key and confirm you "
10838
"wish to exit. Many other functions are available from the Aptitude menu by "
10839
"pressing the <keycap>F10</keycap> key."
10840
msgstr ""
10841
10842
#: serverguide/C/package-management.xml:285(title)
10843
msgid "Automatic Updates"
10844
msgstr ""
10845
10846
#: serverguide/C/package-management.xml:287(para)
10847
msgid ""
10848
"The <application>unattended-upgrades</application> package can be used to "
10849
"automatically install updated packages, and can be configured to update all "
10850
"packages or just install security updates. First, install the package by "
10851
"entering the following in a terminal:"
10852
msgstr ""
10853
10854
#: serverguide/C/package-management.xml:293(command)
10855
msgid "sudo apt-get install unattended-upgrades"
10856
msgstr ""
10857
10858
#: serverguide/C/package-management.xml:296(para)
10859
msgid ""
10860
"To configure <application>unattended-upgrades</application>, edit "
10861
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> and adjust "
10862
"the following to fit your needs:"
10863
msgstr ""
10864
10865
#: serverguide/C/package-management.xml:301(programlisting)
10866
#, no-wrap
10867
msgid ""
10868
"\n"
10869
"Unattended-Upgrade::Allowed-Origins {\n"
10870
" \"Ubuntu lucid-security\";\n"
10871
"// \"Ubuntu lucid-updates\";\n"
10872
"};\n"
10873
msgstr ""
10874
10875
#: serverguide/C/package-management.xml:308(para)
10876
msgid ""
10877
"Certain packages can also be <emphasis>blacklisted</emphasis> and therefore "
10878
"will not be automatically updated. To blacklist a package, add it to the "
10879
"list:"
10880
msgstr ""
10881
10882
#: serverguide/C/package-management.xml:313(programlisting)
10883
#, no-wrap
10884
msgid ""
10885
"\n"
10886
"Unattended-Upgrade::Package-Blacklist {\n"
10887
"// \"vim\";\n"
10888
"// \"libc6\";\n"
10889
"// \"libc6-dev\";\n"
10890
"// \"libc6-i686\";\n"
10891
"};\n"
10892
msgstr ""
10893
10894
#: serverguide/C/package-management.xml:323(para)
10895
msgid ""
10896
"The double <emphasis><quote>//</quote></emphasis> serve as comments, so "
10897
"whatever follows \"//\" will not be evaluated."
10898
msgstr ""
10899
10900
#: serverguide/C/package-management.xml:328(para)
10901
msgid ""
10902
"To enable automatic updates, edit "
10903
"<filename>/etc/apt/apt.conf.d/10periodic</filename> and set the appropriate "
10904
"<application>apt</application> configuration options:"
10905
msgstr ""
10906
10907
#: serverguide/C/package-management.xml:332(programlisting)
10908
#, no-wrap
10909
msgid ""
10910
"\n"
10911
"APT::Periodic::Update-Package-Lists \"1\";\n"
10912
"APT::Periodic::Download-Upgradeable-Packages \"1\";\n"
10913
"APT::Periodic::AutocleanInterval \"7\";\n"
10914
"APT::Periodic::Unattended-Upgrade \"1\";\n"
10915
msgstr ""
10916
10917
#: serverguide/C/package-management.xml:339(para)
10918
msgid ""
10919
"The above configuration updates the package list, downloads, and installs "
10920
"available upgrades every day. The local download archive is cleaned every "
10921
"week."
10922
msgstr ""
10923
10924
#: serverguide/C/package-management.xml:345(para)
10925
msgid ""
10926
"You can read more about <application>apt</application> Periodic "
10927
"configuration options in the <filename>/etc/cron.daily/apt</filename> script "
10928
"header."
10929
msgstr ""
10930
10931
#: serverguide/C/package-management.xml:350(para)
10932
msgid ""
10933
"The results of <application>unattended-upgrades</application> will be logged "
10934
"to <filename>/var/log/unattended-upgrades</filename>."
10935
msgstr ""
10936
10937
#: serverguide/C/package-management.xml:355(title)
10938
msgid "Notifications"
10939
msgstr ""
10940
10941
#: serverguide/C/package-management.xml:357(para)
10942
msgid ""
10943
"Configuring <emphasis>Unattended-Upgrade::Mail</emphasis> in "
10944
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> will enable "
10945
"<application>unattended-upgrades</application> to email an administrator "
10946
"detailing any packages that need upgrading or have problems."
10947
msgstr ""
10948
10949
#: serverguide/C/package-management.xml:362(para)
10950
msgid ""
10951
"Another useful package is <application>apticron</application>. "
10952
"<application>apticron</application> will configure a "
10953
"<application>cron</application> job to email an administrator information "
10954
"about any packages on the system that have updates available, as well as a "
10955
"summary of changes in each package."
10956
msgstr ""
10957
10958
#: serverguide/C/package-management.xml:368(para)
10959
msgid ""
10960
"To install the <application>apticron</application> package, in a terminal "
10961
"enter:"
10962
msgstr ""
10963
10964
#: serverguide/C/package-management.xml:373(command)
10965
msgid "sudo apt-get install apticron"
10966
msgstr ""
10967
10968
#: serverguide/C/package-management.xml:376(para)
10969
msgid ""
10970
"Once the package is installed edit "
10971
"<filename>/etc/apticron/apticron.conf</filename>, to set the email address "
10972
"and other options:"
10973
msgstr ""
10974
10975
#: serverguide/C/package-management.xml:380(programlisting)
10976
#, no-wrap
10977
msgid ""
10978
"\n"
10979
"EMAIL=\"root@example.com\"\n"
10980
msgstr ""
10981
10982
#: serverguide/C/package-management.xml:389(para)
10983
msgid ""
10984
"Configuration of the <emphasis>Advanced Packaging Tool</emphasis> (APT) "
10985
"system repositories is stored in the /etc/apt/sources.list configuration "
10986
"file. An example of this file is referenced here, along with information on "
10987
"adding or removing repository references from the file."
10988
msgstr ""
10989
10990
#: serverguide/C/package-management.xml:395(para)
10991
msgid ""
10992
"<ulink url=\"../sample/sources.list\">Here</ulink> is a simple example of a "
10993
"typical <filename>/etc/apt/sources.list</filename> file."
10994
msgstr ""
10995
10996
#: serverguide/C/package-management.xml:399(para)
10997
msgid ""
10998
"You may edit the file to enable repositories or disable them. For example, "
10999
"to disable the requirement of inserting the Ubuntu CD-ROM whenever package "
11000
"operations occur, simply comment out the appropriate line for the CD-ROM, "
11001
"which appears at the top of the file:"
11002
msgstr ""
11003
11004
#: serverguide/C/package-management.xml:404(screen)
11005
#, no-wrap
11006
msgid ""
11007
"\n"
11008
"# no more prompting for CD-ROM please\n"
11009
"# deb cdrom:[Ubuntu 10.04_Lucid_Lynx - Release i386 (20070419.1)]/ lucid "
11010
"main restricted\n"
11011
msgstr ""
11012
11013
#: serverguide/C/package-management.xml:410(title)
11014
msgid "Extra Repositories"
11015
msgstr ""
11016
11017
#: serverguide/C/package-management.xml:411(para)
11018
msgid ""
11019
"In addition to the officially supported package repositories available for "
11020
"Ubuntu, there exist additional community-maintained repositories which add "
11021
"thousands more potential packages for installation. Two of the most popular "
11022
"are the <emphasis>Universe</emphasis> and <emphasis>Multiverse</emphasis> "
11023
"repositories. These repositories are not officially supported by Ubuntu, but "
11024
"because they are maintained by the community they generally provide packages "
11025
"which are safe for use with your Ubuntu computer."
11026
msgstr ""
11027
11028
#: serverguide/C/package-management.xml:414(para)
11029
msgid ""
11030
"Packages in the <emphasis>Multiverse</emphasis> repository often have "
11031
"licensing issues that prevent them from being distributed with a free "
11032
"operating system, and they may be illegal in your locality."
11033
msgstr ""
11034
11035
#: serverguide/C/package-management.xml:416(para)
11036
msgid ""
11037
"Be advised that neither the <emphasis>Universe</emphasis> or "
11038
"<emphasis>Multiverse</emphasis> repositories contain officially supported "
11039
"packages. In particular, there may not be security updates for these "
11040
"packages."
11041
msgstr ""
11042
11043
#: serverguide/C/package-management.xml:420(para)
11044
msgid ""
11045
"Many other package sources are available, sometimes even offering only one "
11046
"package, as in the case of package sources provided by the developer of a "
11047
"single application. You should always be very careful and cautious when "
11048
"using non-standard package sources, however. Research the source and "
11049
"packages carefully before performing any installation, as some package "
11050
"sources and their packages could render your system unstable or non-"
11051
"functional in some respects."
11052
msgstr ""
11053
11054
#: serverguide/C/package-management.xml:423(para)
11055
msgid ""
11056
"By default, the <emphasis>Universe</emphasis> and "
11057
"<emphasis>Multiverse</emphasis> repositories are enabled but if you would "
11058
"like to disable them edit <filename>/etc/apt/sources.list</filename> and "
11059
"comment the following lines:"
11060
msgstr ""
11061
11062
#: serverguide/C/package-management.xml:430(programlisting)
11063
#, no-wrap
11064
msgid ""
11065
"\n"
11066
"deb http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
11067
"deb-src http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
11068
"\n"
11069
"deb http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
11070
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
11071
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
11072
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
11073
"\n"
11074
"deb http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
11075
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
11076
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
11077
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
11078
"\n"
11079
"deb http://security.ubuntu.com/ubuntu lucid-security universe\n"
11080
"deb-src http://security.ubuntu.com/ubuntu lucid-security universe\n"
11081
"deb http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
11082
"deb-src http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
11083
msgstr ""
11084
11085
#: serverguide/C/package-management.xml:456(para)
11086
msgid ""
11087
"Most of the material covered in this chapter is available in "
11088
"<application>man</application> pages, many of which are available online."
11089
msgstr ""
11090
11091
#: serverguide/C/package-management.xml:463(para)
11092
msgid ""
11093
"The <ulink "
11094
"url=\"https://help.ubuntu.com/community/InstallingSoftware\">InstallingSoftwa"
11095
"re</ulink> Ubuntu wiki page has more information."
11096
msgstr ""
11097
11098
#: serverguide/C/package-management.xml:468(para)
11099
msgid ""
11100
"For more <application>dpkg</application> details see the <ulink "
11101
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/dpkg.1.html\">dpkg "
11102
"man page</ulink>."
11103
msgstr ""
11104
11105
#: serverguide/C/package-management.xml:474(para)
11106
msgid ""
11107
"The <ulink url=\"http://www.debian.org/doc/manuals/apt-howto/\">APT "
11108
"HOWTO</ulink> and <ulink "
11109
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/apt-get.8.html\">apt-"
11110
"get man page</ulink> contain useful information regarding <application>apt-"
11111
"get</application> usage."
11112
msgstr ""
11113
11114
#: serverguide/C/package-management.xml:481(para)
11115
msgid ""
11116
"See the <ulink "
11117
"url=\"http://manpages.ubuntu.com/manpages/lucid/man8/aptitude.8.html\">aptitu"
11118
"de man page</ulink> for more <application>aptitude</application> options."
11119
msgstr ""
11120
11121
#: serverguide/C/package-management.xml:487(para)
11122
msgid ""
11123
"The <ulink "
11124
"url=\"https://help.ubuntu.com/community/Repositories/Ubuntu\">Adding "
11125
"Repositories HOWTO (Ubuntu Wiki)</ulink> page contains more details on "
11126
"adding repositories."
11127
msgstr ""
11128
11129
#: serverguide/C/other-apps.xml:13(title)
11130
msgid "Other Useful Applications"
11131
msgstr ""
11132
11133
#: serverguide/C/other-apps.xml:15(para)
11134
msgid ""
11135
"There are many very useful applications developed by the Ubuntu Server Team, "
11136
"and others that are well integrated with Ubuntu Server Edition, that might "
11137
"not be well known. This chapter will showcase some useful applications that "
11138
"can make administering an Ubuntu server, or many Ubuntu servers, that much "
11139
"easier."
11140
msgstr ""
11141
11142
#: serverguide/C/other-apps.xml:23(title)
11143
msgid "pam_motd"
11144
msgstr ""
11145
11146
#: serverguide/C/other-apps.xml:25(para)
11147
msgid ""
11148
"When logging into an Ubuntu server you may have noticed the informative "
11149
"Message Of The Day (MOTD). This information is obtained and displayed using "
11150
"a couple of packages:"
11151
msgstr ""
11152
11153
#: serverguide/C/other-apps.xml:32(para)
11154
msgid ""
11155
"<emphasis>landscape-common:</emphasis> provides the core libraries of "
11156
"<application>landscape-client</application>, which can be used to manage "
11157
"systems using the web based <emphasis>Landscape</emphasis> application. The "
11158
"package includes the <application>/usr/bin/landscape-sysinfo</application> "
11159
"utility which is used to gather the information displayed in the MOTD."
11160
msgstr ""
11161
11162
#: serverguide/C/other-apps.xml:40(para)
11163
msgid ""
11164
"<emphasis>update-notifier-common:</emphasis> is used to automatically update "
11165
"the MOTD via <application>pam_motd</application> module."
11166
msgstr ""
11167
11168
#: serverguide/C/other-apps.xml:46(para)
11169
msgid ""
11170
"<application>pam_motd</application> executes the scripts in "
11171
"<filename>/etc/update-motd.d</filename> in order based on the number "
11172
"prepended to the script. The output of the scripts is written to "
11173
"<filename>/var/run/motd</filename>, keeping the numerical order, then "
11174
"concatenated with <filename>/etc/motd.tail</filename>."
11175
msgstr ""
11176
11177
#: serverguide/C/other-apps.xml:52(para)
11178
msgid ""
11179
"You can add your own dynamic information to the MOTD. For example, to add "
11180
"local weather information:"
11181
msgstr ""
11182
11183
#: serverguide/C/other-apps.xml:58(para)
11184
msgid "First, install the <application>weather-util</application> package:"
11185
msgstr ""
11186
11187
#: serverguide/C/other-apps.xml:63(command)
11188
msgid "sudo apt-get install weather-util"
11189
msgstr ""
11190
11191
#: serverguide/C/other-apps.xml:68(para)
11192
msgid ""
11193
"The <application>weather</application> utility uses METAR data from the "
11194
"National Oceanic and Atmospheric Administration and forecasts from the "
11195
"National Weather Service. In order to find local information you will need "
11196
"the 4-character ICAO location indicator. This can be determined by browsing "
11197
"to the <ulink url=\"http://www.weather.gov/tg/siteloc.shtml\">National "
11198
"Weather Service</ulink> site."
11199
msgstr ""
11200
11201
#: serverguide/C/other-apps.xml:75(para)
11202
msgid ""
11203
"Although the National Weather Service is a United States government agency "
11204
"there are weather stations available world wide. However, local weather "
11205
"information for all locations outside the U.S. may not be available."
11206
msgstr ""
11207
11208
#: serverguide/C/other-apps.xml:81(para)
11209
msgid ""
11210
"Create <filename>/usr/local/bin/local-weather</filename>, a simple shell "
11211
"script to use <application>weather</application> with your local ICAO "
11212
"indicator:"
11213
msgstr ""
11214
11215
#: serverguide/C/other-apps.xml:86(programlisting)
11216
#, no-wrap
11217
msgid ""
11218
"\n"
11219
"#!/bin/sh\n"
11220
"#\n"
11221
"#\n"
11222
"# Prints the local weather information for the MOTD.\n"
11223
"#\n"
11224
"#\n"
11225
"\n"
11226
"# Replace KINT with your local weather station.\n"
11227
"# Local stations can be found here: http://www.weather.gov/tg/siteloc.shtml\n"
11228
"\n"
11229
"echo\n"
11230
"weather -i KINT\n"
11231
"echo\n"
11232
"\n"
11233
msgstr ""
11234
11235
#: serverguide/C/other-apps.xml:104(para)
11236
msgid "Make the script executable:"
11237
msgstr ""
11238
11239
#: serverguide/C/other-apps.xml:109(command)
11240
msgid "sudo chmod 755 /usr/local/bin/local-weather"
11241
msgstr ""
11242
11243
#: serverguide/C/other-apps.xml:113(para)
11244
msgid ""
11245
"Next, create a symlink to <filename>/etc/update-motd.d/98-local-"
11246
"weather</filename>:"
11247
msgstr ""
11248
11249
#: serverguide/C/other-apps.xml:118(command)
11250
msgid ""
11251
"sudo ln -s /usr/local/bin/local-weather /etc/update-motd.d/98-local-weather"
11252
msgstr ""
11253
11254
#: serverguide/C/other-apps.xml:122(para)
11255
msgid "Finally, exit the server and re-login to view the new MOTD."
11256
msgstr ""
11257
11258
#: serverguide/C/other-apps.xml:128(para)
11259
msgid ""
11260
"You should now be greeted with some useful information, and some information "
11261
"about the local weather that may not be quite so useful. Hopefully the "
11262
"<application>local-weather</application> example demonstrates the "
11263
"flexibility of <application>pam_motd</application>."
11264
msgstr ""
11265
11266
#: serverguide/C/other-apps.xml:136(title)
11267
msgid "etckeeper"
11268
msgstr ""
11269
11270
#: serverguide/C/other-apps.xml:138(para)
11271
msgid ""
11272
"<application>etckeeper</application> allows the contents of <filename "
11273
"role=\"directory\">/etc</filename> be easily stored in Version Control "
11274
"System (VCS) repository. It hooks into <application>apt</application> to "
11275
"automatically commit changes to <filename>/etc</filename> when packages are "
11276
"installed or upgraded. Placing <filename>/etc</filename> under version "
11277
"control is considered an industry best practice, and the goal of "
11278
"<application>etckeeper</application> is to make this process as painless as "
11279
"possible."
11280
msgstr ""
11281
11282
#: serverguide/C/other-apps.xml:146(para)
11283
msgid ""
11284
"Install <application>etckeeper</application> by entering the following in a "
11285
"terminal:"
11286
msgstr ""
11287
11288
#: serverguide/C/other-apps.xml:151(command)
11289
msgid "sudo apt-get install etckeeper"
11290
msgstr ""
11291
11292
#: serverguide/C/other-apps.xml:154(para)
11293
msgid ""
11294
"The main configuration file, "
11295
"<filename>/etc/etckeeper/etckeeper.conf</filename>, is fairly simple. The "
11296
"main option is which VCS to use. By default "
11297
"<application>etckeeper</application> is configured to use "
11298
"<application>bzr</application> for version control. The repository is "
11299
"automatically initialized (and committed for the first time) during package "
11300
"installation. It is possible to undo this by entering the following command:"
11301
msgstr ""
11302
11303
#: serverguide/C/other-apps.xml:164(command)
11304
msgid "sudo etckeeper uninit"
11305
msgstr ""
11306
11307
#: serverguide/C/other-apps.xml:167(para)
11308
msgid ""
11309
"By default, etckeeper will commit uncommitted changes made to /etc daily. "
11310
"This can be disabled using the AVOID_DAILY_AUTOCOMMITS configuration option. "
11311
"It will also automatically commit changes before and after package "
11312
"installation. For a more precise tracking of changes, it is recommended to "
11313
"commit your changes manually, together with a commit message, using:"
11314
msgstr ""
11315
11316
#: serverguide/C/other-apps.xml:176(command)
11317
msgid "sudo etckeeper commit \"..Reason for configuration change..\""
11318
msgstr ""
11319
11320
#: serverguide/C/other-apps.xml:179(para)
11321
msgid ""
11322
"Using the VCS commands you can view log information about files in "
11323
"<filename>/etc</filename>:"
11324
msgstr ""
11325
11326
#: serverguide/C/other-apps.xml:184(command)
11327
msgid "sudo bzr log /etc/passwd"
11328
msgstr ""
11329
11330
#: serverguide/C/other-apps.xml:187(para)
11331
msgid ""
11332
"To demonstrate the integration with the package management system, install "
11333
"<application>postfix</application>:"
11334
msgstr ""
11335
11336
#: serverguide/C/other-apps.xml:192(command) serverguide/C/mail.xml:45(command)
11337
msgid "sudo apt-get install postfix"
11338
msgstr ""
11339
11340
#: serverguide/C/other-apps.xml:195(para)
11341
msgid ""
11342
"When the installation is finished, all the "
11343
"<application>postfix</application> configuration files should be committed "
11344
"to the repository:"
11345
msgstr ""
11346
11347
#: serverguide/C/other-apps.xml:201(computeroutput)
11348
#, no-wrap
11349
msgid ""
11350
"Committing to: /etc/\n"
11351
"added aliases.db\n"
11352
"modified group\n"
11353
"modified group-\n"
11354
"modified gshadow\n"
11355
"modified gshadow-\n"
11356
"modified passwd\n"
11357
"modified passwd-\n"
11358
"added postfix\n"
11359
"added resolvconf\n"
11360
"added rsyslog.d\n"
11361
"modified shadow\n"
11362
"modified shadow-\n"
11363
"added init.d/postfix\n"
11364
"added network/if-down.d/postfix\n"
11365
"added network/if-up.d/postfix\n"
11366
"added postfix/dynamicmaps.cf\n"
11367
"added postfix/main.cf\n"
11368
"added postfix/master.cf\n"
11369
"added postfix/post-install\n"
11370
"added postfix/postfix-files\n"
11371
"added postfix/postfix-script\n"
11372
"added postfix/sasl\n"
11373
"added ppp/ip-down.d\n"
11374
"added ppp/ip-down.d/postfix\n"
11375
"added ppp/ip-up.d/postfix\n"
11376
"added rc0.d/K20postfix\n"
11377
"added rc1.d/K20postfix\n"
11378
"added rc2.d/S20postfix\n"
11379
"added rc3.d/S20postfix\n"
11380
"added rc4.d/S20postfix\n"
11381
"added rc5.d/S20postfix\n"
11382
"added rc6.d/K20postfix\n"
11383
"added resolvconf/update-libc.d\n"
11384
"added resolvconf/update-libc.d/postfix\n"
11385
"added rsyslog.d/postfix.conf\n"
11386
"added ufw/applications.d/postfix\n"
11387
"Committed revision 2."
11388
msgstr ""
11389
11390
#: serverguide/C/other-apps.xml:241(para)
11391
msgid ""
11392
"For an example of how <application>etckeeper</application> tracks manual "
11393
"changes, add new a host to <filename>/etc/hosts</filename>. Using "
11394
"<application>bzr</application> you can see which files have been modified:"
11395
msgstr ""
11396
11397
#: serverguide/C/other-apps.xml:247(command)
11398
msgid "sudo bzr status /etc/"
11399
msgstr ""
11400
11401
#: serverguide/C/other-apps.xml:248(computeroutput)
11402
#, no-wrap
11403
msgid ""
11404
"modified:\n"
11405
" hosts"
11406
msgstr ""
11407
11408
#: serverguide/C/other-apps.xml:252(para)
11409
msgid "Now commit the changes:"
11410
msgstr ""
11411
11412
#: serverguide/C/other-apps.xml:257(command)
11413
msgid "sudo etckeeper commit \"new host\""
11414
msgstr ""
11415
11416
#: serverguide/C/other-apps.xml:260(para)
11417
msgid ""
11418
"For more information on <application>bzr</application> see <xref "
11419
"linkend=\"bazaar\"/>."
11420
msgstr ""
11421
11422
#: serverguide/C/other-apps.xml:266(title)
11423
msgid "Byobu"
11424
msgstr ""
11425
11426
#: serverguide/C/other-apps.xml:268(para)
11427
msgid ""
11428
"One of the most useful applications for any system administrator is "
11429
"<application>screen</application>. It allows the execution of multiple "
11430
"shells in one terminal. To make some of the advanced "
11431
"<application>screen</application> features more user friendly, and provide "
11432
"some useful information about the system, the "
11433
"<application>byobu</application> package was created."
11434
msgstr ""
11435
11436
#: serverguide/C/other-apps.xml:275(para)
11437
msgid ""
11438
"When executing <application>byobu</application> pressing the "
11439
"<emphasis>F9</emphasis> key will bring up the "
11440
"<application>Configuration</application> menu. This menu will allow you to:"
11441
msgstr ""
11442
11443
#: serverguide/C/other-apps.xml:281(para)
11444
msgid "View the Help menu"
11445
msgstr ""
11446
11447
#: serverguide/C/other-apps.xml:282(para)
11448
msgid "Change Byobu's background color"
11449
msgstr ""
11450
11451
#: serverguide/C/other-apps.xml:283(para)
11452
msgid "Change Byobu's foreground color"
11453
msgstr ""
11454
11455
#: serverguide/C/other-apps.xml:284(para)
11456
msgid "Toggle status notifications"
11457
msgstr ""
11458
11459
#: serverguide/C/other-apps.xml:285(para)
11460
msgid "Change the key binding set"
11461
msgstr ""
11462
11463
#: serverguide/C/other-apps.xml:286(para)
11464
msgid "Change the escape sequence"
11465
msgstr ""
11466
11467
#: serverguide/C/other-apps.xml:287(para)
11468
msgid "Create new windows"
11469
msgstr ""
11470
11471
#: serverguide/C/other-apps.xml:288(para)
11472
msgid "Manage the default windows"
11473
msgstr ""
11474
11475
#: serverguide/C/other-apps.xml:289(para)
11476
msgid "Byobu currently does not launch at login (toggle on)"
11477
msgstr ""
11478
11479
#: serverguide/C/other-apps.xml:292(para)
11480
msgid ""
11481
"The <emphasis>key bindings</emphasis> determine such things as the escape "
11482
"sequence, new window, change window, etc. There are two key binding sets to "
11483
"choose from <emphasis>f-keys</emphasis> and <emphasis>screen-escape-"
11484
"keys</emphasis>. If you wish to use the original key bindings choose the "
11485
"<emphasis>none</emphasis> set."
11486
msgstr ""
11487
11488
#: serverguide/C/other-apps.xml:298(para)
11489
msgid ""
11490
"<application>byobu</application> provides a menu which displays the Ubuntu "
11491
"release, processor information, memory information, and the time and date. "
11492
"The effect is similar to a desktop menu."
11493
msgstr ""
11494
11495
#: serverguide/C/other-apps.xml:303(para)
11496
msgid ""
11497
"Using the <emphasis>\"Byobu currently does not launch at login (toggle "
11498
"on)\"</emphasis> option will cause <application>byobu</application> to be "
11499
"executed any time a terminal is opened. Changes made to "
11500
"<application>byobu</application> are on a per user basis, and will not "
11501
"affect other users on the system."
11502
msgstr ""
11503
11504
#: serverguide/C/other-apps.xml:309(para)
11505
msgid ""
11506
"One difference when using byobu is the <emphasis>scrollback</emphasis> mode. "
11507
"Press the <emphasis>F7</emphasis> key to enter scrollback mode. Scrollback "
11508
"mode allows you to navigate past output using <emphasis>vi</emphasis> like "
11509
"commands. Here is a quick list of movement commands:"
11510
msgstr ""
11511
11512
#: serverguide/C/other-apps.xml:316(para)
11513
msgid "<emphasis>h</emphasis> - Move the cursor left by one character"
11514
msgstr ""
11515
11516
#: serverguide/C/other-apps.xml:317(para)
11517
msgid "<emphasis>j</emphasis> - Move the cursor down by one line"
11518
msgstr ""
11519
11520
#: serverguide/C/other-apps.xml:318(para)
11521
msgid "<emphasis>k</emphasis> - Move the cursor up by one line"
11522
msgstr ""
11523
11524
#: serverguide/C/other-apps.xml:319(para)
11525
msgid "<emphasis>l</emphasis> - Move the cursor right by one character"
11526
msgstr ""
11527
11528
#: serverguide/C/other-apps.xml:320(para)
11529
msgid "<emphasis>0</emphasis> - Move to the beginning of the current line"
11530
msgstr ""
11531
11532
#: serverguide/C/other-apps.xml:321(para)
11533
msgid "<emphasis>$</emphasis> - Move to the end of the current line"
11534
msgstr ""
11535
11536
#: serverguide/C/other-apps.xml:322(para)
11537
msgid ""
11538
"<emphasis>G</emphasis> - Moves to the specified line (defaults to the end of "
11539
"the buffer)"
11540
msgstr ""
11541
11542
#: serverguide/C/other-apps.xml:323(para)
11543
msgid "<emphasis>/</emphasis> - Search forward"
11544
msgstr ""
11545
11546
#: serverguide/C/other-apps.xml:324(para)
11547
msgid "<emphasis>?</emphasis> - Search backward"
11548
msgstr ""
11549
11550
#: serverguide/C/other-apps.xml:325(para)
11551
msgid ""
11552
"<emphasis>n</emphasis> - Moves to the next match, either forward or backword"
11553
msgstr ""
11554
11555
#: serverguide/C/other-apps.xml:334(para)
11556
msgid ""
11557
"See the <ulink "
11558
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/update-motd.1.html\">"
11559
"update-motd man page</ulink> for more options available to "
11560
"<application>update-motd</application>."
11561
msgstr ""
11562
11563
#: serverguide/C/other-apps.xml:340(para)
11564
msgid ""
11565
"The Debian Package of the Day <ulink "
11566
"url=\"http://debaday.debian.net/2007/10/04/weather-check-weather-conditions-"
11567
"and-forecasts-on-the-command-line/\">weather</ulink> article has more "
11568
"details about using the <application>weather</application>utility."
11569
msgstr ""
11570
11571
#: serverguide/C/other-apps.xml:347(para)
11572
msgid ""
11573
"See the <ulink "
11574
"url=\"http://kitenet.net/~joey/code/etckeeper/\">etckeeper</ulink> site for "
11575
"more details on using <application>etckeeper</application>."
11576
msgstr ""
11577
11578
#: serverguide/C/other-apps.xml:353(para)
11579
msgid ""
11580
"The <ulink url=\"https://help.ubuntu.com/community/etckeeper\">etckeeper "
11581
"Ubuntu Wiki</ulink> page."
11582
msgstr ""
11583
11584
#: serverguide/C/other-apps.xml:358(para)
11585
msgid ""
11586
"For the latest news and information about <application>bzr</application> see "
11587
"the <ulink url=\"http://bazaar-vcs.org/\">bzr</ulink> web site."
11588
msgstr ""
11589
11590
#: serverguide/C/other-apps.xml:363(para)
11591
msgid ""
11592
"For more information on <application>screen</application> see the <ulink "
11593
"url=\"http://www.gnu.org/software/screen/\">screen web site</ulink>."
11594
msgstr ""
11595
11596
#: serverguide/C/other-apps.xml:368(para)
11597
msgid ""
11598
"And the <ulink url=\"https://help.ubuntu.com/community/Screen\">Ubuntu Wiki "
11599
"screen</ulink> page."
11600
msgstr ""
11601
11602
#: serverguide/C/other-apps.xml:373(para)
11603
msgid ""
11604
"Also, see the <application>byobu</application><ulink "
11605
"url=\"https://launchpad.net/byobu\">project page</ulink> for more "
11606
"information."
11607
msgstr ""
11608
11609
#: serverguide/C/network-config.xml:14(para)
11610
msgid ""
11611
"Networks consist of two or more devices, such as computer systems, printers, "
11612
"and related equipment which are connected by either physical cabling or "
11613
"wireless links for the purpose of sharing and distributing information among "
11614
"the connected devices."
11615
msgstr ""
11616
11617
#: serverguide/C/network-config.xml:20(para)
11618
msgid ""
11619
"This section provides general and specific information pertaining to "
11620
"networking, including an overview of network concepts and detailed "
11621
"discussion of popular network protocols."
11622
msgstr ""
11623
11624
#: serverguide/C/network-config.xml:27(title)
11625
msgid "Network Configuration"
11626
msgstr "Конфигурација на мрежа"
11627
11628
#: serverguide/C/network-config.xml:28(para)
11629
msgid ""
11630
"Ubuntu ships with a number of graphical utilities to configure your network "
11631
"devices. This document is geared toward server administrators and will focus "
11632
"on managing your network on the command line."
11633
msgstr ""
11634
"Ubuntu догаѓа со голем број на графички алатки за конфигурација на мрежните "
11635
"уреди. Овој документ е наменет за серверските администратори и ќе се "
11636
"фокусира на управување со вашата мрежа од конмандна линија."
11637
11638
#: serverguide/C/network-config.xml:35(title)
11639
msgid "Ethernet Interfaces"
11640
msgstr ""
11641
11642
#: serverguide/C/network-config.xml:36(para)
11643
msgid ""
11644
"Ethernet interfaces are identified by the system using the naming convention "
11645
"of <emphasis role=\"italix\">ethX</emphasis>, where <emphasis "
11646
"role=\"italic\">X</emphasis> represents a numeric value. The first Ethernet "
11647
"interface is typically identified as <emphasis "
11648
"role=\"italic\">eth0</emphasis>, the second as <emphasis "
11649
"role=\"italic\">eth1</emphasis>, and all others should move up in numerical "
11650
"order."
11651
msgstr ""
11652
11653
#: serverguide/C/network-config.xml:46(title)
11654
msgid "Identify Ethernet Interfaces"
11655
msgstr ""
11656
11657
#: serverguide/C/network-config.xml:47(para)
11658
msgid ""
11659
"To quickly identify all available Ethernet interfaces, you can use the "
11660
"<application>ifconfig</application> command as shown below."
11661
msgstr ""
11662
11663
#: serverguide/C/network-config.xml:52(userinput)
11664
#, no-wrap
11665
msgid "ifconfig -a | grep eth"
11666
msgstr ""
11667
11668
#: serverguide/C/network-config.xml:51(screen)
11669
#, no-wrap
11670
msgid ""
11671
"\n"
11672
"<placeholder-1/>\n"
11673
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a\n"
11674
msgstr ""
11675
11676
#: serverguide/C/network-config.xml:55(para)
11677
msgid ""
11678
"Another application that can help identify all network interfaces available "
11679
"to your system is the <application>lshw</application> command. In the "
11680
"example below, <application>lshw</application> shows a single Ethernet "
11681
"interface with the logical name of <emphasis role=\"italic\">eth0</emphasis> "
11682
"along with bus information, driver details and all supported capabilities."
11683
msgstr ""
11684
11685
#: serverguide/C/network-config.xml:62(userinput)
11686
#, no-wrap
11687
msgid "sudo lshw -class network"
11688
msgstr ""
11689
11690
#: serverguide/C/network-config.xml:61(screen)
11691
#, no-wrap
11692
msgid ""
11693
"\n"
11694
"<placeholder-1/>\n"
11695
" *-network\n"
11696
" description: Ethernet interface\n"
11697
" product: BCM4401-B0 100Base-TX\n"
11698
" vendor: Broadcom Corporation\n"
11699
" physical id: 0\n"
11700
" bus info: pci@0000:03:00.0\n"
11701
" logical name: eth0\n"
11702
" version: 02\n"
11703
" serial: 00:15:c5:4a:16:5a\n"
11704
" size: 10MB/s\n"
11705
" capacity: 100MB/s\n"
11706
" width: 32 bits\n"
11707
" clock: 33MHz\n"
11708
" capabilities: (snipped for brevity)\n"
11709
" configuration: (snipped for brevity)\n"
11710
" resources: irq:17 memory:ef9fe000-ef9fffff\n"
11711
msgstr ""
11712
11713
#: serverguide/C/network-config.xml:83(title)
11714
msgid "Ethernet Interface Logical Names"
11715
msgstr ""
11716
11717
#: serverguide/C/network-config.xml:84(para)
11718
msgid ""
11719
"Interface logical names are configured in the file "
11720
"<filename>/etc/udev/rules.d/70-persistent-net.rules.</filename> If you would "
11721
"like control which interface receives a particular logical name, find the "
11722
"line matching the interfaces physical MAC address and modify the value of "
11723
"<emphasis role=\"italic\">NAME=ethX</emphasis> to the desired logical name. "
11724
"Reboot the system to commit your changes."
11725
msgstr ""
11726
11727
#: serverguide/C/network-config.xml:92(programlisting)
11728
#, no-wrap
11729
msgid ""
11730
"\n"
11731
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11732
"ATTR{address}==\"00:15:c5:4a:16:5a\", ATTR{dev_id}==\"0x0\", "
11733
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth0\"\n"
11734
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11735
"ATTR{address}==\"00:15:c5:4a:16:5b\", ATTR{dev_id}==\"0x0\", "
11736
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth1\"\n"
11737
msgstr ""
11738
11739
#: serverguide/C/network-config.xml:99(title)
11740
msgid "Ethernet Interface Settings"
11741
msgstr ""
11742
11743
#: serverguide/C/network-config.xml:100(para)
11744
msgid ""
11745
"<application>ethtool</application> is a program that displays and changes "
11746
"Ethernet card settings such as auto-negotiation, port speed, duplex mode, "
11747
"and Wake-on-LAN. It is not installed by default, but is available for "
11748
"installation in the repositories."
11749
msgstr ""
11750
11751
#: serverguide/C/network-config.xml:106(userinput)
11752
#, no-wrap
11753
msgid "sudo apt-get install ethtool"
11754
msgstr ""
11755
11756
#: serverguide/C/network-config.xml:108(para)
11757
msgid ""
11758
"The following is an example of how to view supported features and configured "
11759
"settings of an Ethernet interface."
11760
msgstr ""
11761
11762
#: serverguide/C/network-config.xml:113(userinput)
11763
#, no-wrap
11764
msgid "sudo ethtool eth0"
11765
msgstr ""
11766
11767
#: serverguide/C/network-config.xml:112(screen)
11768
#, no-wrap
11769
msgid ""
11770
"\n"
11771
"<placeholder-1/>\n"
11772
"Settings for eth0:\n"
11773
" Supported ports: [ TP ]\n"
11774
" Supported link modes: 10baseT/Half 10baseT/Full \n"
11775
" 100baseT/Half 100baseT/Full \n"
11776
" 1000baseT/Half 1000baseT/Full \n"
11777
" Supports auto-negotiation: Yes\n"
11778
" Advertised link modes: 10baseT/Half 10baseT/Full \n"
11779
" 100baseT/Half 100baseT/Full \n"
11780
" 1000baseT/Half 1000baseT/Full \n"
11781
" Advertised auto-negotiation: Yes\n"
11782
" Speed: 1000Mb/s\n"
11783
" Duplex: Full\n"
11784
" Port: Twisted Pair\n"
11785
" PHYAD: 1\n"
11786
" Transceiver: internal\n"
11787
" Auto-negotiation: on\n"
11788
" Supports Wake-on: g\n"
11789
" Wake-on: d\n"
11790
" Current message level: 0x000000ff (255)\n"
11791
" Link detected: yes\n"
11792
msgstr ""
11793
11794
#: serverguide/C/network-config.xml:135(para)
11795
msgid ""
11796
"Changes made with the <application>ethtool</application> command are "
11797
"temporary and will be lost after a reboot. If you would like to retain "
11798
"settings, simply add the desired <application>ethtool</application> command "
11799
"to a <emphasis role=\"italic\">pre-up</emphasis> statement in the interface "
11800
"configuration file <filename>/etc/network/interfaces</filename>."
11801
msgstr ""
11802
11803
#: serverguide/C/network-config.xml:141(para)
11804
msgid ""
11805
"The following is an example of how the interface identified as <emphasis "
11806
"role=\"italic\">eth0</emphasis> could be permanently configured with a port "
11807
"speed of 1000Mb/s running in full duplex mode."
11808
msgstr ""
11809
11810
#: serverguide/C/network-config.xml:145(programlisting)
11811
#, no-wrap
11812
msgid ""
11813
"\n"
11814
"auto eth0\n"
11815
"iface eth0 inet static\n"
11816
"pre-up /usr/sbin/ethtool -s eth0 speed 1000 duplex full\n"
11817
msgstr ""
11818
11819
#: serverguide/C/network-config.xml:151(para)
11820
msgid ""
11821
"Although the example above shows the interface configured to use the "
11822
"<emphasis role=\"italic\">static</emphasis> method, it actually works with "
11823
"other methods as well, such as DHCP. The example is meant to demonstrate "
11824
"only proper placement of the <emphasis role=\"italic\">pre-up</emphasis> "
11825
"statement in relation to the rest of the interface configuration."
11826
msgstr ""
11827
11828
#: serverguide/C/network-config.xml:163(title)
11829
msgid "IP Addressing"
11830
msgstr ""
11831
11832
#: serverguide/C/network-config.xml:164(para)
11833
msgid ""
11834
"The following section describes the process of configuring your systems IP "
11835
"address and default gateway needed for communicating on a local area network "
11836
"and the Internet."
11837
msgstr ""
11838
11839
#: serverguide/C/network-config.xml:171(title)
11840
msgid "Temporary IP Address Assignment"
11841
msgstr ""
11842
11843
#: serverguide/C/network-config.xml:172(para)
11844
msgid ""
11845
"For temporary network configurations, you can use standard commands such as "
11846
"<application>ip</application>, <application>ifconfig</application> and "
11847
"<application>route</application>, which are also found on most other "
11848
"GNU/Linux operating systems. These commands allow you to configure settings "
11849
"which take effect immediately, however they are not persistent and will be "
11850
"lost after a reboot."
11851
msgstr ""
11852
11853
#: serverguide/C/network-config.xml:180(para)
11854
msgid ""
11855
"To temporarily configure an IP address, you can use the "
11856
"<application>ifconfig</application> command in the following manner. Just "
11857
"modify the IP address and subnet mask to match your network requirements."
11858
msgstr ""
11859
11860
#: serverguide/C/network-config.xml:186(userinput)
11861
#, no-wrap
11862
msgid "sudo ifconfig eth0 10.0.0.100 netmask 255.255.255.0"
11863
msgstr ""
11864
11865
#: serverguide/C/network-config.xml:188(para)
11866
msgid ""
11867
"To verify the IP address configuration of <application>eth0</application>, "
11868
"you can use the <application>ifconfig</application> command in the following "
11869
"manner."
11870
msgstr ""
11871
11872
#: serverguide/C/network-config.xml:193(userinput)
11873
#, no-wrap
11874
msgid "ifconfig eth0"
11875
msgstr ""
11876
11877
#: serverguide/C/network-config.xml:192(screen)
11878
#, no-wrap
11879
msgid ""
11880
"\n"
11881
"<placeholder-1/>\n"
11882
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a \n"
11883
" inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0\n"
11884
" inet6 addr: fe80::215:c5ff:fe4a:165a/64 Scope:Link\n"
11885
" UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1\n"
11886
" RX packets:466475604 errors:0 dropped:0 overruns:0 frame:0\n"
11887
" TX packets:403172654 errors:0 dropped:0 overruns:0 carrier:0\n"
11888
" collisions:0 txqueuelen:1000 \n"
11889
" RX bytes:2574778386 (2.5 GB) TX bytes:1618367329 (1.6 GB)\n"
11890
" Interrupt:16 \n"
11891
msgstr ""
11892
11893
#: serverguide/C/network-config.xml:204(para)
11894
msgid ""
11895
"To configure a default gateway, you can use the "
11896
"<application>route</application> command in the following manner. Modify the "
11897
"default gateway address to match your network requirements."
11898
msgstr ""
11899
11900
#: serverguide/C/network-config.xml:210(userinput)
11901
#, no-wrap
11902
msgid "sudo route add default gw 10.0.0.1 eth0"
11903
msgstr ""
11904
11905
#: serverguide/C/network-config.xml:212(para)
11906
msgid ""
11907
"To verify your default gateway configuration, you can use the "
11908
"<application>route</application> command in the following manner."
11909
msgstr ""
11910
11911
#: serverguide/C/network-config.xml:217(userinput)
11912
#, no-wrap
11913
msgid "route -n"
11914
msgstr ""
11915
11916
#: serverguide/C/network-config.xml:216(screen)
11917
#, no-wrap
11918
msgid ""
11919
"\n"
11920
"<placeholder-1/>\n"
11921
"Kernel IP routing table\n"
11922
"Destination Gateway Genmask Flags Metric Ref Use "
11923
"Iface\n"
11924
"10.0.0.0 0.0.0.0 255.255.255.0 U 1 0 0 "
11925
"eth0\n"
11926
"0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 "
11927
"eth0\n"
11928
msgstr ""
11929
11930
#: serverguide/C/network-config.xml:223(para)
11931
msgid ""
11932
"If you require DNS for your temporary network configuration, you can add DNS "
11933
"server IP addresses in the file <filename>/etc/resolv.conf</filename>. The "
11934
"example below shows how to enter two DNS servers to "
11935
"<filename>/etc/resolv.conf</filename>, which should be changed to servers "
11936
"appropriate for your network. A more lengthy description of DNS client "
11937
"configuration is in a following section."
11938
msgstr ""
11939
11940
#: serverguide/C/network-config.xml:230(programlisting)
11941
#, no-wrap
11942
msgid ""
11943
"\n"
11944
"nameserver 8.8.8.8\n"
11945
"nameserver 8.8.4.4\n"
11946
msgstr ""
11947
11948
#: serverguide/C/network-config.xml:234(para)
11949
msgid ""
11950
"If you no longer need this configuration and wish to purge all IP "
11951
"configuration from an interface, you can use the "
11952
"<application>ip</application> command with the flush option as shown below."
11953
msgstr ""
11954
11955
#: serverguide/C/network-config.xml:240(userinput)
11956
#, no-wrap
11957
msgid "ip addr flush eth0"
11958
msgstr ""
11959
11960
#: serverguide/C/network-config.xml:243(para)
11961
msgid ""
11962
"Flushing the IP configuration using the <application>ip</application> "
11963
"command does not clear the contents of "
11964
"<filename>/etc/resolv.conf</filename>. You must remove or modify those "
11965
"entries manually."
11966
msgstr ""
11967
11968
#: serverguide/C/network-config.xml:251(title)
11969
msgid "Dynamic IP Address Assignment (DHCP Client)"
11970
msgstr ""
11971
11972
#: serverguide/C/network-config.xml:252(para)
11973
msgid ""
11974
"To configure your server to use DHCP for dynamic address assignment, add the "
11975
"<emphasis role=\"italic\">dhcp</emphasis> method to the inet address family "
11976
"statement for the appropriate interface in the file "
11977
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
11978
"are configuring your first Ethernet interface identified as <emphasis "
11979
"role=\"italic\">eth0</emphasis>."
11980
msgstr ""
11981
11982
#: serverguide/C/network-config.xml:259(programlisting)
11983
#, no-wrap
11984
msgid ""
11985
"\n"
11986
"auto eth0\n"
11987
"iface eth0 inet dhcp\n"
11988
msgstr ""
11989
11990
#: serverguide/C/network-config.xml:263(para)
11991
msgid ""
11992
"By adding an interface configuration as shown above, you can manually enable "
11993
"the interface through the <application>ifup</application> command which "
11994
"initiates the DHCP process via <application>dhclient</application>."
11995
msgstr ""
11996
11997
#: serverguide/C/network-config.xml:269(userinput) serverguide/C/network-config.xml:304(userinput)
11998
#, no-wrap
11999
msgid "sudo ifup eth0"
12000
msgstr ""
12001
12002
#: serverguide/C/network-config.xml:271(para)
12003
msgid ""
12004
"To manually disable the interface, you can use the "
12005
"<application>ifdown</application> command, which in turn will initiate the "
12006
"DHCP release process and shut down the interface."
12007
msgstr ""
12008
12009
#: serverguide/C/network-config.xml:277(userinput) serverguide/C/network-config.xml:311(userinput)
12010
#, no-wrap
12011
msgid "sudo ifdown eth0"
12012
msgstr ""
12013
12014
#: serverguide/C/network-config.xml:282(title)
12015
msgid "Static IP Address Assignment"
12016
msgstr ""
12017
12018
#: serverguide/C/network-config.xml:283(para)
12019
msgid ""
12020
"To configure your system to use a static IP address assignment, add the "
12021
"<emphasis role=\"italic\">static</emphasis> method to the inet address "
12022
"family statement for the appropriate interface in the file "
12023
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
12024
"are configuring your first Ethernet interface identified as <emphasis "
12025
"role=\"italic\">eth0</emphasis>. Change the <emphasis "
12026
"role=\"italic\">address</emphasis>, <emphasis "
12027
"role=\"italic\">netmask</emphasis>, and <emphasis "
12028
"role=\"italic\">gateway</emphasis> values to meet the requirements of your "
12029
"network."
12030
msgstr ""
12031
12032
#: serverguide/C/network-config.xml:292(programlisting)
12033
#, no-wrap
12034
msgid ""
12035
"\n"
12036
"auto eth0\n"
12037
"iface eth0 inet static\n"
12038
"address 10.0.0.100\n"
12039
"netmask 255.255.255.0\n"
12040
"gateway 10.0.0.1\n"
12041
msgstr ""
12042
12043
#: serverguide/C/network-config.xml:299(para)
12044
msgid ""
12045
"By adding an interface configuration as shown above, you can manually enable "
12046
"the interface through the <application>ifup</application> command."
12047
msgstr ""
12048
12049
#: serverguide/C/network-config.xml:306(para)
12050
msgid ""
12051
"To manually disable the interface, you can use the "
12052
"<application>ifdown</application> command."
12053
msgstr ""
12054
12055
#: serverguide/C/network-config.xml:316(title)
12056
msgid "Loopback Interface"
12057
msgstr ""
12058
12059
#: serverguide/C/network-config.xml:317(para)
12060
msgid ""
12061
"The loopback interface is identified by the system as <emphasis "
12062
"role=\"italic\">lo</emphasis> and has a default IP address of 127.0.0.1. It "
12063
"can be viewed using the ifconfig command."
12064
msgstr ""
12065
12066
#: serverguide/C/network-config.xml:322(userinput)
12067
#, no-wrap
12068
msgid "ifconfig lo"
12069
msgstr ""
12070
12071
#: serverguide/C/network-config.xml:321(screen)
12072
#, no-wrap
12073
msgid ""
12074
"\n"
12075
"<placeholder-1/>\n"
12076
"lo Link encap:Local Loopback \n"
12077
" inet addr:127.0.0.1 Mask:255.0.0.0\n"
12078
" inet6 addr: ::1/128 Scope:Host\n"
12079
" UP LOOPBACK RUNNING MTU:16436 Metric:1\n"
12080
" RX packets:2718 errors:0 dropped:0 overruns:0 frame:0\n"
12081
" TX packets:2718 errors:0 dropped:0 overruns:0 carrier:0\n"
12082
" collisions:0 txqueuelen:0 \n"
12083
" RX bytes:183308 (183.3 KB) TX bytes:183308 (183.3 KB)\n"
12084
msgstr ""
12085
12086
#: serverguide/C/network-config.xml:332(para)
12087
msgid ""
12088
"By default, there should be two lines in "
12089
"<filename>/etc/network/interfaces</filename> responsible for automatically "
12090
"configuring your loopback interface. It is recommended that you keep the "
12091
"default settings unless you have a specific purpose for changing them. An "
12092
"example of the two default lines are shown below."
12093
msgstr ""
12094
12095
#: serverguide/C/network-config.xml:338(programlisting)
12096
#, no-wrap
12097
msgid ""
12098
"\n"
12099
"auto lo\n"
12100
"iface lo inet loopback\n"
12101
msgstr ""
12102
12103
#: serverguide/C/network-config.xml:347(title)
12104
msgid "Name Resolution"
12105
msgstr ""
12106
12107
#: serverguide/C/network-config.xml:348(para)
12108
msgid ""
12109
"Name resolution as it relates to IP networking is the process of mapping IP "
12110
"addresses to hostnames, making it easier to identify resources on a network. "
12111
"The following section will explain how to properly configure your system for "
12112
"name resolution using DNS and static hostname records."
12113
msgstr ""
12114
12115
#: serverguide/C/network-config.xml:356(title)
12116
msgid "DNS Client Configuration"
12117
msgstr ""
12118
12119
#: serverguide/C/network-config.xml:357(para)
12120
msgid ""
12121
"To configure your system to use DNS for name resolution, add the IP "
12122
"addresses of the DNS servers that are appropriate for your network in the "
12123
"file <filename>/etc/resolv.conf</filename>. You can also add an optional DNS "
12124
"suffix search-lists to match your network domain names."
12125
msgstr ""
12126
12127
#: serverguide/C/network-config.xml:362(para)
12128
msgid ""
12129
"Below is an example of a typical configuration of "
12130
"<filename>/etc/resolv.conf</filename> for a server on the domain \"<emphasis "
12131
"role=\"italic\">example.com</emphasis>\" and using two public DNS servers."
12132
msgstr ""
12133
12134
#: serverguide/C/network-config.xml:367(programlisting)
12135
#, no-wrap
12136
msgid ""
12137
"\n"
12138
"search example.com\n"
12139
"nameserver 8.8.8.8\n"
12140
"nameserver 8.8.4.4\n"
12141
msgstr ""
12142
12143
#: serverguide/C/network-config.xml:372(para)
12144
msgid ""
12145
"The <emphasis role=\"italic\">search</emphasis> option can also be used with "
12146
"multiple domain names so that DNS queries will be appended in the order in "
12147
"which they are entered. For example, your network may have multiple sub-"
12148
"domains to search; a parent domain of <emphasis "
12149
"role=\"italic\">example.com</emphasis>, and two sub-domains, <emphasis "
12150
"role=\"italic\">sales.example.com</emphasis> and <emphasis "
12151
"role=\"italic\">dev.example.com</emphasis>."
12152
msgstr ""
12153
12154
#: serverguide/C/network-config.xml:380(para)
12155
msgid ""
12156
"If you have multiple domains you wish to search, your configuration might "
12157
"look like the following."
12158
msgstr ""
12159
12160
#: serverguide/C/network-config.xml:383(programlisting)
12161
#, no-wrap
12162
msgid ""
12163
"\n"
12164
"search example.com sales.example.com dev.example.com\n"
12165
"nameserver 8.8.8.8\n"
12166
"nameserver 8.8.4.4\n"
12167
msgstr ""
12168
12169
#: serverguide/C/network-config.xml:388(para)
12170
msgid ""
12171
"If you try to ping a host with the name of <emphasis "
12172
"role=\"italic\">server1</emphasis>, your system will automatically query DNS "
12173
"for its Fully Qualified Domain Name (FQDN) in the following order:"
12174
msgstr ""
12175
12176
#: serverguide/C/network-config.xml:394(para)
12177
msgid "server1<emphasis role=\"bold\">.example.com</emphasis>"
12178
msgstr ""
12179
12180
#: serverguide/C/network-config.xml:399(para)
12181
msgid "server1<emphasis role=\"bold\">.sales.example.com</emphasis>"
12182
msgstr ""
12183
12184
#: serverguide/C/network-config.xml:404(para)
12185
msgid "server1<emphasis role=\"bold\">.dev.example.com</emphasis>"
12186
msgstr ""
12187
12188
#: serverguide/C/network-config.xml:409(para)
12189
msgid ""
12190
"If no matches are found, the DNS server will provide a result of <emphasis "
12191
"role=\"italic\">notfound</emphasis> and the DNS query will fail."
12192
msgstr ""
12193
12194
#: serverguide/C/network-config.xml:416(title)
12195
msgid "Static Hostnames"
12196
msgstr ""
12197
12198
#: serverguide/C/network-config.xml:417(para)
12199
msgid ""
12200
"Static hostnames are locally defined hostname-to-IP mappings located in the "
12201
"file <filename>/etc/hosts</filename>. Entries in the "
12202
"<filename>hosts</filename> file will have precedence over DNS by default. "
12203
"This means that if your system tries to resolve a hostname and it matches an "
12204
"entry in /etc/hosts, it will not attempt to look up the record in DNS. In "
12205
"some configurations, especially when Internet access is not required, "
12206
"servers that communicate with a limited number of resources can be "
12207
"conveniently set to use static hostnames instead of DNS."
12208
msgstr ""
12209
12210
#: serverguide/C/network-config.xml:424(para)
12211
msgid ""
12212
"The following is an example of a <filename>hosts</filename> file where a "
12213
"number of local servers have been identified by simple hostnames, aliases "
12214
"and their equivalent Fully Qualified Domain Names (FQDN's)."
12215
msgstr ""
12216
12217
#: serverguide/C/network-config.xml:428(programlisting)
12218
#, no-wrap
12219
msgid ""
12220
"\n"
12221
"127.0.0.1\tlocalhost\n"
12222
"127.0.1.1\tubuntu-server\n"
12223
"10.0.0.11\tserver1 vpn server1.example.com\n"
12224
"10.0.0.12\tserver2 mail server2.example.com\n"
12225
"10.0.0.13\tserver3 www server3.example.com\n"
12226
"10.0.0.14\tserver4 file server4.example.com\n"
12227
msgstr ""
12228
12229
#: serverguide/C/network-config.xml:437(para)
12230
msgid ""
12231
"In the above example, notice that each of the servers have been given "
12232
"aliases in addition to their proper names and FQDN's. <emphasis "
12233
"role=\"italic\">Server1</emphasis> has been mapped to the name <emphasis "
12234
"role=\"italic\">vpn</emphasis>, <emphasis role=\"italic\">server2</emphasis> "
12235
"is referred to as <emphasis role=\"italic\">mail</emphasis>, <emphasis "
12236
"role=\"italic\">server3</emphasis> as <emphasis "
12237
"role=\"italic\">www</emphasis>, and <emphasis "
12238
"role=\"italic\">server4</emphasis> as <emphasis "
12239
"role=\"italic\">file</emphasis>."
12240
msgstr ""
12241
12242
#: serverguide/C/network-config.xml:449(title)
12243
msgid "Name Service Switch Configuration"
12244
msgstr ""
12245
12246
#: serverguide/C/network-config.xml:450(para)
12247
msgid ""
12248
"The order in which your system selects a method of resolving hostnames to IP "
12249
"addresses is controlled by the Name Service Switch (NSS) configuration file "
12250
"<filename>/etc/nsswitch.conf</filename>. As mentioned in the previous "
12251
"section, typically static hostnames defined in the systems "
12252
"<filename>/etc/hosts</filename> file have precedence over names resolved "
12253
"from DNS. The following is an example of the line responsible for this order "
12254
"of hostname lookups in the file <filename>/etc/nsswitch.conf</filename>."
12255
msgstr ""
12256
12257
#: serverguide/C/network-config.xml:458(programlisting)
12258
#, no-wrap
12259
msgid ""
12260
"\n"
12261
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
12262
msgstr ""
12263
12264
#: serverguide/C/network-config.xml:464(para)
12265
msgid ""
12266
"<emphasis role=\"bold\">files</emphasis> first tries to resolve static "
12267
"hostnames located in <filename>/etc/hosts</filename>."
12268
msgstr ""
12269
12270
#: serverguide/C/network-config.xml:470(para)
12271
msgid ""
12272
"<emphasis role=\"bold\">mdns4_minimal</emphasis> attempts to resolve the "
12273
"name using Multicast DNS."
12274
msgstr ""
12275
12276
#: serverguide/C/network-config.xml:475(para)
12277
msgid ""
12278
"<emphasis role=\"bold\">[NOTFOUND=return]</emphasis> means that any response "
12279
"of <emphasis role=\"italic\">notfound</emphasis> by the preceeding <emphasis "
12280
"role=\"italic\">mdns4_minimal</emphasis> process should be treated as "
12281
"authoritative and that the system should not try to continue hunting for an "
12282
"answer."
12283
msgstr ""
12284
12285
#: serverguide/C/network-config.xml:483(para)
12286
msgid ""
12287
"<emphasis role=\"bold\">dns</emphasis> represents a legacy unicast DNS query."
12288
msgstr ""
12289
12290
#: serverguide/C/network-config.xml:488(para)
12291
msgid ""
12292
"<emphasis role=\"bold\">mdns4</emphasis> represents a Multicast DNS query."
12293
msgstr ""
12294
12295
#: serverguide/C/network-config.xml:494(para)
12296
msgid ""
12297
"To modify the order of the above mentioned name resolution methods, you can "
12298
"simply change the <emphasis role=\"italic\">hosts:</emphasis> string to the "
12299
"value of your choosing. For example, if you prefer to use legacy Unicast DNS "
12300
"versus Multicast DNS, you can change the string in "
12301
"<filename>/etc/nsswitch.conf</filename> as shown below."
12302
msgstr ""
12303
12304
#: serverguide/C/network-config.xml:501(programlisting)
12305
#, no-wrap
12306
msgid ""
12307
"\n"
12308
"hosts: files dns [NOTFOUND=return] mdns4_minimal mdns4\n"
12309
msgstr ""
12310
12311
#: serverguide/C/network-config.xml:508(title)
12312
msgid "Bridging"
12313
msgstr ""
12314
12315
#: serverguide/C/network-config.xml:510(para)
12316
msgid ""
12317
"Bridging multiple interfaces is a more advanced configuration, but is very "
12318
"useful in multiple scenarios. One scenario is setting up a bridge with "
12319
"multiple network interfaces, then using a firewall to filter traffic between "
12320
"two network segments. Another scenario is using bridge on a system with one "
12321
"interface to allow virtual machines direct access to the outside network. "
12322
"The following example covers the latter scenario."
12323
msgstr ""
12324
12325
#: serverguide/C/network-config.xml:517(para)
12326
msgid ""
12327
"Before configuring a bridge you will need to install the <application>bridge-"
12328
"utils</application> package. To install the package, in a terminal enter:"
12329
msgstr ""
12330
12331
#: serverguide/C/network-config.xml:523(command)
12332
msgid "sudo apt-get install bridge-utils"
12333
msgstr ""
12334
12335
#: serverguide/C/network-config.xml:526(para)
12336
msgid ""
12337
"Next, configure the bridge by editing "
12338
"<filename>/etc/network/interfaces</filename>:"
12339
msgstr ""
12340
12341
#: serverguide/C/network-config.xml:530(programlisting)
12342
#, no-wrap
12343
msgid ""
12344
"\n"
12345
"auto lo\n"
12346
"iface lo inet loopback\n"
12347
"\n"
12348
"auto br0\n"
12349
"iface br0 inet static\n"
12350
" address 192.168.0.10\n"
12351
" network 192.168.0.0\n"
12352
" netmask 255.255.255.0\n"
12353
" broadcast 192.168.0.255\n"
12354
" gateway 192.168.0.1\n"
12355
" bridge_ports eth0\n"
12356
" bridge_fd 9\n"
12357
" bridge_hello 2\n"
12358
" bridge_maxage 12\n"
12359
" bridge_stp off\n"
12360
msgstr ""
12361
12362
#: serverguide/C/network-config.xml:549(para)
12363
msgid "Enter the appropriate values for your physical interface and network."
12364
msgstr ""
12365
12366
#: serverguide/C/network-config.xml:554(para)
12367
msgid "Now restart networking to enable the bridge interface:"
12368
msgstr ""
12369
12370
#: serverguide/C/network-config.xml:561(para)
12371
msgid ""
12372
"The new bridge interface should now be up and running. The "
12373
"<application>brctl</application> provides useful information about the state "
12374
"of the bridge, controls which interfaces are part of the bridge, etc. See "
12375
"<command>man brctl</command> for more information."
12376
msgstr ""
12377
12378
#: serverguide/C/network-config.xml:577(para)
12379
msgid ""
12380
"The <ulink url=\"https://help.ubuntu.com/community/Network\">Ubuntu Wiki "
12381
"Network page</ulink> has links to articles covering more advanced network "
12382
"configuration."
12383
msgstr ""
12384
12385
#: serverguide/C/network-config.xml:583(para)
12386
msgid ""
12387
"The <ulink "
12388
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/interfaces.5.html\">i"
12389
"nterfaces man page</ulink> has details on more options for "
12390
"<filename>/etc/network/interfaces</filename>."
12391
msgstr ""
12392
12393
#: serverguide/C/network-config.xml:589(para)
12394
msgid ""
12395
"The <ulink "
12396
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/dhclient.8.html\">dhc"
12397
"lient man page</ulink> has details on more options for configuring DHCP "
12398
"client settings."
12399
msgstr ""
12400
12401
#: serverguide/C/network-config.xml:595(para)
12402
msgid ""
12403
"For more information on DNS client configuration see the <ulink "
12404
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/resolver.5.html\">res"
12405
"olver man page</ulink>. Also, Chapter 6 of O'Reilly's <ulink "
12406
"url=\"http://oreilly.com/catalog/linag2/book/ch06.html\">Linux Network "
12407
"Administrator's Guide</ulink> is a good source of resolver and name service "
12408
"configuration information."
12409
msgstr ""
12410
12411
#: serverguide/C/network-config.xml:603(para)
12412
msgid ""
12413
"For more information on <emphasis>bridging</emphasis> see the <ulink "
12414
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/brctl.8.html\">brctl "
12415
"man page</ulink> and the Linux Foundation's <ulink "
12416
"url=\"http://www.linuxfoundation.org/en/Net:Bridge\">Net:Bridge</ulink> page."
12417
msgstr ""
12418
12419
#: serverguide/C/network-config.xml:614(title)
12420
msgid "TCP/IP"
12421
msgstr ""
12422
12423
#: serverguide/C/network-config.xml:615(para)
12424
msgid ""
12425
"The Transmission Control Protocol and Internet Protocol (TCP/IP) is a "
12426
"standard set of protocols developed in the late 1970s by the Defense "
12427
"Advanced Research Projects Agency (DARPA) as a means of communication "
12428
"between different types of computers and computer networks. TCP/IP is the "
12429
"driving force of the Internet, and thus it is the most popular set of "
12430
"network protocols on Earth."
12431
msgstr ""
12432
12433
#: serverguide/C/network-config.xml:623(title)
12434
msgid "TCP/IP Introduction"
12435
msgstr ""
12436
12437
#: serverguide/C/network-config.xml:624(para)
12438
msgid ""
12439
"The two protocol components of TCP/IP deal with different aspects of "
12440
"computer networking. <emphasis>Internet Protocol</emphasis>, the \"IP\" of "
12441
"TCP/IP is a connectionless protocol which deals only with network packet "
12442
"routing using the <emphasis role=\"italics\">IP Datagram</emphasis> as the "
12443
"basic unit of networking information. The IP Datagram consists of a header "
12444
"followed by a message. The <emphasis> Transmission Control "
12445
"Protocol</emphasis> is the \"TCP\" of TCP/IP and enables network hosts to "
12446
"establish connections which may be used to exchange data streams. TCP also "
12447
"guarantees that the data between connections is delivered and that it "
12448
"arrives at one network host in the same order as sent from another network "
12449
"host."
12450
msgstr ""
12451
12452
#: serverguide/C/network-config.xml:637(title)
12453
msgid "TCP/IP Configuration"
12454
msgstr ""
12455
12456
#: serverguide/C/network-config.xml:638(para)
12457
msgid ""
12458
"The TCP/IP protocol configuration consists of several elements which must be "
12459
"set by editing the appropriate configuration files, or deploying solutions "
12460
"such as the Dynamic Host Configuration Protocol (DHCP) server which in turn, "
12461
"can be configured to provide the proper TCP/IP configuration settings to "
12462
"network clients automatically. These configuration values must be set "
12463
"correctly in order to facilitate the proper network operation of your Ubuntu "
12464
"system."
12465
msgstr ""
12466
12467
#: serverguide/C/network-config.xml:650(para)
12468
msgid ""
12469
"<emphasis role=\"bold\">IP address</emphasis> The IP address is a unique "
12470
"identifying string expressed as four decimal numbers ranging from zero (0) "
12471
"to two-hundred and fifty-five (255), separated by periods, with each of the "
12472
"four numbers representing eight (8) bits of the address for a total length "
12473
"of thirty-two (32) bits for the whole address. This format is called "
12474
"<emphasis>dotted quad notation</emphasis>."
12475
msgstr ""
12476
12477
#: serverguide/C/network-config.xml:660(para)
12478
msgid ""
12479
"<emphasis role=\"bold\">Netmask</emphasis> The Subnet Mask (or simply, "
12480
"<emphasis>netmask</emphasis>) is a local bit mask, or set of flags which "
12481
"separate the portions of an IP address significant to the network from the "
12482
"bits significant to the <emphasis>subnetwork</emphasis>. For example, in a "
12483
"Class C network, the standard netmask is 255.255.255.0 which masks the first "
12484
"three bytes of the IP address and allows the last byte of the IP address to "
12485
"remain available for specifying hosts on the subnetwork."
12486
msgstr ""
12487
12488
#: serverguide/C/network-config.xml:671(para)
12489
msgid ""
12490
"<emphasis role=\"bold\">Network Address</emphasis> The Network Address "
12491
"represents the bytes comprising the network portion of an IP address. For "
12492
"example, the host 12.128.1.2 in a Class A network would use 12.0.0.0 as the "
12493
"network address, where twelve (12) represents the first byte of the IP "
12494
"address, (the network part) and zeroes (0) in all of the remaining three "
12495
"bytes to represent the potential host values. A network host using the "
12496
"private IP address 192.168.1.100 would in turn use a Network Address of "
12497
"192.168.1.0, which specifies the first three bytes of the Class C 192.168.1 "
12498
"network and a zero (0) for all the possible hosts on the network."
12499
msgstr ""
12500
12501
#: serverguide/C/network-config.xml:684(para)
12502
msgid ""
12503
"<emphasis role=\"bold\">Broadcast Address</emphasis> The Broadcast Address "
12504
"is an IP address which allows network data to be sent simultaneously to all "
12505
"hosts on a given subnetwork rather than specifying a particular host. The "
12506
"standard general broadcast address for IP networks is 255.255.255.255, but "
12507
"this broadcast address cannot be used to send a broadcast message to every "
12508
"host on the Internet because routers block it. A more appropriate broadcast "
12509
"address is set to match a specific subnetwork. For example, on the private "
12510
"Class C IP network, 192.168.1.0, the broadcast address is 192.168.1.255. "
12511
"Broadcast messages are typically produced by network protocols such as the "
12512
"Address Resolution Protocol (ARP) and the Routing Information Protocol (RIP)."
12513
msgstr ""
12514
12515
#: serverguide/C/network-config.xml:697(para)
12516
msgid ""
12517
"<emphasis role=\"bold\">Gateway Address</emphasis> A Gateway Address is the "
12518
"IP address through which a particular network, or host on a network, may be "
12519
"reached. If one network host wishes to communicate with another network "
12520
"host, and that host is not located on the same network, then a "
12521
"<emphasis>gateway</emphasis> must be used. In many cases, the Gateway "
12522
"Address will be that of a router on the same network, which will in turn "
12523
"pass traffic on to other networks or hosts, such as Internet hosts. The "
12524
"value of the Gateway Address setting must be correct, or your system will "
12525
"not be able to reach any hosts beyond those on the same network."
12526
msgstr ""
12527
12528
#: serverguide/C/network-config.xml:708(para)
12529
msgid ""
12530
"<emphasis role=\"bold\">Nameserver Address</emphasis> Nameserver Addresses "
12531
"represent the IP addresses of Domain Name Service (DNS) systems, which "
12532
"resolve network hostnames into IP addresses. There are three levels of "
12533
"Nameserver Addresses, which may be specified in order of precedence: The "
12534
"<emphasis>Primary</emphasis> Nameserver, the <emphasis>Secondary</emphasis> "
12535
"Nameserver, and the <emphasis>Tertiary</emphasis> Nameserver. In order for "
12536
"your system to be able to resolve network hostnames into their corresponding "
12537
"IP addresses, you must specify valid Nameserver Addresses which you are "
12538
"authorized to use in your system's TCP/IP configuration. In many cases these "
12539
"addresses can and will be provided by your network service provider, but "
12540
"many free and publicly accessible nameservers are available for use, such as "
12541
"the Level3 (Verizon) servers with IP addresses from 4.2.2.1 to 4.2.2.6."
12542
msgstr ""
12543
12544
#: serverguide/C/network-config.xml:722(para)
12545
msgid ""
12546
"The IP address, Netmask, Network Address, Broadcast Address, and Gateway "
12547
"Address are typically specified via the appropriate directives in the file "
12548
"<filename>/etc/network/interfaces</filename>. The Nameserver Addresses are "
12549
"typically specified via <emphasis>nameserver</emphasis> directives in the "
12550
"file <filename>/etc/resolv.conf</filename>. For more information, view the "
12551
"system manual page for <filename>interfaces</filename> or "
12552
"<filename>resolv.conf</filename> respectively, with the following commands "
12553
"typed at a terminal prompt:"
12554
msgstr ""
12555
12556
#: serverguide/C/network-config.xml:729(para)
12557
msgid ""
12558
"Access the system manual page for <filename>interfaces</filename> with the "
12559
"following command:"
12560
msgstr ""
12561
12562
#: serverguide/C/network-config.xml:734(command)
12563
msgid "man interfaces"
12564
msgstr ""
12565
12566
#: serverguide/C/network-config.xml:737(para)
12567
msgid ""
12568
"Access the system manual page for <filename>resolv.conf</filename> with the "
12569
"following command:"
12570
msgstr ""
12571
12572
#: serverguide/C/network-config.xml:741(command)
12573
msgid "man resolv.conf"
12574
msgstr ""
12575
12576
#: serverguide/C/network-config.xml:646(para)
12577
msgid ""
12578
"The common configuration elements of TCP/IP and their purposes are as "
12579
"follows: <placeholder-1/>"
12580
msgstr ""
12581
12582
#: serverguide/C/network-config.xml:748(title)
12583
msgid "IP Routing"
12584
msgstr ""
12585
12586
#: serverguide/C/network-config.xml:749(para)
12587
msgid ""
12588
"IP routing is a means of specifying and discovering paths in a TCP/IP "
12589
"network along which network data may be sent. Routing uses a set of "
12590
"<emphasis>routing tables</emphasis> to direct the forwarding of network data "
12591
"packets from their source to the destination, often via many intermediary "
12592
"network nodes known as <emphasis>routers</emphasis>. There are two primary "
12593
"forms of IP routing: <emphasis>Static Routing</emphasis> and "
12594
"<emphasis>Dynamic Routing.</emphasis>"
12595
msgstr ""
12596
12597
#: serverguide/C/network-config.xml:758(para)
12598
msgid ""
12599
"Static routing involves manually adding IP routes to the system's routing "
12600
"table, and this is usually done by manipulating the routing table with the "
12601
"<application>route</application> command. Static routing enjoys many "
12602
"advantages over dynamic routing, such as simplicity of implementation on "
12603
"smaller networks, predictability (the routing table is always computed in "
12604
"advance, and thus the route is precisely the same each time it is used), and "
12605
"low overhead on other routers and network links due to the lack of a dynamic "
12606
"routing protocol. However, static routing does present some disadvantages as "
12607
"well. For example, static routing is limited to small networks and does not "
12608
"scale well. Static routing also fails completely to adapt to network outages "
12609
"and failures along the route due to the fixed nature of the route."
12610
msgstr ""
12611
12612
#: serverguide/C/network-config.xml:768(para)
12613
msgid ""
12614
"Dynamic routing depends on large networks with multiple possible IP routes "
12615
"from a source to a destination and makes use of special routing protocols, "
12616
"such as the Router Information Protocol (RIP), which handle the automatic "
12617
"adjustments in routing tables that make dynamic routing possible. Dynamic "
12618
"routing has several advantages over static routing, such as superior "
12619
"scalability and the ability to adapt to failures and outages along network "
12620
"routes. Additionally, there is less manual configuration of the routing "
12621
"tables, since routers learn from one another about their existence and "
12622
"available routes. This trait also eliminates the possibility of introducing "
12623
"mistakes in the routing tables via human error. Dynamic routing is not "
12624
"perfect, however, and presents disadvantages such as heightened complexity "
12625
"and additional network overhead from router communications, which does not "
12626
"immediately benefit the end users, but still consumes network bandwidth."
12627
msgstr ""
12628
12629
#: serverguide/C/network-config.xml:782(title)
12630
msgid "TCP and UDP"
12631
msgstr ""
12632
12633
#: serverguide/C/network-config.xml:783(para)
12634
msgid ""
12635
"TCP is a connection-based protocol, offering error correction and guaranteed "
12636
"delivery of data via what is known as <emphasis>flow control</emphasis>. "
12637
"Flow control determines when the flow of a data stream needs to be stopped, "
12638
"and previously sent data packets should to be re-sent due to problems such "
12639
"as <emphasis>collisions</emphasis>, for example, thus ensuring complete and "
12640
"accurate delivery of the data. TCP is typically used in the exchange of "
12641
"important information such as database transactions."
12642
msgstr ""
12643
12644
#: serverguide/C/network-config.xml:791(para)
12645
msgid ""
12646
"The User Datagram Protocol (UDP), on the other hand, is a "
12647
"<emphasis>connectionless</emphasis> protocol which seldom deals with the "
12648
"transmission of important data because it lacks flow control or any other "
12649
"method to ensure reliable delivery of the data. UDP is commonly used in such "
12650
"applications as audio and video streaming, where it is considerably faster "
12651
"than TCP due to the lack of error correction and flow control, and where the "
12652
"loss of a few packets is not generally catastrophic."
12653
msgstr ""
12654
12655
#: serverguide/C/network-config.xml:801(title)
12656
msgid "ICMP"
12657
msgstr ""
12658
12659
#: serverguide/C/network-config.xml:802(para)
12660
msgid ""
12661
"The Internet Control Messaging Protocol (ICMP) is an extension to the "
12662
"Internet Protocol (IP) as defined in the Request For Comments (RFC) #792 and "
12663
"supports network packets containing control, error, and informational "
12664
"messages. ICMP is used by such network applications as the "
12665
"<application>ping</application> utility, which can determine the "
12666
"availability of a network host or device. Examples of some error messages "
12667
"returned by ICMP which are useful to both network hosts and devices such as "
12668
"routers, include <emphasis>Destination Unreachable</emphasis> and "
12669
"<emphasis>Time Exceeded</emphasis>."
12670
msgstr ""
12671
12672
#: serverguide/C/network-config.xml:812(title)
12673
msgid "Daemons"
12674
msgstr ""
12675
12676
#: serverguide/C/network-config.xml:813(para)
12677
msgid ""
12678
"Daemons are special system applications which typically execute continuously "
12679
"in the background and await requests for the functions they provide from "
12680
"other applications. Many daemons are network-centric; that is, a large "
12681
"number of daemons executing in the background on an Ubuntu system may "
12682
"provide network-related functionality. Some examples of such network daemons "
12683
"include the <emphasis>Hyper Text Transport Protocol Daemon</emphasis> "
12684
"(httpd), which provides web server functionality; the <emphasis>Secure SHell "
12685
"Daemon</emphasis> (sshd), which provides secure remote login shell and file "
12686
"transfer capabilities; and the <emphasis>Internet Message Access Protocol "
12687
"Daemon</emphasis> (imapd), which provides E-Mail services."
12688
msgstr ""
12689
12690
#: serverguide/C/network-config.xml:828(para)
12691
msgid ""
12692
"There are man pages for <ulink "
12693
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/tcp.7.html\">TCP</uli"
12694
"nk> and <ulink "
12695
"url=\"http://manpages.ubuntu.com/manpages/lucid/man7/ip.7.html\">IP</ulink> "
12696
"that contain more useful information."
12697
msgstr ""
12698
12699
#: serverguide/C/network-config.xml:834(para)
12700
msgid ""
12701
"Also, see the <ulink "
12702
"url=\"http://www.redbooks.ibm.com/abstracts/gg243376.html\">TCP/IP Tutorial "
12703
"and Technical Overview</ulink> IBM Redbook."
12704
msgstr ""
12705
12706
#: serverguide/C/network-config.xml:840(para)
12707
msgid ""
12708
"Another resource is O'Reilly's <ulink "
12709
"url=\"http://oreilly.com/catalog/9780596002978/\">TCP/IP Network "
12710
"Administration</ulink>."
12711
msgstr ""
12712
12713
#: serverguide/C/network-config.xml:849(title)
12714
msgid "Dynamic Host Configuration Protocol (DHCP)"
12715
msgstr ""
12716
12717
#: serverguide/C/network-config.xml:850(para)
12718
msgid ""
12719
"The Dynamic Host Configuration Protocol (DHCP) is a network service that "
12720
"enables host computers to be automatically assigned settings from a server "
12721
"as opposed to manually configuring each network host. Computers configured "
12722
"to be DHCP clients have no control over the settings they receive from the "
12723
"DHCP server, and the configuration is transparent to the computer's user."
12724
msgstr ""
12725
12726
#: serverguide/C/network-config.xml:857(para)
12727
msgid ""
12728
"The most common settings provided by a DHCP server to DHCP clients include:"
12729
msgstr ""
12730
12731
#: serverguide/C/network-config.xml:862(para)
12732
msgid "IP-Address and Netmask"
12733
msgstr ""
12734
12735
#: serverguide/C/network-config.xml:865(para)
12736
msgid "DNS"
12737
msgstr ""
12738
12739
#: serverguide/C/network-config.xml:868(para)
12740
msgid "WINS"
12741
msgstr ""
12742
12743
#: serverguide/C/network-config.xml:871(para)
12744
msgid ""
12745
"However, a DHCP server can also supply configuration properties such as:"
12746
msgstr ""
12747
12748
#: serverguide/C/network-config.xml:876(para)
12749
msgid "Host Name"
12750
msgstr ""
12751
12752
#: serverguide/C/network-config.xml:879(para)
12753
msgid "Domain Name"
12754
msgstr ""
12755
12756
#: serverguide/C/network-config.xml:882(para)
12757
msgid "Default Gateway"
12758
msgstr ""
12759
12760
#: serverguide/C/network-config.xml:885(para)
12761
msgid "Time Server"
12762
msgstr ""
12763
12764
#: serverguide/C/network-config.xml:888(para)
12765
msgid "Print Server"
12766
msgstr ""
12767
12768
#: serverguide/C/network-config.xml:891(para)
12769
msgid ""
12770
"The advantage of using DHCP is that changes to the network, for example a "
12771
"change in the address of the DNS server, need only be changed at the DHCP "
12772
"server, and all network hosts will be reconfigured the next time their DHCP "
12773
"clients poll the DHCP server. As an added advantage, it is also easier to "
12774
"integrate new computers into the network, as there is no need to check for "
12775
"the availability of an IP address. Conflicts in IP address allocation are "
12776
"also reduced."
12777
msgstr ""
12778
12779
#: serverguide/C/network-config.xml:899(para)
12780
msgid "A DHCP server can provide configuration settings using two methods:"
12781
msgstr ""
12782
12783
#: serverguide/C/network-config.xml:904(term)
12784
msgid "MAC Address"
12785
msgstr ""
12786
12787
#: serverguide/C/network-config.xml:906(para)
12788
msgid ""
12789
"This method entails using DHCP to identify the unique hardware address of "
12790
"each network card connected to the network and then continually supplying a "
12791
"constant configuration each time the DHCP client makes a request to the DHCP "
12792
"server using that network device."
12793
msgstr ""
12794
12795
#: serverguide/C/network-config.xml:915(term)
12796
msgid "Address Pool"
12797
msgstr ""
12798
12799
#: serverguide/C/network-config.xml:917(para)
12800
msgid ""
12801
"This method entails defining a pool (sometimes also called a range or scope) "
12802
"of IP addresses from which DHCP clients are supplied their configuration "
12803
"properties dynamically and on a \"first come, first served\" basis. When a "
12804
"DHCP client is no longer on the network for a specified period, the "
12805
"configuration is expired and released back to the address pool for use by "
12806
"other DHCP Clients."
12807
msgstr ""
12808
12809
#: serverguide/C/network-config.xml:928(para)
12810
msgid ""
12811
"Ubuntu is shipped with both DHCP server and client. The server is "
12812
"<application>dhcpd</application> (dynamic host configuration protocol "
12813
"daemon). The client provided with Ubuntu is "
12814
"<application>dhclient</application> and should be installed on all computers "
12815
"required to be automatically configured. Both programs are easy to install "
12816
"and configure and will be automatically started at system boot."
12817
msgstr ""
12818
12819
#: serverguide/C/network-config.xml:938(para)
12820
msgid ""
12821
"At a terminal prompt, enter the following command to install "
12822
"<application>dhcpd</application>:"
12823
msgstr ""
12824
12825
#: serverguide/C/network-config.xml:943(command)
12826
msgid "sudo apt-get install dhcp3-server"
12827
msgstr ""
12828
12829
#: serverguide/C/network-config.xml:945(para)
12830
msgid ""
12831
"You will probably need to change the default configuration by editing "
12832
"/etc/dhcp3/dhcpd.conf to suit your needs and particular configuration."
12833
msgstr ""
12834
12835
#: serverguide/C/network-config.xml:949(para)
12836
msgid ""
12837
"You also need to edit /etc/default/dhcp3-server to specify the interfaces "
12838
"dhcpd should listen to. By default it listens to eth0."
12839
msgstr ""
12840
12841
#: serverguide/C/network-config.xml:953(para)
12842
msgid ""
12843
"NOTE: dhcpd's messages are being sent to syslog. Look there for diagnostics "
12844
"messages."
12845
msgstr ""
12846
12847
#: serverguide/C/network-config.xml:960(para)
12848
msgid ""
12849
"The error message the installation ends with might be a little confusing, "
12850
"but the following steps will help you configure the service:"
12851
msgstr ""
12852
12853
#: serverguide/C/network-config.xml:964(para)
12854
msgid ""
12855
"Most commonly, what you want to do is assign an IP address randomly. This "
12856
"can be done with settings as follows:"
12857
msgstr ""
12858
12859
#: serverguide/C/network-config.xml:968(programlisting)
12860
#, no-wrap
12861
msgid ""
12862
"\n"
12863
"# Sample /etc/dhcpd.conf\n"
12864
"# (add your comments here) \n"
12865
"default-lease-time 600;\n"
12866
"max-lease-time 7200;\n"
12867
"option subnet-mask 255.255.255.0;\n"
12868
"option broadcast-address 192.168.1.255;\n"
12869
"option routers 192.168.1.254;\n"
12870
"option domain-name-servers 192.168.1.1, 192.168.1.2;\n"
12871
"option domain-name \"mydomain.example\";\n"
12872
"\n"
12873
"subnet 192.168.1.0 netmask 255.255.255.0 {\n"
12874
"range 192.168.1.10 192.168.1.100;\n"
12875
"range 192.168.1.150 192.168.1.200;\n"
12876
"} \n"
12877
msgstr ""
12878
12879
#: serverguide/C/network-config.xml:984(para)
12880
msgid ""
12881
"This will result in the DHCP server giving a client an IP address from the "
12882
"range 192.168.1.10-192.168.1.100 or 192.168.1.150-192.168.1.200. It will "
12883
"lease an IP address for 600 seconds if the client doesn't ask for a specific "
12884
"time frame. Otherwise the maximum (allowed) lease will be 7200 seconds. The "
12885
"server will also \"advise\" the client that it should use 255.255.255.0 as "
12886
"its subnet mask, 192.168.1.255 as its broadcast address, 192.168.1.254 as "
12887
"the router/gateway and 192.168.1.1 and 192.168.1.2 as its DNS servers."
12888
msgstr ""
12889
12890
#: serverguide/C/network-config.xml:993(para)
12891
msgid ""
12892
"If you need to specify a WINS server for your Windows clients, you will need "
12893
"to include the netbios-name-servers option, e.g."
12894
msgstr ""
12895
12896
#: serverguide/C/network-config.xml:997(programlisting)
12897
#, no-wrap
12898
msgid ""
12899
"\n"
12900
"option netbios-name-servers 192.168.1.1; \n"
12901
msgstr ""
12902
12903
#: serverguide/C/network-config.xml:1000(para)
12904
msgid ""
12905
"Dhcpd configuration settings are taken from the DHCP mini-HOWTO, which can "
12906
"be found <ulink "
12907
"url=\"http://www.tldp.org/HOWTO/DHCP/index.html\">here</ulink>."
12908
msgstr ""
12909
12910
#: serverguide/C/network-config.xml:1010(para)
12911
msgid ""
12912
"The <ulink url=\"https://help.ubuntu.com/community/dhcp3-server\">dhcp3-"
12913
"server Ubuntu Wiki</ulink> page has more information."
12914
msgstr ""
12915
12916
#: serverguide/C/network-config.xml:1015(para)
12917
msgid ""
12918
"For more <filename>/etc/dhcp3/dchpd.conf</filename> options see the <ulink "
12919
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/dhcpd.conf.5.html\">d"
12920
"hcpd.conf man page</ulink>."
12921
msgstr ""
12922
12923
#: serverguide/C/network-config.xml:1021(para)
12924
msgid ""
12925
"Also see the <ulink url=\"http://www.dhcp-handbook.com/dhcp_faq.html\">DHCP "
12926
"FAQ</ulink>"
12927
msgstr ""
12928
12929
#: serverguide/C/network-config.xml:1031(title)
12930
msgid "Time Synchronisation with NTP"
12931
msgstr ""
12932
12933
#: serverguide/C/network-config.xml:1032(para)
12934
msgid ""
12935
"This page describes methods for keeping your computer's time accurate. This "
12936
"is useful for servers, but is not necessary (or desirable) for desktop "
12937
"machines."
12938
msgstr ""
12939
12940
#: serverguide/C/network-config.xml:1035(para)
12941
msgid ""
12942
"NTP is a TCP/IP protocol for synchronising time over a network. Basically a "
12943
"client requests the current time from a server, and uses it to set its own "
12944
"clock."
12945
msgstr ""
12946
12947
#: serverguide/C/network-config.xml:1038(para)
12948
msgid ""
12949
"Behind this simple description, there is a lot of complexity - there are "
12950
"tiers of NTP servers, with the tier one NTP servers connected to atomic "
12951
"clocks (often via GPS), and tier two and three servers spreading the load of "
12952
"actually handling requests across the Internet. Also the client software is "
12953
"a lot more complex than you might think - it has to factor out communication "
12954
"delays, and adjust the time in a way that does not upset all the other "
12955
"processes that run on the server. But luckily all that complexity is hidden "
12956
"from you!"
12957
msgstr ""
12958
12959
#: serverguide/C/network-config.xml:1041(para)
12960
msgid ""
12961
"Ubuntu has two ways of automatically setting your time: ntpdate and ntpd."
12962
msgstr ""
12963
12964
#: serverguide/C/network-config.xml:1046(title)
12965
msgid "ntpdate"
12966
msgstr ""
12967
12968
#: serverguide/C/network-config.xml:1047(para)
12969
msgid ""
12970
"Ubuntu comes with ntpdate as standard, and will run it once at boot time to "
12971
"set up your time according to Ubuntu's NTP server. However, a server's clock "
12972
"is likely to drift considerably between reboots, so it makes sense to "
12973
"correct the time occasionally. The easiest way to do this is to get cron to "
12974
"run ntpdate every day. With your favorite editor, as root, create a file "
12975
"<code>/etc/cron.daily/ntpdate</code> containing:"
12976
msgstr ""
12977
12978
#: serverguide/C/network-config.xml:1052(screen)
12979
#, no-wrap
12980
msgid "ntpdate ntp.ubuntu.com\n"
12981
msgstr ""
12982
12983
#: serverguide/C/network-config.xml:1054(para)
12984
msgid ""
12985
"The file <code>/etc/cron.daily/ntpdate</code> must also be executable."
12986
msgstr ""
12987
12988
#: serverguide/C/network-config.xml:1057(screen)
12989
#, no-wrap
12990
msgid "sudo chmod 755 /etc/cron.daily/ntpdate\n"
12991
msgstr ""
12992
12993
#: serverguide/C/network-config.xml:1061(title)
12994
msgid "ntpd"
12995
msgstr ""
12996
12997
#: serverguide/C/network-config.xml:1062(para)
12998
msgid ""
12999
"ntpdate is a bit of a blunt instrument - it can only adjust the time once a "
13000
"day, in one big correction. The ntp daemon ntpd is far more subtle. It "
13001
"calculates the drift of your system clock and continuously adjusts it, so "
13002
"there are no large corrections that could lead to inconsistent logs for "
13003
"instance. The cost is a little processing power and memory, but for a modern "
13004
"server this is negligible."
13005
msgstr ""
13006
13007
#: serverguide/C/network-config.xml:1065(para)
13008
msgid "To set up ntpd:"
13009
msgstr ""
13010
13011
#: serverguide/C/network-config.xml:1066(screen)
13012
#, no-wrap
13013
msgid "sudo apt-get install ntp\n"
13014
msgstr ""
13015
13016
#: serverguide/C/network-config.xml:1071(title)
13017
msgid "Changing Time Servers"
13018
msgstr ""
13019
13020
#: serverguide/C/network-config.xml:1072(para)
13021
msgid ""
13022
"In both cases above, your system will use Ubuntu's NTP server at "
13023
"<code>ntp.ubuntu.com</code> by default. This is OK, but you might want to "
13024
"use several servers to increase accuracy and resilience, and you may want to "
13025
"use time servers that are geographically closer to you. to do this for "
13026
"ntpdate, change the contents of <code>/etc/cron.daily/ntpdate</code> to:"
13027
msgstr ""
13028
13029
#: serverguide/C/network-config.xml:1079(screen)
13030
#, no-wrap
13031
msgid "ntpdate ntp.ubuntu.com pool.ntp.org \n"
13032
msgstr ""
13033
13034
#: serverguide/C/network-config.xml:1081(para)
13035
msgid ""
13036
"And for ntpd edit <code>/etc/ntp.conf</code> to include additional server "
13037
"lines:"
13038
msgstr ""
13039
13040
#: serverguide/C/network-config.xml:1086(screen)
13041
#, no-wrap
13042
msgid ""
13043
"server ntp.ubuntu.com\n"
13044
"server pool.ntp.org\n"
13045
msgstr ""
13046
13047
#: serverguide/C/network-config.xml:1089(para)
13048
msgid ""
13049
"You may notice <code>pool.ntp.org</code> in the examples above. This is a "
13050
"really good idea which uses round-robin DNS to return an NTP server from a "
13051
"pool, spreading the load between several different servers. Even better, "
13052
"they have pools for different regions - for instance, if you are in New "
13053
"Zealand, so you could use <code>nz.pool.ntp.org</code> instead of "
13054
"<code>pool.ntp.org</code> . Look at <ulink "
13055
"url=\"http://www.pool.ntp.org/\">http://www.pool.ntp.org/</ulink> for more "
13056
"details."
13057
msgstr ""
13058
13059
#: serverguide/C/network-config.xml:1100(para)
13060
msgid ""
13061
"You can also Google for NTP servers in your region, and add these to your "
13062
"configuration. To test that a server works, just type <code>sudo ntpdate "
13063
"ntp.server.name</code> and see what happens."
13064
msgstr ""
13065
13066
#: serverguide/C/network-config.xml:1111(para)
13067
msgid ""
13068
"See the <ulink url=\"https://help.ubuntu.com/community/UbuntuTime\">Ubuntu "
13069
"Time</ulink> wiki page for more information."
13070
msgstr ""
13071
13072
#: serverguide/C/network-config.xml:1117(ulink)
13073
msgid "NTP Support"
13074
msgstr ""
13075
13076
#: serverguide/C/network-config.xml:1122(ulink)
13077
msgid "The NTP FAQ and HOWTO"
13078
msgstr ""
13079
13080
#: serverguide/C/network-auth.xml:13(title)
13081
msgid "Network Authentication"
13082
msgstr ""
13083
13084
#: serverguide/C/network-auth.xml:15(para)
13085
msgid "This section explains various Network Authentication protocols."
13086
msgstr ""
13087
13088
#: serverguide/C/network-auth.xml:19(title)
13089
msgid "OpenLDAP Server"
13090
msgstr ""
13091
13092
#: serverguide/C/network-auth.xml:20(para)
13093
msgid ""
13094
"LDAP is an acronym for Lightweight Directory Access Protocol, it is a "
13095
"simplified version of the X.500 protocol. The directory setup in this "
13096
"section will be used for authentication. Nevertheless, LDAP can be used in "
13097
"numerous ways: authentication, shared directory (for mail clients), address "
13098
"book, etc."
13099
msgstr ""
13100
13101
#: serverguide/C/network-auth.xml:28(para)
13102
msgid ""
13103
"To describe LDAP quickly, all information is stored in a tree structure. "
13104
"With <application>OpenLDAP</application> you have freedom to determine the "
13105
"directory arborescence (the Directory Information Tree: the DIT) yourself. "
13106
"We will begin with a basic tree containing two nodes below the root:"
13107
msgstr ""
13108
13109
#: serverguide/C/network-auth.xml:37(para)
13110
msgid "\"People\" node where your users will be stored"
13111
msgstr ""
13112
13113
#: serverguide/C/network-auth.xml:40(para)
13114
msgid "\"Groups\" node where your groups will be stored"
13115
msgstr ""
13116
13117
#: serverguide/C/network-auth.xml:44(para)
13118
msgid ""
13119
"Before beginning, you should determine what the root of your LDAP directory "
13120
"will be. By default, your tree will be determined by your Fully Qualified "
13121
"Domain Name (FQDN). If your domain is example.com (which we will use in this "
13122
"example), your root node will be dc=example,dc=com."
13123
msgstr ""
13124
13125
#: serverguide/C/network-auth.xml:54(para)
13126
msgid ""
13127
"First, install the <application>OpenLDAP</application> server daemon "
13128
"<application>slapd</application> and <application>ldap-utils</application>, "
13129
"a package containing LDAP management utilities:"
13130
msgstr ""
13131
13132
#: serverguide/C/network-auth.xml:60(command)
13133
msgid "sudo apt-get install slapd ldap-utils"
13134
msgstr ""
13135
13136
#: serverguide/C/network-auth.xml:63(para)
13137
msgid ""
13138
"By default <application>slapd</application> is configured with minimal "
13139
"options needed to run the <application>slapd</application> daemon."
13140
msgstr ""
13141
13142
#: serverguide/C/network-auth.xml:68(para)
13143
msgid ""
13144
"The configuration example in the following sections will match the domain "
13145
"name of the server. For example, if the machine's Fully Qualified Domain "
13146
"Name (FQDN) is ldap.example.com, the default suffix will be "
13147
"<emphasis>dc=example,dc=com</emphasis>."
13148
msgstr ""
13149
13150
#: serverguide/C/network-auth.xml:76(title)
13151
msgid "Populating LDAP"
13152
msgstr ""
13153
13154
#: serverguide/C/network-auth.xml:78(para)
13155
msgid ""
13156
"<application>OpenLDAP</application> uses a separate directory which contains "
13157
"the <emphasis>cn=config</emphasis> Directory Information Tree (DIT). The "
13158
"<emphasis>cn=config</emphasis> DIT is used to dynamically configure the "
13159
"<application>slapd</application> daemon, allowing the modification of schema "
13160
"definitions, indexes, ACLs, etc without stopping the service."
13161
msgstr ""
13162
13163
#: serverguide/C/network-auth.xml:86(para)
13164
msgid ""
13165
"The backend <emphasis>cn=config</emphasis> directory has only a minimal "
13166
"configuration and will need additional configuration options in order to "
13167
"populate the frontend directory. The frontend will be populated with a "
13168
"\"classical\" scheme that will be compatible with address book applications "
13169
"and with Unix Posix accounts. Posix accounts will allow authentication to "
13170
"various applications, such as web applications, email Mail Transfer Agent "
13171
"(MTA) applications, etc."
13172
msgstr ""
13173
13174
#: serverguide/C/network-auth.xml:95(para)
13175
msgid ""
13176
"For external applications to authenticate using LDAP they will each need to "
13177
"be specifically configured to do so. Refer to the individual application "
13178
"documentation for details."
13179
msgstr ""
13180
13181
#: serverguide/C/network-auth.xml:103(para)
13182
msgid ""
13183
"Remember to change <emphasis>dc=example,dc=com</emphasis> in the following "
13184
"examples to match your LDAP configuration."
13185
msgstr ""
13186
13187
#: serverguide/C/network-auth.xml:108(para)
13188
msgid ""
13189
"First, some additional schema files need to be loaded. In a terminal enter:"
13190
msgstr ""
13191
13192
#: serverguide/C/network-auth.xml:113(command) serverguide/C/network-auth.xml:702(command)
13193
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif"
13194
msgstr ""
13195
13196
#: serverguide/C/network-auth.xml:114(command) serverguide/C/network-auth.xml:703(command)
13197
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif"
13198
msgstr ""
13199
13200
#: serverguide/C/network-auth.xml:115(command) serverguide/C/network-auth.xml:704(command)
13201
msgid ""
13202
"sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif"
13203
msgstr ""
13204
13205
#: serverguide/C/network-auth.xml:118(para)
13206
msgid ""
13207
"Next, copy the following example LDIF file, naming it "
13208
"<filename>backend.example.com.ldif</filename>, somewhere on your system:"
13209
msgstr ""
13210
13211
#: serverguide/C/network-auth.xml:123(programlisting)
13212
#, no-wrap
13213
msgid ""
13214
"\n"
13215
"# Load dynamic backend modules\n"
13216
"dn: cn=module,cn=config\n"
13217
"objectClass: olcModuleList\n"
13218
"cn: module\n"
13219
"olcModulepath: /usr/lib/ldap\n"
13220
"olcModuleload: back_hdb\n"
13221
"\n"
13222
"# Database settings\n"
13223
"dn: olcDatabase=hdb,cn=config\n"
13224
"objectClass: olcDatabaseConfig\n"
13225
"objectClass: olcHdbConfig\n"
13226
"olcDatabase: {1}hdb\n"
13227
"olcSuffix: dc=example,dc=com\n"
13228
"olcDbDirectory: /var/lib/ldap\n"
13229
"olcRootDN: cn=admin,dc=example,dc=com\n"
13230
"olcRootPW: secret\n"
13231
"olcDbConfig: set_cachesize 0 2097152 0\n"
13232
"olcDbConfig: set_lk_max_objects 1500\n"
13233
"olcDbConfig: set_lk_max_locks 1500\n"
13234
"olcDbConfig: set_lk_max_lockers 1500\n"
13235
"olcDbIndex: objectClass eq\n"
13236
"olcLastMod: TRUE\n"
13237
"olcDbCheckpoint: 512 30\n"
13238
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13239
"by anonymous auth by self write by * none\n"
13240
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13241
"olcAccess: to dn.base=\"\" by * read\n"
13242
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13243
"\n"
13244
msgstr ""
13245
13246
#: serverguide/C/network-auth.xml:155(para)
13247
msgid ""
13248
"Change <emphasis>olcRootPW: secret</emphasis> to a password of your choosing."
13249
msgstr ""
13250
13251
#: serverguide/C/network-auth.xml:160(para)
13252
msgid "Now add the LDIF to the directory:"
13253
msgstr ""
13254
13255
#: serverguide/C/network-auth.xml:165(command) serverguide/C/network-auth.xml:746(command)
13256
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.example.com.ldif"
13257
msgstr ""
13258
13259
#: serverguide/C/network-auth.xml:168(para)
13260
msgid ""
13261
"The frontend directory is now ready to be populated. Create a "
13262
"<filename>frontend.example.com.ldif</filename> with the following contents:"
13263
msgstr ""
13264
13265
#: serverguide/C/network-auth.xml:173(programlisting)
13266
#, no-wrap
13267
msgid ""
13268
"\n"
13269
"# Create top-level object in domain\n"
13270
"dn: dc=example,dc=com\n"
13271
"objectClass: top\n"
13272
"objectClass: dcObject\n"
13273
"objectclass: organization\n"
13274
"o: Example Organization\n"
13275
"dc: Example\n"
13276
"description: LDAP Example \n"
13277
"\n"
13278
"# Admin user.\n"
13279
"dn: cn=admin,dc=example,dc=com\n"
13280
"objectClass: simpleSecurityObject\n"
13281
"objectClass: organizationalRole\n"
13282
"cn: admin\n"
13283
"description: LDAP administrator\n"
13284
"userPassword: secret\n"
13285
"\n"
13286
"dn: ou=people,dc=example,dc=com\n"
13287
"objectClass: organizationalUnit\n"
13288
"ou: people\n"
13289
"\n"
13290
"dn: ou=groups,dc=example,dc=com\n"
13291
"objectClass: organizationalUnit\n"
13292
"ou: groups\n"
13293
"\n"
13294
"dn: uid=john,ou=people,dc=example,dc=com\n"
13295
"objectClass: inetOrgPerson\n"
13296
"objectClass: posixAccount\n"
13297
"objectClass: shadowAccount\n"
13298
"uid: john\n"
13299
"sn: Doe\n"
13300
"givenName: John\n"
13301
"cn: John Doe\n"
13302
"displayName: John Doe\n"
13303
"uidNumber: 1000\n"
13304
"gidNumber: 10000\n"
13305
"userPassword: password\n"
13306
"gecos: John Doe\n"
13307
"loginShell: /bin/bash\n"
13308
"homeDirectory: /home/john\n"
13309
"shadowExpire: -1\n"
13310
"shadowFlag: 0\n"
13311
"shadowWarning: 7\n"
13312
"shadowMin: 8\n"
13313
"shadowMax: 999999\n"
13314
"shadowLastChange: 10877\n"
13315
"mail: john.doe@example.com\n"
13316
"postalCode: 31000\n"
13317
"l: Toulouse\n"
13318
"o: Example\n"
13319
"mobile: +33 (0)6 xx xx xx xx\n"
13320
"homePhone: +33 (0)5 xx xx xx xx\n"
13321
"title: System Administrator\n"
13322
"postalAddress: \n"
13323
"initials: JD\n"
13324
"\n"
13325
"dn: cn=example,ou=groups,dc=example,dc=com\n"
13326
"objectClass: posixGroup\n"
13327
"cn: example\n"
13328
"gidNumber: 10000\n"
13329
msgstr ""
13330
13331
#: serverguide/C/network-auth.xml:236(para)
13332
msgid ""
13333
"In this example the directory structure, a user, and a group have been "
13334
"setup. In other examples you might see the <emphasis>objectClass: "
13335
"top</emphasis> added in every entry, but that is the default behaviour so "
13336
"you do not have to add it explicitly."
13337
msgstr ""
13338
13339
#: serverguide/C/network-auth.xml:243(para)
13340
msgid "Add the entries to the LDAP directory:"
13341
msgstr ""
13342
13343
#: serverguide/C/network-auth.xml:249(command) serverguide/C/network-auth.xml:757(command)
13344
msgid ""
13345
"sudo ldapadd -x -D cn=admin,dc=example,dc=com -W -f frontend.example.com.ldif"
13346
msgstr ""
13347
13348
#: serverguide/C/network-auth.xml:252(para)
13349
msgid ""
13350
"We can check that the content has been correctly added with the "
13351
"<application>ldapsearch</application> utility. Execute a search of the LDAP "
13352
"directory:"
13353
msgstr ""
13354
13355
#: serverguide/C/network-auth.xml:258(command)
13356
msgid "ldapsearch -xLLL -b \"dc=example,dc=com\" uid=john sn givenName cn"
13357
msgstr ""
13358
13359
#: serverguide/C/network-auth.xml:259(computeroutput)
13360
#, no-wrap
13361
msgid ""
13362
"\n"
13363
"dn: uid=john,ou=people,dc=example,dc=com\n"
13364
"cn: John Doe\n"
13365
"sn: Doe\n"
13366
"givenName: John\n"
13367
msgstr ""
13368
13369
#: serverguide/C/network-auth.xml:267(para)
13370
msgid "Just a quick explanation:"
13371
msgstr ""
13372
13373
#: serverguide/C/network-auth.xml:273(para)
13374
msgid ""
13375
"<emphasis>-x:</emphasis> will not use SASL authentication method, which is "
13376
"the default."
13377
msgstr ""
13378
13379
#: serverguide/C/network-auth.xml:279(para)
13380
msgid "<emphasis>-LLL:</emphasis> disable printing LDIF schema information."
13381
msgstr ""
13382
13383
#: serverguide/C/network-auth.xml:287(title)
13384
msgid "Further Configuration"
13385
msgstr ""
13386
13387
#: serverguide/C/network-auth.xml:290(para)
13388
msgid ""
13389
"The <emphasis>cn=config</emphasis> tree can be manipulated using the "
13390
"utilities in the <application>ldap-utils</application> package. For example:"
13391
msgstr ""
13392
13393
#: serverguide/C/network-auth.xml:298(para)
13394
msgid ""
13395
"Use <application>ldapsearch</application> to view the tree, entering the "
13396
"admin password set during installation or reconfiguration:"
13397
msgstr ""
13398
13399
#: serverguide/C/network-auth.xml:304(command)
13400
msgid "sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn"
13401
msgstr ""
13402
13403
#: serverguide/C/network-auth.xml:308(computeroutput)
13404
#, no-wrap
13405
msgid ""
13406
"\n"
13407
"SASL/EXTERNAL authentication started\n"
13408
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13409
"SASL SSF: 0\n"
13410
"dn: cn=config\n"
13411
"\n"
13412
"dn: cn=module{0},cn=config\n"
13413
"\n"
13414
"dn: cn=schema,cn=config\n"
13415
"\n"
13416
"dn: cn={0}core,cn=schema,cn=config\n"
13417
"\n"
13418
"dn: cn={1}cosine,cn=schema,cn=config\n"
13419
"\n"
13420
"dn: cn={2}nis,cn=schema,cn=config\n"
13421
"\n"
13422
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
13423
"\n"
13424
"dn: olcDatabase={-1}frontend,cn=config\n"
13425
"\n"
13426
"dn: olcDatabase={0}config,cn=config\n"
13427
"\n"
13428
"dn: olcDatabase={1}hdb,cn=config\n"
13429
msgstr ""
13430
13431
#: serverguide/C/network-auth.xml:334(para)
13432
msgid ""
13433
"The output above is the current configuration options for the "
13434
"<emphasis>cn=config</emphasis> backend database. Your output may be vary."
13435
msgstr ""
13436
13437
#: serverguide/C/network-auth.xml:342(para)
13438
msgid ""
13439
"As an example of modifying the <emphasis>cn=config</emphasis> tree, add "
13440
"another attribute to the index list using "
13441
"<application>ldapmodify</application>:"
13442
msgstr ""
13443
13444
#: serverguide/C/network-auth.xml:348(command) serverguide/C/network-auth.xml:984(command) serverguide/C/network-auth.xml:1155(command) serverguide/C/network-auth.xml:1191(command)
13445
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:///"
13446
msgstr ""
13447
13448
#: serverguide/C/network-auth.xml:356(userinput)
13449
#, no-wrap
13450
msgid ""
13451
"dn: olcDatabase={1}hdb,cn=config\n"
13452
"add: olcDbIndex\n"
13453
"olcDbIndex: uidNumber eq"
13454
msgstr ""
13455
13456
#: serverguide/C/network-auth.xml:352(computeroutput)
13457
#, no-wrap
13458
msgid ""
13459
"\n"
13460
"SASL/EXTERNAL authentication started\n"
13461
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13462
"SASL SSF: 0\n"
13463
"<placeholder-1/>\n"
13464
"\n"
13465
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13466
msgstr ""
13467
13468
#: serverguide/C/network-auth.xml:364(para)
13469
msgid ""
13470
"Once the modification has completed, press <emphasis>Ctrl+D</emphasis> to "
13471
"exit the utility."
13472
msgstr ""
13473
13474
#: serverguide/C/network-auth.xml:371(para)
13475
msgid ""
13476
"<application>ldapmodify</application> can also read the changes from a file. "
13477
"Copy and paste the following into a file named "
13478
"<filename>uid_index.ldif</filename>:"
13479
msgstr ""
13480
13481
#: serverguide/C/network-auth.xml:376(programlisting)
13482
#, no-wrap
13483
msgid ""
13484
"\n"
13485
"dn: olcDatabase={1}hdb,cn=config\n"
13486
"add: olcDbIndex\n"
13487
"olcDbIndex: uid eq,pres,sub\n"
13488
msgstr ""
13489
13490
#: serverguide/C/network-auth.xml:382(para)
13491
msgid "Then execute <application>ldapmodify</application>:"
13492
msgstr ""
13493
13494
#: serverguide/C/network-auth.xml:387(command)
13495
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f uid_index.ldif"
13496
msgstr ""
13497
13498
#: serverguide/C/network-auth.xml:391(computeroutput)
13499
#, no-wrap
13500
msgid ""
13501
"\n"
13502
"SASL/EXTERNAL authentication started\n"
13503
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13504
"SASL SSF: 0\n"
13505
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13506
msgstr ""
13507
13508
#: serverguide/C/network-auth.xml:399(para)
13509
msgid "The file method is very useful for large changes."
13510
msgstr ""
13511
13512
#: serverguide/C/network-auth.xml:406(para)
13513
msgid ""
13514
"Adding additional <emphasis>schemas</emphasis> to "
13515
"<application>slapd</application> requires the schema to be converted to LDIF "
13516
"format. The <filename role=\"directory\">/etc/ldap/schema</filename> "
13517
"directory contains some schema files already converted to LDIF format as "
13518
"demonstrated in the previous section. Fortunately, the "
13519
"<application>slapd</application> program can be used to automate the "
13520
"conversion. The following example will add the "
13521
"<emphasis>dyngoup.schema</emphasis>:"
13522
msgstr ""
13523
13524
#: serverguide/C/network-auth.xml:416(para)
13525
msgid ""
13526
"First, create a conversion <filename>schema_convert.conf</filename> file "
13527
"containing the following lines:"
13528
msgstr ""
13529
13530
#: serverguide/C/network-auth.xml:421(programlisting)
13531
#, no-wrap
13532
msgid ""
13533
"\n"
13534
"include /etc/ldap/schema/core.schema\n"
13535
"include /etc/ldap/schema/collective.schema\n"
13536
"include /etc/ldap/schema/corba.schema\n"
13537
"include /etc/ldap/schema/cosine.schema\n"
13538
"include /etc/ldap/schema/duaconf.schema\n"
13539
"include /etc/ldap/schema/dyngroup.schema\n"
13540
"include /etc/ldap/schema/inetorgperson.schema\n"
13541
"include /etc/ldap/schema/java.schema\n"
13542
"include /etc/ldap/schema/misc.schema\n"
13543
"include /etc/ldap/schema/nis.schema\n"
13544
"include /etc/ldap/schema/openldap.schema\n"
13545
"include /etc/ldap/schema/ppolicy.schema\n"
13546
msgstr ""
13547
13548
#: serverguide/C/network-auth.xml:439(para) serverguide/C/network-auth.xml:1655(para)
13549
msgid "Next, create a temporary directory to hold the output:"
13550
msgstr ""
13551
13552
#: serverguide/C/network-auth.xml:444(command) serverguide/C/network-auth.xml:1660(command) serverguide/C/network-auth.xml:2695(command)
13553
msgid "mkdir /tmp/ldif_output"
13554
msgstr ""
13555
13556
#: serverguide/C/network-auth.xml:450(para)
13557
msgid ""
13558
"Now using <application>slapcat</application> convert the schema files to "
13559
"LDIF:"
13560
msgstr ""
13561
13562
#: serverguide/C/network-auth.xml:455(command)
13563
msgid ""
13564
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
13565
"\"cn={5}dyngroup,cn=schema,cn=config\" > /tmp/cn=dyngroup.ldif"
13566
msgstr ""
13567
13568
#: serverguide/C/network-auth.xml:458(para)
13569
msgid ""
13570
"Adjust the configuration file name and temporary directory names if yours "
13571
"are different. Also, it may be worthwhile to keep the "
13572
"<filename>ldif_output</filename> directory around in case you want to add "
13573
"additional schemas in the future."
13574
msgstr ""
13575
13576
#: serverguide/C/network-auth.xml:467(para)
13577
msgid ""
13578
"Edit the <filename>/tmp/cn\\=dyngroup.ldif</filename> file, changing the "
13579
"following attributes:"
13580
msgstr ""
13581
13582
#: serverguide/C/network-auth.xml:471(programlisting)
13583
#, no-wrap
13584
msgid ""
13585
"\n"
13586
"dn: cn=dyngroup,cn=schema,cn=config\n"
13587
"...\n"
13588
"cn: dyngroup\n"
13589
msgstr ""
13590
13591
#: serverguide/C/network-auth.xml:477(para) serverguide/C/network-auth.xml:1691(para)
13592
msgid "And remove the following lines from the bottom of the file:"
13593
msgstr ""
13594
13595
#: serverguide/C/network-auth.xml:481(programlisting)
13596
#, no-wrap
13597
msgid ""
13598
"\n"
13599
"structuralObjectClass: olcSchemaConfig\n"
13600
"entryUUID: 10dae0ea-0760-102d-80d3-f9366b7f7757\n"
13601
"creatorsName: cn=config\n"
13602
"createTimestamp: 20080826021140Z\n"
13603
"entryCSN: 20080826021140.791425Z#000000#000#000000\n"
13604
"modifiersName: cn=config\n"
13605
"modifyTimestamp: 20080826021140Z\n"
13606
msgstr ""
13607
13608
#: serverguide/C/network-auth.xml:492(para) serverguide/C/network-auth.xml:1706(para) serverguide/C/network-auth.xml:2741(para)
13609
msgid ""
13610
"The attribute values will vary, just be sure the attributes are removed."
13611
msgstr ""
13612
13613
#: serverguide/C/network-auth.xml:500(para) serverguide/C/network-auth.xml:1714(para)
13614
msgid ""
13615
"Finally, using the <application>ldapadd</application> utility, add the new "
13616
"schema to the directory:"
13617
msgstr ""
13618
13619
#: serverguide/C/network-auth.xml:506(command)
13620
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/cn\\=dyngroup.ldif"
13621
msgstr ""
13622
13623
#: serverguide/C/network-auth.xml:512(para)
13624
msgid ""
13625
"There should now be a <emphasis>dn: "
13626
"cn={4}dyngroup,cn=schema,cn=config</emphasis> entry in the cn=config tree."
13627
msgstr ""
13628
13629
#: serverguide/C/network-auth.xml:522(title)
13630
msgid "LDAP Replication"
13631
msgstr ""
13632
13633
#: serverguide/C/network-auth.xml:524(para)
13634
msgid ""
13635
"LDAP often quickly becomes a highly critical service to the network. "
13636
"Multiple systems will come to depend on LDAP for authentication, "
13637
"authorization, configuration, etc. It is a good idea to setup a redundant "
13638
"system through replication."
13639
msgstr ""
13640
13641
#: serverguide/C/network-auth.xml:530(para)
13642
msgid ""
13643
"Replication is achieved using the <emphasis>Syncrepl</emphasis> engine. "
13644
"Syncrepl allows the changes to be synced using a "
13645
"<emphasis>consumer</emphasis>, <emphasis>provider</emphasis> model. A "
13646
"provider sends directory changes to consumers."
13647
msgstr ""
13648
13649
#: serverguide/C/network-auth.xml:537(title)
13650
msgid "Provider Configuration"
13651
msgstr ""
13652
13653
#: serverguide/C/network-auth.xml:539(para)
13654
msgid ""
13655
"The following is an example of a <emphasis>Single-Master</emphasis> "
13656
"configuration. In this configuration one OpenLDAP server is configured as a "
13657
"<emphasis>provider</emphasis> and another as a <emphasis>consumer</emphasis>."
13658
msgstr ""
13659
13660
#: serverguide/C/network-auth.xml:547(para)
13661
msgid ""
13662
"First, configure the provider server. Copy the following to a file named "
13663
"<filename>provider_sync.ldif</filename>:"
13664
msgstr ""
13665
13666
#: serverguide/C/network-auth.xml:552(programlisting)
13667
#, no-wrap
13668
msgid ""
13669
"\n"
13670
"# Add indexes to the frontend db.\n"
13671
"dn: olcDatabase={1}hdb,cn=config\n"
13672
"changetype: modify\n"
13673
"add: olcDbIndex\n"
13674
"olcDbIndex: entryCSN eq\n"
13675
"-\n"
13676
"add: olcDbIndex\n"
13677
"olcDbIndex: entryUUID eq\n"
13678
"\n"
13679
"#Load the syncprov and accesslog modules.\n"
13680
"dn: cn=module{0},cn=config\n"
13681
"changetype: modify\n"
13682
"add: olcModuleLoad\n"
13683
"olcModuleLoad: syncprov\n"
13684
"-\n"
13685
"add: olcModuleLoad\n"
13686
"olcModuleLoad: accesslog\n"
13687
"\n"
13688
"# Accesslog database definitions\n"
13689
"dn: olcDatabase={2}hdb,cn=config\n"
13690
"objectClass: olcDatabaseConfig\n"
13691
"objectClass: olcHdbConfig\n"
13692
"olcDatabase: {2}hdb\n"
13693
"olcDbDirectory: /var/lib/ldap/accesslog\n"
13694
"olcSuffix: cn=accesslog\n"
13695
"olcRootDN: cn=admin,dc=example,dc=com\n"
13696
"olcDbIndex: default eq\n"
13697
"olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart\n"
13698
"\n"
13699
"# Accesslog db syncprov.\n"
13700
"dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config\n"
13701
"changetype: add\n"
13702
"objectClass: olcOverlayConfig\n"
13703
"objectClass: olcSyncProvConfig\n"
13704
"olcOverlay: syncprov\n"
13705
"olcSpNoPresent: TRUE\n"
13706
"olcSpReloadHint: TRUE\n"
13707
"\n"
13708
"# syncrepl Provider for primary db\n"
13709
"dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config\n"
13710
"changetype: add\n"
13711
"objectClass: olcOverlayConfig\n"
13712
"objectClass: olcSyncProvConfig\n"
13713
"olcOverlay: syncprov\n"
13714
"olcSpNoPresent: TRUE\n"
13715
"\n"
13716
"# accesslog overlay definitions for primary db\n"
13717
"dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config\n"
13718
"objectClass: olcOverlayConfig\n"
13719
"objectClass: olcAccessLogConfig\n"
13720
"olcOverlay: accesslog\n"
13721
"olcAccessLogDB: cn=accesslog\n"
13722
"olcAccessLogOps: writes\n"
13723
"olcAccessLogSuccess: TRUE\n"
13724
"# scan the accesslog DB every day, and purge entries older than 7 days\n"
13725
"olcAccessLogPurge: 07+00:00 01+00:00\n"
13726
msgstr ""
13727
13728
#: serverguide/C/network-auth.xml:614(para)
13729
msgid ""
13730
"The <application>AppArmor</application> profile for "
13731
"<application>slapd</application> will need to be adjusted for the accesslog "
13732
"database location. Edit <filename>/etc/apparmor.d/usr.sbin.slapd</filename> "
13733
"adding:"
13734
msgstr ""
13735
13736
#: serverguide/C/network-auth.xml:619(programlisting)
13737
#, no-wrap
13738
msgid ""
13739
"\n"
13740
" /var/lib/ldap/accesslog/ r,\n"
13741
" /var/lib/ldap/accesslog/** rwk,\n"
13742
msgstr ""
13743
13744
#: serverguide/C/network-auth.xml:624(para)
13745
msgid ""
13746
"Then create the directory, reload the <application>apparmor</application> "
13747
"profile, and copy the <filename>DB_CONFIG</filename> file:"
13748
msgstr ""
13749
13750
#: serverguide/C/network-auth.xml:630(command)
13751
msgid "sudo -u openldap mkdir /var/lib/ldap/accesslog"
13752
msgstr ""
13753
13754
#: serverguide/C/network-auth.xml:631(command)
13755
msgid "sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog/"
13756
msgstr ""
13757
13758
#: serverguide/C/network-auth.xml:636(para)
13759
msgid ""
13760
"Using the <emphasis>-u openldap</emphasis> option with the "
13761
"<application>sudo</application> commands above removes the need to adjust "
13762
"permissions for the new directory later."
13763
msgstr ""
13764
13765
#: serverguide/C/network-auth.xml:645(para)
13766
msgid ""
13767
"Edit the file and change the <emphasis>olcRootDN</emphasis> to match your "
13768
"directory:"
13769
msgstr ""
13770
13771
#: serverguide/C/network-auth.xml:649(programlisting)
13772
#, no-wrap
13773
msgid ""
13774
"\n"
13775
"olcRootDN: cn=admin,dc=example,dc=com\n"
13776
msgstr ""
13777
13778
#: serverguide/C/network-auth.xml:657(para)
13779
msgid ""
13780
"Next, add the LDIF file using the <application>ldapadd</application> utility:"
13781
msgstr ""
13782
13783
#: serverguide/C/network-auth.xml:662(command)
13784
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif"
13785
msgstr ""
13786
13787
#: serverguide/C/network-auth.xml:669(para)
13788
msgid "Restart <application>slapd</application>:"
13789
msgstr ""
13790
13791
#: serverguide/C/network-auth.xml:674(command) serverguide/C/network-auth.xml:1040(command) serverguide/C/network-auth.xml:1227(command)
13792
msgid "sudo /etc/init.d/slapd restart"
13793
msgstr ""
13794
13795
#: serverguide/C/network-auth.xml:680(para)
13796
msgid ""
13797
"The <emphasis>Provider</emphasis> server is now configured, and it is time "
13798
"to configure a <emphasis>Consumer</emphasis> server."
13799
msgstr ""
13800
13801
#: serverguide/C/network-auth.xml:687(title)
13802
msgid "Consumer Configuration"
13803
msgstr ""
13804
13805
#: serverguide/C/network-auth.xml:692(para)
13806
msgid ""
13807
"On the <emphasis>Consumer</emphasis> server configure it the same as the "
13808
"<emphasis>Provider</emphasis> except for the <emphasis>Syncrepl</emphasis> "
13809
"configuration steps."
13810
msgstr ""
13811
13812
#: serverguide/C/network-auth.xml:697(para)
13813
msgid "Add the additional schema files:"
13814
msgstr ""
13815
13816
#: serverguide/C/network-auth.xml:707(para)
13817
msgid ""
13818
"Also, create, or copy from the provider server, the "
13819
"<filename>backend.example.com.ldif</filename>"
13820
msgstr ""
13821
13822
#: serverguide/C/network-auth.xml:711(programlisting)
13823
#, no-wrap
13824
msgid ""
13825
"\n"
13826
"# Load dynamic backend modules\n"
13827
"dn: cn=module,cn=config\n"
13828
"objectClass: olcModuleList\n"
13829
"cn: module\n"
13830
"olcModulepath: /usr/lib/ldap\n"
13831
"olcModuleload: back_hdb\n"
13832
"\n"
13833
"# Database settings\n"
13834
"dn: olcDatabase=hdb,cn=config\n"
13835
"objectClass: olcDatabaseConfig\n"
13836
"objectClass: olcHdbConfig\n"
13837
"olcDatabase: {1}hdb\n"
13838
"olcSuffix: dc=example,dc=com\n"
13839
"olcDbDirectory: /var/lib/ldap\n"
13840
"olcRootDN: cn=admin,dc=example,dc=com\n"
13841
"olcRootPW: secret\n"
13842
"olcDbConfig: set_cachesize 0 2097152 0\n"
13843
"olcDbConfig: set_lk_max_objects 1500\n"
13844
"olcDbConfig: set_lk_max_locks 1500\n"
13845
"olcDbConfig: set_lk_max_lockers 1500\n"
13846
"olcDbIndex: objectClass eq\n"
13847
"olcLastMod: TRUE\n"
13848
"olcDbCheckpoint: 512 30\n"
13849
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13850
"by anonymous auth by self write by * none\n"
13851
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13852
"olcAccess: to dn.base=\"\" by * read\n"
13853
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13854
msgstr ""
13855
13856
#: serverguide/C/network-auth.xml:741(para)
13857
msgid "And add the LDIF by entering:"
13858
msgstr ""
13859
13860
#: serverguide/C/network-auth.xml:752(para)
13861
msgid ""
13862
"Do the same with the <filename>frontend.example.com.ldif</filename> file "
13863
"listed above, and add it:"
13864
msgstr ""
13865
13866
#: serverguide/C/network-auth.xml:760(para)
13867
msgid ""
13868
"The two severs should now have the same configuration except for the "
13869
"<emphasis>Syncrepl</emphasis> options."
13870
msgstr ""
13871
13872
#: serverguide/C/network-auth.xml:768(para)
13873
msgid ""
13874
"Now create a file named <filename>consumer_sync.ldif</filename> containing:"
13875
msgstr ""
13876
13877
#: serverguide/C/network-auth.xml:772(programlisting)
13878
#, no-wrap
13879
msgid ""
13880
"\n"
13881
"#Load the syncprov module.\n"
13882
"dn: cn=module{0},cn=config\n"
13883
"changetype: modify\n"
13884
"add: olcModuleLoad\n"
13885
"olcModuleLoad: syncprov\n"
13886
"\n"
13887
"# syncrepl specific indices\n"
13888
"dn: olcDatabase={1}hdb,cn=config\n"
13889
"changetype: modify\n"
13890
"add: olcDbIndex\n"
13891
"olcDbIndex: entryUUID eq\n"
13892
"-\n"
13893
"add: olcSyncRepl\n"
13894
"olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
13895
"binddn=\"cn=admin,dc=example,dc=com\" \n"
13896
" credentials=secret searchbase=\"dc=example,dc=com\" "
13897
"logbase=\"cn=accesslog\" \n"
13898
" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" "
13899
"schemachecking=on \n"
13900
" type=refreshAndPersist retry=\"60 +\" syncdata=accesslog\n"
13901
"-\n"
13902
"add: olcUpdateRef\n"
13903
"olcUpdateRef: ldap://ldap01.example.com\n"
13904
msgstr ""
13905
13906
#: serverguide/C/network-auth.xml:795(para)
13907
msgid "You will probably want to change the following attributes:"
13908
msgstr ""
13909
13910
#: serverguide/C/network-auth.xml:800(para)
13911
msgid "<emphasis>ldap01.example.com</emphasis> to your server's hostname."
13912
msgstr ""
13913
13914
#: serverguide/C/network-auth.xml:801(emphasis)
13915
msgid "binddn"
13916
msgstr ""
13917
13918
#: serverguide/C/network-auth.xml:802(emphasis)
13919
msgid "credentials"
13920
msgstr ""
13921
13922
#: serverguide/C/network-auth.xml:803(emphasis)
13923
msgid "searchbase"
13924
msgstr ""
13925
13926
#: serverguide/C/network-auth.xml:804(emphasis)
13927
msgid "olcUpdateRef:"
13928
msgstr ""
13929
13930
#: serverguide/C/network-auth.xml:810(para)
13931
msgid "Add the LDIF file to the configuration tree:"
13932
msgstr ""
13933
13934
#: serverguide/C/network-auth.xml:815(command)
13935
msgid "sudo ldapadd -c -Y EXTERNAL -H ldapi:/// -f consumer_sync.ldif"
13936
msgstr ""
13937
13938
#: serverguide/C/network-auth.xml:821(para)
13939
msgid ""
13940
"The frontend database should now sync between servers. You can add "
13941
"additional servers using the steps above as the need arises."
13942
msgstr ""
13943
13944
#: serverguide/C/network-auth.xml:831(programlisting)
13945
#, no-wrap
13946
msgid "127.0.0.1\tldap01.example.com ldap01"
13947
msgstr ""
13948
13949
#: serverguide/C/network-auth.xml:827(para)
13950
msgid ""
13951
"The <application>slapd</application> daemon will send log information to "
13952
"<filename>/var/log/syslog</filename> by default. So if all does "
13953
"<emphasis>not</emphasis> go well check there for errors and other "
13954
"troubleshooting information. Also, be sure that each server knows it's Fully "
13955
"Qualified Domain Name (FQDN). This is configured in "
13956
"<filename>/etc/hosts</filename> with a line similar to: <placeholder-1/>."
13957
msgstr ""
13958
13959
#: serverguide/C/network-auth.xml:839(title)
13960
msgid "Setting up ACL"
13961
msgstr ""
13962
13963
#: serverguide/C/network-auth.xml:841(para)
13964
msgid ""
13965
"Authentication requires access to the password field, that should be not "
13966
"accessible by default. Also, in order for users to change their own "
13967
"password, using <command>passwd</command> or other utilities, "
13968
"<emphasis>shadowLastChange</emphasis> needs to be accessible once a user has "
13969
"authenticated."
13970
msgstr ""
13971
13972
#: serverguide/C/network-auth.xml:848(para)
13973
msgid ""
13974
"To view the Access Control List (ACL), use the "
13975
"<application>ldapsearch</application> utility:"
13976
msgstr ""
13977
13978
#: serverguide/C/network-auth.xml:853(command)
13979
msgid ""
13980
"ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb "
13981
"olcAccess"
13982
msgstr ""
13983
13984
#: serverguide/C/network-auth.xml:857(computeroutput)
13985
#, no-wrap
13986
msgid ""
13987
"Enter LDAP Password: \n"
13988
"dn: olcDatabase={1}hdb,cn=config\n"
13989
"olcAccess: {0}to attrs=userPassword,shadowLastChange by "
13990
"dn=\"cn=admin,dc=exampl\n"
13991
" e,dc=com\" write by anonymous auth by self write by * none\n"
13992
"olcAccess: {1}to dn.base=\"\" by * read\n"
13993
"olcAccess: {2}to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13994
msgstr ""
13995
13996
#: serverguide/C/network-auth.xml:869(title)
13997
msgid "TLS and SSL"
13998
msgstr ""
13999
14000
#: serverguide/C/network-auth.xml:871(para)
14001
msgid ""
14002
"When authenticating to an OpenLDAP server it is best to do so using an "
14003
"encrypted session. This can be accomplished using Transport Layer Security "
14004
"(TLS) and/or Secure Sockets Layer (SSL)."
14005
msgstr ""
14006
14007
#: serverguide/C/network-auth.xml:876(para)
14008
msgid ""
14009
"The first step in the process is to obtain or create a "
14010
"<emphasis>certificate</emphasis>. Because <application>slapd</application> "
14011
"is compiled using the <application>gnutls</application> library, the "
14012
"<application>certtool</application> utility will be used to create "
14013
"certificates."
14014
msgstr ""
14015
14016
#: serverguide/C/network-auth.xml:885(para)
14017
msgid ""
14018
"First, install <application>gnutls-bin</application> by entering the "
14019
"following in a terminal:"
14020
msgstr ""
14021
14022
#: serverguide/C/network-auth.xml:890(command)
14023
msgid "sudo apt-get install gnutls-bin"
14024
msgstr ""
14025
14026
#: serverguide/C/network-auth.xml:896(para)
14027
msgid ""
14028
"Next, create a private key for the <emphasis>Certificate "
14029
"Authority</emphasis> (CA):"
14030
msgstr ""
14031
14032
#: serverguide/C/network-auth.xml:901(command)
14033
msgid ""
14034
"sudo sh -c \"certtool --generate-privkey > /etc/ssl/private/cakey.pem\""
14035
msgstr ""
14036
14037
#: serverguide/C/network-auth.xml:907(para)
14038
msgid ""
14039
"Create a <filename>/etc/ssl/ca.info</filename> details file to self-sign the "
14040
"CA certificate containing:"
14041
msgstr ""
14042
14043
#: serverguide/C/network-auth.xml:911(programlisting)
14044
#, no-wrap
14045
msgid ""
14046
"\n"
14047
"cn = Example Company\n"
14048
"ca\n"
14049
"cert_signing_key\n"
14050
msgstr ""
14051
14052
#: serverguide/C/network-auth.xml:920(para)
14053
msgid "Now create the self-signed CA certificate:"
14054
msgstr ""
14055
14056
#: serverguide/C/network-auth.xml:925(command)
14057
msgid ""
14058
"sudo certtool --generate-self-signed --load-privkey "
14059
"/etc/ssl/private/cakey.pem \\ --template /etc/ssl/ca.info --outfile "
14060
"/etc/ssl/certs/cacert.pem"
14061
msgstr ""
14062
14063
#: serverguide/C/network-auth.xml:932(para)
14064
msgid "Make a private key for the server:"
14065
msgstr ""
14066
14067
#: serverguide/C/network-auth.xml:937(command)
14068
msgid ""
14069
"sudo sh -c \"certtool --generate-privkey > "
14070
"/etc/ssl/private/ldap01_slapd_key.pem\""
14071
msgstr ""
14072
14073
#: serverguide/C/network-auth.xml:941(para)
14074
msgid ""
14075
"Replace <emphasis>ldap01</emphasis> in the filename with your server's "
14076
"hostname. Naming the certificate and key for the host and service that will "
14077
"be using them will help keep filenames and paths straight."
14078
msgstr ""
14079
14080
#: serverguide/C/network-auth.xml:950(para)
14081
msgid ""
14082
"To sign the server's certificate with the CA, create the "
14083
"<filename>/etc/ssl/ldap01.info</filename> info file containing:"
14084
msgstr ""
14085
14086
#: serverguide/C/network-auth.xml:954(programlisting)
14087
#, no-wrap
14088
msgid ""
14089
"\n"
14090
"organization = Example Company\n"
14091
"cn = ldap01.example.com\n"
14092
"tls_www_server\n"
14093
"encryption_key\n"
14094
"signing_key\n"
14095
msgstr ""
14096
14097
#: serverguide/C/network-auth.xml:965(para)
14098
msgid "Create the server's certificate:"
14099
msgstr ""
14100
14101
#: serverguide/C/network-auth.xml:970(command)
14102
msgid ""
14103
"sudo certtool --generate-certificate --load-privkey /etc/ssl/private/x01-"
14104
"test_slapd_key.pem \\ --load-ca-certificate /etc/ssl/certs/cacert.pem --load-"
14105
"ca-privkey /etc/ssl/private/cakey.pem \\ --template /etc/ssl/x01-test.info --"
14106
"outfile /etc/ssl/certs/x01-test_slapd_cert.pem"
14107
msgstr ""
14108
14109
#: serverguide/C/network-auth.xml:978(para)
14110
msgid ""
14111
"Once you have a certificate, key, and CA cert installed, use "
14112
"<application>ldapmodify</application> to add the new configuration options:"
14113
msgstr ""
14114
14115
#: serverguide/C/network-auth.xml:989(userinput)
14116
#, no-wrap
14117
msgid ""
14118
"dn: cn=config\n"
14119
"add: olcTLSCACertificateFile\n"
14120
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
14121
"-\n"
14122
"add: olcTLSCertificateFile\n"
14123
"olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem\n"
14124
"-\n"
14125
"add: olcTLSCertificateKeyFile\n"
14126
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem"
14127
msgstr ""
14128
14129
#: serverguide/C/network-auth.xml:988(computeroutput) serverguide/C/network-auth.xml:1159(computeroutput)
14130
#, no-wrap
14131
msgid ""
14132
"Enter LDAP Password:\n"
14133
"<placeholder-1/>\n"
14134
"\n"
14135
"modifying entry \"cn=config\"\n"
14136
msgstr ""
14137
14138
#: serverguide/C/network-auth.xml:1004(para)
14139
msgid ""
14140
"Adjust the <filename>ldap01_slapd_cert.pem</filename>, "
14141
"<filename>ldap01_slapd_key.pem</filename>, and "
14142
"<filename>cacert.pem</filename> names if yours are different."
14143
msgstr ""
14144
14145
#: serverguide/C/network-auth.xml:1010(para)
14146
msgid ""
14147
"Next, edit <filename>/etc/default/slapd</filename> uncomment the "
14148
"<emphasis>SLAPD_SERVICES</emphasis> option:"
14149
msgstr ""
14150
14151
#: serverguide/C/network-auth.xml:1014(programlisting)
14152
#, no-wrap
14153
msgid ""
14154
"\n"
14155
"SLAPD_SERVICES=\"ldap:/// ldapi:/// ldaps:///\"\n"
14156
msgstr ""
14157
14158
#: serverguide/C/network-auth.xml:1018(para)
14159
msgid ""
14160
"Now the <emphasis>openldap</emphasis> user needs access to the certificate:"
14161
msgstr ""
14162
14163
#: serverguide/C/network-auth.xml:1023(command)
14164
msgid "sudo adduser openldap ssl-cert"
14165
msgstr ""
14166
14167
#: serverguide/C/network-auth.xml:1024(command)
14168
msgid "sudo chgrp ssl-cert /etc/ssl/private/ldap01_slapd_key.pem"
14169
msgstr ""
14170
14171
#: serverguide/C/network-auth.xml:1025(command)
14172
msgid "sudo chmod g+r /etc/ssl/private/ldap01_slapd_key.pem"
14173
msgstr ""
14174
14175
#: serverguide/C/network-auth.xml:1029(para)
14176
msgid ""
14177
"If the <filename role=\"directory\">/etc/ssl/private</filename> and "
14178
"<filename>/etc/ssl/private/server.key</filename> have different permissions, "
14179
"adjust the commands appropriately."
14180
msgstr ""
14181
14182
#: serverguide/C/network-auth.xml:1035(para)
14183
msgid "Finally, restart <application>slapd</application>:"
14184
msgstr ""
14185
14186
#: serverguide/C/network-auth.xml:1043(para)
14187
msgid ""
14188
"The <application>slapd</application> daemon should now be listening for "
14189
"LDAPS connections and be able to use STARTTLS during authentication."
14190
msgstr ""
14191
14192
#: serverguide/C/network-auth.xml:1049(para)
14193
msgid ""
14194
"If you run into troubles with the server not starting, check the "
14195
"/var/log/syslog. If you see errors like main: TLS init def ctx failed: -1, "
14196
"it is likely there is a configuration problem. Check that the certificate is "
14197
"signed by the authority from in the files configured, and that the ssl-cert "
14198
"group has read permissions on the private key."
14199
msgstr ""
14200
14201
#: serverguide/C/network-auth.xml:1061(title)
14202
msgid "TLS Replication"
14203
msgstr ""
14204
14205
#: serverguide/C/network-auth.xml:1063(para)
14206
msgid ""
14207
"If you have setup <application>Syncrepl</application> between servers, it is "
14208
"prudent to encrypt the replication traffic using <emphasis>Transport Layer "
14209
"Security (TLS)</emphasis>. For details on setting up replication see <xref "
14210
"linkend=\"openldap-server-replication\"/>."
14211
msgstr ""
14212
14213
#: serverguide/C/network-auth.xml:1069(para)
14214
msgid ""
14215
"Assuming you have followed the above instructions and created a CA "
14216
"certificate and server certificate on the <emphasis>Provider</emphasis> "
14217
"server. Follow the following instructions to create a certificate and key "
14218
"for the <emphasis>Consumer</emphasis> server."
14219
msgstr ""
14220
14221
#: serverguide/C/network-auth.xml:1078(para)
14222
msgid "Create a new key for the Consumer server:"
14223
msgstr ""
14224
14225
#: serverguide/C/network-auth.xml:1083(command)
14226
msgid "mkdir ldap02-ssl"
14227
msgstr ""
14228
14229
#: serverguide/C/network-auth.xml:1084(command)
14230
msgid "cd ldap02-ssl"
14231
msgstr ""
14232
14233
#: serverguide/C/network-auth.xml:1085(command)
14234
msgid "certtool --generate-privkey > ldap02_slapd_key.pem"
14235
msgstr ""
14236
14237
#: serverguide/C/network-auth.xml:1089(para)
14238
msgid ""
14239
"Creating a new directory is not strictly necessary, but it will help keep "
14240
"things organized and make it easier to copy the files to the Consumer server."
14241
msgstr ""
14242
14243
#: serverguide/C/network-auth.xml:1098(para)
14244
msgid ""
14245
"Next, create an info file, <filename>ldap02.info</filename> for the Consumer "
14246
"server, changing the attributes to match your locality and server:"
14247
msgstr ""
14248
14249
#: serverguide/C/network-auth.xml:1103(programlisting)
14250
#, no-wrap
14251
msgid ""
14252
"\n"
14253
"country = US\n"
14254
"state = North Carolina\n"
14255
"locality = Winston-Salem\n"
14256
"organization = Example Company\n"
14257
"cn = ldap02.salem.edu\n"
14258
"tls_www_client\n"
14259
"encryption_key\n"
14260
"signing_key\n"
14261
msgstr ""
14262
14263
#: serverguide/C/network-auth.xml:1117(para)
14264
msgid "Create the certificate:"
14265
msgstr ""
14266
14267
#: serverguide/C/network-auth.xml:1122(command)
14268
msgid ""
14269
"sudo certtool --generate-certificate --load-privkey ldap02_slapd_key.pem \\ -"
14270
"-load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey "
14271
"/etc/ssl/private/cakey.pem \\ --template ldap02.info --outfile "
14272
"ldap02_slapd_cert.pem"
14273
msgstr ""
14274
14275
#: serverguide/C/network-auth.xml:1130(para)
14276
msgid "Copy the <filename>cacert.pem</filename> to the dicretory:"
14277
msgstr ""
14278
14279
#: serverguide/C/network-auth.xml:1135(command)
14280
msgid "cp /etc/ssl/certs/cacert.pem ."
14281
msgstr ""
14282
14283
#: serverguide/C/network-auth.xml:1141(para)
14284
msgid ""
14285
"The only thing left is to copy the <filename>ldap02-ssl</filename> directory "
14286
"to the Consumer server, then copy <filename>ldap02_slapd_cert.pem</filename> "
14287
"and <filename>cacert.pem</filename> to <filename>/etc/ssl/certs</filename>, "
14288
"and copy <filename>ldap02_slapd_key.pem</filename> to "
14289
"<filename>/etc/ssl/private</filename>."
14290
msgstr ""
14291
14292
#: serverguide/C/network-auth.xml:1150(para)
14293
msgid ""
14294
"Once the files are in place adjust the <emphasis>cn=config</emphasis> tree "
14295
"by entering:"
14296
msgstr ""
14297
14298
#: serverguide/C/network-auth.xml:1160(userinput)
14299
#, no-wrap
14300
msgid ""
14301
"dn: cn=config\n"
14302
"add: olcTLSCACertificateFile\n"
14303
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
14304
"-\n"
14305
"add: olcTLSCertificateFile\n"
14306
"olcTLSCertificateFile: /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14307
"-\n"
14308
"add: olcTLSCertificateKeyFile\n"
14309
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap02_slapd_key.pem"
14310
msgstr ""
14311
14312
#: serverguide/C/network-auth.xml:1177(para)
14313
msgid ""
14314
"As with the Provider you can now edit "
14315
"<filename>/etc/default/slapd</filename> and add the "
14316
"<emphasis>ldaps:///</emphasis> parameter to the "
14317
"<emphasis>SLAPD_SERVICES</emphasis> option."
14318
msgstr ""
14319
14320
#: serverguide/C/network-auth.xml:1185(para)
14321
msgid ""
14322
"Now that <emphasis>TLS</emphasis> has been setup on each server, once again "
14323
"modify the <emphasis>Consumer</emphasis> server's "
14324
"<emphasis>cn=config</emphasis> tree by entering the following in a terminal:"
14325
msgstr ""
14326
14327
#: serverguide/C/network-auth.xml:1198(userinput)
14328
#, no-wrap
14329
msgid ""
14330
"\n"
14331
"dn: olcDatabase={1}hdb,cn=config\n"
14332
"replace: olcSyncrepl\n"
14333
"olcSyncrepl: {0}rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
14334
"binddn=\"cn=ad\n"
14335
" min,dc=example,dc=com\" credentials=secret searchbase=\"dc=example,dc=com\" "
14336
"logbas\n"
14337
" e=\"cn=accesslog\" "
14338
"logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" s\n"
14339
" chemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog "
14340
"starttls=yes"
14341
msgstr ""
14342
14343
#: serverguide/C/network-auth.xml:1195(computeroutput)
14344
#, no-wrap
14345
msgid ""
14346
"SASL/EXTERNAL authentication started\n"
14347
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
14348
"SASL SSF: 0\n"
14349
"<placeholder-1/>\n"
14350
"\n"
14351
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
14352
msgstr ""
14353
14354
#: serverguide/C/network-auth.xml:1210(para)
14355
msgid ""
14356
"If the LDAP server hostname does not match the Fully Qualified Domain Name "
14357
"(FQDN) in the certificate, you may have to edit "
14358
"<filename>/etc/ldap/ldap.conf</filename> and add the following TLS options:"
14359
msgstr ""
14360
14361
#: serverguide/C/network-auth.xml:1215(programlisting)
14362
#, no-wrap
14363
msgid ""
14364
"\n"
14365
"TLS_CERT /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14366
"TLS_KEY /etc/ssl/private/ldap02_slapd_key.pem\n"
14367
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
14368
msgstr ""
14369
14370
#: serverguide/C/network-auth.xml:1222(para)
14371
msgid ""
14372
"Finally, restart <application>slapd</application> on each of the servers:"
14373
msgstr ""
14374
14375
#: serverguide/C/network-auth.xml:1235(title)
14376
msgid "LDAP Authentication"
14377
msgstr ""
14378
14379
#: serverguide/C/network-auth.xml:1237(para)
14380
msgid ""
14381
"Once you have a working LDAP server, the <application>auth-client-"
14382
"config</application> and <application>libnss-ldap</application> packages "
14383
"take the pain out of configuring an Ubuntu client to authenticate using "
14384
"LDAP. To install the packages from, a terminal prompt enter:"
14385
msgstr ""
14386
14387
#: serverguide/C/network-auth.xml:1244(command)
14388
msgid "sudo apt-get install libnss-ldap"
14389
msgstr ""
14390
14391
#: serverguide/C/network-auth.xml:1247(para)
14392
msgid ""
14393
"During the install a menu dialog will ask you connection details about your "
14394
"LDAP server."
14395
msgstr ""
14396
14397
#: serverguide/C/network-auth.xml:1251(para)
14398
msgid ""
14399
"If you make a mistake when entering your information you can execute the "
14400
"dialog again using:"
14401
msgstr ""
14402
14403
#: serverguide/C/network-auth.xml:1256(command)
14404
msgid "sudo dpkg-reconfigure ldap-auth-config"
14405
msgstr ""
14406
14407
#: serverguide/C/network-auth.xml:1259(para)
14408
msgid ""
14409
"The results of the dialog can be seen in "
14410
"<filename>/etc/ldap.conf</filename>. If your server requires options not "
14411
"covered in the menu edit this file accordingly."
14412
msgstr ""
14413
14414
#: serverguide/C/network-auth.xml:1264(para)
14415
msgid ""
14416
"Now that <application>libnss-ldap</application> is configured enable the "
14417
"<application>auth-client-config</application> LDAP profile by entering:"
14418
msgstr ""
14419
14420
#: serverguide/C/network-auth.xml:1270(command)
14421
msgid "sudo auth-client-config -t nss -p lac_ldap"
14422
msgstr ""
14423
14424
#: serverguide/C/network-auth.xml:1275(para)
14425
msgid ""
14426
"<emphasis>-t:</emphasis> only modifies "
14427
"<filename>/etc/nsswitch.conf</filename>."
14428
msgstr ""
14429
14430
#: serverguide/C/network-auth.xml:1280(para)
14431
msgid "<emphasis>-p:</emphasis> name of the profile to enable, disable, etc."
14432
msgstr ""
14433
14434
#: serverguide/C/network-auth.xml:1285(para)
14435
msgid ""
14436
"<emphasis>lac_ldap:</emphasis> the <application>auth-client-"
14437
"config</application> profile that is part of the <application>ldap-auth-"
14438
"config</application> package."
14439
msgstr ""
14440
14441
#: serverguide/C/network-auth.xml:1292(para)
14442
msgid ""
14443
"Using the <application>pam-auth-update</application> utility, configure the "
14444
"system to use LDAP for authentication:"
14445
msgstr ""
14446
14447
#: serverguide/C/network-auth.xml:1297(command)
14448
msgid "sudo pam-auth-update"
14449
msgstr ""
14450
14451
#: serverguide/C/network-auth.xml:1300(para)
14452
msgid ""
14453
"From the <application>pam-auth-update</application> menu, choose LDAP and "
14454
"any other authentication mechanisms you need."
14455
msgstr ""
14456
14457
#: serverguide/C/network-auth.xml:1304(para)
14458
msgid ""
14459
"You should now be able to login using user credentials stored in the LDAP "
14460
"directory."
14461
msgstr ""
14462
14463
#: serverguide/C/network-auth.xml:1309(para)
14464
msgid ""
14465
"If you are going to use LDAP to store Samba users you will need to configure "
14466
"the server to authenticate using LDAP. See <xref linkend=\"samba-ldap\"/> "
14467
"for details."
14468
msgstr ""
14469
14470
#: serverguide/C/network-auth.xml:1317(title)
14471
msgid "User and Group Management"
14472
msgstr ""
14473
14474
#: serverguide/C/network-auth.xml:1319(para)
14475
msgid ""
14476
"The <application>ldap-utils</application> package comes with multiple "
14477
"utilities to manage the directory, but the long string of options needed, "
14478
"can make them a burden to use. The <application>ldapscripts</application> "
14479
"package contains configurable scripts to easily manage LDAP users and groups."
14480
msgstr ""
14481
14482
#: serverguide/C/network-auth.xml:1325(para)
14483
msgid "To install the package, from a terminal enter:"
14484
msgstr ""
14485
14486
#: serverguide/C/network-auth.xml:1330(command)
14487
msgid "sudo apt-get install ldapscripts"
14488
msgstr ""
14489
14490
#: serverguide/C/network-auth.xml:1333(para)
14491
msgid ""
14492
"Next, edit the config file "
14493
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> uncommenting and "
14494
"changing the following to match your environment:"
14495
msgstr ""
14496
14497
#: serverguide/C/network-auth.xml:1338(programlisting)
14498
#, no-wrap
14499
msgid ""
14500
"\n"
14501
"SERVER=localhost\n"
14502
"BINDDN='cn=admin,dc=example,dc=com'\n"
14503
"BINDPWDFILE=\"/etc/ldapscripts/ldapscripts.passwd\"\n"
14504
"SUFFIX='dc=example,dc=com'\n"
14505
"GSUFFIX='ou=Groups'\n"
14506
"USUFFIX='ou=People'\n"
14507
"MSUFFIX='ou=Computers'\n"
14508
"GIDSTART=10000\n"
14509
"UIDSTART=10000\n"
14510
"MIDSTART=10000\n"
14511
msgstr ""
14512
14513
#: serverguide/C/network-auth.xml:1351(para)
14514
msgid ""
14515
"Now, create the <filename>ldapscripts.passwd</filename> file to allow "
14516
"authenticated access to the directory:"
14517
msgstr ""
14518
14519
#: serverguide/C/network-auth.xml:1356(command)
14520
msgid ""
14521
"sudo sh -c \"echo -n 'secret' > /etc/ldapscripts/ldapscripts.passwd\""
14522
msgstr ""
14523
14524
#: serverguide/C/network-auth.xml:1357(command)
14525
msgid "sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd"
14526
msgstr ""
14527
14528
#: serverguide/C/network-auth.xml:1361(para)
14529
msgid ""
14530
"Replace <quote>secret</quote> with the actual password for your LDAP admin "
14531
"user."
14532
msgstr ""
14533
14534
#: serverguide/C/network-auth.xml:1366(para)
14535
msgid ""
14536
"The <application>ldapscripts</application> are now ready to help manage your "
14537
"directory. The following are some examples of how to use the scripts:"
14538
msgstr ""
14539
14540
#: serverguide/C/network-auth.xml:1373(para)
14541
msgid "Create a new user:"
14542
msgstr ""
14543
14544
#: serverguide/C/network-auth.xml:1377(command)
14545
msgid "sudo ldapadduser george example"
14546
msgstr ""
14547
14548
#: serverguide/C/network-auth.xml:1379(para)
14549
msgid ""
14550
"This will create a user with uid <emphasis role=\"italic\">george</emphasis> "
14551
"and set the user's primary group (gid) to <emphasis "
14552
"role=\"italic\">example</emphasis>"
14553
msgstr ""
14554
14555
#: serverguide/C/network-auth.xml:1385(para)
14556
msgid "Change a user's password:"
14557
msgstr ""
14558
14559
#: serverguide/C/network-auth.xml:1389(command)
14560
msgid "sudo ldapsetpasswd george"
14561
msgstr ""
14562
14563
#: serverguide/C/network-auth.xml:1390(computeroutput)
14564
#, no-wrap
14565
msgid "Changing password for user uid=george,ou=People,dc=example,dc=com"
14566
msgstr ""
14567
14568
#: serverguide/C/network-auth.xml:1391(userinput)
14569
#, no-wrap
14570
msgid "New Password: "
14571
msgstr ""
14572
14573
#: serverguide/C/network-auth.xml:1392(userinput)
14574
#, no-wrap
14575
msgid "New Password (verify): "
14576
msgstr ""
14577
14578
#: serverguide/C/network-auth.xml:1396(para)
14579
msgid "Delete a user:"
14580
msgstr ""
14581
14582
#: serverguide/C/network-auth.xml:1400(command)
14583
msgid "sudo ldapdeleteuser george"
14584
msgstr ""
14585
14586
#: serverguide/C/network-auth.xml:1405(para)
14587
msgid "Add a group:"
14588
msgstr ""
14589
14590
#: serverguide/C/network-auth.xml:1409(command)
14591
msgid "sudo ldapaddgroup qa"
14592
msgstr ""
14593
14594
#: serverguide/C/network-auth.xml:1413(para)
14595
msgid "Delete a group:"
14596
msgstr ""
14597
14598
#: serverguide/C/network-auth.xml:1417(command)
14599
msgid "sudo ldapdeletegroup qa"
14600
msgstr ""
14601
14602
#: serverguide/C/network-auth.xml:1421(para)
14603
msgid "Add a user to a group:"
14604
msgstr ""
14605
14606
#: serverguide/C/network-auth.xml:1425(command)
14607
msgid "sudo ldapaddusertogroup george qa"
14608
msgstr ""
14609
14610
#: serverguide/C/network-auth.xml:1427(para)
14611
msgid ""
14612
"You should now see a <emphasis>memberUid</emphasis> attribute for the "
14613
"<emphasis role=\"italic\">qa</emphasis> group with a value of <emphasis "
14614
"role=\"italic\">george</emphasis>."
14615
msgstr ""
14616
14617
#: serverguide/C/network-auth.xml:1433(para)
14618
msgid "Remove a user from a group:"
14619
msgstr ""
14620
14621
#: serverguide/C/network-auth.xml:1437(command)
14622
msgid "sudo ldapdeleteuserfromgroup george qa"
14623
msgstr ""
14624
14625
#: serverguide/C/network-auth.xml:1439(para)
14626
msgid ""
14627
"The <emphasis>memberUid</emphasis> attribute should now be removed from the "
14628
"<emphasis role=\"italic\">qa</emphasis> group."
14629
msgstr ""
14630
14631
#: serverguide/C/network-auth.xml:1445(para)
14632
msgid ""
14633
"The <application>ldapmodifyuser</application> script allows you to add, "
14634
"remove, or replace a user's attributes. The script uses the same syntax as "
14635
"the <application>ldapmodify</application> utility. For example:"
14636
msgstr ""
14637
14638
#: serverguide/C/network-auth.xml:1450(command)
14639
msgid "sudo ldapmodifyuser george"
14640
msgstr ""
14641
14642
#: serverguide/C/network-auth.xml:1451(computeroutput)
14643
#, no-wrap
14644
msgid ""
14645
"# About to modify the following entry :\n"
14646
"dn: uid=george,ou=People,dc=example,dc=com\n"
14647
"objectClass: account\n"
14648
"objectClass: posixAccount\n"
14649
"cn: george\n"
14650
"uid: george\n"
14651
"uidNumber: 1001\n"
14652
"gidNumber: 1001\n"
14653
"homeDirectory: /home/george\n"
14654
"loginShell: /bin/bash\n"
14655
"gecos: george\n"
14656
"description: User account\n"
14657
"userPassword:: e1NTSEF9eXFsTFcyWlhwWkF1eGUybVdFWHZKRzJVMjFTSG9vcHk=\n"
14658
"\n"
14659
"# Enter your modifications here, end with CTRL-D.\n"
14660
"dn: uid=george,ou=People,dc=example,dc=com"
14661
msgstr ""
14662
14663
#: serverguide/C/network-auth.xml:1467(userinput)
14664
#, no-wrap
14665
msgid ""
14666
"replace: gecos\n"
14667
"gecos: George Carlin"
14668
msgstr ""
14669
14670
#: serverguide/C/network-auth.xml:1470(para)
14671
msgid ""
14672
"The user's <emphasis>gecos</emphasis> should now be <quote>George "
14673
"Carlin</quote>."
14674
msgstr ""
14675
14676
#: serverguide/C/network-auth.xml:1475(para)
14677
msgid ""
14678
"Another great feature of <application>ldapscripts</application>, is the "
14679
"template system. Templates allow you to customize the attributes of user, "
14680
"group, and machine objectes. For example, to enable the "
14681
"<emphasis>user</emphasis> template edit "
14682
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> changing:"
14683
msgstr ""
14684
14685
#: serverguide/C/network-auth.xml:1482(programlisting)
14686
#, no-wrap
14687
msgid ""
14688
"\n"
14689
"UTEMPLATE=\"/etc/ldapscripts/ldapadduser.template\"\n"
14690
msgstr ""
14691
14692
#: serverguide/C/network-auth.xml:1486(para)
14693
msgid ""
14694
"There are <emphasis role=\"italic\">sample</emphasis> templates in the "
14695
"<filename>/etc/ldapscripts</filename> directory. Copy or rename the "
14696
"<filename>ldapadduser.template.sample</filename> file to "
14697
"<filename>/etc/ldapscripts/ldapadduser.template</filename>:"
14698
msgstr ""
14699
14700
#: serverguide/C/network-auth.xml:1493(command)
14701
msgid ""
14702
"sudo cp /etc/ldapscripts/ldapadduser.template.sample "
14703
"/etc/ldapscripts/ldapadduser.template"
14704
msgstr ""
14705
14706
#: serverguide/C/network-auth.xml:1496(para)
14707
msgid ""
14708
"Edit the new template to add the desired attributes. The following will "
14709
"create new user's as with an <emphasis>objectClass</emphasis> of "
14710
"<emphasis>inetOrgPerson</emphasis>:"
14711
msgstr ""
14712
14713
#: serverguide/C/network-auth.xml:1501(programlisting)
14714
#, no-wrap
14715
msgid ""
14716
"\n"
14717
"dn: uid=<user>,<usuffix>,<suffix>\n"
14718
"objectClass: inetOrgPerson\n"
14719
"objectClass: posixAccount\n"
14720
"cn: <user>\n"
14721
"sn: <ask>\n"
14722
"uid: <user>\n"
14723
"uidNumber: <uid>\n"
14724
"gidNumber: <gid>\n"
14725
"homeDirectory: <home>\n"
14726
"loginShell: <shell>\n"
14727
"gecos: <user>\n"
14728
"description: User account\n"
14729
"title: Employee\n"
14730
msgstr ""
14731
14732
#: serverguide/C/network-auth.xml:1517(para)
14733
msgid ""
14734
"Notice the <emphasis><ask></emphasis> option used for the "
14735
"<emphasis>cn</emphasis> value. Using <ask> will configure "
14736
"<application>ldapadduser</application> to prompt you for the attribute value "
14737
"during user creation."
14738
msgstr ""
14739
14740
#: serverguide/C/network-auth.xml:1525(para)
14741
msgid ""
14742
"There are more useful scripts in the package, to see a full list enter: "
14743
"<command>dpkg -L ldapscripts | grep bin</command>"
14744
msgstr ""
14745
14746
#: serverguide/C/network-auth.xml:1534(para)
14747
msgid ""
14748
"The <ulink url=\"https://help.ubuntu.com/community/OpenLDAPServer\">OpenLDAP "
14749
"Ubuntu Wiki</ulink> page has more details."
14750
msgstr ""
14751
14752
#: serverguide/C/network-auth.xml:1539(para)
14753
msgid ""
14754
"For more information see <ulink url=\"http://www.openldap.org/\">OpenLDAP "
14755
"Home Page</ulink>"
14756
msgstr ""
14757
14758
#: serverguide/C/network-auth.xml:1544(para)
14759
msgid ""
14760
"Though starting to show it's age, a great source for in depth LDAP "
14761
"information is O'Reilly's <ulink "
14762
"url=\"http://www.oreilly.com/catalog/ldapsa/\">LDAP System "
14763
"Administration</ulink>"
14764
msgstr ""
14765
14766
#: serverguide/C/network-auth.xml:1550(para)
14767
msgid ""
14768
"Packt's <ulink url=\"http://www.packtpub.com/OpenLDAP-Developers-Server-Open-"
14769
"Source-Linux/book\">Mastering OpenLDAP</ulink> is a great reference covering "
14770
"newer versions of OpenLDAP."
14771
msgstr ""
14772
14773
#: serverguide/C/network-auth.xml:1556(para)
14774
msgid ""
14775
"For more information on <application>auth-client-config</application> see "
14776
"the man page: <command>man auth-client-config</command>."
14777
msgstr ""
14778
14779
#: serverguide/C/network-auth.xml:1561(para)
14780
msgid ""
14781
"For more details regarding the <application>ldapscripts</application> "
14782
"package see the man pages: <command>man ldapscripts</command>, <command>man "
14783
"ldapadduser</command>, <command>man ldapaddgroup</command>, etc."
14784
msgstr ""
14785
14786
#: serverguide/C/network-auth.xml:1571(title)
14787
msgid "Samba and LDAP"
14788
msgstr ""
14789
14790
#: serverguide/C/network-auth.xml:1573(para)
14791
msgid ""
14792
"This section covers configuring Samba to use LDAP for user, group, and "
14793
"machine account information and authentication. The assumption is, you "
14794
"already have a working OpenLDAP directory installed and the server is "
14795
"configured to use it for authentication. See <xref linkend=\"openldap-"
14796
"server\"/> and <xref linkend=\"openldap-auth-config\"/> for details on "
14797
"setting up OpenLDAP. For more information on installing and configuring "
14798
"Samba see <xref linkend=\"windows-networking\"/>."
14799
msgstr ""
14800
14801
#: serverguide/C/network-auth.xml:1583(para)
14802
msgid ""
14803
"There are three packages needed when integrating Samba with LDAP. "
14804
"<application>samba</application>, <application>samba-doc</application>, and "
14805
"<application>smbldap-tools</application> packages . To install the packages, "
14806
"from a terminal enter:"
14807
msgstr ""
14808
14809
#: serverguide/C/network-auth.xml:1589(command)
14810
msgid "sudo apt-get install samba samba-doc smbldap-tools"
14811
msgstr ""
14812
14813
#: serverguide/C/network-auth.xml:1592(para)
14814
msgid ""
14815
"Strictly speaking the <application>smbldap-tools</application> package isn't "
14816
"needed, but unless you have another package or custom scripts, a method of "
14817
"managing users, groups, and computer accounts is needed."
14818
msgstr ""
14819
14820
#: serverguide/C/network-auth.xml:1599(title)
14821
msgid "OpenLDAP Configuration"
14822
msgstr ""
14823
14824
#: serverguide/C/network-auth.xml:1601(para)
14825
msgid ""
14826
"In order for Samba to use OpenLDAP as a <emphasis>passdb backend</emphasis>, "
14827
"the user objects in the directory will need additional attributes. This "
14828
"section assumes you want Samba to be configured as a Windows NT domain "
14829
"controller, and will add the necessary LDAP objects and attributes."
14830
msgstr ""
14831
14832
#: serverguide/C/network-auth.xml:1609(para)
14833
msgid ""
14834
"The Samba attributes are defined in the <filename>samba.schema</filename> "
14835
"file which is part of the <application>samba-doc</application> package. The "
14836
"schema file needs to be unzipped and copied to "
14837
"<filename>/etc/ldap/schema</filename>. From a terminal prompt enter:"
14838
msgstr ""
14839
14840
#: serverguide/C/network-auth.xml:1616(command)
14841
msgid ""
14842
"sudo cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz "
14843
"/etc/ldap/schema/"
14844
msgstr ""
14845
14846
#: serverguide/C/network-auth.xml:1617(command)
14847
msgid "sudo gzip -d /etc/ldap/schema/samba.schema.gz"
14848
msgstr ""
14849
14850
#: serverguide/C/network-auth.xml:1623(para)
14851
msgid ""
14852
"The <emphasis>samba</emphasis> schema needs to be added to the "
14853
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
14854
"<application>slapd</application> is also detailed in <xref "
14855
"linkend=\"openldap-configuration\"/>."
14856
msgstr ""
14857
14858
#: serverguide/C/network-auth.xml:1631(para) serverguide/C/network-auth.xml:2666(para)
14859
msgid ""
14860
"First, create a configuration file named "
14861
"<filename>schema_convert.conf</filename>, or a similar descriptive name, "
14862
"containing the following lines:"
14863
msgstr ""
14864
14865
#: serverguide/C/network-auth.xml:1636(programlisting)
14866
#, no-wrap
14867
msgid ""
14868
"\n"
14869
"include /etc/ldap/schema/core.schema\n"
14870
"include /etc/ldap/schema/collective.schema\n"
14871
"include /etc/ldap/schema/corba.schema\n"
14872
"include /etc/ldap/schema/cosine.schema\n"
14873
"include /etc/ldap/schema/duaconf.schema\n"
14874
"include /etc/ldap/schema/dyngroup.schema\n"
14875
"include /etc/ldap/schema/inetorgperson.schema\n"
14876
"include /etc/ldap/schema/java.schema\n"
14877
"include /etc/ldap/schema/misc.schema\n"
14878
"include /etc/ldap/schema/nis.schema\n"
14879
"include /etc/ldap/schema/openldap.schema\n"
14880
"include /etc/ldap/schema/ppolicy.schema\n"
14881
"include /etc/ldap/schema/samba.schema\n"
14882
msgstr ""
14883
14884
#: serverguide/C/network-auth.xml:1666(para) serverguide/C/network-auth.xml:2701(para)
14885
msgid ""
14886
"Now use <application>slapcat</application> to convert the schema files:"
14887
msgstr ""
14888
14889
#: serverguide/C/network-auth.xml:1671(command)
14890
msgid ""
14891
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
14892
"\"cn={12}samba,cn=schema,cn=config\" > /tmp/cn=samba.ldif"
14893
msgstr ""
14894
14895
#: serverguide/C/network-auth.xml:1674(para) serverguide/C/network-auth.xml:2709(para)
14896
msgid ""
14897
"Change the above file and path names to match your own if they are different."
14898
msgstr ""
14899
14900
#: serverguide/C/network-auth.xml:1681(para)
14901
msgid ""
14902
"Edit the generated <filename>/tmp/cn\\=samba.ldif</filename> file, changing "
14903
"the following attributes:"
14904
msgstr ""
14905
14906
#: serverguide/C/network-auth.xml:1685(programlisting)
14907
#, no-wrap
14908
msgid ""
14909
"\n"
14910
"dn: cn=samba,cn=schema,cn=config\n"
14911
"...\n"
14912
"cn: samba\n"
14913
msgstr ""
14914
14915
#: serverguide/C/network-auth.xml:1695(programlisting)
14916
#, no-wrap
14917
msgid ""
14918
"\n"
14919
"structuralObjectClass: olcSchemaConfig\n"
14920
"entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95\n"
14921
"creatorsName: cn=config\n"
14922
"createTimestamp: 20080827045234Z\n"
14923
"entryCSN: 20080827045234.341425Z#000000#000#000000\n"
14924
"modifiersName: cn=config\n"
14925
"modifyTimestamp: 20080827045234Z\n"
14926
msgstr ""
14927
14928
#: serverguide/C/network-auth.xml:1720(command)
14929
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=samba.ldif"
14930
msgstr ""
14931
14932
#: serverguide/C/network-auth.xml:1726(para)
14933
msgid ""
14934
"There should now be a <emphasis>dn: "
14935
"cn={X}misc,cn=schema,cn=config</emphasis>, where \"X\" is the next "
14936
"sequential schema, entry in the cn=config tree."
14937
msgstr ""
14938
14939
#: serverguide/C/network-auth.xml:1734(para)
14940
msgid ""
14941
"Copy and paste the following into a file named "
14942
"<filename>samba_indexes.ldif</filename>:"
14943
msgstr ""
14944
14945
#: serverguide/C/network-auth.xml:1738(programlisting)
14946
#, no-wrap
14947
msgid ""
14948
"\n"
14949
"dn: olcDatabase={1}hdb,cn=config\n"
14950
"changetype: modify\n"
14951
"add: olcDbIndex\n"
14952
"olcDbIndex: uidNumber eq\n"
14953
"olcDbIndex: gidNumber eq\n"
14954
"olcDbIndex: loginShell eq\n"
14955
"olcDbIndex: uid eq,pres,sub\n"
14956
"olcDbIndex: memberUid eq,pres,sub\n"
14957
"olcDbIndex: uniqueMember eq,pres\n"
14958
"olcDbIndex: sambaSID eq\n"
14959
"olcDbIndex: sambaPrimaryGroupSID eq\n"
14960
"olcDbIndex: sambaGroupType eq\n"
14961
"olcDbIndex: sambaSIDList eq\n"
14962
"olcDbIndex: sambaDomainName eq\n"
14963
"olcDbIndex: default sub\n"
14964
msgstr ""
14965
14966
#: serverguide/C/network-auth.xml:1756(para)
14967
msgid ""
14968
"Using the <application>ldapmodify</application> utility load the new indexes:"
14969
msgstr ""
14970
14971
#: serverguide/C/network-auth.xml:1761(command)
14972
msgid "ldapmodify -x -D cn=admin,cn=config -W -f samba_indexes.ldif"
14973
msgstr ""
14974
14975
#: serverguide/C/network-auth.xml:1763(para)
14976
msgid ""
14977
"If all went well you should see the new indexes using "
14978
"<application>ldapsearch</application>:"
14979
msgstr ""
14980
14981
#: serverguide/C/network-auth.xml:1768(command)
14982
msgid ""
14983
"ldapsearch -xLLL -D cn=admin,cn=config -x -b cn=config -W olcDatabase={1}hdb"
14984
msgstr ""
14985
14986
#: serverguide/C/network-auth.xml:1774(para)
14987
msgid ""
14988
"Next, configure the <application>smbldap-tools</application> package to "
14989
"match your environment. The package comes with a configuration script that "
14990
"will ask questions about the needed options. To run the script enter:"
14991
msgstr ""
14992
14993
#: serverguide/C/network-auth.xml:1780(command)
14994
msgid "sudo gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz"
14995
msgstr ""
14996
14997
#: serverguide/C/network-auth.xml:1781(command)
14998
msgid "sudo perl /usr/share/doc/smbldap-tools/configure.pl"
14999
msgstr ""
15000
15001
#: serverguide/C/network-auth.xml:1784(para)
15002
msgid ""
15003
"Once you have answered the questions, there should be <filename>/etc/smbldap-"
15004
"tools/smbldap.conf</filename> and <filename>/etc/smbldap-"
15005
"tools/smbldap_bind.conf</filename> files. These files are generated by the "
15006
"configure script, so if you made any mistakes while executing the script it "
15007
"may be simpler to edit the file appropriately."
15008
msgstr ""
15009
15010
#: serverguide/C/network-auth.xml:1794(para)
15011
msgid ""
15012
"The <application>smbldap-populate</application> script will add the "
15013
"necessary users, groups, and LDAP objects required for Samba. It is a good "
15014
"idea to make a backup LDAP Data Interchange Format (LDIF) file with "
15015
"<application>slapcat</application> before executing the command:"
15016
msgstr ""
15017
15018
#: serverguide/C/network-auth.xml:1801(command)
15019
msgid "sudo slapcat -l backup.ldif"
15020
msgstr ""
15021
15022
#: serverguide/C/network-auth.xml:1807(para)
15023
msgid ""
15024
"Once you have a current backup execute <application>smbldap-"
15025
"populate</application> by entering:"
15026
msgstr ""
15027
15028
#: serverguide/C/network-auth.xml:1812(command)
15029
msgid "sudo smbldap-populate"
15030
msgstr ""
15031
15032
#: serverguide/C/network-auth.xml:1816(para)
15033
msgid ""
15034
"You can create an LDIF file containing the new Samba objects by executing "
15035
"<command>sudo smbldap-populate -e samba.ldif</command>. This allows you to "
15036
"look over the changes making sure everything is correct."
15037
msgstr ""
15038
15039
#: serverguide/C/network-auth.xml:1824(para)
15040
msgid ""
15041
"Your LDAP directory now has the necessary domain information to authenticate "
15042
"Samba users."
15043
msgstr ""
15044
15045
#: serverguide/C/network-auth.xml:1830(title)
15046
msgid "Samba Configuration"
15047
msgstr ""
15048
15049
#: serverguide/C/network-auth.xml:1832(para)
15050
msgid ""
15051
"There a multiple ways to configure Samba for details on some common "
15052
"configurations see <xref linkend=\"windows-networking\"/>. To configure "
15053
"Samba to use LDAP, edit the main Samba configuration file "
15054
"<filename>/etc/samba/smb.conf</filename> commenting the <emphasis>passdb "
15055
"backend</emphasis> option and adding the following:"
15056
msgstr ""
15057
15058
#: serverguide/C/network-auth.xml:1838(programlisting)
15059
#, no-wrap
15060
msgid ""
15061
"\n"
15062
"# passdb backend = tdbsam\n"
15063
"\n"
15064
"# LDAP Settings\n"
15065
" passdb backend = ldapsam:ldap://hostname\n"
15066
" ldap suffix = dc=example,dc=com\n"
15067
" ldap user suffix = ou=People\n"
15068
" ldap group suffix = ou=Groups\n"
15069
" ldap machine suffix = ou=Computers\n"
15070
" ldap idmap suffix = ou=Idmap\n"
15071
" ldap admin dn = cn=admin,dc=example,dc=com\n"
15072
" ldap ssl = start tls\n"
15073
" ldap passwd sync = yes\n"
15074
"...\n"
15075
" add machine script = sudo /usr/sbin/smbldap-useradd -t 0 -w \"%u\"\n"
15076
msgstr ""
15077
15078
#: serverguide/C/network-auth.xml:1855(para)
15079
msgid "Restart <application>samba</application> to enable the new settings:"
15080
msgstr ""
15081
15082
#: serverguide/C/network-auth.xml:1863(para)
15083
msgid ""
15084
"Now Samba needs to know the LDAP admin password. From a terminal prompt "
15085
"enter:"
15086
msgstr ""
15087
15088
#: serverguide/C/network-auth.xml:1868(command)
15089
msgid "sudo smbpasswd -w secret"
15090
msgstr ""
15091
15092
#: serverguide/C/network-auth.xml:1872(para)
15093
msgid ""
15094
"Replacing <emphasis role=\"italic\">secret</emphasis> with your LDAP admin "
15095
"password."
15096
msgstr ""
15097
15098
#: serverguide/C/network-auth.xml:1877(para)
15099
msgid ""
15100
"If you currently have users in LDAP, and you want them to authenticate using "
15101
"Samba, they will need some Samba attributes defined in the "
15102
"<filename>samba.schema</filename> file. Add the Samba attributes to existing "
15103
"users using the <application>smbpasswd</application> utility, replacing "
15104
"<emphasis role=\"italic\">username</emphasis> with an actual user:"
15105
msgstr ""
15106
15107
#: serverguide/C/network-auth.xml:1885(command)
15108
msgid "sudo smbpasswd -a username"
15109
msgstr ""
15110
15111
#: serverguide/C/network-auth.xml:1888(para)
15112
msgid "You will then be asked to enter the user's password."
15113
msgstr ""
15114
15115
#: serverguide/C/network-auth.xml:1892(para)
15116
msgid ""
15117
"To add new user, group, and machine accounts use the utilities from the "
15118
"<application>smbldap-tools</application> package. Here are some examples:"
15119
msgstr ""
15120
15121
#: serverguide/C/network-auth.xml:1899(para)
15122
msgid ""
15123
"To add a new user to LDAP with Samba attributes enter the following, "
15124
"replacing username with an actual username:"
15125
msgstr ""
15126
15127
#: serverguide/C/network-auth.xml:1903(command)
15128
msgid "sudo smbldap-useradd -a -P username"
15129
msgstr ""
15130
15131
#: serverguide/C/network-auth.xml:1905(para)
15132
msgid ""
15133
"The <emphasis>-a</emphasis> option adds the Samba attributes, and the "
15134
"<emphasis>-P</emphasis> options calls the <application>smbldap-"
15135
"passwd</application> utility after the user is created allowing you to enter "
15136
"a password for the user."
15137
msgstr ""
15138
15139
#: serverguide/C/network-auth.xml:1911(para)
15140
msgid "To remove a user from the directory enter:"
15141
msgstr ""
15142
15143
#: serverguide/C/network-auth.xml:1915(command)
15144
msgid "sudo smbldap-userdel username"
15145
msgstr ""
15146
15147
#: serverguide/C/network-auth.xml:1917(para)
15148
msgid ""
15149
"The <application>smbldap-userdel</application> utility also has a <emphasis>-"
15150
"r</emphasis> option to remove the user's home directory."
15151
msgstr ""
15152
15153
#: serverguide/C/network-auth.xml:1922(para)
15154
msgid ""
15155
"Use <application>smbldap-groupadd</application> to add a group, replacing "
15156
"groupname with an appropriate group:"
15157
msgstr ""
15158
15159
#: serverguide/C/network-auth.xml:1926(command)
15160
msgid "sudo smbldap-groupadd -a groupname"
15161
msgstr ""
15162
15163
#: serverguide/C/network-auth.xml:1928(para)
15164
msgid ""
15165
"Similar to <application>smbldap-useradd</application>, the <emphasis>-"
15166
"a</emphasis> adds the Samba attributes."
15167
msgstr ""
15168
15169
#: serverguide/C/network-auth.xml:1933(para)
15170
msgid ""
15171
"To add a user to a group use <application>smbldap-groupmod</application>:"
15172
msgstr ""
15173
15174
#: serverguide/C/network-auth.xml:1937(command)
15175
msgid "sudo smbldap-groupmod -m username groupname"
15176
msgstr ""
15177
15178
#: serverguide/C/network-auth.xml:1939(para)
15179
msgid ""
15180
"Be sure to replace <emphasis>username</emphasis> with a real user. Also, the "
15181
"<emphasis>-m</emphasis> option can add more than one user at a time by "
15182
"listing them in <emphasis>comma separated</emphasis> format."
15183
msgstr ""
15184
15185
#: serverguide/C/network-auth.xml:1945(para)
15186
msgid ""
15187
"<application>smbldap-groupmod</application> can also be used to remove a "
15188
"user from a group:"
15189
msgstr ""
15190
15191
#: serverguide/C/network-auth.xml:1949(command)
15192
msgid "sudo smbldap-groupmod -x username groupname"
15193
msgstr ""
15194
15195
#: serverguide/C/network-auth.xml:1953(para)
15196
msgid ""
15197
"Additionally, the <application>smbldap-useradd</application> utility can add "
15198
"Samba machine accounts:"
15199
msgstr ""
15200
15201
#: serverguide/C/network-auth.xml:1957(command)
15202
msgid "sudo smbldap-useradd -t 0 -w username"
15203
msgstr ""
15204
15205
#: serverguide/C/network-auth.xml:1959(para)
15206
msgid ""
15207
"Replace <emphasis>username</emphasis> with the name of the workstation. The "
15208
"<emphasis>-t 0</emphasis> option creates the machine account without a "
15209
"delay, while the <emphasis>-w</emphasis> option specifies the user as a "
15210
"machine account. Also, note the <emphasis>add machine script</emphasis> "
15211
"option in <filename>/etc/samba/smb.conf</filename> was changed to use "
15212
"<application>smbldap-useradd</application>."
15213
msgstr ""
15214
15215
#: serverguide/C/network-auth.xml:1968(para)
15216
msgid ""
15217
"There are more useful utilities and options in the <application>smbldap-"
15218
"tools</application> package. The man page for each utility provides more "
15219
"details."
15220
msgstr ""
15221
15222
#: serverguide/C/network-auth.xml:1979(para)
15223
msgid ""
15224
"There are multiple places where LDAP and Samba is documented in the <ulink "
15225
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
15226
"Collection</ulink>."
15227
msgstr ""
15228
15229
#: serverguide/C/network-auth.xml:1985(para)
15230
msgid ""
15231
"Specifically see the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
15232
"HOWTO-Collection/passdb.html\">passdb section</ulink>."
15233
msgstr ""
15234
15235
#: serverguide/C/network-auth.xml:1991(para)
15236
msgid ""
15237
"Another good site is <ulink url=\"http://www.iallanis.info/smbldap-"
15238
"tools/docs/samba-ldap-howto/\">Samba OpenLDAP HOWTO</ulink>."
15239
msgstr ""
15240
15241
#: serverguide/C/network-auth.xml:1997(para)
15242
msgid ""
15243
"Again, for more information on <application>smbldap-tools</application> see "
15244
"the man pages: <command>man smbldap-useradd</command>, <command>man smbldap-"
15245
"groupadd</command>, <command>man smbldap-populate</command>, etc."
15246
msgstr ""
15247
15248
#: serverguide/C/network-auth.xml:2004(para)
15249
msgid ""
15250
"Also, there is a list of <ulink "
15251
"url=\"https://help.ubuntu.com/community/Samba#samba-ldap\">Ubuntu "
15252
"wiki</ulink> articles with more information."
15253
msgstr ""
15254
15255
#: serverguide/C/network-auth.xml:2013(title)
15256
msgid "Kerberos"
15257
msgstr "Kerberos"
15258
15259
#: serverguide/C/network-auth.xml:2015(para)
15260
msgid ""
15261
"<application>Kerberos</application> is a network authentication system based "
15262
"on the principal of a trusted third party. The other two parties being the "
15263
"user and the service the user wishes to authenticate to. Not all services "
15264
"and applications can use Kerberos, but for those that can, it brings the "
15265
"network environment one step closer to being Single Sign On (SSO)."
15266
msgstr ""
15267
15268
#: serverguide/C/network-auth.xml:2021(para)
15269
msgid ""
15270
"This section covers installation and configuration of a Kerberos server, and "
15271
"some example client configurations."
15272
msgstr ""
15273
15274
#: serverguide/C/network-auth.xml:2028(para)
15275
msgid ""
15276
"If you are new to Kerberos there are a few terms that are good to understand "
15277
"before setting up a Kerberos server. Most of the terms will relate to things "
15278
"you may be familiar with in other environments:"
15279
msgstr ""
15280
15281
#: serverguide/C/network-auth.xml:2035(para)
15282
msgid ""
15283
"<emphasis>Principal:</emphasis> any users, computers, and services provided "
15284
"by servers need to be defined as Kerberos Principals."
15285
msgstr ""
15286
15287
#: serverguide/C/network-auth.xml:2040(para)
15288
msgid ""
15289
"<emphasis>Instances:</emphasis> are used for service principals and special "
15290
"administrative principals."
15291
msgstr ""
15292
15293
#: serverguide/C/network-auth.xml:2045(para)
15294
msgid ""
15295
"<emphasis>Realms:</emphasis> the unique realm of control provided by the "
15296
"Kerberos installation. Usually the DNS domain converted to uppercase "
15297
"(EXAMPLE.COM)."
15298
msgstr ""
15299
15300
#: serverguide/C/network-auth.xml:2051(para)
15301
msgid ""
15302
"<emphasis>Key Distribution Center:</emphasis> (KDC) consist of three parts, "
15303
"a database of all principals, the authentication server, and the ticket "
15304
"granting server. For each realm there must be at least one KDC."
15305
msgstr ""
15306
15307
#: serverguide/C/network-auth.xml:2057(para)
15308
msgid ""
15309
"<emphasis>Ticket Granting Ticket:</emphasis> issued by the Authentication "
15310
"Server (AS), the Ticket Granting Ticket (TGT) is encrypted in the user's "
15311
"password which is known only to the user and the KDC."
15312
msgstr ""
15313
15314
#: serverguide/C/network-auth.xml:2063(para)
15315
msgid ""
15316
"<emphasis>Ticket Granting Server:</emphasis> (TGS) issues service tickets to "
15317
"clients upon request."
15318
msgstr ""
15319
15320
#: serverguide/C/network-auth.xml:2068(para)
15321
msgid ""
15322
"<emphasis>Tickets:</emphasis> confirm the identity of the two principals. "
15323
"One principal being a user and the other a service requested by the user. "
15324
"Tickets establish an encryption key used for secure communication during the "
15325
"authenticated session."
15326
msgstr ""
15327
15328
#: serverguide/C/network-auth.xml:2074(para)
15329
msgid ""
15330
"<emphasis>Keytab Files:</emphasis> are files extracted from the KDC "
15331
"principal database and contain the encryption key for a service or host."
15332
msgstr ""
15333
15334
#: serverguide/C/network-auth.xml:2081(para)
15335
msgid ""
15336
"To put the pieces together, a Realm has at least one KDC, preferably two for "
15337
"redundancy, which contains a database of Principals. When a user principal "
15338
"logs into a workstation, configured for Kerberos authentication, the KDC "
15339
"issues a Ticket Granting Ticket (TGT). If the user supplied credentials "
15340
"match, the user is authenticated and can then request tickets for Kerberized "
15341
"services from the Ticket Granting Server (TGS). The service tickets allow "
15342
"the user to authenticate to the service without entering another username "
15343
"and password."
15344
msgstr ""
15345
15346
#: serverguide/C/network-auth.xml:2090(title)
15347
msgid "Kerberos Server"
15348
msgstr ""
15349
15350
#: serverguide/C/network-auth.xml:2094(para)
15351
msgid ""
15352
"Before installing the Kerberos server a properly configured DNS server is "
15353
"needed for your domain. Since the Kerberos Realm by convention matches the "
15354
"domain name, this section uses the <emphasis>example.com</emphasis> domain "
15355
"configured in <xref linkend=\"dns-primarymaster-configuration\"/>."
15356
msgstr ""
15357
15358
#: serverguide/C/network-auth.xml:2100(para)
15359
msgid ""
15360
"Also, Kerberos is a time sensitive protocol. So if the local system time "
15361
"between a client machine and the server differs by more than five minutes "
15362
"(by default), the workstation will not be able to authenticate. To correct "
15363
"the problem all hosts should have their time synchronized using the "
15364
"<emphasis>Network Time Protocol (NTP)</emphasis>. For details on setting up "
15365
"NTP see <xref linkend=\"NTP\"/>."
15366
msgstr ""
15367
15368
#: serverguide/C/network-auth.xml:2107(para)
15369
msgid ""
15370
"The first step in installing a Kerberos Realm is to install the "
15371
"<application>krb5-kdc</application> and <application>krb5-admin-"
15372
"server</application> packages. From a terminal enter:"
15373
msgstr ""
15374
15375
#: serverguide/C/network-auth.xml:2113(command) serverguide/C/network-auth.xml:2288(command)
15376
msgid "sudo apt-get install krb5-kdc krb5-admin-server"
15377
msgstr ""
15378
15379
#: serverguide/C/network-auth.xml:2116(para)
15380
msgid ""
15381
"You will be asked at the end of the install to supply a name for the "
15382
"Kerberos and Admin servers, which may or may not be the same server, for the "
15383
"realm."
15384
msgstr ""
15385
15386
#: serverguide/C/network-auth.xml:2121(para)
15387
msgid ""
15388
"Next, create the new realm with the <application>kdb5_newrealm</application> "
15389
"utility:"
15390
msgstr ""
15391
15392
#: serverguide/C/network-auth.xml:2126(command)
15393
msgid "sudo krb5_newrealm"
15394
msgstr ""
15395
15396
#: serverguide/C/network-auth.xml:2133(para)
15397
msgid ""
15398
"The questions asked during installation are used to configure the "
15399
"<filename>/etc/krb5.conf</filename> file. If you need to adjust the Key "
15400
"Distribution Center (KDC) settings simply edit the file and restart the "
15401
"<application>krb5-kdc</application> daemon."
15402
msgstr ""
15403
15404
#: serverguide/C/network-auth.xml:2141(para)
15405
msgid ""
15406
"Now that the KDC running an admin user is needed. It is recommended to use a "
15407
"different username from your everyday username. Using the "
15408
"<application>kadmin.local</application> utility in a terminal prompt enter:"
15409
msgstr ""
15410
15411
#: serverguide/C/network-auth.xml:2147(command) serverguide/C/network-auth.xml:2943(command)
15412
msgid "sudo kadmin.local"
15413
msgstr ""
15414
15415
#: serverguide/C/network-auth.xml:2148(computeroutput)
15416
#, no-wrap
15417
msgid ""
15418
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
15419
"kadmin.local:"
15420
msgstr ""
15421
15422
#: serverguide/C/network-auth.xml:2149(userinput)
15423
#, no-wrap
15424
msgid " addprinc steve/admin"
15425
msgstr ""
15426
15427
#: serverguide/C/network-auth.xml:2150(computeroutput)
15428
#, no-wrap
15429
msgid ""
15430
"WARNING: no policy specified for steve/admin@EXAMPLE.COM; defaulting to no "
15431
"policy\n"
15432
"Enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15433
"Re-enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15434
"Principal \"steve/admin@EXAMPLE.COM\" created.\n"
15435
"kadmin.local:"
15436
msgstr ""
15437
15438
#: serverguide/C/network-auth.xml:2154(userinput)
15439
#, no-wrap
15440
msgid " quit"
15441
msgstr ""
15442
15443
#: serverguide/C/network-auth.xml:2157(para)
15444
msgid ""
15445
"In the above example <emphasis role=\"italic\">steve</emphasis> is the "
15446
"<emphasis>Principal</emphasis>, <emphasis role=\"italic\">/admin</emphasis> "
15447
"is an <emphasis>Instance</emphasis>, and <emphasis "
15448
"role=\"italic\">@EXAMPLE.COM</emphasis> signifies the realm. The <emphasis "
15449
"role=\"italic\">\"every day\"</emphasis> Principal would be "
15450
"<emphasis>steve@EXAMPLE.COM</emphasis>, and should have only normal user "
15451
"rights."
15452
msgstr ""
15453
15454
#: serverguide/C/network-auth.xml:2165(para)
15455
msgid ""
15456
"Replace <emphasis>EXAMPLE.COM</emphasis> and <emphasis>steve</emphasis> with "
15457
"your Realm and admin username."
15458
msgstr ""
15459
15460
#: serverguide/C/network-auth.xml:2173(para)
15461
msgid ""
15462
"Next, the new admin user needs to have the appropriate Access Control List "
15463
"(ACL) permissions. The permissions are configured in the "
15464
"<filename>/etc/krb5kdc/kadm5.acl</filename> file:"
15465
msgstr ""
15466
15467
#: serverguide/C/network-auth.xml:2178(programlisting)
15468
#, no-wrap
15469
msgid ""
15470
"\n"
15471
"steve/admin@EXAMPLE.COM *\n"
15472
msgstr ""
15473
15474
#: serverguide/C/network-auth.xml:2182(para)
15475
msgid ""
15476
"This entry grants <emphasis>steve/admin</emphasis> the ability to perform "
15477
"any operation on all principals in the realm."
15478
msgstr ""
15479
15480
#: serverguide/C/network-auth.xml:2189(para)
15481
msgid ""
15482
"Now restart the <application>krb5-admin-server</application> for the new ACL "
15483
"to take affect:"
15484
msgstr ""
15485
15486
#: serverguide/C/network-auth.xml:2194(command)
15487
msgid "sudo /etc/init.d/krb5-admin-server restart"
15488
msgstr ""
15489
15490
#: serverguide/C/network-auth.xml:2200(para)
15491
msgid ""
15492
"The new user principal can be tested using the <application>kinit "
15493
"utility</application>:"
15494
msgstr ""
15495
15496
#: serverguide/C/network-auth.xml:2205(command)
15497
msgid "kinit steve/admin"
15498
msgstr ""
15499
15500
#: serverguide/C/network-auth.xml:2206(computeroutput)
15501
#, no-wrap
15502
msgid "steve/admin@EXAMPLE.COM's Password:"
15503
msgstr ""
15504
15505
#: serverguide/C/network-auth.xml:2209(para)
15506
msgid ""
15507
"After entering the password, use the <application>klist</application> "
15508
"utility to view information about the Ticket Granting Ticket (TGT):"
15509
msgstr ""
15510
15511
#: serverguide/C/network-auth.xml:2215(command) serverguide/C/network-auth.xml:2550(command)
15512
msgid "klist"
15513
msgstr ""
15514
15515
#: serverguide/C/network-auth.xml:2216(computeroutput)
15516
#, no-wrap
15517
msgid ""
15518
"Credentials cache: FILE:/tmp/krb5cc_1000\n"
15519
" Principal: steve/admin@EXAMPLE.COM\n"
15520
"\n"
15521
" Issued Expires Principal\n"
15522
"Jul 13 17:53:34 Jul 14 03:53:34 krbtgt/EXAMPLE.COM@EXAMPLE.COM"
15523
msgstr ""
15524
15525
#: serverguide/C/network-auth.xml:2223(para)
15526
msgid ""
15527
"You may need to add an entry into the <filename>/etc/hosts</filename> for "
15528
"the KDC. For example:"
15529
msgstr ""
15530
15531
#: serverguide/C/network-auth.xml:2227(programlisting)
15532
#, no-wrap
15533
msgid ""
15534
"\n"
15535
"192.168.0.1 kdc01.example.com kdc01\n"
15536
msgstr ""
15537
15538
#: serverguide/C/network-auth.xml:2231(para)
15539
msgid ""
15540
"Replacing <emphasis>192.168.0.1</emphasis> with the IP address of your KDC."
15541
msgstr ""
15542
15543
#: serverguide/C/network-auth.xml:2238(para)
15544
msgid ""
15545
"In order for clients to determine the KDC for the Realm some DNS SRV records "
15546
"are needed. Add the following to "
15547
"<filename>/etc/named/db.example.com</filename>:"
15548
msgstr ""
15549
15550
#: serverguide/C/network-auth.xml:2243(programlisting)
15551
#, no-wrap
15552
msgid ""
15553
"\n"
15554
"_kerberos._udp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15555
"_kerberos._tcp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15556
"_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15557
"_kerberos._tcp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15558
"_kerberos-adm._tcp.EXAMPLE.COM. IN SRV 1 0 749 kdc01.example.com.\n"
15559
"_kpasswd._udp.EXAMPLE.COM. IN SRV 1 0 464 kdc01.example.com.\n"
15560
msgstr ""
15561
15562
#: serverguide/C/network-auth.xml:2253(para)
15563
msgid ""
15564
"Replace <emphasis>EXAMPLE.COM</emphasis>, <emphasis>kdc01</emphasis>, and "
15565
"<emphasis>kdc02</emphasis> with your domain name, primary KDC, and secondary "
15566
"KDC."
15567
msgstr ""
15568
15569
#: serverguide/C/network-auth.xml:2259(para)
15570
msgid ""
15571
"See <xref linkend=\"dns\"/> for detailed instructions on setting up DNS."
15572
msgstr ""
15573
15574
#: serverguide/C/network-auth.xml:2266(para)
15575
msgid "Your new Kerberos Realm is now ready to authenticate clients."
15576
msgstr ""
15577
15578
#: serverguide/C/network-auth.xml:2273(title)
15579
msgid "Secondary KDC"
15580
msgstr ""
15581
15582
#: serverguide/C/network-auth.xml:2275(para)
15583
msgid ""
15584
"Once you have one Key Distribution Center (KDC) on your network, it is good "
15585
"practice to have a Secondary KDC in case the primary becomes unavailable."
15586
msgstr ""
15587
15588
#: serverguide/C/network-auth.xml:2283(para)
15589
msgid ""
15590
"First, install the packages, and when asked for the Kerberos and Admin "
15591
"server names enter the name of the Primary KDC:"
15592
msgstr ""
15593
15594
#: serverguide/C/network-auth.xml:2294(para)
15595
msgid ""
15596
"Once you have the packages installed, create the Secondary KDC's host "
15597
"principal. From a terminal prompt, enter:"
15598
msgstr ""
15599
15600
#: serverguide/C/network-auth.xml:2299(command)
15601
msgid "kadmin -q \"addprinc -randkey host/kdc02.example.com\""
15602
msgstr ""
15603
15604
#: serverguide/C/network-auth.xml:2303(para)
15605
msgid ""
15606
"After, issuing any <application>kadmin</application> commands you will be "
15607
"prompted for your <emphasis>username/admin@EXAMPLE.COM</emphasis> principal "
15608
"password."
15609
msgstr ""
15610
15611
#: serverguide/C/network-auth.xml:2312(para)
15612
msgid "Extract the <emphasis>keytab</emphasis> file:"
15613
msgstr ""
15614
15615
#: serverguide/C/network-auth.xml:2317(command)
15616
msgid "kadmin -q \"ktadd -k keytab.kdc02 host/kdc02.example.com\""
15617
msgstr ""
15618
15619
#: serverguide/C/network-auth.xml:2323(para)
15620
msgid ""
15621
"There should now be a <filename>keytab.kdc02</filename> in the current "
15622
"directory, move the file to <filename>/etc/krb5.keytab</filename>:"
15623
msgstr ""
15624
15625
#: serverguide/C/network-auth.xml:2329(command)
15626
msgid "sudo mv keytab.kdc02 /etc/krb5.keytab"
15627
msgstr ""
15628
15629
#: serverguide/C/network-auth.xml:2333(para)
15630
msgid ""
15631
"If the path to the <filename>keytab.kdc02</filename> file is different "
15632
"adjust accordingly."
15633
msgstr ""
15634
15635
#: serverguide/C/network-auth.xml:2338(para)
15636
msgid ""
15637
"Also, you can list the principals in a Keytab file, which can be useful when "
15638
"troubleshooting, using the <application>klist</application> utility:"
15639
msgstr ""
15640
15641
#: serverguide/C/network-auth.xml:2344(command)
15642
msgid "sudo klist -k /etc/krb5.keytab"
15643
msgstr ""
15644
15645
#: serverguide/C/network-auth.xml:2350(para)
15646
msgid ""
15647
"Next, there needs to be a <filename>kpropd.acl</filename> file on each KDC "
15648
"that lists all KDCs for the Realm. For example, on both primary and "
15649
"secondary KDC, create <filename>/etc/krb5kdc/kpropd.acl</filename>:"
15650
msgstr ""
15651
15652
#: serverguide/C/network-auth.xml:2355(programlisting)
15653
#, no-wrap
15654
msgid ""
15655
"\n"
15656
"host/kdc01.example.com@EXAMPLE.COM\n"
15657
"host/kdc02.example.com@EXAMPLE.COM\n"
15658
msgstr ""
15659
15660
#: serverguide/C/network-auth.xml:2363(para)
15661
msgid "Create an empty database on the <emphasis>Secondary KDC</emphasis>:"
15662
msgstr ""
15663
15664
#: serverguide/C/network-auth.xml:2368(command)
15665
msgid "sudo kdb5_util -s create"
15666
msgstr ""
15667
15668
#: serverguide/C/network-auth.xml:2374(para)
15669
msgid ""
15670
"Now start the <application>kpropd</application> daemon, which listens for "
15671
"connections from the <application>kprop</application> utility. "
15672
"<application>kprop</application> is used to transfer dump files:"
15673
msgstr ""
15674
15675
#: serverguide/C/network-auth.xml:2381(command)
15676
msgid "sudo kpropd -S"
15677
msgstr ""
15678
15679
#: serverguide/C/network-auth.xml:2387(para)
15680
msgid ""
15681
"From a terminal on the <emphasis>Primary KDC</emphasis>, create a dump file "
15682
"of the principal database:"
15683
msgstr ""
15684
15685
#: serverguide/C/network-auth.xml:2392(command)
15686
msgid "sudo kdb5_util dump /var/lib/krb5kdc/dump"
15687
msgstr ""
15688
15689
#: serverguide/C/network-auth.xml:2398(para)
15690
msgid ""
15691
"Extract the Primary KDC's <emphasis>keytab</emphasis> file and copy it to "
15692
"<filename>/etc/krb5.keytab</filename>:"
15693
msgstr ""
15694
15695
#: serverguide/C/network-auth.xml:2403(command)
15696
msgid "kadmin -q \"ktadd -k keytab.kdc01 host/kdc01.example.com\""
15697
msgstr ""
15698
15699
#: serverguide/C/network-auth.xml:2404(command)
15700
msgid "sudo mv keytab.kdc01 /etc/kr5b.keytab"
15701
msgstr ""
15702
15703
#: serverguide/C/network-auth.xml:2408(para)
15704
msgid ""
15705
"Make sure there is a <emphasis>host</emphasis> for "
15706
"<emphasis>kdc01.example.com</emphasis> before extracting the Keytab."
15707
msgstr ""
15708
15709
#: serverguide/C/network-auth.xml:2416(para)
15710
msgid ""
15711
"Using the <application>kprop</application> utility push the database to the "
15712
"Secondary KDC:"
15713
msgstr ""
15714
15715
#: serverguide/C/network-auth.xml:2421(command)
15716
msgid "sudo kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com"
15717
msgstr ""
15718
15719
#: serverguide/C/network-auth.xml:2425(para)
15720
msgid ""
15721
"There should be a <emphasis>SUCCEEDED</emphasis> message if the propagation "
15722
"worked. If there is an error message check "
15723
"<filename>/var/log/syslog</filename> on the secondary KDC for more "
15724
"information."
15725
msgstr ""
15726
15727
#: serverguide/C/network-auth.xml:2431(para)
15728
msgid ""
15729
"You may also want to create a <application>cron</application> job to "
15730
"periodically update the database on the Secondary KDC. For example, the "
15731
"following will push the database every hour:"
15732
msgstr ""
15733
15734
#: serverguide/C/network-auth.xml:2436(programlisting)
15735
#, no-wrap
15736
msgid ""
15737
"\n"
15738
"# m h dom mon dow command\n"
15739
"0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && "
15740
"/usr/sbin/kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com\n"
15741
msgstr ""
15742
15743
#: serverguide/C/network-auth.xml:2444(para)
15744
msgid ""
15745
"Back on the <emphasis>Secondary KDC</emphasis>, create a "
15746
"<emphasis>stash</emphasis> file to hold the Kerberos master key:"
15747
msgstr ""
15748
15749
#: serverguide/C/network-auth.xml:2450(command)
15750
msgid "sudo kdb5_util stash"
15751
msgstr ""
15752
15753
#: serverguide/C/network-auth.xml:2456(para)
15754
msgid ""
15755
"Finally, start the <application>krb5-kdc</application> daemon on the "
15756
"Secondary KDC:"
15757
msgstr ""
15758
15759
#: serverguide/C/network-auth.xml:2461(command) serverguide/C/network-auth.xml:3073(command)
15760
msgid "sudo /etc/init.d/krb5-kdc start"
15761
msgstr ""
15762
15763
#: serverguide/C/network-auth.xml:2467(para)
15764
msgid ""
15765
"The <emphasis>Secondary KDC</emphasis> should now be able to issue tickets "
15766
"for the Realm. You can test this by stopping the <application>krb5-"
15767
"kdc</application> daemon on the Primary KDC, then use "
15768
"<application>kinit</application> to request a ticket. If all goes well you "
15769
"should receive a ticket from the Secondary KDC."
15770
msgstr ""
15771
15772
#: serverguide/C/network-auth.xml:2475(title)
15773
msgid "Kerberos Linux Client"
15774
msgstr ""
15775
15776
#: serverguide/C/network-auth.xml:2477(para)
15777
msgid ""
15778
"This section covers configuring a Linux system as a "
15779
"<application>Kerberos</application> client. This will allow access to any "
15780
"kerberized services once a user has successfully logged into the system."
15781
msgstr ""
15782
15783
#: serverguide/C/network-auth.xml:2485(para)
15784
msgid ""
15785
"In order to authenticate to a Kerberos Realm, the <application>krb5-"
15786
"user</application> and <application>libpam-krb5</application> packages are "
15787
"needed, along with a few others that are not strictly necessary but make "
15788
"life easier. To install the packages enter the following in a terminal "
15789
"prompt:"
15790
msgstr ""
15791
15792
#: serverguide/C/network-auth.xml:2492(command)
15793
msgid ""
15794
"sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config"
15795
msgstr ""
15796
15797
#: serverguide/C/network-auth.xml:2495(para)
15798
msgid ""
15799
"The <application>auth-client-config</application> package allows simple "
15800
"configuration of PAM for authentication from multiple sources, and the "
15801
"<application>libpam-ccreds</application> will cache authentication "
15802
"credentials allowing you to login in case the Key Distribution Center (KDC) "
15803
"is unavailable. This package is also useful for laptops that may "
15804
"authenticate using Kerberos while on the corporate network, but will need to "
15805
"be accessed off the network as well."
15806
msgstr ""
15807
15808
#: serverguide/C/network-auth.xml:2506(para)
15809
msgid "To configure the client in a terminal enter:"
15810
msgstr ""
15811
15812
#: serverguide/C/network-auth.xml:2511(command)
15813
msgid "sudo dpkg-reconfigure krb5-config"
15814
msgstr ""
15815
15816
#: serverguide/C/network-auth.xml:2514(para)
15817
msgid ""
15818
"You will then be prompted to enter the name of the Kerberos Realm. Also, if "
15819
"you don't have DNS configured with Kerberos <emphasis>SRV</emphasis> "
15820
"records, the menu will prompt you for the hostname of the Key Distribution "
15821
"Center (KDC) and Realm Administration server."
15822
msgstr ""
15823
15824
#: serverguide/C/network-auth.xml:2520(para)
15825
msgid ""
15826
"The <application>dpkg-reconfigure</application> adds entries to the "
15827
"<filename>/etc/krb5.conf</filename> file for your Realm. You should have "
15828
"entries similar to the following:"
15829
msgstr ""
15830
15831
#: serverguide/C/network-auth.xml:2525(programlisting)
15832
#, no-wrap
15833
msgid ""
15834
"\n"
15835
"[libdefaults]\n"
15836
" default_realm = EXAMPLE.COM\n"
15837
"...\n"
15838
"[realms]\n"
15839
" EXAMPLE.COM = } \n"
15840
" kdc = 192.168.0.1 \n"
15841
" admin_server = 192.168.0.1\n"
15842
" }\n"
15843
msgstr ""
15844
15845
#: serverguide/C/network-auth.xml:2536(para)
15846
msgid ""
15847
"You can test the configuration by requesting a ticket using the "
15848
"<application>kinit</application> utility. For example:"
15849
msgstr ""
15850
15851
#: serverguide/C/network-auth.xml:2541(command)
15852
msgid "kinit steve@EXAMPLE.COM"
15853
msgstr ""
15854
15855
#: serverguide/C/network-auth.xml:2542(computeroutput)
15856
#, no-wrap
15857
msgid "Password for steve@EXAMPLE.COM:"
15858
msgstr ""
15859
15860
#: serverguide/C/network-auth.xml:2545(para)
15861
msgid ""
15862
"When a ticket has been granted, the details can be viewed using "
15863
"<application>klist</application>:"
15864
msgstr ""
15865
15866
#: serverguide/C/network-auth.xml:2551(computeroutput)
15867
#, no-wrap
15868
msgid ""
15869
"Ticket cache: FILE:/tmp/krb5cc_1000\n"
15870
"Default principal: steve@EXAMPLE.COM\n"
15871
"\n"
15872
"Valid starting Expires Service principal\n"
15873
"07/24/08 05:18:56 07/24/08 15:18:56 krbtgt/EXAMPLE.COM@EXAMPLE.COM\n"
15874
" renew until 07/25/08 05:18:57\n"
15875
"\n"
15876
"\n"
15877
"Kerberos 4 ticket cache: /tmp/tkt1000\n"
15878
"klist: You have no tickets cached"
15879
msgstr ""
15880
15881
#: serverguide/C/network-auth.xml:2563(para)
15882
msgid ""
15883
"Next, use the <application>auth-client-config</application> to configure the "
15884
"<application>libpam-krb5</application> module to request a ticket during "
15885
"login:"
15886
msgstr ""
15887
15888
#: serverguide/C/network-auth.xml:2569(command)
15889
msgid "sudo auth-client-config -a -p kerberos_example"
15890
msgstr ""
15891
15892
#: serverguide/C/network-auth.xml:2572(para)
15893
msgid ""
15894
"You will should now receive a ticket upon successful login authentication."
15895
msgstr ""
15896
15897
#: serverguide/C/network-auth.xml:2583(para)
15898
msgid ""
15899
"For more information on Kerberos see the <ulink "
15900
"url=\"http://web.mit.edu/Kerberos/\">MIT Kerberos</ulink> site."
15901
msgstr ""
15902
15903
#: serverguide/C/network-auth.xml:2588(para)
15904
msgid ""
15905
"The <ulink url=\"https://help.ubuntu.com/community/Kerberos\">Ubuntu Wiki "
15906
"Kerberos</ulink> page has more details."
15907
msgstr ""
15908
15909
#: serverguide/C/network-auth.xml:2593(para)
15910
msgid ""
15911
"O'Reilly's <ulink "
15912
"url=\"http://oreilly.com/catalog/9780596004033/\">Kerberos: The Definitive "
15913
"Guide</ulink> is a great reference when setting up Kerberos."
15914
msgstr ""
15915
15916
#: serverguide/C/network-auth.xml:2599(para)
15917
msgid ""
15918
"Also, feel free to stop by the <emphasis>#ubuntu-server</emphasis> IRC "
15919
"channel on <ulink url=\"http://freenode.net/\">Freenode</ulink> if you have "
15920
"Kerberos questions."
15921
msgstr ""
15922
15923
#: serverguide/C/network-auth.xml:2609(title)
15924
msgid "Kerberos and LDAP"
15925
msgstr ""
15926
15927
#: serverguide/C/network-auth.xml:2611(para)
15928
msgid ""
15929
"Replicating a Kerberos principal database between two servers can be "
15930
"complicated, and adds an additional user database to your network. "
15931
"Fortunately, MIT Kerberos can be configured to use an "
15932
"<application>LDAP</application> directory as a principal database. This "
15933
"section covers configuring a primary and secondary kerberos server to use "
15934
"<application>OpenLDAP</application> for the principal database."
15935
msgstr ""
15936
15937
#: serverguide/C/network-auth.xml:2619(title)
15938
msgid "Configuring OpenLDAP"
15939
msgstr ""
15940
15941
#: serverguide/C/network-auth.xml:2621(para)
15942
msgid ""
15943
"First, the necessary <emphasis>schema</emphasis> needs to be loaded on an "
15944
"<application>OpenLDAP</application> server that has network connectivity to "
15945
"the Primary and Secondary KDCs. The rest of this section assumes that you "
15946
"also have LDAP replication configured between at least two servers. For "
15947
"information on setting up OpenLDAP see <xref linkend=\"openldap-server\"/>."
15948
msgstr ""
15949
15950
#: serverguide/C/network-auth.xml:2628(para)
15951
msgid ""
15952
"It is also required to configure OpenLDAP for TLS and SSL connections, so "
15953
"that traffic between the KDC and LDAP server is encrypted. See <xref "
15954
"linkend=\"openldap-tls\"/> for details."
15955
msgstr ""
15956
15957
#: serverguide/C/network-auth.xml:2635(para)
15958
msgid ""
15959
"To load the schema into LDAP, on the LDAP server install the "
15960
"<application>krb5-kdc-ldap</application> package. From a terminal enter:"
15961
msgstr ""
15962
15963
#: serverguide/C/network-auth.xml:2641(command)
15964
msgid "sudo apt-get install krb5-kdc-ldap"
15965
msgstr ""
15966
15967
#: serverguide/C/network-auth.xml:2646(para)
15968
msgid "Next, extract the <filename>kerberos.schema.gz</filename> file:"
15969
msgstr ""
15970
15971
#: serverguide/C/network-auth.xml:2651(command)
15972
msgid "sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz"
15973
msgstr ""
15974
15975
#: serverguide/C/network-auth.xml:2652(command)
15976
msgid ""
15977
"sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/"
15978
msgstr ""
15979
15980
#: serverguide/C/network-auth.xml:2658(para)
15981
msgid ""
15982
"The <emphasis>kerberos</emphasis> schema needs to be added to the "
15983
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
15984
"<application>slapd</application> is also detailed in <xref "
15985
"linkend=\"openldap-configuration\"/>."
15986
msgstr ""
15987
15988
#: serverguide/C/network-auth.xml:2671(programlisting)
15989
#, no-wrap
15990
msgid ""
15991
"\n"
15992
"include /etc/ldap/schema/core.schema\n"
15993
"include /etc/ldap/schema/collective.schema\n"
15994
"include /etc/ldap/schema/corba.schema\n"
15995
"include /etc/ldap/schema/cosine.schema\n"
15996
"include /etc/ldap/schema/duaconf.schema\n"
15997
"include /etc/ldap/schema/dyngroup.schema\n"
15998
"include /etc/ldap/schema/inetorgperson.schema\n"
15999
"include /etc/ldap/schema/java.schema\n"
16000
"include /etc/ldap/schema/misc.schema\n"
16001
"include /etc/ldap/schema/nis.schema\n"
16002
"include /etc/ldap/schema/openldap.schema\n"
16003
"include /etc/ldap/schema/ppolicy.schema\n"
16004
"include /etc/ldap/schema/kerberos.schema\n"
16005
msgstr ""
16006
16007
#: serverguide/C/network-auth.xml:2691(para)
16008
msgid "Create a temporary directory to hold the LDIF files:"
16009
msgstr ""
16010
16011
#: serverguide/C/network-auth.xml:2706(command)
16012
msgid ""
16013
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
16014
"\"cn={12}kerberos,cn=schema,cn=config\" > /tmp/cn=kerberos.ldif"
16015
msgstr ""
16016
16017
#: serverguide/C/network-auth.xml:2716(para)
16018
msgid ""
16019
"Edit the generated <filename>/tmp/cn\\=kerberos.ldif</filename> file, "
16020
"changing the following attributes:"
16021
msgstr ""
16022
16023
#: serverguide/C/network-auth.xml:2720(programlisting)
16024
#, no-wrap
16025
msgid ""
16026
"\n"
16027
"dn: cn=kerberos,cn=schema,cn=config\n"
16028
"...\n"
16029
"cn: kerberos\n"
16030
msgstr ""
16031
16032
#: serverguide/C/network-auth.xml:2726(para)
16033
msgid "And remove the following lines from the end of the file:"
16034
msgstr ""
16035
16036
#: serverguide/C/network-auth.xml:2730(programlisting)
16037
#, no-wrap
16038
msgid ""
16039
"\n"
16040
"structuralObjectClass: olcSchemaConfig\n"
16041
"entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc\n"
16042
"creatorsName: cn=config\n"
16043
"createTimestamp: 20090111203515Z\n"
16044
"entryCSN: 20090111203515.326445Z#000000#000#000000\n"
16045
"modifiersName: cn=config\n"
16046
"modifyTimestamp: 20090111203515Z\n"
16047
msgstr ""
16048
16049
#: serverguide/C/network-auth.xml:2749(para)
16050
msgid "Load the new schema with <application>ldapadd</application>:"
16051
msgstr ""
16052
16053
#: serverguide/C/network-auth.xml:2754(command)
16054
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=kerberos.ldif"
16055
msgstr ""
16056
16057
#: serverguide/C/network-auth.xml:2760(para)
16058
msgid ""
16059
"Add an index for the <emphasis>krb5principalname</emphasis> attribute:"
16060
msgstr ""
16061
16062
#: serverguide/C/network-auth.xml:2765(command) serverguide/C/network-auth.xml:2782(command)
16063
msgid "ldapmodify -x -D cn=admin,cn=config -W"
16064
msgstr ""
16065
16066
#: serverguide/C/network-auth.xml:2767(userinput)
16067
#, no-wrap
16068
msgid ""
16069
"dn: olcDatabase={1}hdb,cn=config\n"
16070
"add: olcDbIndex\n"
16071
"olcDbIndex: krbPrincipalName eq,pres,sub"
16072
msgstr ""
16073
16074
#: serverguide/C/network-auth.xml:2766(computeroutput)
16075
#, no-wrap
16076
msgid ""
16077
"Enter LDAP Password:\n"
16078
"<placeholder-1/>\n"
16079
"\n"
16080
"modifying entry \"olcDatabase={1}hdb,cn=config\""
16081
msgstr ""
16082
16083
#: serverguide/C/network-auth.xml:2777(para)
16084
msgid "Finally, update the Access Control Lists (ACL):"
16085
msgstr ""
16086
16087
#: serverguide/C/network-auth.xml:2784(userinput)
16088
#, no-wrap
16089
msgid ""
16090
"dn: olcDatabase={1}hdb,cn=config\n"
16091
"replace: olcAccess\n"
16092
"olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by "
16093
"dn=\"cn=admin,dc=exampl\n"
16094
" e,dc=com\" write by anonymous auth by self write by * none\n"
16095
"-\n"
16096
"add: olcAccess\n"
16097
"olcAccess: to dn.base=\"\" by * read\n"
16098
"-\n"
16099
"add: olcAccess\n"
16100
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read"
16101
msgstr ""
16102
16103
#: serverguide/C/network-auth.xml:2783(computeroutput)
16104
#, no-wrap
16105
msgid ""
16106
"Enter LDAP Password: \n"
16107
"<placeholder-1/>\n"
16108
"\n"
16109
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
16110
msgstr ""
16111
16112
#: serverguide/C/network-auth.xml:2804(para)
16113
msgid ""
16114
"That's it, your LDAP directory is now ready to serve as a Kerberos principal "
16115
"database."
16116
msgstr ""
16117
16118
#: serverguide/C/network-auth.xml:2810(title)
16119
msgid "Primary KDC Configuration"
16120
msgstr ""
16121
16122
#: serverguide/C/network-auth.xml:2812(para)
16123
msgid ""
16124
"With <application>OpenLDAP</application> configured it is time to configure "
16125
"the KDC."
16126
msgstr ""
16127
16128
#: serverguide/C/network-auth.xml:2818(para)
16129
msgid "First, install the necessary packages, from a terminal enter:"
16130
msgstr ""
16131
16132
#: serverguide/C/network-auth.xml:2823(command) serverguide/C/network-auth.xml:2980(command)
16133
msgid "sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap"
16134
msgstr ""
16135
16136
#: serverguide/C/network-auth.xml:2829(para)
16137
msgid ""
16138
"Now edit <filename>/etc/krb5.conf</filename> adding the following options to "
16139
"under the appropriate sections:"
16140
msgstr ""
16141
16142
#: serverguide/C/network-auth.xml:2833(programlisting)
16143
#, no-wrap
16144
msgid ""
16145
"\n"
16146
"[libdefaults]\n"
16147
" default_realm = EXAMPLE.COM\n"
16148
"\n"
16149
"...\n"
16150
"\n"
16151
"[realms]\n"
16152
" EXAMPLE.COM = {\n"
16153
" kdc = kdc01.example.com\n"
16154
" kdc = kdc02.example.com\n"
16155
" admin_server = kdc01.example.com\n"
16156
" admin_server = kdc02.example.com\n"
16157
" default_domain = example.com\n"
16158
" database_module = openldap_ldapconf\n"
16159
" }\n"
16160
"\n"
16161
"...\n"
16162
"\n"
16163
"[domain_realm]\n"
16164
" .example.com = EXAMPLE.COM\n"
16165
"\n"
16166
"\n"
16167
"...\n"
16168
"\n"
16169
"[dbdefaults]\n"
16170
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16171
"\n"
16172
"[dbmodules]\n"
16173
" openldap_ldapconf = {\n"
16174
" db_library = kldap\n"
16175
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16176
"\n"
16177
" # this object needs to have read rights on\n"
16178
" # the realm container, principal container and realm sub-"
16179
"trees\n"
16180
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16181
"\n"
16182
" # this object needs to have read and write rights on\n"
16183
" # the realm container, principal container and realm sub-"
16184
"trees\n"
16185
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16186
" ldap_servers = ldaps://ldap01.example.com "
16187
"ldaps://ldap02.example.com\n"
16188
" ldap_conns_per_server = 5\n"
16189
" }\n"
16190
msgstr ""
16191
16192
#: serverguide/C/network-auth.xml:2878(para)
16193
msgid ""
16194
"Change <emphasis>example.com</emphasis>, "
16195
"<emphasis>dc=example,dc=com</emphasis>, "
16196
"<emphasis>cn=admin,dc=example,dc=com</emphasis>, and "
16197
"<emphasis>ldap01.example.com</emphasis> to the appropriate domain, LDAP "
16198
"object, and LDAP server for your network."
16199
msgstr ""
16200
16201
#: serverguide/C/network-auth.xml:2887(para)
16202
msgid ""
16203
"Next, use the <application>kdb5_ldap_util</application> utility to create "
16204
"the realm:"
16205
msgstr ""
16206
16207
#: serverguide/C/network-auth.xml:2892(command)
16208
msgid ""
16209
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees "
16210
"dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com"
16211
msgstr ""
16212
16213
#: serverguide/C/network-auth.xml:2898(para)
16214
msgid ""
16215
"Create a stash of the password used to bind to the LDAP server. This "
16216
"password is used by the <emphasis>ldap_kdc_dn</emphasis> and "
16217
"<emphasis>ldap_kadmin_dn</emphasis> options in "
16218
"<filename>/etc/krb5.conf</filename>:"
16219
msgstr ""
16220
16221
#: serverguide/C/network-auth.xml:2904(command) serverguide/C/network-auth.xml:3042(command)
16222
msgid ""
16223
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com stashsrvpw -f "
16224
"/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com"
16225
msgstr ""
16226
16227
#: serverguide/C/network-auth.xml:2910(para)
16228
msgid "Copy the CA certificate from the LDAP server:"
16229
msgstr ""
16230
16231
#: serverguide/C/network-auth.xml:2915(command)
16232
msgid "scp ldap01:/etc/ssl/certs/cacert.pem ."
16233
msgstr ""
16234
16235
#: serverguide/C/network-auth.xml:2916(command)
16236
msgid "sudo cp cacert.pem /etc/ssl/certs"
16237
msgstr ""
16238
16239
#: serverguide/C/network-auth.xml:2919(para)
16240
msgid ""
16241
"And edit <filename>/etc/ldap/ldap.conf</filename> to use the certificate:"
16242
msgstr ""
16243
16244
#: serverguide/C/network-auth.xml:2923(programlisting)
16245
#, no-wrap
16246
msgid ""
16247
"\n"
16248
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
16249
msgstr ""
16250
16251
#: serverguide/C/network-auth.xml:2928(para)
16252
msgid ""
16253
"The certificate will also need to be copied to the Secondary KDC, to allow "
16254
"the connection to the LDAP servers using LDAPS."
16255
msgstr ""
16256
16257
#: serverguide/C/network-auth.xml:2937(para)
16258
msgid ""
16259
"You can now add Kerberos principals to the LDAP database, and they will be "
16260
"copied to any other LDAP servers configured for replication. To add a "
16261
"principal using the <application>kadmin.local</application> utility enter:"
16262
msgstr ""
16263
16264
#: serverguide/C/network-auth.xml:2945(userinput)
16265
#, no-wrap
16266
msgid "addprinc -x dn=\"uid=steve,ou=people,dc=example,dc=com\" steve"
16267
msgstr ""
16268
16269
#: serverguide/C/network-auth.xml:2944(computeroutput)
16270
#, no-wrap
16271
msgid ""
16272
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
16273
"kadmin.local: <placeholder-1/>\n"
16274
"WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy\n"
16275
"Enter password for principal \"steve@EXAMPLE.COM\": \n"
16276
"Re-enter password for principal \"steve@EXAMPLE.COM\": \n"
16277
"Principal \"steve@EXAMPLE.COM\" created."
16278
msgstr ""
16279
16280
#: serverguide/C/network-auth.xml:2952(para)
16281
msgid ""
16282
"There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and "
16283
"krbExtraData attributes added to the "
16284
"<emphasis>uid=steve,ou=people,dc=example,dc=com</emphasis> user object. Use "
16285
"the <application>kinit</application> and <application>klist</application> "
16286
"utilities to test that the user is indeed issued a ticket."
16287
msgstr ""
16288
16289
#: serverguide/C/network-auth.xml:2959(para)
16290
msgid ""
16291
"If the user object is already created the <emphasis>-x dn=\"...\"</emphasis> "
16292
"option is needed to add the Kerberos attributes. Otherwise a new "
16293
"<emphasis>principal</emphasis> object will be created in the realm subtree."
16294
msgstr ""
16295
16296
#: serverguide/C/network-auth.xml:2967(title)
16297
msgid "Secondary KDC Configuration"
16298
msgstr ""
16299
16300
#: serverguide/C/network-auth.xml:2969(para)
16301
msgid ""
16302
"Configuring a Secondary KDC using the LDAP backend is similar to configuring "
16303
"one using the normal Kerberos database."
16304
msgstr ""
16305
16306
#: serverguide/C/network-auth.xml:2975(para)
16307
msgid "First, install the necessary packages. In a terminal enter:"
16308
msgstr ""
16309
16310
#: serverguide/C/network-auth.xml:2986(para)
16311
msgid ""
16312
"Next, edit <filename>/etc/krb5.conf</filename> to use the LDAP backend:"
16313
msgstr ""
16314
16315
#: serverguide/C/network-auth.xml:2990(programlisting)
16316
#, no-wrap
16317
msgid ""
16318
"\n"
16319
"[libdefaults]\n"
16320
" default_realm = EXAMPLE.COM\n"
16321
"\n"
16322
"...\n"
16323
"\n"
16324
"[realms]\n"
16325
" EXAMPLE.COM = {\n"
16326
" kdc = kdc01.example.com\n"
16327
" kdc = kdc02.example.com\n"
16328
" admin_server = kdc01.example.com\n"
16329
" admin_server = kdc02.example.com\n"
16330
" default_domain = example.com\n"
16331
" database_module = openldap_ldapconf\n"
16332
" }\n"
16333
"\n"
16334
"...\n"
16335
"\n"
16336
"[domain_realm]\n"
16337
" .example.com = EXAMPLE.COM\n"
16338
"\n"
16339
"...\n"
16340
"\n"
16341
"[dbdefaults]\n"
16342
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16343
"\n"
16344
"[dbmodules]\n"
16345
" openldap_ldapconf = {\n"
16346
" db_library = kldap\n"
16347
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16348
"\n"
16349
" # this object needs to have read rights on\n"
16350
" # the realm container, principal container and realm sub-"
16351
"trees\n"
16352
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16353
"\n"
16354
" # this object needs to have read and write rights on\n"
16355
" # the realm container, principal container and realm sub-"
16356
"trees\n"
16357
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16358
" ldap_servers = ldaps://ldap01.example.com "
16359
"ldaps://ldap02.example.com\n"
16360
" ldap_conns_per_server = 5\n"
16361
" }\n"
16362
msgstr ""
16363
16364
#: serverguide/C/network-auth.xml:3037(para)
16365
msgid "Create the stash for the LDAP bind password:"
16366
msgstr ""
16367
16368
#: serverguide/C/network-auth.xml:3048(para)
16369
msgid ""
16370
"Now, on the <emphasis>Primary KDC</emphasis> copy the "
16371
"<filename>/etc/krb5kdc/.k5.EXAMPLE.COM</filename><emphasis>Master "
16372
"Key</emphasis> stash to the Secondary KDC. Be sure to copy the file over an "
16373
"encrypted connection such as <application>scp</application>, or on physical "
16374
"media."
16375
msgstr ""
16376
16377
#: serverguide/C/network-auth.xml:3055(command)
16378
msgid "sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM steve@kdc02.example.com:~"
16379
msgstr ""
16380
16381
#: serverguide/C/network-auth.xml:3056(command)
16382
msgid "sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/"
16383
msgstr ""
16384
16385
#: serverguide/C/network-auth.xml:3060(para)
16386
msgid ""
16387
"Again, replace <emphasis>EXAMPLE.COM</emphasis> with your actual realm."
16388
msgstr ""
16389
16390
#: serverguide/C/network-auth.xml:3068(para)
16391
msgid "Finally, start the <application>krb5-kdc</application> daemon:"
16392
msgstr ""
16393
16394
#: serverguide/C/network-auth.xml:3079(para)
16395
msgid ""
16396
"You now have redundant KDCs on your network, and with redundant LDAP servers "
16397
"you should be able to continue to authenticate users if one LDAP server, one "
16398
"Kerberos server, or one LDAP and one Kerberos server become unavailable."
16399
msgstr ""
16400
16401
#: serverguide/C/network-auth.xml:3091(para)
16402
msgid ""
16403
"The <ulink url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16404
"admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend\"> Kerberos Admin "
16405
"Guide</ulink> has some additional details."
16406
msgstr ""
16407
16408
#: serverguide/C/network-auth.xml:3097(para)
16409
msgid ""
16410
"For more information on <application>kdb5_ldap_util</application> see <ulink "
16411
"url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16412
"admin.html#Global-Operations-on-the-Kerberos-LDAP-Database\"> Section "
16413
"5.6</ulink> and the <ulink "
16414
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/kdb5_ldap_util.8.html"
16415
"\">kdb5_ldap_util man page</ulink>."
16416
msgstr ""
16417
16418
#: serverguide/C/network-auth.xml:3105(para)
16419
msgid ""
16420
"Another useful link is the <ulink "
16421
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/krb5.conf.5.html\">kr"
16422
"b5.conf man page</ulink>."
16423
msgstr ""
16424
16425
#: serverguide/C/network-auth.xml:3110(para)
16426
msgid ""
16427
"Also, see the <ulink "
16428
"url=\"https://help.ubuntu.com/community/Kerberos#kerberos-ldap\">Kerberos "
16429
"and LDAP</ulink> Ubuntu wiki page."
16430
msgstr ""
16431
16432
#: serverguide/C/monitoring.xml:13(title)
16433
msgid "Monitoring"
16434
msgstr ""
16435
16436
#: serverguide/C/monitoring.xml:17(para)
16437
msgid ""
16438
"The monitoring of essential servers and services is an important part of "
16439
"system administration. Most network services are monitored for performance, "
16440
"availability, or both. This section will cover installation and "
16441
"configuration of <application>Nagios</application> for availability "
16442
"monitoring, and <application>Munin</application> for performance monitoring."
16443
msgstr ""
16444
16445
#: serverguide/C/monitoring.xml:24(para)
16446
msgid ""
16447
"The examples in this section will use two servers with hostnames "
16448
"<emphasis>server01</emphasis> and <emphasis>server02</emphasis>. "
16449
"<emphasis>Server01</emphasis> will be configured with "
16450
"<application>Nagios</application> to monitor services on itself and "
16451
"<emphasis>server02</emphasis>. Server01 will also be setup with the "
16452
"<application>munin</application> package to gather information from the "
16453
"network. Using the <application>munin-node</application> package, "
16454
"<emphasis>server02</emphasis> will be configured to send information to "
16455
"<emphasis>server01</emphasis>."
16456
msgstr ""
16457
16458
#: serverguide/C/monitoring.xml:33(para)
16459
msgid ""
16460
"Hopefully these simple examples will allow you to monitor additional servers "
16461
"and services on your network."
16462
msgstr ""
16463
16464
#: serverguide/C/monitoring.xml:39(title)
16465
msgid "Nagios"
16466
msgstr ""
16467
16468
#: serverguide/C/monitoring.xml:44(para)
16469
msgid ""
16470
"First, on <emphasis>server01</emphasis> install the "
16471
"<application>nagios</application> package. In a terminal enter:"
16472
msgstr ""
16473
16474
#: serverguide/C/monitoring.xml:50(command)
16475
msgid "sudo apt-get install nagios3 nagios-nrpe-plugin"
16476
msgstr ""
16477
16478
#: serverguide/C/monitoring.xml:53(para)
16479
msgid ""
16480
"You will be asked to enter a password for the "
16481
"<emphasis>nagiosadmin</emphasis> user. The user's credentials are stored in "
16482
"<filename>/etc/nagios3/htpasswd.users</filename>. To change the "
16483
"<emphasis>nagiosadmin</emphasis> password, or add additional users to the "
16484
"Nagios CGI scripts, use the <application>htpasswd</application> that is part "
16485
"of the <application>apache2-utils</application> package."
16486
msgstr ""
16487
16488
#: serverguide/C/monitoring.xml:60(para)
16489
msgid ""
16490
"For example, to change the password for the <emphasis>nagiosadmin</emphasis> "
16491
"user enter:"
16492
msgstr ""
16493
16494
#: serverguide/C/monitoring.xml:65(command)
16495
msgid "sudo htpasswd /etc/nagios3/htpasswd.users nagiosadmin"
16496
msgstr ""
16497
16498
#: serverguide/C/monitoring.xml:68(para)
16499
msgid "To add a user:"
16500
msgstr ""
16501
16502
#: serverguide/C/monitoring.xml:73(command)
16503
msgid "sudo htpasswd /etc/nagios3/htpasswd.users steve"
16504
msgstr ""
16505
16506
#: serverguide/C/monitoring.xml:76(para)
16507
msgid ""
16508
"Next, on <emphasis>server02</emphasis> install the <application>nagios-nrpe-"
16509
"server</application> package. From a terminal on server02 enter:"
16510
msgstr ""
16511
16512
#: serverguide/C/monitoring.xml:82(command)
16513
msgid "sudo apt-get install nagios-nrpe-server"
16514
msgstr ""
16515
16516
#: serverguide/C/monitoring.xml:86(para)
16517
msgid ""
16518
"<application>NRPE</application> allows you to execute local checks on remote "
16519
"hosts. There are other ways of accomplishing this through other Nagios "
16520
"plugins as well as other checks."
16521
msgstr ""
16522
16523
#: serverguide/C/monitoring.xml:94(title)
16524
msgid "Configuration Overview"
16525
msgstr ""
16526
16527
#: serverguide/C/monitoring.xml:96(para)
16528
msgid ""
16529
"There are a couple of directories containing "
16530
"<application>Nagios</application> configuration and check files."
16531
msgstr ""
16532
16533
#: serverguide/C/monitoring.xml:102(para)
16534
msgid ""
16535
"<filename>/etc/nagios3</filename>: contains configuration files for the "
16536
"operation of the <application>nagios</application> daemon, CGI files, hosts, "
16537
"etc."
16538
msgstr ""
16539
16540
#: serverguide/C/monitoring.xml:108(para)
16541
msgid ""
16542
"<filename>/etc/nagios-plugins</filename>: houses configuration files for the "
16543
"service checks."
16544
msgstr ""
16545
16546
#: serverguide/C/monitoring.xml:113(para)
16547
msgid ""
16548
"<filename>/etc/nagios</filename>: on the remote host contains the "
16549
"<application>nagios-nrpe-server</application> configuration files."
16550
msgstr ""
16551
16552
#: serverguide/C/monitoring.xml:118(para)
16553
msgid ""
16554
"<filename>/usr/lib/nagios/plugins/</filename>: where the check binaries are "
16555
"stored. To see the options of a check use the <emphasis>-h</emphasis> option."
16556
msgstr ""
16557
16558
#: serverguide/C/monitoring.xml:123(para)
16559
msgid "For example: <command>/usr/lib/nagios/plugins/check_dhcp -h</command>"
16560
msgstr ""
16561
16562
#: serverguide/C/monitoring.xml:129(para)
16563
msgid ""
16564
"There are a plethora of checks <application>Nagios</application> can be "
16565
"configured to execute for any given host. For this example Nagios will be "
16566
"configured to check disk space, DNS, and a MySQL hostgroup. The DNS check "
16567
"will be on <emphasis>server02</emphasis>, and the MySQL hostgroup will "
16568
"include both <emphasis>server01</emphasis> and <emphasis>server02</emphasis>."
16569
msgstr ""
16570
16571
#: serverguide/C/monitoring.xml:136(para)
16572
msgid ""
16573
"See <xref linkend=\"httpd\"/> for details on setting up Apache, <xref "
16574
"linkend=\"dns\"/> for DNS, and <xref linkend=\"mysql\"/> for MySQL."
16575
msgstr ""
16576
16577
#: serverguide/C/monitoring.xml:141(para)
16578
msgid ""
16579
"Additionally, there are some terms that once explained will hopefully make "
16580
"understanding Nagios configuration easier:"
16581
msgstr ""
16582
16583
#: serverguide/C/monitoring.xml:147(para)
16584
msgid ""
16585
"<emphasis>Host</emphasis>: a server, workstation, network device, etc that "
16586
"is being monitored."
16587
msgstr ""
16588
16589
#: serverguide/C/monitoring.xml:152(para)
16590
msgid ""
16591
"<emphasis>Host Group</emphasis>: a group of similar hosts. For example, you "
16592
"could group all web servers, file server, etc."
16593
msgstr ""
16594
16595
#: serverguide/C/monitoring.xml:157(para)
16596
msgid ""
16597
"<emphasis>Service</emphasis>: the service being monitored on the host. Such "
16598
"as HTTP, DNS, NFS, etc."
16599
msgstr ""
16600
16601
#: serverguide/C/monitoring.xml:162(para)
16602
msgid ""
16603
"<emphasis>Service Group</emphasis>: allows you to group multiple services "
16604
"together. This is useful for grouping multiple HTTP for example."
16605
msgstr ""
16606
16607
#: serverguide/C/monitoring.xml:168(para)
16608
msgid ""
16609
"<emphasis>Contact</emphasis>: person to be notified when an event takes "
16610
"place. Nagios can be configured to send emails, SMS messages, etc."
16611
msgstr ""
16612
16613
#: serverguide/C/monitoring.xml:174(para)
16614
msgid ""
16615
"By default Nagios is configured to check HTTP, disk space, SSH, current "
16616
"users, processes, and load on the <emphasis>localhost</emphasis>. Nagios "
16617
"will also <application>ping</application> check the "
16618
"<emphasis>gateway</emphasis>."
16619
msgstr ""
16620
16621
#: serverguide/C/monitoring.xml:179(para)
16622
msgid ""
16623
"Large Nagios installations can be quite complex to configure. It is usually "
16624
"best to start small, one or two hosts, get things configured the way you "
16625
"like then expand."
16626
msgstr ""
16627
16628
#: serverguide/C/monitoring.xml:194(para)
16629
msgid ""
16630
"First, create a <emphasis>host</emphasis> configuration file for "
16631
"<emphasis>server02</emphasis>. In a terminal enter:"
16632
msgstr ""
16633
16634
#: serverguide/C/monitoring.xml:199(command)
16635
msgid ""
16636
"sudo cp /etc/nagios3/conf.d/localhost_nagios2.cfg "
16637
"/etc/nagios3/conf.d/server02.cfg"
16638
msgstr ""
16639
16640
#: serverguide/C/monitoring.xml:203(para)
16641
msgid ""
16642
"In the above and following command examples, replace "
16643
"<emphasis>\"server01\"</emphasis>, "
16644
"<emphasis>\"server02\"</emphasis><emphasis>172.18.100.100</emphasis>, and "
16645
"<emphasis>172.18.100.101</emphasis> with the host names and IP addresses of "
16646
"your servers."
16647
msgstr ""
16648
16649
#: serverguide/C/monitoring.xml:212(para)
16650
msgid "Next, edit <filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16651
msgstr ""
16652
16653
#: serverguide/C/monitoring.xml:216(programlisting)
16654
#, no-wrap
16655
msgid ""
16656
"\n"
16657
"define host{\n"
16658
" use generic-host ; Name of host "
16659
"template to use\n"
16660
" host_name server02\n"
16661
" alias Server 02\n"
16662
" address 172.18.100.101\n"
16663
"}\n"
16664
"\n"
16665
"# check DNS service.\n"
16666
"define service {\n"
16667
" use generic-service\n"
16668
" host_name server02\n"
16669
" service_description DNS\n"
16670
" check_command check_dns!172.18.100.101\n"
16671
"}\n"
16672
msgstr ""
16673
16674
#: serverguide/C/monitoring.xml:236(para)
16675
msgid ""
16676
"Restart the <application>nagios</application> daemon to enable the new "
16677
"configuration:"
16678
msgstr ""
16679
16680
#: serverguide/C/monitoring.xml:241(command) serverguide/C/monitoring.xml:308(command) serverguide/C/monitoring.xml:375(command)
16681
msgid "sudo /etc/init.d/nagios3 restart"
16682
msgstr ""
16683
16684
#: serverguide/C/monitoring.xml:251(para)
16685
msgid ""
16686
"Now add a service definition for the MySQL check by adding the following to "
16687
"<filename>/etc/nagios3/conf.d/services_nagios2.cfg</filename>:"
16688
msgstr ""
16689
16690
#: serverguide/C/monitoring.xml:255(programlisting)
16691
#, no-wrap
16692
msgid ""
16693
"\n"
16694
"# check MySQL servers.\n"
16695
"define service {\n"
16696
" hostgroup_name mysql-servers\n"
16697
" service_description MySQL\n"
16698
" check_command "
16699
"check_mysql_cmdlinecred!nagios!secret!$HOSTADDRESS\n"
16700
" use generic-service\n"
16701
" notification_interval 0 ; set > 0 if you want to be "
16702
"renotified\n"
16703
"}\n"
16704
msgstr ""
16705
16706
#: serverguide/C/monitoring.xml:269(para)
16707
msgid ""
16708
"A <emphasis>mysqsl-servers</emphasis> hostgroup now needs to be defined. "
16709
"Edit <filename>/etc/nagios3/conf.d/hostgroups_nagios2.cfg</filename> adding:"
16710
msgstr ""
16711
16712
#: serverguide/C/monitoring.xml:274(programlisting)
16713
#, no-wrap
16714
msgid ""
16715
"\n"
16716
"# MySQL hostgroup.\n"
16717
"define hostgroup {\n"
16718
" hostgroup_name mysql-servers\n"
16719
" alias MySQL servers\n"
16720
" members localhost, server02\n"
16721
" }\n"
16722
msgstr ""
16723
16724
#: serverguide/C/monitoring.xml:286(para)
16725
msgid ""
16726
"The Nagios check needs to authenticate to MySQL. To add a "
16727
"<emphasis>nagios</emphasis> user to MySQL enter:"
16728
msgstr ""
16729
16730
#: serverguide/C/monitoring.xml:291(command)
16731
msgid "mysql -u root -p -e \"create user nagios identified by 'secret';\""
16732
msgstr ""
16733
16734
#: serverguide/C/monitoring.xml:295(para)
16735
msgid ""
16736
"The <emphasis>nagios</emphasis> user will need to be added all hosts in the "
16737
"<emphasis>mysql-servers</emphasis> hostgroup."
16738
msgstr ""
16739
16740
#: serverguide/C/monitoring.xml:303(para)
16741
msgid ""
16742
"Restart <application>nagios</application> to start checking the MySQL "
16743
"servers."
16744
msgstr ""
16745
16746
#: serverguide/C/monitoring.xml:318(para)
16747
msgid ""
16748
"Lastly configure NRPE to check the disk space on "
16749
"<emphasis>server02</emphasis>."
16750
msgstr ""
16751
16752
#: serverguide/C/monitoring.xml:322(para)
16753
msgid ""
16754
"On <emphasis>server01</emphasis> add the service check to "
16755
"<filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16756
msgstr ""
16757
16758
#: serverguide/C/monitoring.xml:327(programlisting)
16759
#, no-wrap
16760
msgid ""
16761
"\n"
16762
"# NRPE disk check.\n"
16763
"define service {\n"
16764
" use generic-service\n"
16765
" host_name server02\n"
16766
" service_description nrpe-disk\n"
16767
" check_command "
16768
"check_nrpe_1arg!check_all_disks!172.18.100.101\n"
16769
"}\n"
16770
msgstr ""
16771
16772
#: serverguide/C/monitoring.xml:340(para)
16773
msgid ""
16774
"Now on <emphasis>server02</emphasis> edit "
16775
"<filename>/etc/nagios/nrpe.cfg</filename> changing:"
16776
msgstr ""
16777
16778
#: serverguide/C/monitoring.xml:344(programlisting)
16779
#, no-wrap
16780
msgid ""
16781
"\n"
16782
"allowed_hosts=172.18.100.100\n"
16783
msgstr ""
16784
16785
#: serverguide/C/monitoring.xml:348(para)
16786
msgid "And below in the command definition area add:"
16787
msgstr ""
16788
16789
#: serverguide/C/monitoring.xml:352(programlisting)
16790
#, no-wrap
16791
msgid ""
16792
"\n"
16793
"command[check_all_disks]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -"
16794
"e\n"
16795
msgstr ""
16796
16797
#: serverguide/C/monitoring.xml:359(para)
16798
msgid "Finally, restart <application>nagios-nrpe-server</application>:"
16799
msgstr ""
16800
16801
#: serverguide/C/monitoring.xml:364(command)
16802
msgid "sudo /etc/init.d/nagios-nrpe-server restart"
16803
msgstr ""
16804
16805
#: serverguide/C/monitoring.xml:370(para)
16806
msgid ""
16807
"Also, on <emphasis>server01</emphasis> restart "
16808
"<application>nagios</application>:"
16809
msgstr ""
16810
16811
#: serverguide/C/monitoring.xml:383(para)
16812
msgid ""
16813
"You should now be able to see the host and service checks in the Nagios CGI "
16814
"files. To access them point a browser to http://server01/nagios3. You will "
16815
"then be prompted for the <emphasis>nagiosadmin</emphasis> username and "
16816
"password."
16817
msgstr ""
16818
16819
#: serverguide/C/monitoring.xml:393(para)
16820
msgid ""
16821
"This section has just scratched the surface of Nagios' features. The "
16822
"<application>nagios-plugins-extra</application> and <application>nagios-snmp-"
16823
"plugins</application> contain many more service checks."
16824
msgstr ""
16825
16826
#: serverguide/C/monitoring.xml:400(para)
16827
msgid ""
16828
"For more information see <ulink "
16829
"url=\"http://www.nagios.org/\">Nagios</ulink> website."
16830
msgstr ""
16831
16832
#: serverguide/C/monitoring.xml:405(para)
16833
msgid ""
16834
"Specifically the <ulink "
16835
"url=\"http://nagios.sourceforge.net/docs/3_0/\">Online Documentation</ulink> "
16836
"site."
16837
msgstr ""
16838
16839
#: serverguide/C/monitoring.xml:410(para)
16840
msgid ""
16841
"There is also a list of <ulink "
16842
"url=\"http://www.nagios.org/propaganda/books/\">books</ulink> related to "
16843
"Nagios and network monitoring:"
16844
msgstr ""
16845
16846
#: serverguide/C/monitoring.xml:416(para)
16847
msgid ""
16848
"The <ulink url=\"https://help.ubuntu.com/community/Nagios\">Nagios Ubuntu "
16849
"Wiki</ulink> page also has more details."
16850
msgstr ""
16851
16852
#: serverguide/C/monitoring.xml:425(title)
16853
msgid "Munin"
16854
msgstr ""
16855
16856
#: serverguide/C/monitoring.xml:430(para)
16857
msgid ""
16858
"Before installing <application>Munin</application> on "
16859
"<emphasis>server01</emphasis><application>apache2</application> will need to "
16860
"be installed. The default configuration is fine for running a "
16861
"<application>munin</application> server. For more information see <xref "
16862
"linkend=\"httpd\"/>."
16863
msgstr ""
16864
16865
#: serverguide/C/monitoring.xml:436(para)
16866
msgid ""
16867
"First, on <emphasis>server01</emphasis> install "
16868
"<application>munin</application>. In a terminal enter:"
16869
msgstr ""
16870
16871
#: serverguide/C/monitoring.xml:441(command)
16872
msgid "sudo apt-get install munin"
16873
msgstr ""
16874
16875
#: serverguide/C/monitoring.xml:444(para)
16876
msgid ""
16877
"Now on <emphasis>server02</emphasis> install the <application>munin-"
16878
"node</application> package:"
16879
msgstr ""
16880
16881
#: serverguide/C/monitoring.xml:449(command)
16882
msgid "sudo apt-get install munin-node"
16883
msgstr ""
16884
16885
#: serverguide/C/monitoring.xml:456(para)
16886
msgid ""
16887
"On <emphasis>server01</emphasis> edit the "
16888
"<filename>/etc/munin/munin.conf</filename> adding the IP address for "
16889
"<emphasis>server02</emphasis>:"
16890
msgstr ""
16891
16892
#: serverguide/C/monitoring.xml:461(programlisting)
16893
#, no-wrap
16894
msgid ""
16895
"\n"
16896
"## First our \"normal\" host.\n"
16897
"[server02]\n"
16898
" address 172.18.100.101\n"
16899
msgstr ""
16900
16901
#: serverguide/C/monitoring.xml:468(para)
16902
msgid ""
16903
"Replace <emphasis>server02</emphasis> and "
16904
"<emphasis>172.18.100.101</emphasis> with the actual hostname and IP address "
16905
"for your server."
16906
msgstr ""
16907
16908
#: serverguide/C/monitoring.xml:474(para)
16909
msgid ""
16910
"Next, configure <application>munin-node</application> on "
16911
"<emphasis>server02</emphasis>. Edit <filename>/etc/munin/munin-"
16912
"node.conf</filename> to allow access by <emphasis>server01</emphasis>:"
16913
msgstr ""
16914
16915
#: serverguide/C/monitoring.xml:479(programlisting)
16916
#, no-wrap
16917
msgid ""
16918
"\n"
16919
"allow ^172\\.18\\.100\\.100$\n"
16920
msgstr ""
16921
16922
#: serverguide/C/monitoring.xml:484(para)
16923
msgid ""
16924
"Replace <emphasis>^172\\.18\\.100\\.100$</emphasis> with IP address for your "
16925
"<application>munin</application> server."
16926
msgstr ""
16927
16928
#: serverguide/C/monitoring.xml:489(para)
16929
msgid ""
16930
"Now restart <application>munin-node</application> on "
16931
"<emphasis>server02</emphasis> for the changes to take effect:"
16932
msgstr ""
16933
16934
#: serverguide/C/monitoring.xml:494(command)
16935
msgid "sudo /etc/init.d/munin-node restart"
16936
msgstr ""
16937
16938
#: serverguide/C/monitoring.xml:497(para)
16939
msgid ""
16940
"Finally, in a browser go to <emphasis>http://server01/munin</emphasis>, and "
16941
"you should see links to nice graphs displaying information from the standard "
16942
"<emphasis>munin-plugins</emphasis> for disk, network, processes, and system."
16943
msgstr ""
16944
16945
#: serverguide/C/monitoring.xml:503(para)
16946
msgid ""
16947
"Since this is a new install it may take some time for the graphs to display "
16948
"anything useful."
16949
msgstr ""
16950
16951
#: serverguide/C/monitoring.xml:510(title)
16952
msgid "Additional Plugins"
16953
msgstr ""
16954
16955
#: serverguide/C/monitoring.xml:512(para)
16956
msgid ""
16957
"The <application>munin-plugins-extra</application> package contains "
16958
"performance checks additional services such as DNS, DHCP, Samba, etc. To "
16959
"install the package, from a terminal enter:"
16960
msgstr ""
16961
16962
#: serverguide/C/monitoring.xml:518(command)
16963
msgid "sudo apt-get install munin-plugins-extra"
16964
msgstr ""
16965
16966
#: serverguide/C/monitoring.xml:521(para)
16967
msgid "Be sure to install the package on both the server and node machines."
16968
msgstr ""
16969
16970
#: serverguide/C/monitoring.xml:531(para)
16971
msgid ""
16972
"See the <ulink url=\"http://munin.projects.linpro.no/\">Munin</ulink> "
16973
"website for more details."
16974
msgstr ""
16975
16976
#: serverguide/C/monitoring.xml:536(para)
16977
msgid ""
16978
"Specifically the <ulink "
16979
"url=\"http://munin.projects.linpro.no/wiki/Documentation\">Munin "
16980
"Documentation</ulink> page includes information on additional plugins, "
16981
"writing plugins, etc."
16982
msgstr ""
16983
16984
#: serverguide/C/monitoring.xml:542(para)
16985
msgid ""
16986
"Also, there is a book in German by Open Source Press: <ulink "
16987
"url=\"https://www.opensourcepress.de/index.php?26&backPID=178&tt_prod"
16988
"ucts=152\">Munin Graphisches Netzwerk- und System-Monitoring</ulink>."
16989
msgstr ""
16990
16991
#: serverguide/C/monitoring.xml:548(para)
16992
msgid ""
16993
"Another resource is the <ulink "
16994
"url=\"https://help.ubuntu.com/community/Munin\">Munin Ubuntu Wiki</ulink> "
16995
"page."
16996
msgstr ""
16997
16998
#: serverguide/C/mail.xml:13(title)
16999
msgid "Email Services"
17000
msgstr ""
17001
17002
#: serverguide/C/mail.xml:14(para)
17003
msgid ""
17004
"The process of getting an email from one person to another over a network or "
17005
"the Internet involves many systems working together. Each of these systems "
17006
"must be correctly configured for the process to work. The sender uses a "
17007
"<emphasis>Mail User Agent</emphasis> (MUA), or email client, to send the "
17008
"message through one or more <emphasis>Mail Transfer Agents</emphasis> (MTA), "
17009
"the last of which will hand it off to a <emphasis>Mail Delivery "
17010
"Agent</emphasis> (MDA) for delivery to the recipient's mailbox, from which "
17011
"it will be retrieved by the recipient's email client, usually via a POP3 or "
17012
"IMAP server."
17013
msgstr ""
17014
17015
#: serverguide/C/mail.xml:24(title) serverguide/C/mail.xml:832(application) serverguide/C/mail.xml:866(title) serverguide/C/mail.xml:944(title) serverguide/C/mail.xml:1510(title)
17016
msgid "Postfix"
17017
msgstr ""
17018
17019
#: serverguide/C/mail.xml:25(para)
17020
msgid ""
17021
"<application>Postfix</application> is the default Mail Transfer Agent (MTA) "
17022
"in Ubuntu. It attempts to be fast and easy to administer and secure. It is "
17023
"compatible with the MTA <application>sendmail</application>. This section "
17024
"explains how to install and configure <application>postfix</application>. It "
17025
"also explains how to set it up as an SMTP server using a secure connection "
17026
"(for sending emails securely)."
17027
msgstr ""
17028
17029
#: serverguide/C/mail.xml:34(para)
17030
msgid ""
17031
"This guide does not cover setting up Postfix <emphasis>Virtual "
17032
"Domains</emphasis>, for information on Virtual Domains and other advanced "
17033
"configurations see <xref linkend=\"postfix-references\"/>."
17034
msgstr ""
17035
17036
#: serverguide/C/mail.xml:41(para)
17037
msgid ""
17038
"To install <application>postfix</application> run the following command:"
17039
msgstr ""
17040
17041
#: serverguide/C/mail.xml:47(para)
17042
msgid ""
17043
"Simply press return when the installation process asks questions, the "
17044
"configuration will be done in greater detail in the next stage."
17045
msgstr ""
17046
17047
#: serverguide/C/mail.xml:52(title)
17048
msgid "Basic Configuration"
17049
msgstr ""
17050
17051
#: serverguide/C/mail.xml:53(para)
17052
msgid ""
17053
"To configure <application>postfix</application>, run the following command:"
17054
msgstr ""
17055
17056
#: serverguide/C/mail.xml:57(command)
17057
msgid "sudo dpkg-reconfigure postfix"
17058
msgstr ""
17059
17060
#: serverguide/C/mail.xml:63(para)
17061
msgid "Internet Site"
17062
msgstr ""
17063
17064
#: serverguide/C/mail.xml:64(para)
17065
msgid "mail.example.com"
17066
msgstr ""
17067
17068
#: serverguide/C/mail.xml:65(para)
17069
msgid "steve"
17070
msgstr ""
17071
17072
#: serverguide/C/mail.xml:66(para)
17073
msgid "mail.example.com, localhost.localdomain, localhost"
17074
msgstr ""
17075
17076
#: serverguide/C/mail.xml:67(para)
17077
msgid "No"
17078
msgstr ""
17079
17080
#: serverguide/C/mail.xml:68(para)
17081
msgid "127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24"
17082
msgstr ""
17083
17084
#: serverguide/C/mail.xml:69(para)
17085
msgid "0"
17086
msgstr ""
17087
17088
#: serverguide/C/mail.xml:70(para)
17089
msgid "+"
17090
msgstr ""
17091
17092
#: serverguide/C/mail.xml:71(para)
17093
msgid "all"
17094
msgstr ""
17095
17096
#: serverguide/C/mail.xml:59(para)
17097
msgid ""
17098
"The user interface will be displayed. On each screen, select the following "
17099
"values: <placeholder-1/>"
17100
msgstr ""
17101
17102
#: serverguide/C/mail.xml:75(para)
17103
msgid ""
17104
"Replace mail.example.com with the domain for which you'll accept email, "
17105
"192.168.0.0/24 with the actual network and class range of your mail server, "
17106
"and steve with the appropriate username."
17107
msgstr ""
17108
17109
#: serverguide/C/mail.xml:81(para)
17110
msgid ""
17111
"Now is a good time to decide which mailbox format you want to use. By "
17112
"default Postfix will use <emphasis role=\"strong\">mbox</emphasis> for the "
17113
"mailbox format. Rather than editing the configuration file directly, you can "
17114
"use the <command>postconf</command> command to configure all "
17115
"<application>postfix</application> parameters. The configuration parameters "
17116
"will be stored in <filename>/etc/postfix/main.cf</filename> file. Later if "
17117
"you wish to re-configure a particular parameter, you can either run the "
17118
"command or change it manually in the file."
17119
msgstr ""
17120
17121
#: serverguide/C/mail.xml:92(para)
17122
msgid ""
17123
"To configure the mailbox format for <emphasis "
17124
"role=\"strong\">Maildir:</emphasis>"
17125
msgstr ""
17126
17127
#: serverguide/C/mail.xml:97(command)
17128
msgid "sudo postconf -e 'home_mailbox = Maildir/'"
17129
msgstr ""
17130
17131
#: serverguide/C/mail.xml:100(para)
17132
msgid ""
17133
"This will place new mail in /home/<emphasis "
17134
"role=\"italic\">username</emphasis>/Maildir so you will need to configure "
17135
"your Mail Delivery Agent (MDA) to use the same path."
17136
msgstr ""
17137
17138
#: serverguide/C/mail.xml:108(title) serverguide/C/mail.xml:556(title)
17139
msgid "SMTP Authentication"
17140
msgstr ""
17141
17142
#: serverguide/C/mail.xml:110(para)
17143
msgid ""
17144
"SMTP-AUTH allows a client to identify itself through an authentication "
17145
"mechanism (SASL). Transport Layer Security (TLS) should be used to encrypt "
17146
"the authentication process. Once authenticated the SMTP server will allow "
17147
"the client to relay mail."
17148
msgstr ""
17149
17150
#: serverguide/C/mail.xml:117(para)
17151
msgid "Configure Postfix for SMTP-AUTH using SASL (Dovecot SASL):"
17152
msgstr ""
17153
17154
#: serverguide/C/mail.xml:120(screen)
17155
#, no-wrap
17156
msgid ""
17157
"\n"
17158
"sudo postconf -e 'smtpd_sasl_type = dovecot'\n"
17159
"sudo postconf -e 'smtpd_sasl_path = private/auth-client'\n"
17160
"sudo postconf -e 'smtpd_sasl_local_domain ='\n"
17161
"sudo postconf -e 'smtpd_sasl_security_options = noanonymous'\n"
17162
"sudo postconf -e 'broken_sasl_auth_clients = yes'\n"
17163
"sudo postconf -e 'smtpd_sasl_auth_enable = yes'\n"
17164
"sudo postconf -e 'smtpd_recipient_restrictions = "
17165
"permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'\n"
17166
"sudo postconf -e 'inet_interfaces = all'\n"
17167
msgstr ""
17168
17169
#: serverguide/C/mail.xml:131(para)
17170
msgid ""
17171
"The <emphasis>smtpd_sasl_path</emphasis> configuration is a path relative to "
17172
"the Postfix queue directory."
17173
msgstr ""
17174
17175
#: serverguide/C/mail.xml:137(para)
17176
msgid ""
17177
"Next, obtain a digital certificate for TLS. See <xref linkend=\"certificates-"
17178
"and-security\"/> for details. This example also uses a Certificate Authority "
17179
"(CA). For information on generating a CA certificate see <xref "
17180
"linkend=\"certificate-authority\"/>."
17181
msgstr ""
17182
17183
#: serverguide/C/mail.xml:143(para)
17184
msgid ""
17185
"You can get the digital certificate from a certificate authority. But unlike "
17186
"web clients, SMTP clients rarely complain about \"self-signed "
17187
"certificates\", so alternatively, you can create the certificate yourself. "
17188
"Refer to <xref linkend=\"creating-a-self-signed-certificate\"/> for more "
17189
"details."
17190
msgstr ""
17191
17192
#: serverguide/C/mail.xml:155(para)
17193
msgid ""
17194
"Once you have a certificate, configure Postfix to provide TLS encryption for "
17195
"both incoming and outgoing mail:"
17196
msgstr ""
17197
17198
#: serverguide/C/mail.xml:158(screen)
17199
#, no-wrap
17200
msgid ""
17201
"\n"
17202
"sudo postconf -e 'smtpd_tls_auth_only = no'\n"
17203
"sudo postconf -e 'smtp_use_tls = yes'\n"
17204
"sudo postconf -e 'smtpd_use_tls = yes'\n"
17205
"sudo postconf -e 'smtp_tls_note_starttls_offer = yes'\n"
17206
"sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'\n"
17207
"sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'\n"
17208
"sudo postconf -e 'smtpd_tls_loglevel = 1'\n"
17209
"sudo postconf -e 'smtpd_tls_received_header = yes'\n"
17210
"sudo postconf -e 'smtpd_tls_session_cache_timeout = 3600s'\n"
17211
"sudo postconf -e 'tls_random_source = dev:/dev/urandom'\n"
17212
"sudo postconf -e 'myhostname = mail.example.com'\n"
17213
msgstr ""
17214
17215
#: serverguide/C/mail.xml:173(para)
17216
msgid ""
17217
"If you are using your own <emphasis>Certificate Authority</emphasis> to sign "
17218
"the certificate enter:"
17219
msgstr ""
17220
17221
#: serverguide/C/mail.xml:177(command)
17222
msgid "sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'"
17223
msgstr ""
17224
17225
#: serverguide/C/mail.xml:180(para)
17226
msgid ""
17227
"Again, for more details about certificates see <xref linkend=\"certificates-"
17228
"and-security\"/>."
17229
msgstr ""
17230
17231
#: serverguide/C/mail.xml:186(para)
17232
msgid ""
17233
"After running all the commands, <application>Postfix</application> is "
17234
"configured for SMTP-AUTH and a self-signed certificate has been created for "
17235
"TLS encryption."
17236
msgstr ""
17237
17238
#: serverguide/C/mail.xml:191(para)
17239
msgid ""
17240
"Now, the file <filename>/etc/postfix/main.cf</filename> should look like "
17241
"<ulink url=\"../sample/postfix_configuration\">this</ulink>."
17242
msgstr ""
17243
17244
#: serverguide/C/mail.xml:195(para)
17245
msgid ""
17246
"The postfix initial configuration is complete. Run the following command to "
17247
"restart the postfix daemon:"
17248
msgstr ""
17249
17250
#: serverguide/C/mail.xml:201(command) serverguide/C/mail.xml:315(command) serverguide/C/mail.xml:378(command) serverguide/C/mail.xml:984(command) serverguide/C/mail.xml:1561(command)
17251
msgid "sudo /etc/init.d/postfix restart"
17252
msgstr ""
17253
17254
#: serverguide/C/mail.xml:204(para)
17255
msgid ""
17256
"<application>Postfix</application> supports SMTP-AUTH as defined in <ulink "
17257
"url=\"ftp://ftp.isi.edu/in-notes/rfc2554.txt\">RFC2554</ulink>. It is based "
17258
"on <ulink url=\"ftp://ftp.isi.edu/in-notes/rfc2222.txt\">SASL</ulink>. "
17259
"However it is still necessary to set up SASL authentication before you can "
17260
"use SMTP-AUTH."
17261
msgstr ""
17262
17263
#: serverguide/C/mail.xml:214(title) serverguide/C/mail.xml:609(title)
17264
msgid "Configuring SASL"
17265
msgstr ""
17266
17267
#: serverguide/C/mail.xml:215(para)
17268
msgid ""
17269
"Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To "
17270
"enable Dovecot SASL the <application>dovecot-common</application> package "
17271
"will need to be installed. From a terminal prompt enter the following:"
17272
msgstr ""
17273
17274
#: serverguide/C/mail.xml:221(command)
17275
msgid "sudo apt-get install dovecot-common"
17276
msgstr ""
17277
17278
#: serverguide/C/mail.xml:223(para)
17279
msgid ""
17280
"Next you will need to edit <filename>/etc/dovecot/dovecot.conf</filename>. "
17281
"In the <emphasis>auth default</emphasis> section uncomment the "
17282
"<emphasis>socket listen</emphasis> option and change the following:"
17283
msgstr ""
17284
17285
#: serverguide/C/mail.xml:227(programlisting)
17286
#, no-wrap
17287
msgid ""
17288
"\n"
17289
" socket listen {\n"
17290
" #master {\n"
17291
" # Master socket provides access to userdb information. It's typically\n"
17292
" # used to give Dovecot's local delivery agent access to userdb so it\n"
17293
" # can find mailbox locations.\n"
17294
" #path = /var/run/dovecot/auth-master\n"
17295
" #mode = 0600\n"
17296
" # Default user/group is the one who started dovecot-auth (root)\n"
17297
" #user = \n"
17298
" #group = \n"
17299
" #}\n"
17300
" client {\n"
17301
" # The client socket is generally safe to export to everyone. Typical "
17302
"use\n"
17303
" # is to export it to your SMTP server so it can do SMTP AUTH lookups\n"
17304
" # using it.\n"
17305
" path = /var/spool/postfix/private/auth-client\n"
17306
" mode = 0660\n"
17307
" user = postfix\n"
17308
" group = postfix\n"
17309
" }\n"
17310
" }\n"
17311
msgstr ""
17312
17313
#: serverguide/C/mail.xml:251(para)
17314
msgid ""
17315
"In order to let <application>Outlook</application> clients use SMTPAUTH, in "
17316
"the <emphasis>auth default</emphasis> section of /etc/dovecot/dovecot.conf "
17317
"add <emphasis>\"login\"</emphasis>:"
17318
msgstr ""
17319
17320
#: serverguide/C/mail.xml:256(programlisting)
17321
#, no-wrap
17322
msgid ""
17323
"\n"
17324
" mechanisms = plain login\n"
17325
msgstr ""
17326
17327
#: serverguide/C/mail.xml:260(para)
17328
msgid ""
17329
"Once you have <application>Dovecot</application> configured restart it with:"
17330
msgstr ""
17331
17332
#: serverguide/C/mail.xml:264(command) serverguide/C/mail.xml:735(command)
17333
msgid "sudo /etc/init.d/dovecot restart"
17334
msgstr ""
17335
17336
#: serverguide/C/mail.xml:269(title)
17337
msgid "Postfix-Dovecot"
17338
msgstr ""
17339
17340
#: serverguide/C/mail.xml:271(para)
17341
msgid ""
17342
"Another option for configuring <application>Postfix</application> for SMTP-"
17343
"AUTH is using the <application>dovecot-postfix</application> package. This "
17344
"package will install <application>Dovecot</application> and configure "
17345
"<application>Postfix</application> to use it for both SASL authentication "
17346
"and as a Mail Delivery Agent (MDA). The package also configures "
17347
"<application>Dovecot</application> for IMAP, IMAPS, POP3, and POP3S."
17348
msgstr ""
17349
17350
#: serverguide/C/mail.xml:280(para)
17351
msgid ""
17352
"You may or may not want to run IMAP, IMAPS, POP3, or POP3S on your mail "
17353
"server. For example, if you are configuring your server to be a mail "
17354
"gateway, spam/virus filter, etc. If this is the case it may be easier to use "
17355
"the above commands to configure Postfix for SMTPAUTH."
17356
msgstr ""
17357
17358
#: serverguide/C/mail.xml:287(para)
17359
msgid "To install the package, from a terminal prompt enter:"
17360
msgstr ""
17361
17362
#: serverguide/C/mail.xml:292(command)
17363
msgid "sudo apt-get install dovecot-postfix"
17364
msgstr ""
17365
17366
#: serverguide/C/mail.xml:295(para)
17367
msgid ""
17368
"You should now have a working mail server, but there are a few options that "
17369
"you may wish to further customize. For example, the package uses the "
17370
"certificate and key from the <application>ssl-cert</application> package, "
17371
"and in a production environment you should use a certificate and key "
17372
"generated for the host. See <xref linkend=\"certificates-and-security\"/> "
17373
"for more details."
17374
msgstr ""
17375
17376
#: serverguide/C/mail.xml:301(para)
17377
msgid ""
17378
"Once you have a customized certificate and key for the host, change the "
17379
"following options in <filename>/etc/postfix/main.cf</filename>:"
17380
msgstr ""
17381
17382
#: serverguide/C/mail.xml:305(programlisting)
17383
#, no-wrap
17384
msgid ""
17385
"\n"
17386
"smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem\n"
17387
"smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key\n"
17388
msgstr ""
17389
17390
#: serverguide/C/mail.xml:310(para)
17391
msgid "Then restart Postfix:"
17392
msgstr ""
17393
17394
#: serverguide/C/mail.xml:321(para)
17395
msgid ""
17396
"SMTP-AUTH configuration is complete. Now it is time to test the setup."
17397
msgstr ""
17398
17399
#: serverguide/C/mail.xml:324(para)
17400
msgid "To see if SMTP-AUTH and TLS work properly, run the following command:"
17401
msgstr ""
17402
17403
#: serverguide/C/mail.xml:329(command)
17404
msgid "telnet mail.example.com 25"
17405
msgstr ""
17406
17407
#: serverguide/C/mail.xml:331(para)
17408
msgid ""
17409
"After you have established the connection to the postfix mail server, type:"
17410
msgstr ""
17411
17412
#: serverguide/C/mail.xml:335(screen)
17413
#, no-wrap
17414
msgid ""
17415
"\n"
17416
"ehlo mail.example.com\n"
17417
msgstr ""
17418
17419
#: serverguide/C/mail.xml:338(para)
17420
msgid ""
17421
"If you see the following lines among others, then everything is working "
17422
"perfectly. Type <command>quit</command> to exit."
17423
msgstr ""
17424
17425
#: serverguide/C/mail.xml:342(programlisting)
17426
#, no-wrap
17427
msgid ""
17428
"\n"
17429
"250-STARTTLS\n"
17430
"250-AUTH LOGIN PLAIN\n"
17431
"250-AUTH=LOGIN PLAIN\n"
17432
"250 8BITMIME\n"
17433
msgstr ""
17434
17435
#: serverguide/C/mail.xml:352(para)
17436
msgid ""
17437
"This section introduces some common ways to determine the cause if problems "
17438
"arise."
17439
msgstr ""
17440
17441
#: serverguide/C/mail.xml:356(title)
17442
msgid "Escaping chroot"
17443
msgstr ""
17444
17445
#: serverguide/C/mail.xml:357(para)
17446
msgid ""
17447
"The Ubuntu <application>postfix</application> package will by default "
17448
"install into a <emphasis>chroot</emphasis> environment for security reasons. "
17449
"This can add greater complexity when troubleshooting problems."
17450
msgstr ""
17451
17452
#: serverguide/C/mail.xml:361(para)
17453
msgid ""
17454
"To turn off the chroot operation locate for the following line in the "
17455
"<filename>/etc/postfix/master.cf</filename> configuration file:"
17456
msgstr ""
17457
17458
#: serverguide/C/mail.xml:365(screen)
17459
#, no-wrap
17460
msgid ""
17461
"\n"
17462
"smtp inet n - - - - smtpd\n"
17463
msgstr ""
17464
17465
#: serverguide/C/mail.xml:368(para)
17466
msgid "and modify it as follows:"
17467
msgstr ""
17468
17469
#: serverguide/C/mail.xml:371(screen)
17470
#, no-wrap
17471
msgid ""
17472
"\n"
17473
"smtp inet n - n - - smtpd\n"
17474
msgstr ""
17475
17476
#: serverguide/C/mail.xml:374(para)
17477
msgid ""
17478
"You will then need to restart Postfix to use the new configuration. From a "
17479
"terminal prompt enter:"
17480
msgstr ""
17481
17482
#: serverguide/C/mail.xml:382(title)
17483
msgid "Log Files"
17484
msgstr ""
17485
17486
#: serverguide/C/mail.xml:383(para)
17487
msgid ""
17488
"<application>Postfix</application> sends all log messages to "
17489
"<filename>/var/log/mail.log</filename>. However error and warning messages "
17490
"can sometimes get lost in the normal log output so they are also logged to "
17491
"<filename>/var/log/mail.err</filename> and "
17492
"<filename>/var/log/mail.warn</filename> respectively."
17493
msgstr ""
17494
17495
#: serverguide/C/mail.xml:388(para)
17496
msgid ""
17497
"To see messages entered into the logs in real time you can use the "
17498
"<application>tail -f</application> command:"
17499
msgstr ""
17500
17501
#: serverguide/C/mail.xml:393(command)
17502
msgid "tail -f /var/log/mail.err"
17503
msgstr ""
17504
17505
#: serverguide/C/mail.xml:395(para)
17506
msgid ""
17507
"The amount of detail that is recorded in the logs can be increased. Below "
17508
"are some configuration options for increasing the log level for some of the "
17509
"areas covered above."
17510
msgstr ""
17511
17512
#: serverguide/C/mail.xml:401(para)
17513
msgid ""
17514
"To increase <emphasis>TLS</emphasis> activity logging set the "
17515
"<emphasis>smtpd_tls_loglevel</emphasis> option to a value from 1 to 4."
17516
msgstr ""
17517
17518
#: serverguide/C/mail.xml:405(command)
17519
msgid "sudo postconf -e 'smtpd_tls_loglevel = 4'"
17520
msgstr ""
17521
17522
#: serverguide/C/mail.xml:409(para)
17523
msgid ""
17524
"If you are having trouble sending or receiving mail from a specific domain "
17525
"you can add the domain to the <emphasis>debug_peer_list</emphasis> parameter."
17526
msgstr ""
17527
17528
#: serverguide/C/mail.xml:414(command)
17529
msgid "sudo postconf -e 'debug_peer_list = problem.domain'"
17530
msgstr ""
17531
17532
#: serverguide/C/mail.xml:418(para)
17533
msgid ""
17534
"You can increase the verbosity of any <application>Postfix</application> "
17535
"daemon process by editing the <filename>/etc/postfix/master.cf</filename> "
17536
"and adding a <emphasis>-v</emphasis> after the entry. For example edit the "
17537
"<emphasis>smtp</emphasis> entry:"
17538
msgstr ""
17539
17540
#: serverguide/C/mail.xml:422(programlisting)
17541
#, no-wrap
17542
msgid ""
17543
"\n"
17544
"smtp unix - - - - - smtp -v\n"
17545
msgstr ""
17546
17547
#: serverguide/C/mail.xml:428(para)
17548
msgid ""
17549
"It is important to note that after making one of the logging changes above "
17550
"the <application>Postfix</application> process will need to be reloaded in "
17551
"order to recognize the new configuration: <command>sudo /etc/init.d/postfix "
17552
"reload</command>"
17553
msgstr ""
17554
17555
#: serverguide/C/mail.xml:435(para)
17556
msgid ""
17557
"To increase the amount of information logged when troubleshooting "
17558
"<emphasis>SASL</emphasis> issues you can set the following options in "
17559
"<filename>/etc/dovecot/dovecot.conf</filename>"
17560
msgstr ""
17561
17562
#: serverguide/C/mail.xml:439(programlisting)
17563
#, no-wrap
17564
msgid ""
17565
"\n"
17566
"auth_debug=yes\n"
17567
"auth_debug_passwords=yes\n"
17568
msgstr ""
17569
17570
#: serverguide/C/mail.xml:446(para)
17571
msgid ""
17572
"Just like <application>Postfix</application> if you change a "
17573
"<application>Dovecot</application> configuration the process will need to be "
17574
"reloaded: <command>sudo /etc/init.d/dovecot reload</command>."
17575
msgstr ""
17576
17577
#: serverguide/C/mail.xml:452(para)
17578
msgid ""
17579
"Some of the options above can drastically increase the amount of information "
17580
"sent to the log files. Remember to return the log level back to normal after "
17581
"you have corrected the problem. Then reload the appropriate daemon for the "
17582
"new configuration to take affect."
17583
msgstr ""
17584
17585
#: serverguide/C/mail.xml:460(para)
17586
msgid ""
17587
"Administering a <application>Postfix</application> server can be a very "
17588
"complicated task. At some point you may need to turn to the Ubuntu community "
17589
"for more experienced help."
17590
msgstr ""
17591
17592
#: serverguide/C/mail.xml:464(para)
17593
msgid ""
17594
"A great place to ask for <application>Postfix</application> assistance, and "
17595
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
17596
"server</emphasis> IRC channel on <ulink "
17597
"url=\"http://freenode.net\">freenode</ulink>. You can also post a message to "
17598
"one of the <ulink "
17599
"url=\"http://www.ubuntu.com/support/community/webforums\">Web Forums</ulink>."
17600
msgstr ""
17601
17602
#: serverguide/C/mail.xml:469(para)
17603
msgid ""
17604
"For in depth <application>Postfix</application> information Ubuntu "
17605
"developers highly recommend: <ulink url=\"http://www.postfix-book.com/\">The "
17606
"Book of Postfix</ulink>."
17607
msgstr ""
17608
17609
#: serverguide/C/mail.xml:473(para)
17610
msgid ""
17611
"Finally, the <ulink "
17612
"url=\"http://www.postfix.org/documentation.html\">Postfix</ulink> website "
17613
"also has great documentation on all the different configuration options "
17614
"available."
17615
msgstr ""
17616
17617
#: serverguide/C/mail.xml:477(para)
17618
msgid ""
17619
"Also, the <ulink url=\"https://help.ubuntu.com/community/Postfix\">Ubuntu "
17620
"Wiki Postifx</ulink> page has more information."
17621
msgstr ""
17622
17623
#: serverguide/C/mail.xml:485(title) serverguide/C/mail.xml:872(title) serverguide/C/mail.xml:988(title)
17624
msgid "Exim4"
17625
msgstr ""
17626
17627
#: serverguide/C/mail.xml:486(para)
17628
msgid ""
17629
"<application>Exim4</application> is another Message Transfer Agent (MTA) "
17630
"developed at the University of Cambridge for use on Unix systems connected "
17631
"to the Internet. Exim can be installed in place of "
17632
"<application>sendmail</application>, although the configuration of "
17633
"<application>exim</application> is quite different to that of "
17634
"<application>sendmail</application>."
17635
msgstr ""
17636
17637
#: serverguide/C/mail.xml:497(para)
17638
msgid ""
17639
"To install <application>exim4</application>, run the following command: "
17640
"<screen>\n"
17641
"<command>sudo apt-get install exim4</command>\n"
17642
"</screen>"
17643
msgstr ""
17644
17645
#: serverguide/C/mail.xml:506(para)
17646
msgid ""
17647
"To configure <application>Exim4</application>, run the following command:"
17648
msgstr ""
17649
17650
#: serverguide/C/mail.xml:510(command)
17651
msgid "sudo dpkg-reconfigure exim4-config"
17652
msgstr ""
17653
17654
#: serverguide/C/mail.xml:512(para)
17655
msgid ""
17656
"The user interface will be displayed. The user interface lets you configure "
17657
"many parameters. For example, In <application>Exim4</application> the "
17658
"configuration files are split among multiple files. If you wish to have them "
17659
"in one file you can configure accordingly in this user interface."
17660
msgstr ""
17661
17662
#: serverguide/C/mail.xml:520(para)
17663
msgid ""
17664
"All the parameters you configure in the user interface are stored in "
17665
"<filename>/etc/exim4/update-exim4.conf.conf</filename> file. If you wish to "
17666
"re-configure, either you re-run the configuration wizard or manually edit "
17667
"this file using your favorite editor. Once you configure, you can run the "
17668
"following command to generate the master configuration file:"
17669
msgstr ""
17670
17671
#: serverguide/C/mail.xml:531(command) serverguide/C/mail.xml:604(command)
17672
msgid "sudo update-exim4.conf"
17673
msgstr ""
17674
17675
#: serverguide/C/mail.xml:533(para)
17676
msgid ""
17677
"The master configuration file, is generated and it is stored in "
17678
"<filename>/var/lib/exim4/config.autogenerated</filename>."
17679
msgstr ""
17680
17681
#: serverguide/C/mail.xml:539(para)
17682
msgid ""
17683
"At any time, you should not edit the master configuration file, "
17684
"<filename>/var/lib/exim4/config.autogenerated</filename> manually. It is "
17685
"updated automatically every time you run <command>update-exim4.conf</command>"
17686
msgstr ""
17687
17688
#: serverguide/C/mail.xml:547(para)
17689
msgid ""
17690
"You can run the following command to start <application>Exim4</application> "
17691
"daemon."
17692
msgstr ""
17693
17694
#: serverguide/C/mail.xml:552(command) serverguide/C/mail.xml:994(command)
17695
msgid "sudo /etc/init.d/exim4 start"
17696
msgstr ""
17697
17698
#: serverguide/C/mail.xml:557(para)
17699
msgid ""
17700
"This section covers configuring Exim4 to use SMTP-AUTH with TLS and SASL."
17701
msgstr ""
17702
17703
#: serverguide/C/mail.xml:560(para)
17704
msgid ""
17705
"The first step is to create a certificate for use with TLS. Enter the "
17706
"following into a terminal prompt:"
17707
msgstr ""
17708
17709
#: serverguide/C/mail.xml:564(command)
17710
msgid "sudo /usr/share/doc/exim4-base/examples/exim-gencert"
17711
msgstr ""
17712
17713
#: serverguide/C/mail.xml:566(para)
17714
msgid ""
17715
"Now Exim4 needs to be configured for TLS by editing "
17716
"<filename>/etc/exim4/conf.d/main/03_exim4-config_tlsoptions</filename> add "
17717
"the following:"
17718
msgstr ""
17719
17720
#: serverguide/C/mail.xml:570(programlisting)
17721
#, no-wrap
17722
msgid ""
17723
"\n"
17724
"MAIN_TLS_ENABLE = yes\n"
17725
msgstr ""
17726
17727
#: serverguide/C/mail.xml:573(para)
17728
msgid ""
17729
"Next you need to configure <application>Exim4</application> to use the "
17730
"<application>saslauthd</application> for authentication. Edit "
17731
"<filename>/etc/exim4/conf.d/auth/30_exim4-config_examples</filename> and "
17732
"uncomment the <emphasis>plain_saslauthd_server</emphasis> and "
17733
"<emphasis>login_saslauthd_server</emphasis> sections:"
17734
msgstr ""
17735
17736
#: serverguide/C/mail.xml:578(programlisting)
17737
#, no-wrap
17738
msgid ""
17739
"\n"
17740
" plain_saslauthd_server:\n"
17741
" driver = plaintext\n"
17742
" public_name = PLAIN\n"
17743
" server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}\n"
17744
" server_set_id = $auth2\n"
17745
" server_prompts = :\n"
17746
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17747
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17748
" .endif\n"
17749
"#\n"
17750
" login_saslauthd_server:\n"
17751
" driver = plaintext\n"
17752
" public_name = LOGIN\n"
17753
" server_prompts = \"Username:: : Password::\"\n"
17754
" # don't send system passwords over unencrypted connections\n"
17755
" server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}\n"
17756
" server_set_id = $auth1\n"
17757
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17758
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17759
" .endif\n"
17760
msgstr ""
17761
17762
#: serverguide/C/mail.xml:600(para)
17763
msgid "Finally, update the Exim4 configuration and restart the service:"
17764
msgstr ""
17765
17766
#: serverguide/C/mail.xml:605(command)
17767
msgid "sudo /etc/init.d/exim4 restart"
17768
msgstr ""
17769
17770
#: serverguide/C/mail.xml:610(para)
17771
msgid ""
17772
"This section provides details on configuring the saslauthd to provide "
17773
"authentication for <application>Exim4</application>."
17774
msgstr ""
17775
17776
#: serverguide/C/mail.xml:613(para)
17777
msgid ""
17778
"The first step is to install the sasl2-bin package. From a terminal prompt "
17779
"enter the following:"
17780
msgstr ""
17781
17782
#: serverguide/C/mail.xml:617(command)
17783
msgid "sudo apt-get install sasl2-bin"
17784
msgstr ""
17785
17786
#: serverguide/C/mail.xml:619(para)
17787
msgid ""
17788
"To configure saslauthd edit the /etc/default/saslauthd configuration file "
17789
"and set START=no to:"
17790
msgstr ""
17791
17792
#: serverguide/C/mail.xml:622(programlisting)
17793
#, no-wrap
17794
msgid ""
17795
"\n"
17796
"START=yes\n"
17797
msgstr ""
17798
17799
#: serverguide/C/mail.xml:625(para)
17800
msgid ""
17801
"Next the <emphasis>Debian-exim</emphasis> user needs to be part of the "
17802
"<emphasis>sasl</emphasis> group in order for Exim4 to use the saslauthd "
17803
"service:"
17804
msgstr ""
17805
17806
#: serverguide/C/mail.xml:630(command)
17807
msgid "sudo adduser Debian-exim sasl"
17808
msgstr ""
17809
17810
#: serverguide/C/mail.xml:632(para)
17811
msgid "Now start the <application>saslauthd</application> service:"
17812
msgstr ""
17813
17814
#: serverguide/C/mail.xml:636(command)
17815
msgid "sudo /etc/init.d/saslauthd start"
17816
msgstr ""
17817
17818
#: serverguide/C/mail.xml:638(para)
17819
msgid ""
17820
"<application>Exim4</application> is now configured with SMTP-AUTH using TLS "
17821
"and SASL authentication."
17822
msgstr ""
17823
17824
#: serverguide/C/mail.xml:647(para)
17825
msgid ""
17826
"See <ulink url=\"http://www.exim.org/\">exim.org</ulink> for more "
17827
"information."
17828
msgstr ""
17829
17830
#: serverguide/C/mail.xml:652(para)
17831
msgid ""
17832
"There is also an <ulink url=\"http://www.uit.co.uk/content/exim-smtp-mail-"
17833
"server\">Exim4 Book</ulink> available."
17834
msgstr ""
17835
17836
#: serverguide/C/mail.xml:657(para)
17837
msgid ""
17838
"Another resource is the <ulink "
17839
"url=\"https://help.ubuntu.com/community/Exim4\">Exim4 Ubuntu Wiki </ulink> "
17840
"page."
17841
msgstr ""
17842
17843
#: serverguide/C/mail.xml:666(title)
17844
msgid "Dovecot Server"
17845
msgstr ""
17846
17847
#: serverguide/C/mail.xml:667(para)
17848
msgid ""
17849
"<application>Dovecot</application> is a Mail Delivery Agent, written with "
17850
"security primarily in mind. It supports the major mailbox formats: mbox or "
17851
"Maildir. This section explain how to set it up as an imap or pop3 server."
17852
msgstr ""
17853
17854
#: serverguide/C/mail.xml:675(para)
17855
msgid ""
17856
"To install <application>dovecot</application>, run the following command in "
17857
"the command prompt:"
17858
msgstr ""
17859
17860
#: serverguide/C/mail.xml:680(command)
17861
msgid "sudo apt-get install dovecot-imapd dovecot-pop3d"
17862
msgstr ""
17863
17864
#: serverguide/C/mail.xml:685(para)
17865
msgid ""
17866
"To configure <application>dovecot</application>, you can edit the file "
17867
"<filename>/etc/dovecot/dovecot.conf</filename>. You can choose the protocol "
17868
"you use. It could be pop3, pop3s (pop3 secure), imap and imaps (imap "
17869
"secure). A description of these protocols is beyond the scope of this guide. "
17870
"For further information, refer to the Wikipedia articles on <ulink "
17871
"url=\"http://en.wikipedia.org/wiki/POP3\">POP3</ulink> and <ulink "
17872
"url=\"http://en.wikipedia.org/wiki/Internet_Message_Access_Protocol\">IMAP</u"
17873
"link>."
17874
msgstr ""
17875
17876
#: serverguide/C/mail.xml:695(para)
17877
msgid ""
17878
"IMAPS and POP3S are more secure that the simple IMAP and POP3 because they "
17879
"use SSL encryption to connect. Once you have chosen the protocol, amend the "
17880
"following line in the file <filename>/etc/dovecot/dovecot.conf</filename>:"
17881
msgstr ""
17882
17883
#: serverguide/C/mail.xml:701(programlisting)
17884
#, no-wrap
17885
msgid ""
17886
"\n"
17887
"protocols = pop3 pop3s imap imaps\n"
17888
msgstr ""
17889
17890
#: serverguide/C/mail.xml:704(para)
17891
msgid ""
17892
"Next, choose the mailbox you would like to use. "
17893
"<application>Dovecot</application> supports <emphasis "
17894
"role=\"strong\">maildir</emphasis> and <emphasis "
17895
"role=\"strong\">mbox</emphasis> formats. These are the most commonly used "
17896
"mailbox formats. They both have their own benefits and are discussed on "
17897
"<ulink url=\"http://wiki.dovecot.org/MailboxFormat\">the Dovecot web "
17898
"site</ulink>."
17899
msgstr ""
17900
17901
#: serverguide/C/mail.xml:712(para)
17902
msgid ""
17903
"Once you have chosen your mailbox type, edit the file "
17904
"<filename>/etc/dovecot/dovecot.conf</filename> and change the following line:"
17905
msgstr ""
17906
17907
#: serverguide/C/mail.xml:717(programlisting)
17908
#, no-wrap
17909
msgid ""
17910
"\n"
17911
"mail_location = maildir:~/Maildir # (for maildir)\n"
17912
"or\n"
17913
"mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u # (for mbox)\n"
17914
msgstr ""
17915
17916
#: serverguide/C/mail.xml:723(para)
17917
msgid ""
17918
"You should configure your Mail Transport Agent (MTA) to transfer the "
17919
"incoming mail to this type of mailbox if it is different from the one you "
17920
"have configured."
17921
msgstr ""
17922
17923
#: serverguide/C/mail.xml:729(para)
17924
msgid ""
17925
"Once you have configured dovecot, restart the "
17926
"<application>dovecot</application> daemon in order to test your setup:"
17927
msgstr ""
17928
17929
#: serverguide/C/mail.xml:738(para)
17930
msgid ""
17931
"If you have enabled imap, or pop3, you can also try to log in with the "
17932
"commands <command>telnet localhost pop3</command> or <command>telnet "
17933
"localhost imap2</command>. If you see something like the following, the "
17934
"installation has been successful:"
17935
msgstr ""
17936
17937
#: serverguide/C/mail.xml:745(programlisting)
17938
#, no-wrap
17939
msgid ""
17940
"\n"
17941
"bhuvan@rainbow:~$ telnet localhost pop3\n"
17942
"Trying 127.0.0.1...\n"
17943
"Connected to localhost.localdomain.\n"
17944
"Escape character is '^]'.\n"
17945
"+OK Dovecot ready.\n"
17946
msgstr ""
17947
17948
#: serverguide/C/mail.xml:754(title)
17949
msgid "Dovecot SSL Configuration"
17950
msgstr ""
17951
17952
#: serverguide/C/mail.xml:755(para)
17953
msgid ""
17954
"To configure <application>dovecot</application> to use SSL, you can edit the "
17955
"file <filename>/etc/dovecot/dovecot.conf</filename> and amend following "
17956
"lines:"
17957
msgstr ""
17958
17959
#: serverguide/C/mail.xml:760(programlisting)
17960
#, no-wrap
17961
msgid ""
17962
"\n"
17963
"ssl_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem\n"
17964
"ssl_key_file = /etc/ssl/private/ssl-cert-snakeoil.key\n"
17965
"ssl_disable = no\n"
17966
"disable_plaintext_auth = no\n"
17967
msgstr ""
17968
17969
#: serverguide/C/mail.xml:766(para)
17970
msgid ""
17971
"You can get the SSL certificate from a Certificate Issuing Authority or you "
17972
"can create self signed SSL certificate. The latter is a good option for "
17973
"email, because SMTP clients rarely complain about \"self-signed "
17974
"certificates\". Please refer to <xref linkend=\"certificates-and-"
17975
"security\"/> for details about how to create self signed SSL certificate. "
17976
"Once you create the certificate, you will have a key file and a certificate "
17977
"file. Please copy them to the location pointed in the "
17978
"<filename>/etc/dovecot/dovecot.conf</filename> configuration file."
17979
msgstr ""
17980
17981
#: serverguide/C/mail.xml:781(title)
17982
msgid "Firewall Configuration for an Email Server"
17983
msgstr ""
17984
17985
#: serverguide/C/mail.xml:787(para)
17986
msgid "IMAP - 143"
17987
msgstr ""
17988
17989
#: serverguide/C/mail.xml:788(para)
17990
msgid "IMAPS - 993"
17991
msgstr ""
17992
17993
#: serverguide/C/mail.xml:789(para)
17994
msgid "POP3 - 110"
17995
msgstr ""
17996
17997
#: serverguide/C/mail.xml:790(para)
17998
msgid "POP3S - 995"
17999
msgstr ""
18000
18001
#: serverguide/C/mail.xml:782(para)
18002
msgid ""
18003
"To access your mail server from another computer, you must configure your "
18004
"firewall to allow connections to the server on the necessary ports. "
18005
"<placeholder-1/>"
18006
msgstr ""
18007
18008
#: serverguide/C/mail.xml:799(para)
18009
msgid ""
18010
"See the <ulink url=\"http://www.dovecot.org/\">Dovecot website</ulink> for "
18011
"more information."
18012
msgstr ""
18013
18014
#: serverguide/C/mail.xml:804(para)
18015
msgid ""
18016
"Also, the <ulink url=\"https://help.ubuntu.com/community/Dovecot\">Dovecot "
18017
"Ubuntu Wiki</ulink> page has more details."
18018
msgstr ""
18019
18020
#: serverguide/C/mail.xml:813(title) serverguide/C/mail.xml:890(title) serverguide/C/mail.xml:1113(title)
18021
msgid "Mailman"
18022
msgstr ""
18023
18024
#: serverguide/C/mail.xml:814(para)
18025
msgid ""
18026
"Mailman is an open source program for managing electronic mail discussions "
18027
"and e-newsletter lists. Many open source mailing lists (including all the "
18028
"<ulink url=\"http://lists.ubuntu.com\">Ubuntu mailing lists</ulink>) use "
18029
"Mailman as their mailing list software. It is powerful and easy to install "
18030
"and maintain."
18031
msgstr ""
18032
18033
#: serverguide/C/mail.xml:824(para)
18034
msgid ""
18035
"Mailman provides a web interface for the administrators and users, using an "
18036
"external mail server to send and receive emails. It works perfectly with the "
18037
"following mail servers:"
18038
msgstr ""
18039
18040
#: serverguide/C/mail.xml:835(application)
18041
msgid "Exim"
18042
msgstr ""
18043
18044
#: serverguide/C/mail.xml:838(application)
18045
msgid "Sendmail"
18046
msgstr ""
18047
18048
#: serverguide/C/mail.xml:841(application)
18049
msgid "Qmail"
18050
msgstr ""
18051
18052
#: serverguide/C/mail.xml:846(para)
18053
msgid ""
18054
"We will see how to install and configure Mailman with, the Apache web "
18055
"server, and either the Postfix or Exim mail server. If you wish to install "
18056
"Mailman with a different mail server, please refer to the references section."
18057
msgstr ""
18058
18059
#: serverguide/C/mail.xml:853(para)
18060
msgid ""
18061
"You only need to install one mail server and "
18062
"<application>Postfix</application> is the default Ubuntu Mail Transfer Agent."
18063
msgstr ""
18064
18065
#: serverguide/C/mail.xml:858(title) serverguide/C/mail.xml:917(title)
18066
msgid "Apache2"
18067
msgstr ""
18068
18069
#: serverguide/C/mail.xml:859(para)
18070
msgid ""
18071
"To install apache2 you refer to <ulink url=\"./web-servers.xml#http-"
18072
"installation\">HTTPD Installation</ulink> section for details."
18073
msgstr ""
18074
18075
#: serverguide/C/mail.xml:867(para)
18076
msgid ""
18077
"For instructions on installing and configuring Postfix refer to <xref "
18078
"linkend=\"postfix\"/>"
18079
msgstr ""
18080
18081
#: serverguide/C/mail.xml:873(para)
18082
msgid "To install Exim4 refer to <xref linkend=\"exim4\"/>."
18083
msgstr ""
18084
18085
#: serverguide/C/mail.xml:884(application)
18086
msgid "dc_use_split_config='true'"
18087
msgstr ""
18088
18089
#: serverguide/C/mail.xml:876(para)
18090
msgid ""
18091
"Once exim4 is installed, the configuration files are stored in the "
18092
"<filename>/etc/exim4</filename> directory. In Ubuntu, by default, the exim4 "
18093
"configuration files are split across different files. You can change this "
18094
"behavior by changing the following variable in the "
18095
"<filename>/etc/exim4/update-exim4.conf</filename> file: <placeholder-1/>"
18096
msgstr ""
18097
18098
#: serverguide/C/mail.xml:891(para)
18099
msgid ""
18100
"To install <application>Mailman</application>, run following command at a "
18101
"terminal prompt:"
18102
msgstr ""
18103
18104
#: serverguide/C/mail.xml:895(command)
18105
msgid "sudo apt-get install mailman"
18106
msgstr ""
18107
18108
#: serverguide/C/mail.xml:897(para)
18109
msgid ""
18110
"It copies the installation files in "
18111
"<application>/var/lib/mailman</application> directory. It installs the CGI "
18112
"scripts in <application>/usr/lib/cgi-bin/mailman</application> directory. It "
18113
"creates <emphasis>list</emphasis> linux user. It creates the "
18114
"<emphasis>list</emphasis> linux group. The mailman process will be owned by "
18115
"this user."
18116
msgstr ""
18117
18118
#: serverguide/C/mail.xml:909(para)
18119
msgid ""
18120
"This section assumes you have successfully installed "
18121
"<application>mailman</application>, <application>apache2</application>, and "
18122
"<application>postfix</application> or <application>exim4</application>. Now "
18123
"you just need to configure them."
18124
msgstr ""
18125
18126
#: serverguide/C/mail.xml:918(para)
18127
msgid ""
18128
"An example Apache configuration file comes with "
18129
"<application>Mailman</application> and is placed in "
18130
"<filename>/etc/mailman/apache.conf</filename>. In order for Apache to use "
18131
"the config file it needs to be copied to <filename>/etc/apache2/sites-"
18132
"available</filename>:"
18133
msgstr ""
18134
18135
#: serverguide/C/mail.xml:924(command)
18136
msgid ""
18137
"sudo cp /etc/mailman/apache.conf /etc/apache2/sites-available/mailman.conf"
18138
msgstr ""
18139
18140
#: serverguide/C/mail.xml:926(para)
18141
msgid ""
18142
"This will setup a new Apache <emphasis>VirtualHost</emphasis> for the "
18143
"Mailman administration site. Now enable the new configuration and restart "
18144
"Apache:"
18145
msgstr ""
18146
18147
#: serverguide/C/mail.xml:931(command)
18148
msgid "sudo a2ensite mailman.conf"
18149
msgstr ""
18150
18151
#: serverguide/C/mail.xml:934(para)
18152
msgid ""
18153
"Mailman uses apache2 to render its CGI scripts. The mailman CGI scripts are "
18154
"installed in the <application>/usr/lib/cgi-bin/mailman</application> "
18155
"directory. So, the mailman url will be http://hostname/cgi-bin/mailman/. You "
18156
"can make changes to the <filename>/etc/apache2/sites-"
18157
"available/mailman.conf</filename> file if you wish to change this behavior."
18158
msgstr ""
18159
18160
#: serverguide/C/mail.xml:945(para)
18161
msgid ""
18162
"For <application>Postfix</application> integration, we will associate the "
18163
"domain lists.example.com with the mailing lists. Please replace "
18164
"<emphasis>lists.example.com</emphasis> with the domain of your choosing."
18165
msgstr ""
18166
18167
#: serverguide/C/mail.xml:949(para)
18168
msgid ""
18169
"You can use the postconf command to add the necessary configuration to "
18170
"<filename>/etc/postfix/main.cf</filename>:"
18171
msgstr ""
18172
18173
#: serverguide/C/mail.xml:953(command)
18174
msgid "sudo postconf -e 'relay_domains = lists.example.com'"
18175
msgstr ""
18176
18177
#: serverguide/C/mail.xml:954(command)
18178
msgid "sudo postconf -e 'transport_maps = hash:/etc/postfix/transport'"
18179
msgstr ""
18180
18181
#: serverguide/C/mail.xml:955(command)
18182
msgid "sudo postconf -e 'mailman_destination_recipient_limit = 1'"
18183
msgstr ""
18184
18185
#: serverguide/C/mail.xml:957(para)
18186
msgid ""
18187
"In <filename>/etc/postfix/master.cf</filename> double check that you have "
18188
"the following transport:"
18189
msgstr ""
18190
18191
#: serverguide/C/mail.xml:960(programlisting)
18192
#, no-wrap
18193
msgid ""
18194
"\n"
18195
"mailman unix - n n - - pipe\n"
18196
" flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py\n"
18197
" ${nexthop} ${user}\n"
18198
msgstr ""
18199
18200
#: serverguide/C/mail.xml:965(para)
18201
msgid ""
18202
"It calls the <emphasis>postfix-to-mailman.py</emphasis> script when a mail "
18203
"is delivered to a list."
18204
msgstr ""
18205
18206
#: serverguide/C/mail.xml:968(para)
18207
msgid ""
18208
"Associate the domain lists.example.com to the Mailman transport with the "
18209
"transport map. Edit the file <filename>/etc/postfix/transport</filename>:"
18210
msgstr ""
18211
18212
#: serverguide/C/mail.xml:971(programlisting)
18213
#, no-wrap
18214
msgid ""
18215
"\n"
18216
"lists.example.com mailman:\n"
18217
msgstr ""
18218
18219
#: serverguide/C/mail.xml:974(para)
18220
msgid ""
18221
"Now have <application>Postfix</application> build the transport map by "
18222
"entering the following from a terminal prompt:"
18223
msgstr ""
18224
18225
#: serverguide/C/mail.xml:978(command)
18226
msgid "sudo postmap -v /etc/postfix/transport"
18227
msgstr ""
18228
18229
#: serverguide/C/mail.xml:980(para)
18230
msgid "Then restart Postfix to enable the new configurations:"
18231
msgstr ""
18232
18233
#: serverguide/C/mail.xml:989(para)
18234
msgid ""
18235
"Once Exim4 is installed, you can start the Exim server using the following "
18236
"command from a terminal prompt:"
18237
msgstr ""
18238
18239
#: serverguide/C/mail.xml:1005(para) serverguide/C/mail.xml:1020(title)
18240
msgid "Main"
18241
msgstr ""
18242
18243
#: serverguide/C/mail.xml:1008(para) serverguide/C/mail.xml:1060(title)
18244
msgid "Transport"
18245
msgstr ""
18246
18247
#: serverguide/C/mail.xml:1011(para) serverguide/C/mail.xml:1083(title)
18248
msgid "Router"
18249
msgstr ""
18250
18251
#: serverguide/C/mail.xml:996(para)
18252
msgid ""
18253
"In order to make mailman work with Exim4, you need to configure Exim4. As "
18254
"mentioned earlier, by default, Exim4 uses multiple configuration files of "
18255
"different types. For details, please refer to the <ulink "
18256
"url=\"http://www.exim.org\">Exim</ulink> web site. To run mailman, we should "
18257
"add new a configuration file to the following configuration types: "
18258
"<placeholder-1/> Exim creates a master configuration file by sorting all "
18259
"these mini configuration files. So, the order of these configuration files "
18260
"is very important."
18261
msgstr ""
18262
18263
#: serverguide/C/mail.xml:1027(programlisting)
18264
#, no-wrap
18265
msgid ""
18266
"\n"
18267
"# start\n"
18268
"# Home dir for your Mailman installation -- aka Mailman's prefix\n"
18269
"# directory.\n"
18270
"# On Ubuntu this should be \"/var/lib/mailman\"\n"
18271
"# This is normally the same as ~mailman\n"
18272
"MM_HOME=/var/lib/mailman\n"
18273
"#\n"
18274
"# User and group for Mailman, should match your --with-mail-gid\n"
18275
"# switch to Mailman's configure script. Value is normally \"mailman\"\n"
18276
"MM_UID=list\n"
18277
"MM_GID=list\n"
18278
"#\n"
18279
"# Domains that your lists are in - colon separated list\n"
18280
"# you may wish to add these into local_domains as well\n"
18281
"domainlist mm_domains=hostname.com\n"
18282
"#\n"
18283
"# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
18284
"#\n"
18285
"# These values are derived from the ones above and should not need\n"
18286
"# editing unless you have munged your mailman installation\n"
18287
"#\n"
18288
"# The path of the Mailman mail wrapper script\n"
18289
"MM_WRAP=MM_HOME/mail/mailman\n"
18290
"#\n"
18291
"# The path of the list config file (used as a required file when\n"
18292
"# verifying list addresses)\n"
18293
"MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck\n"
18294
"# end\n"
18295
msgstr ""
18296
18297
#: serverguide/C/mail.xml:1021(para)
18298
msgid ""
18299
"All the configuration files belonging to the main type are stored in the "
18300
"<filename>/etc/exim4/conf.d/main/</filename> directory. You can add the "
18301
"following content to a new file, named <filename>04_exim4-"
18302
"config_mailman</filename>: <placeholder-1/>"
18303
msgstr ""
18304
18305
#: serverguide/C/mail.xml:1067(programlisting)
18306
#, no-wrap
18307
msgid ""
18308
"\n"
18309
" mailman_transport:\n"
18310
" driver = pipe\n"
18311
" command = MM_WRAP \\\n"
18312
" '${if def:local_part_suffix \\\n"
18313
" {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} "
18314
"\\\n"
18315
" {post}}' \\\n"
18316
" $local_part\n"
18317
" current_directory = MM_HOME\n"
18318
" home_directory = MM_HOME\n"
18319
" user = MM_UID\n"
18320
" group = MM_GID\n"
18321
msgstr ""
18322
18323
#: serverguide/C/mail.xml:1061(para)
18324
msgid ""
18325
"All the configuration files belonging to transport type are stored in the "
18326
"<filename>/etc/exim4/conf.d/transport/</filename> directory. You can add the "
18327
"following content to a new file named <filename> 40_exim4-"
18328
"config_mailman</filename>: <placeholder-1/>"
18329
msgstr ""
18330
18331
#: serverguide/C/mail.xml:1088(programlisting)
18332
#, no-wrap
18333
msgid ""
18334
"\n"
18335
" mailman_router:\n"
18336
" driver = accept\n"
18337
" require_files = MM_HOME/lists/$local_part/config.pck\n"
18338
" local_part_suffix_optional\n"
18339
" local_part_suffix = -bounces : -bounces+* : \\\n"
18340
" -confirm+* : -join : -leave : \\\n"
18341
" -owner : -request : -admin\n"
18342
" transport = mailman_transport\n"
18343
msgstr ""
18344
18345
#: serverguide/C/mail.xml:1084(para)
18346
msgid ""
18347
"All the configuration files belonging to router type are stored in the "
18348
"<filename>/etc/exim4/conf.d/router/</filename> directory. You can add the "
18349
"following content in to a new file named <filename>101_exim4-"
18350
"config_mailman</filename>: <placeholder-1/>"
18351
msgstr ""
18352
18353
#: serverguide/C/mail.xml:1101(para)
18354
msgid ""
18355
"The order of main and transport configuration files can be in any order. "
18356
"But, the order of router configuration files must be the same. This "
18357
"particular file must appear before the <application>200_exim4-"
18358
"config_primary</application> file. These two configuration files contain "
18359
"same type of information. The first file takes the precedence. For more "
18360
"details, please refer to the references section."
18361
msgstr ""
18362
18363
#: serverguide/C/mail.xml:1114(para)
18364
msgid ""
18365
"Once mailman is installed, you can run it using the following command:"
18366
msgstr ""
18367
18368
#: serverguide/C/mail.xml:1118(command)
18369
msgid "sudo /etc/init.d/mailman start"
18370
msgstr ""
18371
18372
#: serverguide/C/mail.xml:1120(para)
18373
msgid ""
18374
"Once mailman is installed, you should create the default mailing list. Run "
18375
"the following command to create the mailing list:"
18376
msgstr ""
18377
18378
#: serverguide/C/mail.xml:1126(command)
18379
msgid "sudo /usr/sbin/newlist mailman"
18380
msgstr ""
18381
18382
#: serverguide/C/mail.xml:1129(programlisting)
18383
#, no-wrap
18384
msgid ""
18385
"\n"
18386
" Enter the email address of the person running the list: bhuvan at "
18387
"ubuntu.com\n"
18388
" Initial mailman password:\n"
18389
" To finish creating your mailing list, you must edit your "
18390
"<filename>/etc/aliases</filename> (or\n"
18391
" equivalent) file by adding the following lines, and possibly running the\n"
18392
" `newaliases' program:\n"
18393
"\n"
18394
" ## mailman mailing list\n"
18395
" mailman: \"|/var/lib/mailman/mail/mailman post mailman\"\n"
18396
" mailman-admin: \"|/var/lib/mailman/mail/mailman admin mailman\"\n"
18397
" mailman-bounces: \"|/var/lib/mailman/mail/mailman bounces mailman\"\n"
18398
" mailman-confirm: \"|/var/lib/mailman/mail/mailman confirm mailman\"\n"
18399
" mailman-join: \"|/var/lib/mailman/mail/mailman join mailman\"\n"
18400
" mailman-leave: \"|/var/lib/mailman/mail/mailman leave mailman\"\n"
18401
" mailman-owner: \"|/var/lib/mailman/mail/mailman owner mailman\"\n"
18402
" mailman-request: \"|/var/lib/mailman/mail/mailman request mailman\"\n"
18403
" mailman-subscribe: \"|/var/lib/mailman/mail/mailman subscribe "
18404
"mailman\"\n"
18405
" mailman-unsubscribe: \"|/var/lib/mailman/mail/mailman unsubscribe "
18406
"mailman\"\n"
18407
"\n"
18408
" Hit enter to notify mailman owner...\n"
18409
"\n"
18410
" # \n"
18411
msgstr ""
18412
18413
#: serverguide/C/mail.xml:1152(para)
18414
msgid ""
18415
"We have configured either Postfix or Exim4 to recognize all emails from "
18416
"mailman. So, it is not mandatory to make any new entries in "
18417
"<filename>/etc/aliases</filename>. If you have made any changes to the "
18418
"configuration files, please ensure that you restart those services before "
18419
"continuing to next section."
18420
msgstr ""
18421
18422
#: serverguide/C/mail.xml:1160(para)
18423
msgid ""
18424
"The Exim4 does not use the above aliases to forward mails to Mailman, as it "
18425
"uses a <emphasis>discover</emphasis> approach. To suppress the aliases while "
18426
"creating the list, you can add <emphasis>MTA=None</emphasis> line in Mailman "
18427
"configuration file, <filename>/etc/mailman/mm_cfg.py</filename>."
18428
msgstr ""
18429
18430
#: serverguide/C/mail.xml:1171(title)
18431
msgid "Administration"
18432
msgstr ""
18433
18434
#: serverguide/C/mail.xml:1172(para)
18435
msgid ""
18436
"We assume you have a default installation. The mailman cgi scripts are still "
18437
"in the <application>/usr/lib/cgi-bin/mailman/</application> directory. "
18438
"Mailman provides a web based administration facility. To access this page, "
18439
"point your browser to the following url:"
18440
msgstr ""
18441
18442
#: serverguide/C/mail.xml:1180(para)
18443
msgid "http://hostname/cgi-bin/mailman/admin"
18444
msgstr ""
18445
18446
#: serverguide/C/mail.xml:1184(para)
18447
msgid ""
18448
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18449
"screen. If you click the mailing list name, it will ask for your "
18450
"authentication password. If you enter the correct password, you will be able "
18451
"to change administrative settings of this mailing list. You can create a new "
18452
"mailing list using the command line utility "
18453
"(<command>/usr/sbin/newlist</command>). Alternatively, you can create a new "
18454
"mailing list using the web interface."
18455
msgstr ""
18456
18457
#: serverguide/C/mail.xml:1197(title)
18458
msgid "Users"
18459
msgstr ""
18460
18461
#: serverguide/C/mail.xml:1198(para)
18462
msgid ""
18463
"Mailman provides a web based interface for users. To access this page, point "
18464
"your browser to the following url:"
18465
msgstr ""
18466
18467
#: serverguide/C/mail.xml:1203(para)
18468
msgid "http://hostname/cgi-bin/mailman/listinfo"
18469
msgstr ""
18470
18471
#: serverguide/C/mail.xml:1207(para)
18472
msgid ""
18473
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18474
"screen. If you click the mailing list name, it will display the subscription "
18475
"form. You can enter your email address, name (optional), and password to "
18476
"subscribe. An email invitation will be sent to you. You can follow the "
18477
"instructions in the email to subscribe."
18478
msgstr ""
18479
18480
#: serverguide/C/mail.xml:1219(ulink)
18481
msgid "GNU Mailman - Installation Manual"
18482
msgstr ""
18483
18484
#: serverguide/C/mail.xml:1223(ulink)
18485
msgid "HOWTO - Using Exim 4 and Mailman 2.1 together"
18486
msgstr ""
18487
18488
#: serverguide/C/mail.xml:1226(para)
18489
msgid ""
18490
"Also, see the <ulink "
18491
"url=\"https://help.ubuntu.com/community/Mailman\">Mailman Ubuntu "
18492
"Wiki</ulink> page."
18493
msgstr ""
18494
18495
#: serverguide/C/mail.xml:1232(title)
18496
msgid "Mail Filtering"
18497
msgstr ""
18498
18499
#: serverguide/C/mail.xml:1233(para)
18500
msgid ""
18501
"One of the largest issues with email today is the problem of Unsolicited "
18502
"Bulk Email (UBE). Also known as SPAM, such messages may also carry viruses "
18503
"and other forms of malware. According to some reports these messages make up "
18504
"the bulk of all email traffic on the Internet."
18505
msgstr ""
18506
18507
#: serverguide/C/mail.xml:1238(para)
18508
msgid ""
18509
"This section will cover integrating <application>Amavisd-new</application>, "
18510
"<application>Spamassassin</application>, and "
18511
"<application>ClamAV</application> with the "
18512
"<application>Postfix</application> Mail Transport Agent (MTA). "
18513
"<application>Postfix</application> can also check email validity by passing "
18514
"it through external content filters. These filters can sometimes determine "
18515
"if a message is spam without needing to process it with more resource "
18516
"intensive applications. Two common filters are <application>dkim-"
18517
"filter</application> and <application>python-policyd-spf</application>."
18518
msgstr ""
18519
18520
#: serverguide/C/mail.xml:1248(para)
18521
msgid ""
18522
"<application>Amavisd-new</application> is a wrapper program that can call "
18523
"any number of content filtering programs for spam detection, antivirus, etc."
18524
msgstr ""
18525
18526
#: serverguide/C/mail.xml:1254(para)
18527
msgid ""
18528
"<application>Spamassassin</application> uses a variety of mechanisms to "
18529
"filter email based on the message content."
18530
msgstr ""
18531
18532
#: serverguide/C/mail.xml:1259(para)
18533
msgid ""
18534
"<application>ClamAV</application> is an open source antivirus application."
18535
msgstr ""
18536
18537
#: serverguide/C/mail.xml:1264(para)
18538
msgid ""
18539
"<application>dkim-filter</application> implements a Sendmail Mail Filter "
18540
"(Milter) for the DomainKeys Identified Mail (DKIM) standard."
18541
msgstr ""
18542
18543
#: serverguide/C/mail.xml:1270(para)
18544
msgid ""
18545
"<application>python-policyd-spf</application> enables Sender Policy "
18546
"Framework (SPF) checking with <application>Postfix</application>."
18547
msgstr ""
18548
18549
#: serverguide/C/mail.xml:1275(para)
18550
msgid "This is how the pieces fit together:"
18551
msgstr ""
18552
18553
#: serverguide/C/mail.xml:1280(para)
18554
msgid "An email message is accepted by <application>Postfix</application>."
18555
msgstr ""
18556
18557
#: serverguide/C/mail.xml:1285(para)
18558
msgid ""
18559
"The message is passed through any external filters <application>dkim-"
18560
"filter</application> and <application>python-policyd-spf</application> in "
18561
"this case."
18562
msgstr ""
18563
18564
#: serverguide/C/mail.xml:1291(para)
18565
msgid "<application>Amavisd-new</application> then processes the message."
18566
msgstr ""
18567
18568
#: serverguide/C/mail.xml:1296(para)
18569
msgid ""
18570
"<application>ClamAV</application> is used to scan the message. If the "
18571
"message contains a virus <application>Postfix</application> will reject the "
18572
"message."
18573
msgstr ""
18574
18575
#: serverguide/C/mail.xml:1302(para)
18576
msgid ""
18577
"Clean messages will then be analyzed by "
18578
"<application>Spamassassin</application> to find out if the message is spam. "
18579
"<application>Spamassassin</application> will then add X-Header lines "
18580
"allowing <application>Amavisd-new</application> to further manipulate the "
18581
"message."
18582
msgstr ""
18583
18584
#: serverguide/C/mail.xml:1309(para)
18585
msgid ""
18586
"For example, if a message has a Spam score of over fifty the message could "
18587
"be automatically dropped from the queue without the recipient ever having to "
18588
"be bothered. Another, way to handle flagged messages is to deliver them to "
18589
"the Mail User Agent (MUA) allowing the user to deal with the message as they "
18590
"see fit."
18591
msgstr ""
18592
18593
#: serverguide/C/mail.xml:1316(para)
18594
msgid ""
18595
"See <xref linkend=\"postfix\"/> for instructions on installing and "
18596
"configuring Postfix."
18597
msgstr ""
18598
18599
#: serverguide/C/mail.xml:1319(para)
18600
msgid ""
18601
"To install the rest of the applications enter the following from a terminal "
18602
"prompt:"
18603
msgstr ""
18604
18605
#: serverguide/C/mail.xml:1323(command)
18606
msgid "sudo apt-get install amavisd-new spamassassin clamav-daemon"
18607
msgstr ""
18608
18609
#: serverguide/C/mail.xml:1324(command)
18610
msgid "sudo apt-get install dkim-filter python-policyd-spf"
18611
msgstr ""
18612
18613
#: serverguide/C/mail.xml:1326(para)
18614
msgid ""
18615
"There are some optional packages that integrate with "
18616
"<application>Spamassassin</application> for better spam detection:"
18617
msgstr ""
18618
18619
#: serverguide/C/mail.xml:1330(command)
18620
msgid "sudo apt-get install pyzor razor"
18621
msgstr ""
18622
18623
#: serverguide/C/mail.xml:1332(para)
18624
msgid ""
18625
"Along with the main filtering applications compression utilities are needed "
18626
"to process some email attachments:"
18627
msgstr ""
18628
18629
#: serverguide/C/mail.xml:1336(command)
18630
msgid ""
18631
"sudo apt-get install arj cabextract cpio lha nomarch pax rar unrar unzip zip"
18632
msgstr ""
18633
18634
#: serverguide/C/mail.xml:1339(para)
18635
msgid ""
18636
"If some packages are not found, check that the "
18637
"<emphasis>multiverse</emphasis> repository is enabled in "
18638
"<filename>/etc/apt/sources.list</filename>"
18639
msgstr ""
18640
18641
#: serverguide/C/mail.xml:1340(para)
18642
msgid ""
18643
"If you make changes to the file, be sure to run <command>sudo apt-get "
18644
"update</command> before trying to install again."
18645
msgstr ""
18646
18647
#: serverguide/C/mail.xml:1345(para)
18648
msgid "Now configure everything to work together and filter email."
18649
msgstr ""
18650
18651
#: serverguide/C/mail.xml:1349(title)
18652
msgid "ClamAV"
18653
msgstr ""
18654
18655
#: serverguide/C/mail.xml:1350(para)
18656
msgid ""
18657
"The default behaviour of <application>ClamAV</application> will fit our "
18658
"needs. For more ClamAV configuration options, check the configuration files "
18659
"in <filename>/etc/clamav</filename>."
18660
msgstr ""
18661
18662
#: serverguide/C/mail.xml:1355(para)
18663
msgid ""
18664
"Add the <emphasis>clamav</emphasis> user to the <emphasis>amavis</emphasis> "
18665
"group in order for <application>Amavisd-new</application> to have the "
18666
"appropriate access to scan files:"
18667
msgstr ""
18668
18669
#: serverguide/C/mail.xml:1360(command)
18670
msgid "sudo adduser clamav amavis"
18671
msgstr ""
18672
18673
#: serverguide/C/mail.xml:1364(title)
18674
msgid "Spamassassin"
18675
msgstr ""
18676
18677
#: serverguide/C/mail.xml:1365(para)
18678
msgid ""
18679
"Spamassassin automatically detects optional components and will use them if "
18680
"they are present. This means that there is no need to configure "
18681
"<application>pyzor</application> and <application>razor</application>."
18682
msgstr ""
18683
18684
#: serverguide/C/mail.xml:1369(para)
18685
msgid ""
18686
"Edit <filename>/etc/default/spamassassin</filename> to activate the "
18687
"<application>Spamassassin</application> daemon. Change "
18688
"<emphasis>ENABLED=0</emphasis> to:"
18689
msgstr ""
18690
18691
#: serverguide/C/mail.xml:1373(programlisting)
18692
#, no-wrap
18693
msgid ""
18694
"\n"
18695
"ENABLED=1\n"
18696
msgstr ""
18697
18698
#: serverguide/C/mail.xml:1376(para)
18699
msgid "Now start the daemon:"
18700
msgstr ""
18701
18702
#: serverguide/C/mail.xml:1380(command)
18703
msgid "sudo /etc/init.d/spamassassin start"
18704
msgstr ""
18705
18706
#: serverguide/C/mail.xml:1384(title)
18707
msgid "Amavisd-new"
18708
msgstr ""
18709
18710
#: serverguide/C/mail.xml:1385(para)
18711
msgid ""
18712
"First activate spam and antivirus detection in <application>Amavisd-"
18713
"new</application> by editing <filename>/etc/amavis/conf.d/15-"
18714
"content_filter_mode</filename>:"
18715
msgstr ""
18716
18717
#: serverguide/C/mail.xml:1389(programlisting)
18718
#, no-wrap
18719
msgid ""
18720
"\n"
18721
"use strict;\n"
18722
"\n"
18723
"# You can modify this file to re-enable SPAM checking through spamassassin\n"
18724
"# and to re-enable antivirus checking.\n"
18725
"\n"
18726
"#\n"
18727
"# Default antivirus checking mode\n"
18728
"# Uncomment the two lines below to enable it\n"
18729
"#\n"
18730
"\n"
18731
"@bypass_virus_checks_maps = (\n"
18732
" \\%bypass_virus_checks, \\@bypass_virus_checks_acl, \\"
18733
"$bypass_virus_checks_re);\n"
18734
"\n"
18735
"\n"
18736
"#\n"
18737
"# Default SPAM checking mode\n"
18738
"# Uncomment the two lines below to enable it\n"
18739
"#\n"
18740
"\n"
18741
"@bypass_spam_checks_maps = (\n"
18742
" \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\"
18743
"$bypass_spam_checks_re);\n"
18744
"\n"
18745
"1; # insure a defined return\n"
18746
msgstr ""
18747
18748
#: serverguide/C/mail.xml:1414(para)
18749
msgid ""
18750
"Bouncing spam can be a bad idea as the return address is often faked. "
18751
"Consider editing <filename>/etc/amavis/conf.d/20-debian_defaults</filename> "
18752
"to set <emphasis>$final_spam_destiny</emphasis> to D_DISCARD rather than "
18753
"D_BOUNCE, as follows:"
18754
msgstr ""
18755
18756
#: serverguide/C/mail.xml:1420(programlisting)
18757
#, no-wrap
18758
msgid ""
18759
"\n"
18760
"$final_spam_destiny = D_DISCARD;\n"
18761
msgstr ""
18762
18763
#: serverguide/C/mail.xml:1424(para)
18764
msgid ""
18765
"Additionally, you may want to adjust the following options to flag more "
18766
"messages as spam:"
18767
msgstr ""
18768
18769
#: serverguide/C/mail.xml:1428(programlisting)
18770
#, no-wrap
18771
msgid ""
18772
"\n"
18773
"$sa_tag_level_deflt = -999; # add spam info headers if at, or above that "
18774
"level\n"
18775
"$sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level\n"
18776
"$sa_kill_level_deflt = 21.0; # triggers spam evasive actions\n"
18777
"$sa_dsn_cutoff_level = 4; # spam level beyond which a DSN is not sent\n"
18778
msgstr ""
18779
18780
#: serverguide/C/mail.xml:1435(para)
18781
msgid ""
18782
"If the server's <emphasis>hostname</emphasis> is different from the domain's "
18783
"MX record you may need to manually set the <emphasis>$myhostname</emphasis> "
18784
"option. Also, if the server receives mail for multiple domains the "
18785
"<emphasis>@local_domains_acl</emphasis> option will need to be customized. "
18786
"Edit the <filename>/etc/amavis/conf.d/50-user</filename> file:"
18787
msgstr ""
18788
18789
#: serverguide/C/mail.xml:1442(programlisting)
18790
#, no-wrap
18791
msgid ""
18792
"\n"
18793
"$myhostname = 'mail.example.com';\n"
18794
"@local_domains_acl = ( \"example.com\", \"example.org\" );\n"
18795
msgstr ""
18796
18797
#: serverguide/C/mail.xml:1447(para)
18798
msgid ""
18799
"After configuration <application>Amavisd-new</application> needs to be "
18800
"restarted:"
18801
msgstr ""
18802
18803
#: serverguide/C/mail.xml:1451(command) serverguide/C/mail.xml:1497(command)
18804
msgid "sudo /etc/init.d/amavis restart"
18805
msgstr ""
18806
18807
#: serverguide/C/mail.xml:1454(title)
18808
msgid "DKIM Whitelist"
18809
msgstr ""
18810
18811
#: serverguide/C/mail.xml:1456(para)
18812
msgid ""
18813
"<application>Amavisd-new</application> can be configured to automatically "
18814
"<emphasis>Whitelist</emphasis> addresses from domains with valid Domain "
18815
"Keys. There are some pre-configured domains in the "
18816
"<filename>/etc/amavis/conf.d/40-policy_banks</filename>."
18817
msgstr ""
18818
18819
#: serverguide/C/mail.xml:1462(para)
18820
msgid "There are multiple ways to configure the Whitelist for a domain:"
18821
msgstr ""
18822
18823
#: serverguide/C/mail.xml:1468(para)
18824
msgid ""
18825
"<emphasis>'example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18826
"address from the \"example.com\" domain."
18827
msgstr ""
18828
18829
#: serverguide/C/mail.xml:1473(para)
18830
msgid ""
18831
"<emphasis>'.example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18832
"address from any <emphasis>subdomains</emphasis> of \"example.com\" that "
18833
"have a valid signature."
18834
msgstr ""
18835
18836
#: serverguide/C/mail.xml:1479(para)
18837
msgid ""
18838
"<emphasis>'.example.com/@example.com' => 'WHITELIST',</emphasis>: will "
18839
"whitelist subdomains of \"example.com\" that use the signature of <emphasis "
18840
"role=\"italic\">example.com</emphasis> the parent domain."
18841
msgstr ""
18842
18843
#: serverguide/C/mail.xml:1485(para)
18844
msgid ""
18845
"<emphasis>'./@example.com' => 'WHITELIST',</emphasis>: adds addresses "
18846
"that have a valid signature from \"example.com\". This is usually used for "
18847
"discussion groups that sign thier messages."
18848
msgstr ""
18849
18850
#: serverguide/C/mail.xml:1492(para)
18851
msgid ""
18852
"A domain can also have multiple Whitelist configurations. After, editing the "
18853
"file restart <application>amaisd-new</application>:"
18854
msgstr ""
18855
18856
#: serverguide/C/mail.xml:1501(para)
18857
msgid ""
18858
"In this context, once a domain has been added to the Whitelist the message "
18859
"will not receive any anti-virus or spam filtering. This may or may not be "
18860
"the intended behavior you wish for a domain."
18861
msgstr ""
18862
18863
#: serverguide/C/mail.xml:1511(para)
18864
msgid ""
18865
"For <application>Postfix</application> integration, enter the following from "
18866
"a terminal prompt:"
18867
msgstr ""
18868
18869
#: serverguide/C/mail.xml:1515(command)
18870
msgid "sudo postconf -e 'content_filter = smtp-amavis:[127.0.0.1]:10024'"
18871
msgstr ""
18872
18873
#: serverguide/C/mail.xml:1517(para)
18874
msgid ""
18875
"Next edit <filename>/etc/postfix/master.cf</filename> and add the following "
18876
"to the end of the file:"
18877
msgstr ""
18878
18879
#: serverguide/C/mail.xml:1520(programlisting)
18880
#, no-wrap
18881
msgid ""
18882
"\n"
18883
"smtp-amavis unix - - - - 2 smtp\n"
18884
" -o smtp_data_done_timeout=1200\n"
18885
" -o smtp_send_xforward_command=yes\n"
18886
" -o disable_dns_lookups=yes\n"
18887
" -o max_use=20\n"
18888
"\n"
18889
"127.0.0.1:10025 inet n - - - - smtpd\n"
18890
" -o content_filter=\n"
18891
" -o local_recipient_maps=\n"
18892
" -o relay_recipient_maps=\n"
18893
" -o smtpd_restriction_classes=\n"
18894
" -o smtpd_delay_reject=no\n"
18895
" -o smtpd_client_restrictions=permit_mynetworks,reject\n"
18896
" -o smtpd_helo_restrictions=\n"
18897
" -o smtpd_sender_restrictions=\n"
18898
" -o smtpd_recipient_restrictions=permit_mynetworks,reject\n"
18899
" -o smtpd_data_restrictions=reject_unauth_pipelining\n"
18900
" -o smtpd_end_of_data_restrictions=\n"
18901
" -o mynetworks=127.0.0.0/8\n"
18902
" -o smtpd_error_sleep_time=0\n"
18903
" -o smtpd_soft_error_limit=1001\n"
18904
" -o smtpd_hard_error_limit=1000\n"
18905
" -o smtpd_client_connection_count_limit=0\n"
18906
" -o smtpd_client_connection_rate_limit=0\n"
18907
" -o "
18908
"receive_override_options=no_header_body_checks,no_unknown_recipient_checks\n"
18909
msgstr ""
18910
18911
#: serverguide/C/mail.xml:1547(para)
18912
msgid ""
18913
"Also add the following two lines immediately below the "
18914
"<emphasis>\"pickup\"</emphasis> transport service:"
18915
msgstr ""
18916
18917
#: serverguide/C/mail.xml:1550(programlisting)
18918
#, no-wrap
18919
msgid ""
18920
"\n"
18921
" -o content_filter=\n"
18922
" -o receive_override_options=no_header_body_checks\n"
18923
msgstr ""
18924
18925
#: serverguide/C/mail.xml:1554(para)
18926
msgid ""
18927
"This will prevent messages that are generated to report on spam from being "
18928
"classified as spam."
18929
msgstr ""
18930
18931
#: serverguide/C/mail.xml:1557(para)
18932
msgid "Now restart <application>Postfix</application>:"
18933
msgstr ""
18934
18935
#: serverguide/C/mail.xml:1563(para)
18936
msgid "Content filtering with spam and virus detection is now enabled."
18937
msgstr ""
18938
18939
#: serverguide/C/mail.xml:1570(para)
18940
msgid ""
18941
"First, test that the <application>Amavisd-new</application> SMTP is "
18942
"listening:"
18943
msgstr ""
18944
18945
#: serverguide/C/mail.xml:1573(programlisting)
18946
#, no-wrap
18947
msgid ""
18948
"\n"
18949
"telnet localhost 10024\n"
18950
"Trying 127.0.0.1...\n"
18951
"Connected to localhost.\n"
18952
"Escape character is '^]'.\n"
18953
"220 [127.0.0.1] ESMTP amavisd-new service ready\n"
18954
"^]\n"
18955
msgstr ""
18956
18957
#: serverguide/C/mail.xml:1581(para)
18958
msgid ""
18959
"In the Header of messages that go through the content filter you should see:"
18960
msgstr ""
18961
18962
#: serverguide/C/mail.xml:1584(programlisting)
18963
#, no-wrap
18964
msgid ""
18965
"\n"
18966
"X-Spam-Level: \n"
18967
"X-Virus-Scanned: Debian amavisd-new at example.com\n"
18968
"X-Spam-Status: No, hits=-2.3 tagged_above=-1000.0 required=5.0 tests=AWL, "
18969
"BAYES_00\n"
18970
"X-Spam-Level: \n"
18971
msgstr ""
18972
18973
#: serverguide/C/mail.xml:1591(para)
18974
msgid ""
18975
"Your output will vary, but the important thing is that there are <emphasis>X-"
18976
"Virus-Scanned</emphasis> and <emphasis>X-Spam-Status</emphasis> entries."
18977
msgstr ""
18978
18979
#: serverguide/C/mail.xml:1599(para)
18980
msgid ""
18981
"The best way to figure out why something is going wrong is to check the log "
18982
"files."
18983
msgstr ""
18984
18985
#: serverguide/C/mail.xml:1604(para)
18986
msgid ""
18987
"For instructions on <application>Postfix</application> logging see the <xref "
18988
"linkend=\"postfix-troubleshooting\"/> section."
18989
msgstr ""
18990
18991
#: serverguide/C/mail.xml:1610(para)
18992
msgid ""
18993
"<application>Amavisd-new</application> uses "
18994
"<application>Syslog</application> to send messages to "
18995
"<filename>/var/log/mail.log</filename>. The amount of detail can be "
18996
"increased by adding the <emphasis>$log_level</emphasis> option to "
18997
"<filename>/etc/amavis/conf.d/50-user</filename>, and setting the value from "
18998
"1 to 5."
18999
msgstr ""
19000
19001
#: serverguide/C/mail.xml:1615(programlisting)
19002
#, no-wrap
19003
msgid ""
19004
"\n"
19005
"$log_level = 2;\n"
19006
msgstr ""
19007
19008
#: serverguide/C/mail.xml:1619(para)
19009
msgid ""
19010
"When the <application>Amavisd-new</application> log output is increased "
19011
"<application>Spamassassin</application> log output is also increased."
19012
msgstr ""
19013
19014
#: serverguide/C/mail.xml:1626(para)
19015
msgid ""
19016
"The <application>ClamAV</application> log level can be increased by editing "
19017
"<filename>/etc/clamav/clamd.conf</filename> and setting the following option:"
19018
msgstr ""
19019
19020
#: serverguide/C/mail.xml:1630(programlisting)
19021
#, no-wrap
19022
msgid ""
19023
"\n"
19024
"LogVerbose true\n"
19025
msgstr ""
19026
19027
#: serverguide/C/mail.xml:1633(para)
19028
msgid ""
19029
"By default <application>ClamAV</application> will send log messages to "
19030
"<filename>/var/log/clamav/clamav.log</filename>."
19031
msgstr ""
19032
19033
#: serverguide/C/mail.xml:1639(para)
19034
msgid ""
19035
"After changing an applications log settings remember to restart the service "
19036
"for the new settings to take affect. Also, once the issue you are "
19037
"troubleshooting is resolved it is a good idea to change the log settings "
19038
"back to normal."
19039
msgstr ""
19040
19041
#: serverguide/C/mail.xml:1647(para)
19042
msgid "For more information on filtering mail see the following links:"
19043
msgstr ""
19044
19045
#: serverguide/C/mail.xml:1653(ulink)
19046
msgid "Amavisd-new Documentation"
19047
msgstr ""
19048
19049
#: serverguide/C/mail.xml:1657(para)
19050
msgid ""
19051
"<ulink url=\"http://www.clamav.org/doc/latest/html/\">ClamAV "
19052
"Documentation</ulink> and <ulink "
19053
"url=\"http://wiki.clamav.net/Main/WebHome\">ClamAV Wiki</ulink>"
19054
msgstr ""
19055
19056
#: serverguide/C/mail.xml:1664(ulink)
19057
msgid "Spamassassin Wiki"
19058
msgstr ""
19059
19060
#: serverguide/C/mail.xml:1669(ulink)
19061
msgid "Pyzor Homepage"
19062
msgstr ""
19063
19064
#: serverguide/C/mail.xml:1674(ulink)
19065
msgid "Razor Homepage"
19066
msgstr ""
19067
19068
#: serverguide/C/mail.xml:1679(ulink)
19069
msgid "DKIM.org"
19070
msgstr ""
19071
19072
#: serverguide/C/mail.xml:1684(ulink)
19073
msgid "Postfix Amavis New"
19074
msgstr ""
19075
19076
#: serverguide/C/mail.xml:1688(para)
19077
msgid ""
19078
"Also, feel free to ask questions in the <emphasis>#ubuntu-server</emphasis> "
19079
"IRC channel on <ulink url=\"http://freenode.net\">freenode</ulink>."
19080
msgstr ""
19081
19082
#: serverguide/C/lamp-applications.xml:13(title)
19083
msgid "LAMP Applications"
19084
msgstr ""
19085
19086
#: serverguide/C/lamp-applications.xml:19(para)
19087
msgid ""
19088
"LAMP installations (Linux + Apache + MySQL + PHP) are a popular setup for "
19089
"Ubuntu servers. There is a plethora of Open Source applications written "
19090
"using the LAMP application stack. Some popular LAMP applications are Wiki's, "
19091
"Content Management Systems, and Management Software such as phpMyAdmin."
19092
msgstr ""
19093
19094
#: serverguide/C/lamp-applications.xml:26(para)
19095
msgid ""
19096
"One advantage of LAMP is the substantial flexibility for different database, "
19097
"web server, and scripting languages. Popular substitutes for MySQL include "
19098
"Posgresql and SQLite. Python, Perl, and Ruby are also frequently used "
19099
"instead of PHP."
19100
msgstr ""
19101
19102
#: serverguide/C/lamp-applications.xml:32(para)
19103
msgid ""
19104
"The traditional way to install most <emphasis>LAMP</emphasis> applications "
19105
"is:"
19106
msgstr ""
19107
19108
#: serverguide/C/lamp-applications.xml:38(para)
19109
msgid "Download an archive containing the application source files."
19110
msgstr ""
19111
19112
#: serverguide/C/lamp-applications.xml:43(para)
19113
msgid ""
19114
"Unpack the archive, usually in a directory accessible to a web server."
19115
msgstr ""
19116
19117
#: serverguide/C/lamp-applications.xml:48(para)
19118
msgid ""
19119
"Depending on where the source was extracted, configure a web browser to "
19120
"serve the files."
19121
msgstr ""
19122
19123
#: serverguide/C/lamp-applications.xml:53(para)
19124
msgid "Configure the application to connect to the database."
19125
msgstr ""
19126
19127
#: serverguide/C/lamp-applications.xml:58(para)
19128
msgid ""
19129
"Run a script, or browse to a page of the application, to install the "
19130
"database needed by the application."
19131
msgstr ""
19132
19133
#: serverguide/C/lamp-applications.xml:63(para)
19134
msgid ""
19135
"Once the steps above, or similar steps, are completed you are ready to begin "
19136
"using the application."
19137
msgstr ""
19138
19139
#: serverguide/C/lamp-applications.xml:69(para)
19140
msgid ""
19141
"A disadvantage of using this approach is that the application files are not "
19142
"placed in the file system in a standard way, which can cause confusion as to "
19143
"where the application is installed. Another larger disadvantage is updating "
19144
"the application. When a new version is released, the same process used to "
19145
"install the application is needed to apply updates."
19146
msgstr ""
19147
19148
#: serverguide/C/lamp-applications.xml:76(para)
19149
msgid ""
19150
"Fortunately, a number of <emphasis>LAMP</emphasis> applications are already "
19151
"packaged for Ubuntu, and are available for installation in the same way as "
19152
"non-LAMP applications. Depending on the application some extra configuration "
19153
"and setup steps may be needed, however."
19154
msgstr ""
19155
19156
#: serverguide/C/lamp-applications.xml:82(para)
19157
msgid ""
19158
"This section covers howto install and configure the Wiki applications "
19159
"<application>MoinMoin</application>, <application>MediaWiki</application>, "
19160
"and the MySQL management application <application>phpMyAdmin</application>."
19161
msgstr ""
19162
19163
#: serverguide/C/lamp-applications.xml:88(para)
19164
msgid ""
19165
"A Wiki is a website that allows the visitors to easily add, remove and "
19166
"modify available content easily. The ease of interaction and operation makes "
19167
"Wiki an effective tool for mass collaborative authoring. The term Wiki is "
19168
"also referred to the collaborative software."
19169
msgstr ""
19170
19171
#: serverguide/C/lamp-applications.xml:100(title)
19172
msgid "Moin Moin"
19173
msgstr ""
19174
19175
#: serverguide/C/lamp-applications.xml:102(para)
19176
msgid ""
19177
"MoinMoin is a Wiki engine implemented in Python, based on the PikiPiki Wiki "
19178
"engine, and licensed under the GNU GPL."
19179
msgstr ""
19180
19181
#: serverguide/C/lamp-applications.xml:110(para)
19182
msgid ""
19183
"To install <application>MoinMoin</application>, run the following command in "
19184
"the command prompt:"
19185
msgstr ""
19186
19187
#: serverguide/C/lamp-applications.xml:116(command)
19188
msgid "sudo apt-get install python-moinmoin"
19189
msgstr ""
19190
19191
#: serverguide/C/lamp-applications.xml:119(para)
19192
msgid ""
19193
"You should also install <application>apache2</application> web server. For "
19194
"installing <application>apache2</application> web server, please refer to "
19195
"<xref linkend=\"http-installation\"/> sub-section in <xref "
19196
"linkend=\"httpd\"/> section."
19197
msgstr ""
19198
19199
#: serverguide/C/lamp-applications.xml:130(para)
19200
msgid ""
19201
"For configuring your first Wiki application, please run the following set of "
19202
"commands. Let us assume that you are creating a Wiki named "
19203
"<emphasis>mywiki</emphasis>:"
19204
msgstr ""
19205
19206
#: serverguide/C/lamp-applications.xml:137(command)
19207
msgid "cd /usr/share/moin"
19208
msgstr ""
19209
19210
#: serverguide/C/lamp-applications.xml:138(command)
19211
msgid "sudo mkdir mywiki"
19212
msgstr ""
19213
19214
#: serverguide/C/lamp-applications.xml:139(command)
19215
msgid "sudo cp -R data mywiki"
19216
msgstr ""
19217
19218
#: serverguide/C/lamp-applications.xml:140(command)
19219
msgid "sudo cp -R underlay mywiki"
19220
msgstr ""
19221
19222
#: serverguide/C/lamp-applications.xml:141(command)
19223
msgid "sudo cp server/moin.cgi mywiki"
19224
msgstr ""
19225
19226
#: serverguide/C/lamp-applications.xml:142(command)
19227
msgid "sudo chown -R www-data.www-data mywiki"
19228
msgstr ""
19229
19230
#: serverguide/C/lamp-applications.xml:143(command)
19231
msgid "sudo chmod -R ug+rwX mywiki"
19232
msgstr ""
19233
19234
#: serverguide/C/lamp-applications.xml:144(command)
19235
msgid "sudo chmod -R o-rwx mywiki"
19236
msgstr ""
19237
19238
#: serverguide/C/lamp-applications.xml:147(para)
19239
msgid ""
19240
"Now you should configure <application>MoinMoin</application> to find your "
19241
"new Wiki <emphasis>mywiki</emphasis>. To configure "
19242
"<application>MoinMoin</application>, open "
19243
"<filename>/etc/moin/mywiki.py</filename> file and change the following line:"
19244
msgstr ""
19245
19246
#: serverguide/C/lamp-applications.xml:155(programlisting)
19247
#, no-wrap
19248
msgid "data_dir = '/org/mywiki/data'"
19249
msgstr ""
19250
19251
#: serverguide/C/lamp-applications.xml:157(para)
19252
msgid "to"
19253
msgstr ""
19254
19255
#: serverguide/C/lamp-applications.xml:161(programlisting)
19256
#, no-wrap
19257
msgid "data_dir = '/usr/share/moin/mywiki/data'"
19258
msgstr ""
19259
19260
#: serverguide/C/lamp-applications.xml:163(para)
19261
msgid ""
19262
"Also, below the <emphasis>data_dir</emphasis> option add the "
19263
"<emphasis>data_underlay_dir</emphasis>:"
19264
msgstr ""
19265
19266
#: serverguide/C/lamp-applications.xml:167(programlisting)
19267
#, no-wrap
19268
msgid ""
19269
"\n"
19270
"data_underlay_dir='/usr/share/moin/mywiki/underlay'\n"
19271
msgstr ""
19272
19273
#: serverguide/C/lamp-applications.xml:172(para)
19274
msgid ""
19275
"If the <filename>/etc/moin/mywiki.py</filename> file does not exists, you "
19276
"should copy <filename>/etc/moin/moinmaster.py</filename> file to "
19277
"<filename>/etc/moin/mywiki.py</filename> file and do the above mentioned "
19278
"change."
19279
msgstr ""
19280
19281
#: serverguide/C/lamp-applications.xml:181(para)
19282
msgid ""
19283
"If you have named your Wiki as <emphasis>my_wiki_name</emphasis> you should "
19284
"insert a line <quote>(\"my_wiki_name\", r\".*\")</quote> in "
19285
"<filename>/etc/moin/farmconfig.py</filename> file after the line "
19286
"<quote>(\"mywiki\", r\".*\")</quote>."
19287
msgstr ""
19288
19289
#: serverguide/C/lamp-applications.xml:189(para)
19290
msgid ""
19291
"Once you have configured <application>MoinMoin</application> to find your "
19292
"first Wiki application <emphasis>mywiki</emphasis>, you should configure "
19293
"<application>apache2</application> and make it ready for your Wiki "
19294
"application."
19295
msgstr ""
19296
19297
#: serverguide/C/lamp-applications.xml:196(para)
19298
msgid ""
19299
"You should add the following lines in <filename>/etc/apache2/sites-"
19300
"available/default</filename> file inside the <quote><VirtualHost "
19301
"*></quote> tag:"
19302
msgstr ""
19303
19304
#: serverguide/C/lamp-applications.xml:202(programlisting)
19305
#, no-wrap
19306
msgid ""
19307
"\n"
19308
"### moin\n"
19309
" ScriptAlias /mywiki \"/usr/share/moin/mywiki/moin.cgi\"\n"
19310
" alias /moin_static184 \"/usr/share/moin/htdocs\"\n"
19311
" <Directory /usr/share/moin/htdocs>\n"
19312
" Order allow,deny\n"
19313
" allow from all\n"
19314
" </Directory>\n"
19315
"### end moin\n"
19316
msgstr ""
19317
19318
#: serverguide/C/lamp-applications.xml:214(para)
19319
msgid ""
19320
"Adjust the <emphasis>\"moin_static184\"</emphasis> in the "
19321
"<emphasis>alias</emphasis> line above, to the "
19322
"<application>moinmoin</application> version installed."
19323
msgstr ""
19324
19325
#: serverguide/C/lamp-applications.xml:220(para)
19326
msgid ""
19327
"Once you configure the <application>apache2</application> web server and "
19328
"make it ready for your Wiki application, you should restart it. You can run "
19329
"the following command to restart the <application>apache2</application> web "
19330
"server:"
19331
msgstr ""
19332
19333
#: serverguide/C/lamp-applications.xml:233(title)
19334
msgid "Verification"
19335
msgstr ""
19336
19337
#: serverguide/C/lamp-applications.xml:235(para)
19338
msgid ""
19339
"You can verify the Wiki application and see if it works by pointing your web "
19340
"browser to the following URL:"
19341
msgstr ""
19342
19343
#: serverguide/C/lamp-applications.xml:239(programlisting)
19344
#, no-wrap
19345
msgid ""
19346
"\n"
19347
"http://localhost/mywiki\n"
19348
msgstr ""
19349
19350
#: serverguide/C/lamp-applications.xml:243(para)
19351
msgid ""
19352
"You can also run the test command by pointing your web browser to the "
19353
"following URL:"
19354
msgstr ""
19355
19356
#: serverguide/C/lamp-applications.xml:248(programlisting)
19357
#, no-wrap
19358
msgid ""
19359
"\n"
19360
"http://localhost/mywiki?action=test\n"
19361
msgstr ""
19362
19363
#: serverguide/C/lamp-applications.xml:252(para)
19364
msgid ""
19365
"For more details, please refer to the <ulink "
19366
"url=\"http://moinmo.in/\">MoinMoin</ulink> web site."
19367
msgstr ""
19368
19369
#: serverguide/C/lamp-applications.xml:263(para)
19370
msgid ""
19371
"For more information see the <ulink url=\"http://moinmo.in/\">moinmoin "
19372
"Wiki</ulink>."
19373
msgstr ""
19374
19375
#: serverguide/C/lamp-applications.xml:268(para)
19376
msgid ""
19377
"Also, see the <ulink "
19378
"url=\"https://help.ubuntu.com/community/MoinMoin\">Ubuntu Wiki "
19379
"MoinMoin</ulink> page."
19380
msgstr ""
19381
19382
#: serverguide/C/lamp-applications.xml:277(title)
19383
msgid "MediaWiki"
19384
msgstr ""
19385
19386
#: serverguide/C/lamp-applications.xml:279(para)
19387
msgid ""
19388
"MediaWiki is an web based Wiki software written in the PHP language. It can "
19389
"either use <application>MySQL</application> or "
19390
"<application>PostgreSQL</application> Database Management System."
19391
msgstr ""
19392
19393
#: serverguide/C/lamp-applications.xml:289(para)
19394
msgid ""
19395
"Before installing <application>MediaWiki</application> you should also "
19396
"install <application>Apache2</application>, the "
19397
"<application>PHP5</application> scripting language and Database a Management "
19398
"System. <application>MySQL</application> or "
19399
"<application>PostgreSQL</application> are the most common, choose one "
19400
"depending on your need. Please refer to those sections in this manual for "
19401
"installation instructions."
19402
msgstr ""
19403
19404
#: serverguide/C/lamp-applications.xml:297(para)
19405
msgid ""
19406
"To install <application>MediaWiki</application>, run the following command "
19407
"in the command prompt:"
19408
msgstr ""
19409
19410
#: serverguide/C/lamp-applications.xml:303(command)
19411
msgid "sudo apt-get install mediawiki php5-gd"
19412
msgstr ""
19413
19414
#: serverguide/C/lamp-applications.xml:306(para)
19415
msgid ""
19416
"For additional <application>MediaWiki</application> functionality see the "
19417
"<application>mediawiki-extensions</application> package."
19418
msgstr ""
19419
19420
#: serverguide/C/lamp-applications.xml:316(para)
19421
msgid ""
19422
"The Apache configuration file <filename>mediawiki.conf</filename> for "
19423
"MediaWiki is installed in <filename>/etc/apache2/conf.d/</filename> "
19424
"directory. You should uncomment the following line in this file to access "
19425
"MediaWiki application."
19426
msgstr ""
19427
19428
#: serverguide/C/lamp-applications.xml:324(screen)
19429
#, no-wrap
19430
msgid ""
19431
"\n"
19432
"# Alias /mediawiki /var/lib/mediawiki\n"
19433
msgstr ""
19434
19435
#: serverguide/C/lamp-applications.xml:328(para)
19436
msgid ""
19437
"After you uncomment the above line, restart Apache server and access "
19438
"MediaWiki using the following url:"
19439
msgstr ""
19440
19441
#: serverguide/C/lamp-applications.xml:333(programlisting)
19442
#, no-wrap
19443
msgid ""
19444
"\n"
19445
"http://localhost/mediawiki/config/index.php\n"
19446
msgstr ""
19447
19448
#: serverguide/C/lamp-applications.xml:338(para)
19449
msgid ""
19450
"Please read the <quote>Checking environment...</quote> section in this page. "
19451
"You should be able to fix many issues by carefully reading this section."
19452
msgstr ""
19453
19454
#: serverguide/C/lamp-applications.xml:345(para)
19455
msgid ""
19456
"Once the configuration is complete, you should copy the "
19457
"<filename>LocalSettings.php</filename> file to "
19458
"<filename>/etc/mediawiki</filename> directory:"
19459
msgstr ""
19460
19461
#: serverguide/C/lamp-applications.xml:352(command)
19462
msgid "sudo mv /var/lib/mediawiki/config/LocalSettings.php /etc/mediawiki/"
19463
msgstr ""
19464
19465
#: serverguide/C/lamp-applications.xml:355(para)
19466
msgid ""
19467
"You may also want to edit "
19468
"<filename>/etc/mediawiki/LocalSettings.php</filename> adjusting:"
19469
msgstr ""
19470
19471
#: serverguide/C/lamp-applications.xml:360(programlisting)
19472
#, no-wrap
19473
msgid ""
19474
"\n"
19475
"ini_set( 'memory_limit', '64M' );\n"
19476
msgstr ""
19477
19478
#: serverguide/C/lamp-applications.xml:367(title)
19479
msgid "Extensions"
19480
msgstr ""
19481
19482
#: serverguide/C/lamp-applications.xml:368(para)
19483
msgid ""
19484
"The extensions add new features and enhancements for the MediaWiki "
19485
"application. The extensions give wiki administrators and end users the "
19486
"ability to customize MediaWiki to their requirements."
19487
msgstr ""
19488
19489
#: serverguide/C/lamp-applications.xml:374(para)
19490
msgid ""
19491
"You can download MediaWiki extensions as an archive file or checkout from "
19492
"the Subversion repository. You should copy it to "
19493
"<filename>/var/lib/mediawiki/extensions</filename> directory. You should "
19494
"also add the following line at the end of file: "
19495
"<filename>/etc/mediawiki/LocalSettings.php</filename>."
19496
msgstr ""
19497
19498
#: serverguide/C/lamp-applications.xml:382(programlisting)
19499
#, no-wrap
19500
msgid ""
19501
"\n"
19502
"require_once \"$IP/extensions/ExtentionName/ExtentionName.php\";\n"
19503
msgstr ""
19504
19505
#: serverguide/C/lamp-applications.xml:392(para)
19506
msgid ""
19507
"For more details, please refer to the <ulink "
19508
"url=\"http://www.mediawiki.org\">MediaWiki</ulink> web site."
19509
msgstr ""
19510
19511
#: serverguide/C/lamp-applications.xml:398(para)
19512
msgid ""
19513
"The <ulink url=\"http://www.packtpub.com/Mediawiki/book\">MediaWiki "
19514
"Administrators’ Tutorial Guide</ulink> contains a wealth of information for "
19515
"new MediaWiki administrators."
19516
msgstr ""
19517
19518
#: serverguide/C/lamp-applications.xml:404(para)
19519
msgid ""
19520
"Also, the <ulink url=\"https://help.ubuntu.com/community/MediaWiki\">Ubuntu "
19521
"Wiki MediaWiki</ulink> page is a good resource."
19522
msgstr ""
19523
19524
#: serverguide/C/lamp-applications.xml:414(title)
19525
msgid "phpMyAdmin"
19526
msgstr ""
19527
19528
#: serverguide/C/lamp-applications.xml:416(para)
19529
msgid ""
19530
"<application>phpMyAdmin</application> is a LAMP application specifically "
19531
"written for administering <application>MySQL</application> servers. Written "
19532
"in <application>PHP</application>, and accessed through a web browser, "
19533
"phpMyAdmin provides a graphical interface for database administration tasks."
19534
msgstr ""
19535
19536
#: serverguide/C/lamp-applications.xml:425(para)
19537
msgid ""
19538
"Before installing <application>phpMyAdmin</application> you will need access "
19539
"to a <application>MySQL</application> database either on the same host as "
19540
"that phpMyAdmin is installed on, or on a host accessible over the network. "
19541
"For more information see <xref linkend=\"mysql\"/>. From a terminal prompt "
19542
"enter:"
19543
msgstr ""
19544
19545
#: serverguide/C/lamp-applications.xml:432(command)
19546
msgid "sudo apt-get install phpmyadmin"
19547
msgstr ""
19548
19549
#: serverguide/C/lamp-applications.xml:435(para)
19550
msgid ""
19551
"At the prompt choose which web server to be configured for "
19552
"<application>phpMyAdmin</application>. The rest of this section will use "
19553
"<application>Apache2</application> for the web server."
19554
msgstr ""
19555
19556
#: serverguide/C/lamp-applications.xml:440(para)
19557
msgid ""
19558
"In a browser go to <emphasis>http://servername/phpmyadmin</emphasis>, "
19559
"replacing <emphasis role=\"italic\">serveranme</emphasis> with the server's "
19560
"actual hostname. At the login, page enter <emphasis>root</emphasis> for the "
19561
"<emphasis>username</emphasis>, or another <application>MySQL</application> "
19562
"user if you any setup, and enter the <application>MySQL</application> user's "
19563
"password."
19564
msgstr ""
19565
19566
#: serverguide/C/lamp-applications.xml:447(para)
19567
msgid ""
19568
"Once logged in you can reset the <emphasis>root</emphasis> password if "
19569
"needed, create users, create/destroy databases and tables, etc."
19570
msgstr ""
19571
19572
#: serverguide/C/lamp-applications.xml:455(para)
19573
msgid ""
19574
"The configuration files for <application>phpMyAdmin</application> are "
19575
"located in <filename>/etc/phpmyadmin</filename>. The main configuration file "
19576
"is <filename>/etc/phpmyadmin/config.inc.php</filename>. This file contains "
19577
"configuration options that apply globally to "
19578
"<application>phpMyAdmin</application>."
19579
msgstr ""
19580
19581
#: serverguide/C/lamp-applications.xml:461(para)
19582
msgid ""
19583
"To use <application>phpMyAdmin</application> to administer a MySQL database "
19584
"hosted on another server, adjust the following in "
19585
"<filename>/etc/phpmyadmin/config.inc.php</filename>:"
19586
msgstr ""
19587
19588
#: serverguide/C/lamp-applications.xml:466(programlisting)
19589
#, no-wrap
19590
msgid ""
19591
"\n"
19592
"$cfg['Servers'][$i]['host'] = 'db_server';\n"
19593
msgstr ""
19594
19595
#: serverguide/C/lamp-applications.xml:471(para)
19596
msgid ""
19597
"Replace <emphasis role=\"italic\">db_server</emphasis> with the actual "
19598
"remote database server name or IP address. Also, be sure that the "
19599
"<application>phpMyAdmin</application> host has permissions to access the "
19600
"remote database."
19601
msgstr ""
19602
19603
#: serverguide/C/lamp-applications.xml:477(para)
19604
msgid ""
19605
"Once configured, log out of <application>phpMyAdmin</application> and back "
19606
"in, and you should be accessing the new server."
19607
msgstr ""
19608
19609
#: serverguide/C/lamp-applications.xml:481(para)
19610
msgid ""
19611
"The <filename>config.header.inc.php</filename> and "
19612
"<filename>config.footer.inc.php</filename> files are used to add a HTML "
19613
"header and footer to <application>phpMyAdmin</application>."
19614
msgstr ""
19615
19616
#: serverguide/C/lamp-applications.xml:486(para)
19617
msgid ""
19618
"Another important configuration file is "
19619
"<filename>/etc/phpmyadmin/apache.conf</filename>, this file is symlinked to "
19620
"<filename>/etc/apache2/conf.d/phpmyadmin.conf</filename>, and is used to "
19621
"configure <application>Apache2</application> to serve the "
19622
"<application>phpMyAdmin</application> site. The file contains directives for "
19623
"loading <application>PHP</application>, directory permissions, etc. For more "
19624
"information on configuring <application>Apache2</application> see <xref "
19625
"linkend=\"httpd\"/>."
19626
msgstr ""
19627
19628
#: serverguide/C/lamp-applications.xml:500(para)
19629
msgid ""
19630
"The <application>phpMyAdmin</application> documentation comes installed with "
19631
"the package and can be accessed from the <emphasis>phpMyAdmin "
19632
"Documentation</emphasis> link (a question mark with a box around it) under "
19633
"the phpMyAdmin logo. The official docs can also be access on the <ulink "
19634
"url=\"http://www.phpmyadmin.net/home_page/docs.php\">phpMyAdmin</ulink> site."
19635
msgstr ""
19636
19637
#: serverguide/C/lamp-applications.xml:507(para)
19638
msgid ""
19639
"Also, <ulink url=\"http://www.packtpub.com/phpmyadmin-3rd-"
19640
"edition/book\">Mastering phpMyAdmin</ulink> is a great resource."
19641
msgstr ""
19642
19643
#: serverguide/C/lamp-applications.xml:512(para)
19644
msgid ""
19645
"A third resource is the <ulink "
19646
"url=\"https://help.ubuntu.com/community/phpMyAdmin\">phpMyAdmin Ubuntu "
19647
"Wiki</ulink> page."
19648
msgstr ""
19649
19650
#: serverguide/C/introduction.xml:14(para)
19651
msgid "Welcome to the <emphasis>Ubuntu Server Guide</emphasis>!"
19652
msgstr ""
19653
19654
#: serverguide/C/introduction.xml:15(para)
19655
msgid ""
19656
"Here you can find information on how to install and configure various server "
19657
"applications. It is a step-by-step, task-oriented guide for configuring and "
19658
"customizing your system."
19659
msgstr ""
19660
19661
#: serverguide/C/introduction.xml:19(para)
19662
msgid ""
19663
"This guide assumes you have a basic understanding of your Ubuntu system. "
19664
"Some installation details are covered in <xref linkend=\"installation\"/>, "
19665
"but if you need detailed instructions installing Ubuntu please refer to the "
19666
"<ulink url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19667
"Installation Guide</ulink>."
19668
msgstr ""
19669
19670
#: serverguide/C/introduction.xml:25(para)
19671
msgid ""
19672
"A HTML version of the manual is available online at <ulink "
19673
"url=\"http://help.ubuntu.com\">the Ubuntu Documentation website</ulink>. The "
19674
"HTML files are also available in the <application>ubuntu-"
19675
"serverguide</application> package. See <xref linkend=\"package-"
19676
"management\"/> for details on installing packages."
19677
msgstr ""
19678
19679
#: serverguide/C/introduction.xml:32(para)
19680
msgid ""
19681
"If you choose to install the <application>ubuntu-serverguide</application> "
19682
"you can view this document from a console by:"
19683
msgstr ""
19684
19685
#: serverguide/C/introduction.xml:36(command)
19686
msgid "w3m /usr/share/ubuntu-serverguide/html/C/index.html"
19687
msgstr ""
19688
19689
#: serverguide/C/introduction.xml:39(para)
19690
msgid ""
19691
"If you are using a localized version of Ubuntu, replace "
19692
"<emphasis>C</emphasis> with your language localization (e.g. "
19693
"<emphasis>en_GB</emphasis>)."
19694
msgstr ""
19695
19696
#: serverguide/C/introduction.xml:53(title)
19697
msgid "Support"
19698
msgstr ""
19699
19700
#: serverguide/C/introduction.xml:55(para)
19701
msgid ""
19702
"There are a couple of different ways that Ubuntu Server Edition is "
19703
"supported, commercial support and community support. The main commercial "
19704
"support (and development funding) is available from Canonical Ltd. They "
19705
"supply reasonably priced support contracts on a per desktop or per server "
19706
"basis. For more information see the <ulink "
19707
"url=\"http://www.canonical.com/services/support\">Canonical Services</ulink> "
19708
"page."
19709
msgstr ""
19710
19711
#: serverguide/C/introduction.xml:62(para)
19712
msgid ""
19713
"Community support is also provided by dedicated individuals, and companies, "
19714
"that wish to make Ubuntu the best distribution possible. Support is provided "
19715
"through multiple mailing lists, IRC channels, forums, blogs, wikis, etc. The "
19716
"large amount of information available can be overwhelming, but a good search "
19717
"engine query can usually provide an answer to your questions. See the <ulink "
19718
"url=\"http://www.ubuntu.com/support\">Ubuntu Support</ulink> page for more "
19719
"information."
19720
msgstr ""
19721
19722
#: serverguide/C/installation.xml:14(para)
19723
msgid ""
19724
"This chapter provides a quick overview of installing Ubuntu 10.04 LTS Server "
19725
"Edition. For more detailed instructions, please refer to the <ulink "
19726
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19727
"Installation Guide</ulink>."
19728
msgstr ""
19729
19730
#: serverguide/C/installation.xml:19(title)
19731
msgid "Preparing to Install"
19732
msgstr ""
19733
19734
#: serverguide/C/installation.xml:20(para)
19735
msgid ""
19736
"This section explains various aspects to consider before starting the "
19737
"installation."
19738
msgstr ""
19739
19740
#: serverguide/C/installation.xml:24(title)
19741
msgid "System Requirements"
19742
msgstr ""
19743
19744
#: serverguide/C/installation.xml:25(para)
19745
msgid ""
19746
"Ubuntu 10.04 LTS Server Edition supports two (2) major architectures: Intel "
19747
"x86 and AMD64. The table below lists recommended hardware specifications. "
19748
"Depending on your needs, you might manage with less than this. However, most "
19749
"users risk being frustrated if they ignore these suggestions."
19750
msgstr ""
19751
19752
#: serverguide/C/installation.xml:27(title)
19753
msgid "Recommended Minimum Requirements"
19754
msgstr ""
19755
19756
#: serverguide/C/installation.xml:35(para)
19757
msgid "Install Type"
19758
msgstr ""
19759
19760
#: serverguide/C/installation.xml:36(para)
19761
msgid "RAM"
19762
msgstr ""
19763
19764
#: serverguide/C/installation.xml:37(para)
19765
msgid "Hard Drive Space"
19766
msgstr ""
19767
19768
#: serverguide/C/installation.xml:40(para)
19769
msgid "Base System"
19770
msgstr ""
19771
19772
#: serverguide/C/installation.xml:41(para)
19773
msgid "All Tasks Installed"
19774
msgstr ""
19775
19776
#: serverguide/C/installation.xml:46(para)
19777
msgid "Server"
19778
msgstr "Сервер"
19779
19780
#: serverguide/C/installation.xml:47(para)
19781
msgid "128 megabytes"
19782
msgstr ""
19783
19784
#: serverguide/C/installation.xml:48(para)
19785
msgid "500 megabytes"
19786
msgstr ""
19787
19788
#: serverguide/C/installation.xml:49(para)
19789
msgid "1 gigabyte"
19790
msgstr ""
19791
19792
#: serverguide/C/installation.xml:54(para)
19793
msgid ""
19794
"The Server Edition provides a common base for all sorts of server "
19795
"applications. It is a minimalist design providing a platform for the desired "
19796
"services, such as file/print services, web hosting, email hosting, etc."
19797
msgstr ""
19798
19799
#: serverguide/C/installation.xml:60(para)
19800
msgid ""
19801
"The requirements for UEC are slightly different for Front End requirements "
19802
"see <xref linkend=\"uec-frontend-requirements\"/> and for UEC Node "
19803
"requirements see <xref linkend=\"uec-node-requirements\"/>."
19804
msgstr ""
19805
19806
#: serverguide/C/installation.xml:68(title)
19807
msgid "Server and Desktop Differences"
19808
msgstr ""
19809
19810
#: serverguide/C/installation.xml:69(para)
19811
msgid ""
19812
"There are a few differences between the <emphasis>Ubuntu Server "
19813
"Edition</emphasis> and the <emphasis>Ubuntu Desktop Edition</emphasis>. It "
19814
"should be noted that both editions use the same "
19815
"<application>apt</application> repositories. Making it just as easy to "
19816
"install a <emphasis role=\"italic\">server</emphasis> application on the "
19817
"Desktop Edition as it is on the Server Edition."
19818
msgstr ""
19819
19820
#: serverguide/C/installation.xml:75(para)
19821
msgid ""
19822
"The differences between the two editions are the lack of an X window "
19823
"environment in the Server Edition, the installation process, and different "
19824
"Kernel options."
19825
msgstr ""
19826
19827
#: serverguide/C/installation.xml:82(title)
19828
msgid "Kernel Differences:"
19829
msgstr ""
19830
19831
#: serverguide/C/installation.xml:85(para)
19832
msgid ""
19833
"The Server Edition uses the <emphasis>Deadline</emphasis> I/O scheduler "
19834
"instead of the <emphasis>CFQ</emphasis> scheduler used by the Desktop "
19835
"Edition."
19836
msgstr ""
19837
19838
#: serverguide/C/installation.xml:91(para)
19839
msgid "<emphasis>Preemption</emphasis> is turned off in the Server Edition."
19840
msgstr ""
19841
19842
#: serverguide/C/installation.xml:96(para)
19843
msgid ""
19844
"The timer interrupt is 100 Hz in the Server Edition and 250 Hz in the "
19845
"Desktop Edition."
19846
msgstr ""
19847
19848
#: serverguide/C/installation.xml:102(para)
19849
msgid ""
19850
"When running a 64-bit version of Ubuntu on 64-bit processors you are not "
19851
"limited by memory addressing space."
19852
msgstr ""
19853
19854
#: serverguide/C/installation.xml:107(para)
19855
msgid ""
19856
"To see all kernel configuration options you can look through "
19857
"<filename>/boot/config-2.6.31-server</filename>. Also, <ulink "
19858
"url=\"http://www.kroah.com/lkn/\">Linux Kernel in a Nutshell</ulink> is a "
19859
"great resource on the options available."
19860
msgstr ""
19861
19862
#: serverguide/C/installation.xml:116(title)
19863
msgid "Backing Up"
19864
msgstr ""
19865
19866
#: serverguide/C/installation.xml:119(para)
19867
msgid ""
19868
"Before installing <application>Ubuntu Server Edition</application> you "
19869
"should make sure all data on the system is backed up. See <xref "
19870
"linkend=\"backups\"/> for backup options."
19871
msgstr ""
19872
19873
#: serverguide/C/installation.xml:123(para)
19874
msgid ""
19875
"If this is not the first time an operating system has been installed on your "
19876
"computer, it is likely you will need to re-partition your disk to make room "
19877
"for Ubuntu."
19878
msgstr ""
19879
19880
#: serverguide/C/installation.xml:127(para)
19881
msgid ""
19882
"Any time you partition your disk, you should be prepared to lose everything "
19883
"on the disk should you make a mistake or something goes wrong during "
19884
"partitioning. The programs used in installation are quite reliable, most "
19885
"have seen years of use, but they also perform destructive actions."
19886
msgstr ""
19887
19888
#: serverguide/C/installation.xml:139(title)
19889
msgid "Installing from CD"
19890
msgstr ""
19891
19892
#: serverguide/C/installation.xml:140(para)
19893
msgid ""
19894
"The basic steps to install Ubuntu Server Edition from CD are the same for "
19895
"installing any operating system from CD. Unlike the <emphasis>Desktop "
19896
"Edition</emphasis> the <emphasis>Server Edition</emphasis> does not include "
19897
"a graphical installation program. Instead the Server Edition uses a console "
19898
"menu based process."
19899
msgstr ""
19900
19901
#: serverguide/C/installation.xml:147(para)
19902
msgid ""
19903
"First, download and burn the appropriate ISO file from the <ulink "
19904
"url=\"http://www.ubuntu.com/getubuntu/download\"> Ubuntu web site</ulink>."
19905
msgstr ""
19906
19907
#: serverguide/C/installation.xml:153(para)
19908
msgid "Boot the system from the CD-ROM drive."
19909
msgstr ""
19910
19911
#: serverguide/C/installation.xml:158(para)
19912
msgid ""
19913
"At the boot prompt you will be asked to select the language. Afterwards the "
19914
"installation process begins by asking for your keyboard layout."
19915
msgstr ""
19916
19917
#: serverguide/C/installation.xml:164(para)
19918
msgid ""
19919
"From the main boot menu there are some additional options to install Ubuntu "
19920
"Server Edition. You can install a basic Ubuntu Server, or install Ubuntu "
19921
"Server as part of a <emphasis>Ubuntu Enterprise Cloud</emphasis>. For more "
19922
"information on UEC see <xref linkend=\"uec\"/>. The rest of this section "
19923
"will cover the basic Ubuntu Server install."
19924
msgstr ""
19925
19926
#: serverguide/C/installation.xml:172(para)
19927
msgid ""
19928
"The installer then discovers your hardware configuration, and configures the "
19929
"network settings using DHCP. If you do not wish to use DHCP at the next "
19930
"screen choose \"Go Back\", and you have the option to \"Configure the "
19931
"network manually\"."
19932
msgstr ""
19933
19934
#: serverguide/C/installation.xml:179(para)
19935
msgid "Next, the installer asks for the system's hostname and Time Zone."
19936
msgstr ""
19937
19938
#: serverguide/C/installation.xml:184(para)
19939
msgid ""
19940
"You can then choose from several options to configure the hard drive layout. "
19941
"For advanced disk options see <xref linkend=\"advanced-installation\"/>."
19942
msgstr ""
19943
19944
#: serverguide/C/installation.xml:190(para)
19945
msgid "The Ubuntu base system is then installed."
19946
msgstr ""
19947
19948
#: serverguide/C/installation.xml:195(para)
19949
msgid ""
19950
"A new user is setup, this user will have <emphasis>root</emphasis> access "
19951
"through the <application>sudo</application> utility."
19952
msgstr ""
19953
19954
#: serverguide/C/installation.xml:201(para)
19955
msgid ""
19956
"After the user is setup, you will be asked to encrypt your <filename "
19957
"role=\"directory\">home</filename> directory."
19958
msgstr ""
19959
19960
#: serverguide/C/installation.xml:207(para)
19961
msgid ""
19962
"The next step in the installation process is to decide how you want to "
19963
"update the system. There are three options:"
19964
msgstr ""
19965
19966
#: serverguide/C/installation.xml:213(para)
19967
msgid ""
19968
"<emphasis>No automatic updates</emphasis>: this requires an administrator to "
19969
"log into the machine and manually install updates."
19970
msgstr ""
19971
19972
#: serverguide/C/installation.xml:219(para)
19973
msgid ""
19974
"<emphasis>Install security updates Automatically</emphasis>: will install "
19975
"the <application>unattended-upgrades</application> package, which will "
19976
"install security updates without the intervention of an administrator. For "
19977
"more details see <xref linkend=\"automatic-updates\"/>."
19978
msgstr ""
19979
19980
#: serverguide/C/installation.xml:226(para)
19981
msgid ""
19982
"<emphasis>Manage the system with Landscape</emphasis>: Landscape is a paid "
19983
"service provided by Canonical to help manage your Ubuntu machines. See the "
19984
"<ulink url=\"http://www.canonical.com/projects/landscape\">Landscape</ulink> "
19985
"site for details."
19986
msgstr ""
19987
19988
#: serverguide/C/installation.xml:235(para)
19989
msgid ""
19990
"You now have the option to install, or not install, several package tasks. "
19991
"See <xref linkend=\"install-tasks\"/> for details. Also, there is an option "
19992
"to launch <application>aptitude</application> to choose specific packages to "
19993
"install. For more information see <xref linkend=\"aptitude\"/>."
19994
msgstr ""
19995
19996
#: serverguide/C/installation.xml:243(para)
19997
msgid "Finally, the last step before rebooting is to set the clock to UTC."
19998
msgstr ""
19999
20000
#: serverguide/C/installation.xml:249(para)
20001
msgid ""
20002
"If at any point during installation you are not satisfied by the default "
20003
"setting, use the \"Go Back\" function at any prompt to be brought to a "
20004
"detailed installation menu that will allow you to modify the default "
20005
"settings."
20006
msgstr ""
20007
20008
#: serverguide/C/installation.xml:254(para)
20009
msgid ""
20010
"At some point during the installation process you may want to read the help "
20011
"screen provided by the installation system. To do this, press F1."
20012
msgstr ""
20013
20014
#: serverguide/C/installation.xml:259(para)
20015
msgid ""
20016
"Once again, for detailed instructions see the <ulink "
20017
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\"> Ubuntu "
20018
"Installation Guide</ulink>."
20019
msgstr ""
20020
20021
#: serverguide/C/installation.xml:265(title)
20022
msgid "Package Tasks"
20023
msgstr ""
20024
20025
#: serverguide/C/installation.xml:266(para)
20026
msgid ""
20027
"During the Server Edition installation you have the option of installing "
20028
"additional packages from the CD. The packages are grouped by the type of "
20029
"service they provide."
20030
msgstr ""
20031
20032
#: serverguide/C/installation.xml:272(para)
20033
msgid "Cloud computing: Walrus storage service"
20034
msgstr ""
20035
20036
#: serverguide/C/installation.xml:277(para)
20037
msgid "Cloud computing: all-in-one cluster"
20038
msgstr ""
20039
20040
#: serverguide/C/installation.xml:282(para)
20041
msgid "Cloud computing: Cluster controller"
20042
msgstr ""
20043
20044
#: serverguide/C/installation.xml:287(para)
20045
msgid "Cloud computing: Node controller"
20046
msgstr ""
20047
20048
#: serverguide/C/installation.xml:292(para)
20049
msgid "Cloud computing: Storage controller"
20050
msgstr ""
20051
20052
#: serverguide/C/installation.xml:297(para)
20053
msgid "Cloud computing: top-level cloud controller"
20054
msgstr ""
20055
20056
#: serverguide/C/installation.xml:302(para)
20057
msgid "DNS server: Selects the BIND DNS server and its documentation."
20058
msgstr ""
20059
20060
#: serverguide/C/installation.xml:307(para)
20061
msgid "LAMP server: Selects a ready-made Linux/Apache/MySQL/PHP server."
20062
msgstr ""
20063
20064
#: serverguide/C/installation.xml:312(para)
20065
msgid ""
20066
"Mail server: This task selects a variety of package useful for a general "
20067
"purpose mail server system."
20068
msgstr ""
20069
20070
#: serverguide/C/installation.xml:317(para)
20071
msgid "OpenSSH server: Selects packages needed for an OpenSSH server."
20072
msgstr ""
20073
20074
#: serverguide/C/installation.xml:322(para)
20075
msgid ""
20076
"PostgreSQL database: This task selects client and server packages for the "
20077
"PostgreSQL database."
20078
msgstr ""
20079
20080
#: serverguide/C/installation.xml:327(para)
20081
msgid "Print server: This task sets up your system to be a print server."
20082
msgstr ""
20083
20084
#: serverguide/C/installation.xml:332(para)
20085
msgid ""
20086
"Samba File server: This task sets up your system to be a Samba file server, "
20087
"which is especially suitable in networks with both Windows and Linux systems."
20088
msgstr ""
20089
20090
#: serverguide/C/installation.xml:338(para)
20091
msgid ""
20092
"Tomcat server: Installs the Apache Tomcat and needed dependencies Java, gcj, "
20093
"etc."
20094
msgstr ""
20095
20096
#: serverguide/C/installation.xml:343(para)
20097
msgid ""
20098
"Virtual machine host: Includes packages needed to run KVM virtual machines."
20099
msgstr ""
20100
20101
#: serverguide/C/installation.xml:348(para)
20102
msgid ""
20103
"Manually select packages: Executes <application>apptitude</application> "
20104
"allowing you to individually select packages."
20105
msgstr ""
20106
20107
#: serverguide/C/installation.xml:353(para)
20108
msgid ""
20109
"Installing the package groups is accomplished using the "
20110
"<application>tasksel</application> utility. One of the important difference "
20111
"between Ubuntu (or Debian) and other GNU/Linux distribution is that, when "
20112
"installed, a package is also configured to reasonable defaults, eventually "
20113
"prompting you for additional required information. Likewise, when installing "
20114
"a task, the packages are not only installed, but also configured to provided "
20115
"a fully integrated service."
20116
msgstr ""
20117
20118
#: serverguide/C/installation.xml:360(para)
20119
msgid ""
20120
"For more information on the <emphasis>Cloud Computing</emphasis> tasks see "
20121
"<xref linkend=\"uec\"/>."
20122
msgstr ""
20123
20124
#: serverguide/C/installation.xml:363(para)
20125
msgid ""
20126
"Once the installation process has finished you can view a list of available "
20127
"tasks by entering the following from a terminal prompt:"
20128
msgstr ""
20129
20130
#: serverguide/C/installation.xml:368(command)
20131
msgid "tasksel --list-tasks"
20132
msgstr ""
20133
20134
#: serverguide/C/installation.xml:371(para)
20135
msgid ""
20136
"The output will list tasks from other Ubuntu based distributions such as "
20137
"Kubuntu and Edubuntu. Note that you can also invoke the "
20138
"<command>tasksel</command> command by itself, which will bring up a menu of "
20139
"the different tasks available."
20140
msgstr ""
20141
20142
#: serverguide/C/installation.xml:377(para)
20143
msgid ""
20144
"You can view a list of which packages are installed with each task using the "
20145
"<emphasis>--task-packages</emphasis> option. For example, to list the "
20146
"packages installed with the <emphasis>DNS Server</emphasis> task enter the "
20147
"following:"
20148
msgstr ""
20149
20150
#: serverguide/C/installation.xml:382(command)
20151
msgid "tasksel --task-packages dns-server"
20152
msgstr ""
20153
20154
#: serverguide/C/installation.xml:384(para)
20155
msgid "The output of the command should list:"
20156
msgstr ""
20157
20158
#: serverguide/C/installation.xml:387(programlisting)
20159
#, no-wrap
20160
msgid ""
20161
"\n"
20162
"bind9-doc \n"
20163
"bind9utils \n"
20164
"bind9\n"
20165
msgstr ""
20166
20167
#: serverguide/C/installation.xml:392(para)
20168
msgid ""
20169
"Also, if you did not install one of the tasks during the installation "
20170
"process, but for example you decide to make your new LAMP server a DNS "
20171
"server as well. Simply insert the installation CD and from a terminal:"
20172
msgstr ""
20173
20174
#: serverguide/C/installation.xml:397(command)
20175
msgid "sudo tasksel install dns-server"
20176
msgstr ""
20177
20178
#: serverguide/C/installation.xml:402(title)
20179
msgid "Upgrading"
20180
msgstr ""
20181
20182
#: serverguide/C/installation.xml:403(para)
20183
msgid ""
20184
"There are several ways to upgrade from one Ubuntu release to another. This "
20185
"section gives an overview of the recommended upgrade method."
20186
msgstr ""
20187
20188
#: serverguide/C/installation.xml:407(title) serverguide/C/installation.xml:422(command)
20189
msgid "do-release-upgrade"
20190
msgstr ""
20191
20192
#: serverguide/C/installation.xml:408(para)
20193
msgid ""
20194
"The recommended way to upgrade a Server Edition installation is to use the "
20195
"<application>do-release-upgrade</application> utility. Part of the "
20196
"<emphasis>update-manager-core</emphasis> package, it does not have any "
20197
"graphical dependencies and is installed by default."
20198
msgstr ""
20199
20200
#: serverguide/C/installation.xml:413(para)
20201
msgid ""
20202
"Debian based systems can also be upgraded by using <command>apt-get dist-"
20203
"upgrade</command>. However, using <application>do-release-"
20204
"upgrade</application> is recommended because it has the ability to handle "
20205
"system configuration changes sometimes needed between releases."
20206
msgstr ""
20207
20208
#: serverguide/C/installation.xml:418(para)
20209
msgid "To upgrade to a newer release, from a terminal prompt enter:"
20210
msgstr ""
20211
20212
#: serverguide/C/installation.xml:424(para)
20213
msgid ""
20214
"It is also possible to use <application>do-release-upgrade</application> to "
20215
"upgrade to a development version of Ubuntu. To accomplish this use the "
20216
"<emphasis>-d</emphasis> switch:"
20217
msgstr ""
20218
20219
#: serverguide/C/installation.xml:429(command)
20220
msgid "do-release-upgrade -d"
20221
msgstr ""
20222
20223
#: serverguide/C/installation.xml:432(para)
20224
msgid ""
20225
"Upgrading to a development release is <emphasis>not</emphasis> recommended "
20226
"for production environments."
20227
msgstr ""
20228
20229
#: serverguide/C/installation.xml:439(title)
20230
msgid "Advanced Installation"
20231
msgstr ""
20232
20233
#: serverguide/C/installation.xml:442(title)
20234
msgid "Software RAID"
20235
msgstr ""
20236
20237
#: serverguide/C/installation.xml:444(para)
20238
msgid ""
20239
"RAID is a method of configuring multiple hard drives to act as one, reducing "
20240
"the probability of catastrophic data loss in case of drive failure. RAID is "
20241
"implemented in either software (where the operating system knows about both "
20242
"drives and actively maintains both of them) or hardware (where a special "
20243
"controller makes the OS think there's only one drive and maintains the "
20244
"drives 'invisibly')."
20245
msgstr ""
20246
20247
#: serverguide/C/installation.xml:451(para)
20248
msgid ""
20249
"The RAID software included with current versions of Linux (and Ubuntu) is "
20250
"based on the <application>'mdadm'</application> driver and works very well, "
20251
"better even than many so-called 'hardware' RAID controllers. This section "
20252
"will guide you through installing Ubuntu Server Edition using two RAID1 "
20253
"partitions on two physical hard drives, one for <emphasis>/</emphasis> and "
20254
"another for <emphasis>swap</emphasis>."
20255
msgstr ""
20256
20257
#: serverguide/C/installation.xml:461(para) serverguide/C/installation.xml:975(para)
20258
msgid ""
20259
"Follow the installation steps until you get to the <emphasis>Partition "
20260
"disks</emphasis> step, then:"
20261
msgstr ""
20262
20263
#: serverguide/C/installation.xml:468(para)
20264
msgid "Select <emphasis>Manual</emphasis> as the partition method."
20265
msgstr ""
20266
20267
#: serverguide/C/installation.xml:475(para)
20268
msgid ""
20269
"Select the first hard drive, and agree to <emphasis>\"Create a new empty "
20270
"partition table on this device?\"</emphasis>."
20271
msgstr ""
20272
20273
#: serverguide/C/installation.xml:479(para)
20274
msgid ""
20275
"Repeat this step for each drive you wish to be part of the RAID array."
20276
msgstr ""
20277
20278
#: serverguide/C/installation.xml:486(para)
20279
msgid ""
20280
"Select the <emphasis>\"FREE SPACE\"</emphasis> on the first drive then "
20281
"select <emphasis>\"Create a new partition\"</emphasis>."
20282
msgstr ""
20283
20284
#: serverguide/C/installation.xml:493(para)
20285
msgid ""
20286
"Next, select the <emphasis>Size</emphasis> of the partition. This partition "
20287
"will be the <emphasis>swap</emphasis> partition, and a general rule for swap "
20288
"size is twice that of RAM. Enter the partition size, then choose "
20289
"<emphasis>Primary</emphasis>, then <emphasis>Beginning</emphasis>."
20290
msgstr ""
20291
20292
#: serverguide/C/installation.xml:502(para)
20293
msgid ""
20294
"Select the <emphasis>\"Use as:\"</emphasis> line at the top. By default this "
20295
"is <emphasis role=\"italic\">\"Ext4 journaling file system\"</emphasis>, "
20296
"change that to <emphasis>\"physical volume for RAID\"</emphasis> then "
20297
"<emphasis>\"Done setting up partition\"</emphasis>."
20298
msgstr ""
20299
20300
#: serverguide/C/installation.xml:511(para)
20301
msgid ""
20302
"For the <emphasis>/</emphasis> partition once again select <emphasis>\"Free "
20303
"Space\"</emphasis> on the first drive then <emphasis>\"Create a new "
20304
"partition\"</emphasis>."
20305
msgstr ""
20306
20307
#: serverguide/C/installation.xml:519(para)
20308
msgid ""
20309
"Use the rest of the free space on the drive and choose "
20310
"<emphasis>Continue</emphasis>, then <emphasis>Primary</emphasis>."
20311
msgstr ""
20312
20313
#: serverguide/C/installation.xml:526(para)
20314
msgid ""
20315
"As with the swap partition, select the <emphasis>\"Use as:\"</emphasis> line "
20316
"at the top, changing it to <emphasis>\"physical volume for "
20317
"RAID\"</emphasis>. Also select the <emphasis>\"Bootable flag:\"</emphasis> "
20318
"line to change the value to <emphasis>\"on\"</emphasis>. Then choose "
20319
"<emphasis>\"Done setting up partition\"</emphasis>."
20320
msgstr ""
20321
20322
#: serverguide/C/installation.xml:536(para)
20323
msgid "Repeat steps three through eight for the other disk and partitions."
20324
msgstr ""
20325
20326
#: serverguide/C/installation.xml:545(title)
20327
msgid "RAID Configuration"
20328
msgstr ""
20329
20330
#: serverguide/C/installation.xml:547(para)
20331
msgid "With the partitions setup the arrays are ready to be configured:"
20332
msgstr ""
20333
20334
#: serverguide/C/installation.xml:554(para)
20335
msgid ""
20336
"Back in the main \"Partition Disks\" page, select <emphasis>\"Configure "
20337
"Software RAID\"</emphasis> at the top."
20338
msgstr ""
20339
20340
#: serverguide/C/installation.xml:561(para)
20341
msgid "Select <emphasis>\"yes\"</emphasis> to write the changes to disk."
20342
msgstr ""
20343
20344
#: serverguide/C/installation.xml:568(para)
20345
msgid "Choose <emphasis>\"Create MD device\"</emphasis>."
20346
msgstr ""
20347
20348
#: serverguide/C/installation.xml:575(para)
20349
msgid ""
20350
"For this example, select <emphasis>\"RAID1\"</emphasis>, but if you are "
20351
"using a different setup choose the appropriate type (RAID0 RAID1 RAID5)."
20352
msgstr ""
20353
20354
#: serverguide/C/installation.xml:581(para)
20355
msgid ""
20356
"In order to use <emphasis>RAID5</emphasis> you need at least "
20357
"<emphasis>three</emphasis> drives. Using RAID0 or RAID1 only "
20358
"<emphasis>two</emphasis> drives are required."
20359
msgstr ""
20360
20361
#: serverguide/C/installation.xml:590(para)
20362
msgid ""
20363
"Enter the number of active devices <emphasis>\"2\"</emphasis>, or the amount "
20364
"of hard drives you have, for the array. Then select "
20365
"<emphasis>\"Continue\"</emphasis>."
20366
msgstr ""
20367
20368
#: serverguide/C/installation.xml:598(para)
20369
msgid ""
20370
"Next, enter the number of spare devices <emphasis>\"0\"</emphasis> by "
20371
"default, then choose <emphasis>\"Continue\"</emphasis>."
20372
msgstr ""
20373
20374
#: serverguide/C/installation.xml:605(para)
20375
msgid ""
20376
"Choose which partitions to use. Generally they will be sda1, sdb1, sdc1, "
20377
"etc. The numbers will usually match and the different letters correspond to "
20378
"different hard drives."
20379
msgstr ""
20380
20381
#: serverguide/C/installation.xml:610(para)
20382
msgid ""
20383
"For the <emphasis>swap</emphasis> partition choose <emphasis>sda1</emphasis> "
20384
"and <emphasis>sdb1</emphasis>. Select <emphasis>\"Continue\"</emphasis> to "
20385
"go to the next step."
20386
msgstr ""
20387
20388
#: serverguide/C/installation.xml:618(para)
20389
msgid ""
20390
"Repeat steps <emphasis>three</emphasis> through <emphasis>seven</emphasis> "
20391
"for the <emphasis>/</emphasis> partition choosing <emphasis>sda2</emphasis> "
20392
"and <emphasis>sdb2</emphasis>."
20393
msgstr ""
20394
20395
#: serverguide/C/installation.xml:626(para)
20396
msgid "Once done select <emphasis>\"Finish\"</emphasis>."
20397
msgstr ""
20398
20399
#: serverguide/C/installation.xml:636(title)
20400
msgid "Formatting"
20401
msgstr ""
20402
20403
#: serverguide/C/installation.xml:638(para)
20404
msgid ""
20405
"There should now be a list of hard drives and RAID devices. The next step is "
20406
"to format and set the mount point for the RAID devices. Treat the RAID "
20407
"device as a local hard drive, format and mount accordingly."
20408
msgstr ""
20409
20410
#: serverguide/C/installation.xml:646(para)
20411
msgid ""
20412
"Select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20413
"#0\"</emphasis> partition."
20414
msgstr ""
20415
20416
#: serverguide/C/installation.xml:653(para)
20417
msgid ""
20418
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"swap "
20419
"area\"</emphasis>, then <emphasis>\"Done setting up partition\"</emphasis>."
20420
msgstr ""
20421
20422
#: serverguide/C/installation.xml:661(para)
20423
msgid ""
20424
"Next, select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20425
"#1\"</emphasis> partition."
20426
msgstr ""
20427
20428
#: serverguide/C/installation.xml:668(para)
20429
msgid ""
20430
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"Ext4 "
20431
"journaling file system\"</emphasis>."
20432
msgstr ""
20433
20434
#: serverguide/C/installation.xml:675(para)
20435
msgid ""
20436
"Then select the <emphasis>\"Mount point\"</emphasis> and choose "
20437
"<emphasis>\"/ - the root file system\"</emphasis>. Change any of the other "
20438
"options as appropriate, then select <emphasis>\"Done setting up "
20439
"partition\"</emphasis>."
20440
msgstr ""
20441
20442
#: serverguide/C/installation.xml:683(para)
20443
msgid ""
20444
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20445
"disk\"</emphasis>."
20446
msgstr ""
20447
20448
#: serverguide/C/installation.xml:690(para)
20449
msgid ""
20450
"If you choose to place the root partition on a RAID array, the installer "
20451
"will then ask if you would like to boot in a <emphasis>degraded</emphasis> "
20452
"state. See <xref linkend=\"raid-degraded\"/> for further details."
20453
msgstr ""
20454
20455
#: serverguide/C/installation.xml:695(para)
20456
msgid "The installation process will then continue normally."
20457
msgstr ""
20458
20459
#: serverguide/C/installation.xml:701(title)
20460
msgid "Degraded RAID"
20461
msgstr ""
20462
20463
#: serverguide/C/installation.xml:703(para)
20464
msgid ""
20465
"At some point in the life of the computer a disk failure event may occur. "
20466
"When this happens, using Software RAID, the operating system will place the "
20467
"array into what is known as a <emphasis>degraded</emphasis> state."
20468
msgstr ""
20469
20470
#: serverguide/C/installation.xml:708(para)
20471
msgid ""
20472
"If the array has become degraded, due to the chance of data corruption, by "
20473
"default Ubuntu Server Edition will boot to <emphasis>initramfs</emphasis> "
20474
"after thirty seconds. Once the initramfs has booted there is a fifteen "
20475
"second prompt giving you the option to go ahead and boot the system, or "
20476
"attempt manual recover. Booting to the initramfs prompt may or may not be "
20477
"the desired behavior, especially if the machine is in a remote location. "
20478
"Booting to a degraded array can be configured several ways:"
20479
msgstr ""
20480
20481
#: serverguide/C/installation.xml:719(para)
20482
msgid ""
20483
"The <application>dpkg-reconfigure</application> utility can be used to "
20484
"configure the default behavior, and during the process you will be queried "
20485
"about additional settings related to the array. Such as monitoring, email "
20486
"alerts, etc. To reconfigure <application>mdadm</application> enter the "
20487
"following:"
20488
msgstr ""
20489
20490
#: serverguide/C/installation.xml:726(command)
20491
msgid "sudo dpkg-reconfigure mdadm"
20492
msgstr ""
20493
20494
#: serverguide/C/installation.xml:732(para)
20495
msgid ""
20496
"The <command>dpkg-reconfigure mdadm</command> process will change the "
20497
"<filename>/etc/initramfs-tools/conf.d/mdadm</filename> configuration file. "
20498
"The file has the advantage of being able to pre-configure the system's "
20499
"behavior, and can also be manually edited:"
20500
msgstr ""
20501
20502
#: serverguide/C/installation.xml:738(programlisting)
20503
#, no-wrap
20504
msgid ""
20505
"\n"
20506
"BOOT_DEGRADED=true\n"
20507
msgstr ""
20508
20509
#: serverguide/C/installation.xml:743(para)
20510
msgid "The configuration file can be overridden by using a Kernel argument."
20511
msgstr ""
20512
20513
#: serverguide/C/installation.xml:751(para)
20514
msgid ""
20515
"Using a Kernel argument will allow the system to boot to a degraded array as "
20516
"well:"
20517
msgstr ""
20518
20519
#: serverguide/C/installation.xml:757(para)
20520
msgid ""
20521
"When the server is booting press <keycap>Shift</keycap> to open the "
20522
"<application>Grub</application> menu."
20523
msgstr ""
20524
20525
#: serverguide/C/installation.xml:762(para)
20526
msgid "Press <keycap>e</keycap> to edit your kernel command options."
20527
msgstr ""
20528
20529
#: serverguide/C/installation.xml:767(para)
20530
msgid "Press the <keycap>down</keycap> arrow to highlight the kernel line."
20531
msgstr ""
20532
20533
#: serverguide/C/installation.xml:772(para)
20534
msgid ""
20535
"Add <emphasis>\"bootdegraded=true\"</emphasis> (without the quotes) to the "
20536
"end of the line."
20537
msgstr ""
20538
20539
#: serverguide/C/installation.xml:777(para)
20540
msgid ""
20541
"Press <keycombo><keycap>Ctrl</keycap><keycap>x</keycap></keycombo> to boot "
20542
"the system."
20543
msgstr ""
20544
20545
#: serverguide/C/installation.xml:786(para)
20546
msgid ""
20547
"Once the system has booted you can either repair the array see <xref "
20548
"linkend=\"raid-maintenance\"/> for details, or copy important data to "
20549
"another machine due to major hardware failure."
20550
msgstr ""
20551
20552
#: serverguide/C/installation.xml:793(title)
20553
msgid "RAID Maintenance"
20554
msgstr ""
20555
20556
#: serverguide/C/installation.xml:795(para)
20557
msgid ""
20558
"The <application>mdadm</application> utility can be used to view the status "
20559
"of an array, add disks to an array, remove disks, etc:"
20560
msgstr ""
20561
20562
#: serverguide/C/installation.xml:802(para)
20563
msgid "To view the status of an array, from a terminal prompt enter:"
20564
msgstr ""
20565
20566
#: serverguide/C/installation.xml:806(command)
20567
msgid "sudo mdadm -D /dev/md0"
20568
msgstr ""
20569
20570
#: serverguide/C/installation.xml:809(para)
20571
msgid ""
20572
"The <emphasis>-D</emphasis> tells <application>mdadm</application> to "
20573
"display <emphasis>detailed</emphasis> information about the "
20574
"<filename>/dev/md0</filename> device. Replace <filename>/dev/md0</filename> "
20575
"with the appropriate RAID device."
20576
msgstr ""
20577
20578
#: serverguide/C/installation.xml:815(para)
20579
msgid "To view the status of a disk in an array:"
20580
msgstr ""
20581
20582
#: serverguide/C/installation.xml:819(command)
20583
msgid "sudo mdadm -E /dev/sda1"
20584
msgstr ""
20585
20586
#: serverguide/C/installation.xml:821(para)
20587
msgid ""
20588
"The output if very similar to the <command>mdadm -D</command> command, "
20589
"adjust <filename>/dev/sda1</filename> for each disk."
20590
msgstr ""
20591
20592
#: serverguide/C/installation.xml:826(para)
20593
msgid "If a disk fails and needs to be removed from an array enter:"
20594
msgstr ""
20595
20596
#: serverguide/C/installation.xml:830(command)
20597
msgid "sudo mdadm --remove /dev/md0 /dev/sda1"
20598
msgstr ""
20599
20600
#: serverguide/C/installation.xml:832(para)
20601
msgid ""
20602
"Change <filename>/dev/md0</filename> and <filename>/dev/sda1</filename> to "
20603
"the appropriate RAID device and disk."
20604
msgstr ""
20605
20606
#: serverguide/C/installation.xml:837(para)
20607
msgid "Similarly, to add a new disk:"
20608
msgstr ""
20609
20610
#: serverguide/C/installation.xml:841(command)
20611
msgid "sudo mdadm --add /dev/md0 /dev/sda1"
20612
msgstr ""
20613
20614
#: serverguide/C/installation.xml:846(para)
20615
msgid ""
20616
"Sometimes a disk can change to a <emphasis>faulty</emphasis> state even "
20617
"though there is nothing physically wrong with the drive. It is usually "
20618
"worthwhile to remove the drive from the array then re-add it. This will "
20619
"cause the drive to re-sync with the array. If the drive will not sync with "
20620
"the array, it is a good indication of hardware failure."
20621
msgstr ""
20622
20623
#: serverguide/C/installation.xml:852(para)
20624
msgid ""
20625
"The <filename>/proc/mdstat</filename> file also contains useful information "
20626
"about the system's RAID devices:"
20627
msgstr ""
20628
20629
#: serverguide/C/installation.xml:857(command)
20630
msgid "cat /proc/mdstat"
20631
msgstr ""
20632
20633
#: serverguide/C/installation.xml:858(computeroutput)
20634
#, no-wrap
20635
msgid ""
20636
"Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] "
20637
"[raid10] \n"
20638
"md0 : active raid1 sda1[0] sdb1[1]\n"
20639
" 10016384 blocks [2/2] [UU]\n"
20640
" \n"
20641
"unused devices: <none>"
20642
msgstr ""
20643
20644
#: serverguide/C/installation.xml:865(para)
20645
msgid ""
20646
"The following command is great for watching the status of a syncing drive:"
20647
msgstr ""
20648
20649
#: serverguide/C/installation.xml:870(command)
20650
msgid "watch -n1 cat /proc/mdstat"
20651
msgstr ""
20652
20653
#: serverguide/C/installation.xml:873(para)
20654
msgid ""
20655
"Press <emphasis>Ctrl+c</emphasis> to stop the "
20656
"<application>watch</application> command."
20657
msgstr ""
20658
20659
#: serverguide/C/installation.xml:877(para)
20660
msgid ""
20661
"If you do need to replace a faulty drive, after the drive has been replaced "
20662
"and synced, <application>grub</application> will need to be installed. To "
20663
"install <application>grub</application> on the new drive, enter the "
20664
"following:"
20665
msgstr ""
20666
20667
#: serverguide/C/installation.xml:883(command)
20668
msgid "sudo grub-install /dev/md0"
20669
msgstr ""
20670
20671
#: serverguide/C/installation.xml:886(para)
20672
msgid ""
20673
"Replace <filename>/dev/md0</filename> with the appropriate array device name."
20674
msgstr ""
20675
20676
#: serverguide/C/installation.xml:894(para)
20677
msgid ""
20678
"The topic of RAID arrays is a complex one due to the plethora of ways RAID "
20679
"can be configured. Please see the following links for more information:"
20680
msgstr ""
20681
20682
#: serverguide/C/installation.xml:901(para)
20683
msgid ""
20684
"<ulink url=\"https://help.ubuntu.com/community/Installation#raid\">Ubuntu "
20685
"Wiki Articles on RAID</ulink>."
20686
msgstr ""
20687
20688
#: serverguide/C/installation.xml:907(ulink)
20689
msgid "Software RAID HOWTO"
20690
msgstr ""
20691
20692
#: serverguide/C/installation.xml:912(ulink)
20693
msgid "Managing RAID on Linux"
20694
msgstr ""
20695
20696
#: serverguide/C/installation.xml:919(title)
20697
msgid "Logical Volume Manager (LVM)"
20698
msgstr ""
20699
20700
#: serverguide/C/installation.xml:921(para)
20701
msgid ""
20702
"Logical Volume Manger, or <emphasis>LVM</emphasis>, allows administrators to "
20703
"create <emphasis>logical</emphasis> volumes out of one or multiple physical "
20704
"hard disks. LVM volumes can be created on both software RAID partitions and "
20705
"standard partitions residing on a single disk. Volumes can also be extended, "
20706
"giving greater flexibility to systems as requirements change."
20707
msgstr ""
20708
20709
#: serverguide/C/installation.xml:930(para)
20710
msgid ""
20711
"A side effect of LVM's power and flexibility is a greater degree of "
20712
"complication. Before diving into the LVM installation process, it is best to "
20713
"get familiar with some terms."
20714
msgstr ""
20715
20716
#: serverguide/C/installation.xml:937(para)
20717
msgid ""
20718
"<emphasis>Volume Group (VG):</emphasis> contains one or several Logical "
20719
"Volumes (LV)."
20720
msgstr ""
20721
20722
#: serverguide/C/installation.xml:942(para)
20723
msgid ""
20724
"<emphasis>Logical Volume (LV):</emphasis> is similar to a partition in a non-"
20725
"LVM system. Multiple Physical Volumes (PV) can make up one LV, on top of "
20726
"which resides the actual EXT3, XFS, JFS, etc filesystem."
20727
msgstr ""
20728
20729
#: serverguide/C/installation.xml:948(para)
20730
msgid ""
20731
"<emphasis>Physical Volume (PV):</emphasis> physical hard disk or software "
20732
"RAID partition. The Volume Group can be extended by adding more PVs."
20733
msgstr ""
20734
20735
#: serverguide/C/installation.xml:959(para)
20736
msgid ""
20737
"As an example this section covers installing Ubuntu Server Edition with "
20738
"<filename role=\"directory\">/srv</filename> mounted on a LVM volume. During "
20739
"the initial install only one Physical Volume (PV) will be part of the Volume "
20740
"Group (VG). Another PV will be added after install to demonstrate how a VG "
20741
"can be extended."
20742
msgstr ""
20743
20744
#: serverguide/C/installation.xml:965(para)
20745
msgid ""
20746
"There are several installation options for LVM, <emphasis>\"Guided - use the "
20747
"entire disk and setup LVM\"</emphasis> which will also allow you to assign a "
20748
"portion of the available space to LVM, <emphasis>\"Guided - use entire and "
20749
"setup encrypted LVM\"</emphasis>, or <emphasis>Manually</emphasis> setup the "
20750
"partitions and configure LVM. At this time the only way to configure a "
20751
"system with both LVM and standard partitions, during installation, is to use "
20752
"the Manual approach."
20753
msgstr ""
20754
20755
#: serverguide/C/installation.xml:982(para)
20756
msgid ""
20757
"At the <emphasis>\"Partition Disks</emphasis> screen choose "
20758
"<emphasis>\"Manual\"</emphasis>."
20759
msgstr ""
20760
20761
#: serverguide/C/installation.xml:989(para)
20762
msgid ""
20763
"Select the hard disk and on the next screen choose \"yes\" to "
20764
"<emphasis>\"Create a new empty partition table on this device\"</emphasis>."
20765
msgstr ""
20766
20767
#: serverguide/C/installation.xml:996(para)
20768
msgid ""
20769
"Next, create standard <emphasis>/boot</emphasis>, <emphasis>swap</emphasis>, "
20770
"and <emphasis>/</emphasis> partitions with whichever filesystem you prefer."
20771
msgstr ""
20772
20773
#: serverguide/C/installation.xml:1004(para)
20774
msgid ""
20775
"For the LVM <emphasis>/srv</emphasis>, create a new "
20776
"<emphasis>Logical</emphasis> partition. Then change <emphasis>\"Use "
20777
"as\"</emphasis> to <emphasis>\"physical volume for LVM\"</emphasis> then "
20778
"<emphasis>\"Done setting up the partition\"</emphasis>."
20779
msgstr ""
20780
20781
#: serverguide/C/installation.xml:1012(para)
20782
msgid ""
20783
"Now select <emphasis>\"Configure the Logical Volume Manager\"</emphasis> at "
20784
"the top, and choose <emphasis>\"Yes\"</emphasis> to write the changes to "
20785
"disk."
20786
msgstr ""
20787
20788
#: serverguide/C/installation.xml:1020(para)
20789
msgid ""
20790
"For the <emphasis>\"LVM configuration action\"</emphasis> on the next "
20791
"screen, choose <emphasis>\"Create volume group\"</emphasis>. Enter a name "
20792
"for the VG such as <emphasis>vg01</emphasis>, or something more descriptive. "
20793
"After entering a name, select the partition configured for LVM, and choose "
20794
"<emphasis>\"Continue\"</emphasis>."
20795
msgstr ""
20796
20797
#: serverguide/C/installation.xml:1029(para)
20798
msgid ""
20799
"Back at the <emphasis>\"LVM configuration action\"</emphasis> screen, select "
20800
"<emphasis>\"Create logical volume\"</emphasis>. Select the newly created "
20801
"volume group, and enter a name for the new LV, for example "
20802
"<emphasis>srv</emphasis> since that is the intended mount point. Then choose "
20803
"a size, which may be the full partition because it can always be extended "
20804
"later. Choose <emphasis>\"Finish\"</emphasis> and you should be back at the "
20805
"main <emphasis>\"Partition Disks\"</emphasis> screen."
20806
msgstr ""
20807
20808
#: serverguide/C/installation.xml:1039(para)
20809
msgid ""
20810
"Now add a filesystem to the new LVM. Select the partition under "
20811
"<emphasis>\"LVM VG vg01, LV srv\"</emphasis>, or whatever name you have "
20812
"chosen, the choose <emphasis>Use as</emphasis>. Setup a file system as "
20813
"normal selecting <emphasis>/srv</emphasis> as the mount point. Once done, "
20814
"select <emphasis>\"Done setting up the partition\"</emphasis>."
20815
msgstr ""
20816
20817
#: serverguide/C/installation.xml:1048(para)
20818
msgid ""
20819
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20820
"disk\"</emphasis>. Then confirm the changes and continue with the rest of "
20821
"the installation."
20822
msgstr ""
20823
20824
#: serverguide/C/installation.xml:1056(para)
20825
msgid "There are some useful utilities to view information about LVM:"
20826
msgstr ""
20827
20828
#: serverguide/C/installation.xml:1061(para)
20829
msgid ""
20830
"<emphasis>vgdisplay:</emphasis> shows information about Volume Groups."
20831
msgstr ""
20832
20833
#: serverguide/C/installation.xml:1062(para)
20834
msgid ""
20835
"<emphasis>lvdisplay:</emphasis> has information about Logical Volumes."
20836
msgstr ""
20837
20838
#: serverguide/C/installation.xml:1063(para)
20839
msgid ""
20840
"<emphasis>pvdisplay:</emphasis> similarly displays information about "
20841
"Physical Volumes."
20842
msgstr ""
20843
20844
#: serverguide/C/installation.xml:1068(title)
20845
msgid "Extending Volume Groups"
20846
msgstr ""
20847
20848
#: serverguide/C/installation.xml:1070(para)
20849
msgid ""
20850
"Continuing with <emphasis>srv</emphasis> as an LVM volume example, this "
20851
"section covers adding a second hard disk, creating a Physical Volume (PV), "
20852
"adding it to the volume group (VG), extending the logical volume <filename "
20853
"role=\"directory\">srv</filename> and finally extending the filesystem. This "
20854
"example assumes a second hard disk has been added to the system. This hard "
20855
"disk will be named <filename>/dev/sdb</filename> in our example. BEWARE: "
20856
"make sure you don't already have an existing <filename>/dev/sdb</filename> "
20857
"before issuing the commands below. You could lose some data if you issue "
20858
"those commands on a non-empty disk. In our example we will use the entire "
20859
"disk as a physical volume (you could choose to create partitions and use "
20860
"them as different physical volumes)"
20861
msgstr ""
20862
20863
#: serverguide/C/installation.xml:1082(para)
20864
msgid "First, create the physical volume, in a terminal execute:"
20865
msgstr ""
20866
20867
#: serverguide/C/installation.xml:1087(command)
20868
msgid "sudo pvcreate /dev/sdb"
20869
msgstr ""
20870
20871
#: serverguide/C/installation.xml:1093(para)
20872
msgid "Now extend the Volume Group (VG):"
20873
msgstr ""
20874
20875
#: serverguide/C/installation.xml:1098(command)
20876
msgid "sudo vgextend vg01 /dev/sdb"
20877
msgstr ""
20878
20879
#: serverguide/C/installation.xml:1104(para)
20880
msgid ""
20881
"Use <application>vgdisplay</application> to find out the free physical "
20882
"extents - Free PE / size (the size you can allocate). We will assume a free "
20883
"size of 511 PE (equivalent to 2GB with a PE size of 4MB) and we will use the "
20884
"whole free space available. Use your own PE and/or free space."
20885
msgstr ""
20886
20887
#: serverguide/C/installation.xml:1110(para)
20888
msgid ""
20889
"The Logical Volume (LV) can now be extended by different methods, we will "
20890
"only see how to use the PE to extend the LV:"
20891
msgstr ""
20892
20893
#: serverguide/C/installation.xml:1115(command)
20894
msgid "sudo lvextend /dev/vg01/srv -l +511"
20895
msgstr ""
20896
20897
#: serverguide/C/installation.xml:1118(para)
20898
msgid ""
20899
"The <emphasis>-l</emphasis> option allows the LV to be extended using PE. "
20900
"The <emphasis>-L</emphasis> option allows the LV to be extended using Meg, "
20901
"Gig, Tera, etc bytes."
20902
msgstr ""
20903
20904
#: serverguide/C/installation.xml:1126(para)
20905
msgid ""
20906
"Even though you are supposed to be able to <emphasis>expand</emphasis> an "
20907
"ext3 or ext4 filesystem without unmounting it first, it may be a good "
20908
"pratice to unmount it anyway and check the filesystem, so that you don't "
20909
"mess up the day you want to reduce a logical volume (in that case unmounting "
20910
"first is compulsory)."
20911
msgstr ""
20912
20913
#: serverguide/C/installation.xml:1132(para)
20914
msgid ""
20915
"The following commands are for an <emphasis>EXT3</emphasis> or "
20916
"<emphasis>EXT4</emphasis> filesystem. If you are using another filesystem "
20917
"there may be other utilities available."
20918
msgstr ""
20919
20920
#: serverguide/C/installation.xml:1139(command)
20921
msgid "sudo e2fsck -f /dev/vg01/srv"
20922
msgstr ""
20923
20924
#: serverguide/C/installation.xml:1142(para)
20925
msgid ""
20926
"The <emphasis>-f</emphasis> option of <application>e2fsck</application> "
20927
"forces checking even if the system seems clean."
20928
msgstr ""
20929
20930
#: serverguide/C/installation.xml:1149(para)
20931
msgid "Finally, resize the filesystem:"
20932
msgstr ""
20933
20934
#: serverguide/C/installation.xml:1154(command)
20935
msgid "sudo resize2fs /dev/vg01/srv"
20936
msgstr ""
20937
20938
#: serverguide/C/installation.xml:1160(para)
20939
msgid "Now mount the partition and check its size."
20940
msgstr ""
20941
20942
#: serverguide/C/installation.xml:1165(command)
20943
msgid "mount /dev/vg01/srv /srv && df -h /srv"
20944
msgstr ""
20945
20946
#: serverguide/C/installation.xml:1177(para)
20947
msgid ""
20948
"See the <ulink "
20949
"url=\"https://help.ubuntu.com/community/Installation#lvm\">Ubuntu Wiki LVM "
20950
"Articles</ulink>."
20951
msgstr ""
20952
20953
#: serverguide/C/installation.xml:1182(para)
20954
msgid ""
20955
"See the <ulink url=\"http://tldp.org/HOWTO/LVM-HOWTO/index.html\">LVM "
20956
"HOWTO</ulink> for more information."
20957
msgstr ""
20958
20959
#: serverguide/C/installation.xml:1187(para)
20960
msgid ""
20961
"Another good article is <ulink "
20962
"url=\"http://www.linuxdevcenter.com/pub/a/linux/2006/04/27/managing-disk-"
20963
"space-with-lvm.html\">Managing Disk Space with LVM</ulink> on O'Reilly's "
20964
"linuxdevcenter.com site."
20965
msgstr ""
20966
20967
#: serverguide/C/installation.xml:1194(para)
20968
msgid ""
20969
"For more information on <application>fdisk</application> see the <ulink "
20970
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/fdisk.8.html\">fdisk "
20971
"man page</ulink>."
20972
msgstr ""
20973
20974
#: serverguide/C/file-server.xml:13(title)
20975
msgid "File Servers"
20976
msgstr ""
20977
20978
#: serverguide/C/file-server.xml:15(para)
20979
msgid ""
20980
"If you have more than one computer on a single network. At some point you "
20981
"will probably need to share files between them. In this section we cover "
20982
"installing and configuring FTP, NFS, and CUPS."
20983
msgstr ""
20984
20985
#: serverguide/C/file-server.xml:22(title)
20986
msgid "FTP Server"
20987
msgstr ""
20988
20989
#: serverguide/C/file-server.xml:24(para)
20990
msgid ""
20991
"File Transfer Protocol (FTP) is a TCP protocol for uploading and downloading "
20992
"files between computers. FTP works on a client/server model. The server "
20993
"component is called an <emphasis>FTP daemon</emphasis>. It continuously "
20994
"listens for FTP requests from remote clients. When a request is received, it "
20995
"manages the login and sets up the connection. For the duration of the "
20996
"session it executes any of commands sent by the FTP client."
20997
msgstr ""
20998
20999
#: serverguide/C/file-server.xml:33(para)
21000
msgid "Access to an FTP server can be managed in two ways:"
21001
msgstr ""
21002
21003
#: serverguide/C/file-server.xml:37(para)
21004
msgid "Anonymous"
21005
msgstr ""
21006
21007
#: serverguide/C/file-server.xml:40(para)
21008
msgid "Authenticated"
21009
msgstr ""
21010
21011
#: serverguide/C/file-server.xml:43(para)
21012
msgid ""
21013
"In the Anonymous mode, remote clients can access the FTP server by using the "
21014
"default user account called \"anonymous\" or \"ftp\" and sending an email "
21015
"address as the password. In the Authenticated mode a user must have an "
21016
"account and a password. User access to the FTP server directories and files "
21017
"is dependent on the permissions defined for the account used at login. As a "
21018
"general rule, the FTP daemon will hide the root directory of the FTP server "
21019
"and change it to the FTP Home directory. This hides the rest of the file "
21020
"system from remote sessions."
21021
msgstr ""
21022
21023
#: serverguide/C/file-server.xml:55(title)
21024
msgid "vsftpd - FTP Server Installation"
21025
msgstr ""
21026
21027
#: serverguide/C/file-server.xml:57(para)
21028
msgid ""
21029
"vsftpd is an FTP daemon available in Ubuntu. It is easy to install, set up, "
21030
"and maintain. To install <application>vsftpd</application> you can run the "
21031
"following command:"
21032
msgstr ""
21033
21034
#: serverguide/C/file-server.xml:65(command)
21035
msgid "sudo apt-get install vsftpd"
21036
msgstr ""
21037
21038
#: serverguide/C/file-server.xml:71(title)
21039
msgid "Anonymous FTP Configuration"
21040
msgstr ""
21041
21042
#: serverguide/C/file-server.xml:73(para)
21043
msgid ""
21044
"By default <application>vsftpd</application> is configured to only allow "
21045
"anonymous download. During installation a <emphasis>ftp</emphasis> user is "
21046
"created with a home directory of <filename>/home/ftp</filename>. This is the "
21047
"default FTP directory."
21048
msgstr ""
21049
21050
#: serverguide/C/file-server.xml:80(para)
21051
msgid ""
21052
"If you wish to change this location, to <filename>/srv/ftp</filename> for "
21053
"example, simply create a directory in another location and change the "
21054
"<emphasis>ftp</emphasis> user's home directory:"
21055
msgstr ""
21056
21057
#: serverguide/C/file-server.xml:87(command)
21058
msgid "sudo mkdir /srv/ftp"
21059
msgstr ""
21060
21061
#: serverguide/C/file-server.xml:88(command)
21062
msgid "sudo usermod -d /srv/ftp ftp"
21063
msgstr ""
21064
21065
#: serverguide/C/file-server.xml:91(para)
21066
msgid "After making the change restart <application>vsftpd</application>:"
21067
msgstr ""
21068
21069
#: serverguide/C/file-server.xml:96(command) serverguide/C/file-server.xml:124(command) serverguide/C/file-server.xml:189(command) serverguide/C/file-server.xml:237(command)
21070
msgid "sudo /etc/init.d/vsftpd restart"
21071
msgstr ""
21072
21073
#: serverguide/C/file-server.xml:99(para)
21074
msgid ""
21075
"Finally, copy any files and directories you would like to make available "
21076
"through anonymous FTP to <filename>/srv/ftp</filename>."
21077
msgstr ""
21078
21079
#: serverguide/C/file-server.xml:106(title)
21080
msgid "User Authenticated FTP Configuration"
21081
msgstr ""
21082
21083
#: serverguide/C/file-server.xml:108(para)
21084
msgid ""
21085
"To configure <application>vsftpd</application> to authenticate system users "
21086
"and allow them to upload files edit <filename>/etc/vsftpd.conf</filename>:"
21087
msgstr ""
21088
21089
#: serverguide/C/file-server.xml:114(programlisting)
21090
#, no-wrap
21091
msgid ""
21092
"\n"
21093
"local_enable=YES\n"
21094
"write_enable=YES\n"
21095
msgstr ""
21096
21097
#: serverguide/C/file-server.xml:119(para)
21098
msgid "Now restart <application>vsftpd</application>:"
21099
msgstr ""
21100
21101
#: serverguide/C/file-server.xml:127(para)
21102
msgid ""
21103
"Now when system users login to FTP they will start in their "
21104
"<emphasis>home</emphasis> directories where they can download, upload, "
21105
"create directories, etc."
21106
msgstr ""
21107
21108
#: serverguide/C/file-server.xml:133(para)
21109
msgid ""
21110
"Similarly, by default, the anonymous users are not allowed to upload files "
21111
"to FTP server. To change this setting, you should uncomment the following "
21112
"line, and restart <application>vsftpd</application>:"
21113
msgstr ""
21114
21115
#: serverguide/C/file-server.xml:140(programlisting)
21116
#, no-wrap
21117
msgid ""
21118
"\n"
21119
"anon_upload_enable=YES\n"
21120
msgstr ""
21121
21122
#: serverguide/C/file-server.xml:145(para)
21123
msgid ""
21124
"Enabling anonymous FTP upload can be an extreme security risk. It is best to "
21125
"not enable anonymous upload on servers accessed directly from the Internet."
21126
msgstr ""
21127
21128
#: serverguide/C/file-server.xml:151(para)
21129
msgid ""
21130
"The configuration file consists of many configuration parameters. The "
21131
"information about each parameter is available in the configuration file. "
21132
"Alternatively, you can refer to the man page, <command>man 5 "
21133
"vsftpd.conf</command> for details of each parameter."
21134
msgstr ""
21135
21136
#: serverguide/C/file-server.xml:162(title)
21137
msgid "Securing FTP"
21138
msgstr ""
21139
21140
#: serverguide/C/file-server.xml:164(para)
21141
msgid ""
21142
"There are options in <filename>/etc/vsftpd.conf</filename> to help make "
21143
"<application>vsftpd</application> more secure. For example users can be "
21144
"limited to their home directories by uncommenting:"
21145
msgstr ""
21146
21147
#: serverguide/C/file-server.xml:170(programlisting)
21148
#, no-wrap
21149
msgid ""
21150
"\n"
21151
"chroot_local_user=YES\n"
21152
msgstr ""
21153
21154
#: serverguide/C/file-server.xml:174(para)
21155
msgid ""
21156
"You can also limit a specific list of users to just their home directories:"
21157
msgstr ""
21158
21159
#: serverguide/C/file-server.xml:178(programlisting)
21160
#, no-wrap
21161
msgid ""
21162
"\n"
21163
"chroot_list_enable=YES\n"
21164
"chroot_list_file=/etc/vsftpd.chroot_list\n"
21165
msgstr ""
21166
21167
#: serverguide/C/file-server.xml:183(para)
21168
msgid ""
21169
"After uncommenting the above options, create a "
21170
"<filename>/etc/vsftpd.chroot_list</filename> containing a list of users one "
21171
"per line. Then restart <application>vsftpd</application>:"
21172
msgstr ""
21173
21174
#: serverguide/C/file-server.xml:192(para)
21175
msgid ""
21176
"Also, the <filename>/etc/ftpusers</filename> file is a list of users that "
21177
"are <emphasis>disallowed</emphasis> FTP access. The default list includes "
21178
"root, daemon, nobody, etc. To disable FTP access for additional users simply "
21179
"add them to the list."
21180
msgstr ""
21181
21182
#: serverguide/C/file-server.xml:199(para)
21183
msgid ""
21184
"FTP can also be encrypted using <emphasis>FTPS</emphasis>. Different from "
21185
"<emphasis>SFTP</emphasis>, <emphasis>FTPS</emphasis> is FTP over Secure "
21186
"Socket Layer (SSL). <emphasis>SFTP</emphasis> is a FTP like session over an "
21187
"encrypted <emphasis>SSH</emphasis> connection. A major difference is that "
21188
"users of SFTP need to have a <emphasis>shell</emphasis> account on the "
21189
"system, instead of a <emphasis>nologin</emphasis> shell. Providing all users "
21190
"with a shell may not be ideal for some environments, such as a shared web "
21191
"host."
21192
msgstr ""
21193
21194
#: serverguide/C/file-server.xml:208(para)
21195
msgid ""
21196
"To configure <emphasis>FTPS</emphasis>, edit "
21197
"<filename>/etc/vsftpd.conf</filename> and at the bottom add:"
21198
msgstr ""
21199
21200
#: serverguide/C/file-server.xml:212(programlisting)
21201
#, no-wrap
21202
msgid ""
21203
"\n"
21204
"ssl_enable=Yes\n"
21205
msgstr ""
21206
21207
#: serverguide/C/file-server.xml:216(para)
21208
msgid "Also, notice the certificate and key related options:"
21209
msgstr ""
21210
21211
#: serverguide/C/file-server.xml:220(programlisting)
21212
#, no-wrap
21213
msgid ""
21214
"\n"
21215
"rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
21216
"rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
21217
msgstr ""
21218
21219
#: serverguide/C/file-server.xml:225(para)
21220
msgid ""
21221
"By default these options are set the certificate and key provided by the "
21222
"<application>ssl-cert</application> package. In a production environment "
21223
"these should be replaced with a certificate and key generated for the "
21224
"specific host. For more information on certificates see <xref "
21225
"linkend=\"certificates-and-security\"/>."
21226
msgstr ""
21227
21228
#: serverguide/C/file-server.xml:231(para)
21229
msgid ""
21230
"Now restart <application>vsftpd</application>, and non-anonymous users will "
21231
"be forced to use <emphasis>FTPS</emphasis>:"
21232
msgstr ""
21233
21234
#: serverguide/C/file-server.xml:240(para)
21235
msgid ""
21236
"To allow users with a shell of <filename>/usr/sbin/nologin</filename> access "
21237
"to FTP, but have no shell access, edit <filename>/etc/shells</filename> "
21238
"adding the <emphasis>nologin</emphasis> shell:"
21239
msgstr ""
21240
21241
#: serverguide/C/file-server.xml:245(programlisting)
21242
#, no-wrap
21243
msgid ""
21244
"\n"
21245
"# /etc/shells: valid login shells\n"
21246
"/bin/csh\n"
21247
"/bin/sh\n"
21248
"/usr/bin/es\n"
21249
"/usr/bin/ksh\n"
21250
"/bin/ksh\n"
21251
"/usr/bin/rc\n"
21252
"/usr/bin/tcsh\n"
21253
"/bin/tcsh\n"
21254
"/usr/bin/esh\n"
21255
"/bin/dash\n"
21256
"/bin/bash\n"
21257
"/bin/rbash\n"
21258
"/usr/bin/screen\n"
21259
"/usr/sbin/nologin\n"
21260
msgstr ""
21261
21262
#: serverguide/C/file-server.xml:263(para)
21263
msgid ""
21264
"This is necessary because, by default <application>vsftpd</application> uses "
21265
"PAM for authentication, and the <filename>/etc/pam.d/vsftpd</filename> "
21266
"configuration file contains:"
21267
msgstr ""
21268
21269
#: serverguide/C/file-server.xml:268(programlisting)
21270
#, no-wrap
21271
msgid ""
21272
"\n"
21273
"auth required pam_shells.so\n"
21274
msgstr ""
21275
21276
#: serverguide/C/file-server.xml:272(para)
21277
msgid ""
21278
"The <emphasis>shells</emphasis> PAM module restricts access to shells listed "
21279
"in the <filename>/etc/shells</filename> file."
21280
msgstr ""
21281
21282
#: serverguide/C/file-server.xml:277(para)
21283
msgid ""
21284
"Most popular FTP clients can be configured connect using FTPS. The "
21285
"<application>lftp</application> command line FTP client has the ability to "
21286
"use FTPS as well."
21287
msgstr ""
21288
21289
#: serverguide/C/file-server.xml:288(para)
21290
msgid ""
21291
"See the <ulink url=\"http://vsftpd.beasts.org/vsftpd_conf.html\">vsftpd "
21292
"website</ulink> for more information."
21293
msgstr ""
21294
21295
#: serverguide/C/file-server.xml:293(para)
21296
msgid ""
21297
"For detailed <filename>/etc/vsftpd.conf</filename> options see the <ulink "
21298
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/vsftpd.conf.5.html\">"
21299
"vsftpd.conf man page</ulink>."
21300
msgstr ""
21301
21302
#: serverguide/C/file-server.xml:299(para)
21303
msgid ""
21304
"The CodeGurus article <ulink "
21305
"url=\"http://www.codeguru.com/csharp/.net/net_general/internet/article.php/c1"
21306
"4329\"> FTPS vs. SFTP: What to Choose</ulink> has useful information "
21307
"contrasting FTPS and SFTP."
21308
msgstr ""
21309
21310
#: serverguide/C/file-server.xml:305(para)
21311
msgid ""
21312
"Also, for more information see the <ulink "
21313
"url=\"https://help.ubuntu.com/community/vsftpd\">Ubuntu Wiki vsftpd</ulink> "
21314
"page."
21315
msgstr ""
21316
21317
#: serverguide/C/file-server.xml:315(title)
21318
msgid "Network File System (NFS)"
21319
msgstr ""
21320
21321
#: serverguide/C/file-server.xml:316(para)
21322
msgid ""
21323
"NFS allows a system to share directories and files with others over a "
21324
"network. By using NFS, users and programs can access files on remote systems "
21325
"almost as if they were local files."
21326
msgstr ""
21327
21328
#: serverguide/C/file-server.xml:322(para)
21329
msgid "Some of the most notable benefits that NFS can provide are:"
21330
msgstr ""
21331
21332
#: serverguide/C/file-server.xml:328(para)
21333
msgid ""
21334
"Local workstations use less disk space because commonly used data can be "
21335
"stored on a single machine and still remain accessible to others over the "
21336
"network."
21337
msgstr ""
21338
21339
#: serverguide/C/file-server.xml:333(para)
21340
msgid ""
21341
"There is no need for users to have separate home directories on every "
21342
"network machine. Home directories could be set up on the NFS server and made "
21343
"available throughout the network."
21344
msgstr ""
21345
21346
#: serverguide/C/file-server.xml:339(para)
21347
msgid ""
21348
"Storage devices such as floppy disks, CDROM drives, and USB Thumb drives can "
21349
"be used by other machines on the network. This may reduce the number of "
21350
"removable media drives throughout the network."
21351
msgstr ""
21352
21353
#: serverguide/C/file-server.xml:349(para)
21354
msgid ""
21355
"At a terminal prompt enter the following command to install the NFS Server:"
21356
msgstr ""
21357
21358
#: serverguide/C/file-server.xml:355(command)
21359
msgid "sudo apt-get install nfs-kernel-server"
21360
msgstr ""
21361
21362
#: serverguide/C/file-server.xml:361(para)
21363
msgid ""
21364
"You can configure the directories to be exported by adding them to the "
21365
"<filename>/etc/exports</filename> file. For example:"
21366
msgstr ""
21367
21368
#: serverguide/C/file-server.xml:366(screen)
21369
#, no-wrap
21370
msgid ""
21371
"\n"
21372
"/ubuntu *(ro,sync,no_root_squash)\n"
21373
"/home *(rw,sync,no_root_squash)\n"
21374
msgstr ""
21375
21376
#: serverguide/C/file-server.xml:372(para)
21377
msgid ""
21378
"You can replace * with one of the hostname formats. Make the hostname "
21379
"declaration as specific as possible so unwanted systems cannot access the "
21380
"NFS mount."
21381
msgstr ""
21382
21383
#: serverguide/C/file-server.xml:378(para)
21384
msgid ""
21385
"To start the NFS server, you can run the following command at a terminal "
21386
"prompt:"
21387
msgstr ""
21388
21389
#: serverguide/C/file-server.xml:383(command)
21390
msgid "sudo /etc/init.d/nfs-kernel-server start"
21391
msgstr ""
21392
21393
#: serverguide/C/file-server.xml:388(title)
21394
msgid "NFS Client Configuration"
21395
msgstr ""
21396
21397
#: serverguide/C/file-server.xml:389(para)
21398
msgid ""
21399
"Use the <application>mount</application> command to mount a shared NFS "
21400
"directory from another machine, by typing a command line similar to the "
21401
"following at a terminal prompt:"
21402
msgstr ""
21403
21404
#: serverguide/C/file-server.xml:395(command)
21405
msgid "sudo mount example.hostname.com:/ubuntu /local/ubuntu"
21406
msgstr ""
21407
21408
#: serverguide/C/file-server.xml:399(para)
21409
msgid ""
21410
"The mount point directory <filename>/local/ubuntu</filename> must exist. "
21411
"There should be no files or subdirectories in the "
21412
"<filename>/local/ubuntu</filename> directory."
21413
msgstr ""
21414
21415
#: serverguide/C/file-server.xml:406(para)
21416
msgid ""
21417
"An alternate way to mount an NFS share from another machine is to add a line "
21418
"to the <filename>/etc/fstab</filename> file. The line must state the "
21419
"hostname of the NFS server, the directory on the server being exported, and "
21420
"the directory on the local machine where the NFS share is to be mounted."
21421
msgstr ""
21422
21423
#: serverguide/C/file-server.xml:414(para)
21424
msgid ""
21425
"The general syntax for the line in <filename>/etc/fstab</filename> file is "
21426
"as follows:"
21427
msgstr ""
21428
21429
#: serverguide/C/file-server.xml:420(programlisting)
21430
#, no-wrap
21431
msgid ""
21432
"\n"
21433
"example.hostname.com:/ubuntu /local/ubuntu nfs "
21434
"rsize=8192,wsize=8192,timeo=14,intr\n"
21435
msgstr ""
21436
21437
#: serverguide/C/file-server.xml:424(para)
21438
msgid ""
21439
"If you have trouble mounting an NFS share, make sure the <application>nfs-"
21440
"common</application> package is installed on your client. To install "
21441
"<application>nfs-common</application> enter the following command at the "
21442
"terminal prompt: <screen>\n"
21443
"<command>sudo apt-get install nfs-common</command>\n"
21444
"</screen>"
21445
msgstr ""
21446
21447
#: serverguide/C/file-server.xml:437(ulink)
21448
msgid "Linux NFS faq"
21449
msgstr ""
21450
21451
#: serverguide/C/file-server.xml:439(ulink)
21452
msgid "Ubuntu Wiki NFS Howto"
21453
msgstr ""
21454
21455
#: serverguide/C/file-server.xml:445(title)
21456
msgid "CUPS - Print Server"
21457
msgstr ""
21458
21459
#: serverguide/C/file-server.xml:446(para)
21460
msgid ""
21461
"The primary mechanism for Ubuntu printing and print services is the "
21462
"<emphasis role=\"bold\">Common UNIX Printing System</emphasis> (CUPS). This "
21463
"printing system is a freely available, portable printing layer which has "
21464
"become the new standard for printing in most Linux distributions."
21465
msgstr ""
21466
21467
#: serverguide/C/file-server.xml:453(para)
21468
msgid ""
21469
"CUPS manages print jobs and queues and provides network printing using the "
21470
"standard Internet Printing Protocol (IPP), while offering support for a very "
21471
"large range of printers, from dot-matrix to laser and many in between. CUPS "
21472
"also supports PostScript Printer Description (PPD) and auto-detection of "
21473
"network printers, and features a simple web-based configuration and "
21474
"administration tool."
21475
msgstr ""
21476
21477
#: serverguide/C/file-server.xml:463(para)
21478
msgid ""
21479
"To install CUPS on your Ubuntu computer, simply use "
21480
"<application>sudo</application> with the <application>apt-get</application> "
21481
"command and give the packages to install as the first parameter. A complete "
21482
"CUPS install has many package dependencies, but they may all be specified on "
21483
"the same command line. Enter the following at a terminal prompt to install "
21484
"CUPS:"
21485
msgstr ""
21486
21487
#: serverguide/C/file-server.xml:468(command)
21488
msgid "sudo apt-get install cups"
21489
msgstr ""
21490
21491
#: serverguide/C/file-server.xml:471(para)
21492
msgid ""
21493
"Upon authenticating with your user password, the packages should be "
21494
"downloaded and installed without error. Upon the conclusion of installation, "
21495
"the CUPS server will be started automatically."
21496
msgstr ""
21497
21498
#: serverguide/C/file-server.xml:476(para)
21499
msgid ""
21500
"For troubleshooting purposes, you can access CUPS server errors via the "
21501
"error log file at: <filename>/var/log/cups/error_log</filename>. If the "
21502
"error log does not show enough information to troubleshoot any problems you "
21503
"encounter, the verbosity of the CUPS log can be increased by changing the "
21504
"<emphasis role=\"bold\">LogLevel</emphasis> directive in the configuration "
21505
"file (discussed below) to \"debug\" or even \"debug2\", which logs "
21506
"everything, from the default of \"info\". If you make this change, remember "
21507
"to change it back once you've solved your problem, to prevent the log file "
21508
"from becoming overly large."
21509
msgstr ""
21510
21511
#: serverguide/C/file-server.xml:489(para)
21512
msgid ""
21513
"The Common UNIX Printing System server's behavior is configured through the "
21514
"directives contained in the file <filename>/etc/cups/cupsd.conf</filename>. "
21515
"The CUPS configuration file follows the same syntax as the primary "
21516
"configuration file for the Apache HTTP server, so users familiar with "
21517
"editing Apache's configuration file should feel at ease when editing the "
21518
"CUPS configuration file. Some examples of settings you may wish to change "
21519
"initially will be presented here."
21520
msgstr ""
21521
21522
#: serverguide/C/file-server.xml:499(para)
21523
msgid ""
21524
"Prior to editing the configuration file, you should make a copy of the "
21525
"original file and protect it from writing, so you will have the original "
21526
"settings as a reference, and to reuse as necessary."
21527
msgstr ""
21528
21529
#: serverguide/C/file-server.xml:503(para)
21530
msgid ""
21531
"Copy the <filename>/etc/cups/cupsd.conf</filename> file and protect it from "
21532
"writing with the following commands, issued at a terminal prompt:"
21533
msgstr ""
21534
21535
#: serverguide/C/file-server.xml:509(command)
21536
msgid "sudo cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.original"
21537
msgstr ""
21538
21539
#: serverguide/C/file-server.xml:510(command)
21540
msgid "sudo chmod a-w /etc/cups/cupsd.conf.original"
21541
msgstr ""
21542
21543
#: serverguide/C/file-server.xml:515(para)
21544
msgid ""
21545
"<emphasis role=\"bold\">ServerAdmin</emphasis>: To configure the email "
21546
"address of the designated administrator of the CUPS server, simply edit the "
21547
"<filename>/etc/cups/cupsd.conf</filename> configuration file with your "
21548
"preferred text editor, and add or modify the <emphasis "
21549
"role=\"italics\">ServerAdmin</emphasis> line accordingly. For example, if "
21550
"you are the Administrator for the CUPS server, and your e-mail address is "
21551
"'bjoy@somebigco.com', then you would modify the ServerAdmin line to appear "
21552
"as such:"
21553
msgstr ""
21554
21555
#: serverguide/C/file-server.xml:526(screen)
21556
#, no-wrap
21557
msgid ""
21558
"\n"
21559
"ServerAdmin bjoy@somebigco.com\n"
21560
msgstr ""
21561
21562
#: serverguide/C/file-server.xml:532(para)
21563
msgid ""
21564
"<emphasis role=\"bold\">Listen</emphasis>: By default on Ubuntu, the CUPS "
21565
"server installation listens only on the loopback interface at IP address "
21566
"<emphasis>127.0.0.1</emphasis>. In order to instruct the CUPS server to "
21567
"listen on an actual network adapter's IP address, you must specify either a "
21568
"hostname, the IP address, or optionally, an IP address/port pairing via the "
21569
"addition of a Listen directive. For example, if your CUPS server resides on "
21570
"a local network at the IP address <emphasis "
21571
"role=\"italics\">192.168.10.250</emphasis> and you'd like to make it "
21572
"accessible to the other systems on this subnetwork, you would edit the "
21573
"<filename>/etc/cups/cupsd.conf</filename> and add a Listen directive, as "
21574
"such:"
21575
msgstr ""
21576
21577
#: serverguide/C/file-server.xml:546(screen)
21578
#, no-wrap
21579
msgid ""
21580
"\n"
21581
"Listen 127.0.0.1:631 # existing loopback Listen\n"
21582
"Listen /var/run/cups/cups.sock # existing socket Listen\n"
21583
"Listen 192.168.10.250:631 # Listen on the LAN interface, Port 631 "
21584
"(IPP)\n"
21585
msgstr ""
21586
21587
#: serverguide/C/file-server.xml:552(para)
21588
msgid ""
21589
"In the example above, you may comment out or remove the reference to the "
21590
"Loopback address (127.0.0.1) if you do not wish <application>cupsd "
21591
"</application> to listen on that interface, but would rather have it only "
21592
"listen on the Ethernet interfaces of the Local Area Network (LAN). To enable "
21593
"listening for all network interfaces for which a certain hostname is bound, "
21594
"including the Loopback, you could create a Listen entry for the hostname "
21595
"<emphasis>socrates</emphasis> as such:"
21596
msgstr ""
21597
21598
#: serverguide/C/file-server.xml:562(screen)
21599
#, no-wrap
21600
msgid ""
21601
"\n"
21602
"Listen socrates:631 # Listen on all interfaces for the hostname 'socrates'\n"
21603
msgstr ""
21604
21605
#: serverguide/C/file-server.xml:566(para)
21606
msgid ""
21607
"or by omitting the Listen directive and using <emphasis>Port</emphasis> "
21608
"instead, as in:"
21609
msgstr ""
21610
21611
#: serverguide/C/file-server.xml:568(screen)
21612
#, no-wrap
21613
msgid ""
21614
"\n"
21615
"Port 631 # Listen on port 631 on all interfaces\n"
21616
msgstr ""
21617
21618
#: serverguide/C/file-server.xml:575(para)
21619
msgid ""
21620
"For more examples of configuration directives in the CUPS server "
21621
"configuration file, view the associated system manual page by entering the "
21622
"following command at a terminal prompt:"
21623
msgstr ""
21624
21625
#: serverguide/C/file-server.xml:582(command)
21626
msgid "man cupsd.conf"
21627
msgstr ""
21628
21629
#: serverguide/C/file-server.xml:586(para)
21630
msgid ""
21631
"Whenever you make changes to the <filename>/etc/cups/cupsd.conf</filename> "
21632
"configuration file, you'll need to restart the CUPS server by typing the "
21633
"following command at a terminal prompt:"
21634
msgstr ""
21635
21636
#: serverguide/C/file-server.xml:592(command)
21637
msgid "sudo /etc/init.d/cups restart"
21638
msgstr ""
21639
21640
#: serverguide/C/file-server.xml:598(title)
21641
msgid "Web Interface"
21642
msgstr ""
21643
21644
#: serverguide/C/file-server.xml:600(para)
21645
msgid ""
21646
"CUPS can be configured and monitored using a web interface, which by default "
21647
"is available at <ulink "
21648
"url=\"http://localhost:631/admin\">http://localhost:631/admin</ulink>. The "
21649
"web interface can be used to perform all printer management tasks."
21650
msgstr ""
21651
21652
#: serverguide/C/file-server.xml:604(para)
21653
msgid ""
21654
"In order to perform administrative tasks via the web interface, you must "
21655
"either have the root account enabled on your server, or authenticate as a "
21656
"user in the <emphasis role=\"italic\">lpadmin</emphasis> group. For security "
21657
"reasons, CUPS won't authenticate a user that doesn't have a password."
21658
msgstr ""
21659
21660
#: serverguide/C/file-server.xml:607(para)
21661
msgid ""
21662
"To add a user to the <emphasis role=\"italic\">lpadmin</emphasis> group, run "
21663
"at the terminal prompt: <screen>\n"
21664
"<command>sudo usermod -aG lpadmin username</command>\n"
21665
"</screen>"
21666
msgstr ""
21667
21668
#: serverguide/C/file-server.xml:613(para)
21669
msgid ""
21670
"Further documentation is available in the <emphasis "
21671
"role=\"italic\">Documentation/Help</emphasis> tab of the web interface."
21672
msgstr ""
21673
21674
#: serverguide/C/file-server.xml:621(ulink)
21675
msgid "CUPS Website"
21676
msgstr ""
21677
21678
#: serverguide/C/file-server.xml:624(ulink)
21679
msgid "Ubuntu Wiki CUPS page"
21680
msgstr ""
21681
21682
#: serverguide/C/dns.xml:13(title)
21683
msgid "Domain Name Service (DNS)"
21684
msgstr ""
21685
21686
#: serverguide/C/dns.xml:14(para)
21687
msgid ""
21688
"Domain Name Service (DNS) is an Internet service that maps IP addresses and "
21689
"fully qualified domain names (FQDN) to one another. In this way, DNS "
21690
"alleviates the need to remember IP addresses. Computers that run DNS are "
21691
"called <emphasis>name servers</emphasis>. Ubuntu ships with "
21692
"<application>BIND</application> (Berkley Internet Naming Daemon), the most "
21693
"common program used for maintaining a name server on Linux."
21694
msgstr ""
21695
21696
#: serverguide/C/dns.xml:24(para)
21697
msgid ""
21698
"At a terminal prompt, enter the following command to install "
21699
"<application>dns</application>:"
21700
msgstr ""
21701
21702
#: serverguide/C/dns.xml:28(command)
21703
msgid "sudo apt-get install bind9"
21704
msgstr ""
21705
21706
#: serverguide/C/dns.xml:30(para)
21707
msgid ""
21708
"A very useful package for testing and troubleshooting DNS issues is the "
21709
"dnsutils package. To install <application>dnsutils</application> enter the "
21710
"following:"
21711
msgstr ""
21712
21713
#: serverguide/C/dns.xml:35(command)
21714
msgid "sudo apt-get install dnsutils"
21715
msgstr ""
21716
21717
#: serverguide/C/dns.xml:40(para)
21718
msgid ""
21719
"There a many ways to configure <application>BIND9</application>. Some of the "
21720
"most common configurations are a caching nameserver, primary master, and a "
21721
"as a secondary master."
21722
msgstr ""
21723
21724
#: serverguide/C/dns.xml:46(para)
21725
msgid ""
21726
"When configured as a caching nameserver BIND9 will find the answer to name "
21727
"queries and remember the answer when the domain is queried again."
21728
msgstr ""
21729
21730
#: serverguide/C/dns.xml:52(para)
21731
msgid ""
21732
"As a primary master server BIND9 reads the data for a zone from a file on "
21733
"it's host and is authoritative for that zone."
21734
msgstr ""
21735
21736
#: serverguide/C/dns.xml:57(para)
21737
msgid ""
21738
"In a secondary master configuration BIND9 gets the zone data from another "
21739
"nameserver authoritative for the zone."
21740
msgstr ""
21741
21742
#: serverguide/C/dns.xml:65(para)
21743
msgid ""
21744
"The DNS configuration files are stored in the <filename>/etc/bind</filename> "
21745
"directory. The primary configuration file is "
21746
"<filename>/etc/bind/named.conf</filename>."
21747
msgstr ""
21748
21749
#: serverguide/C/dns.xml:72(para)
21750
msgid ""
21751
"The <emphasis>include</emphasis> line specifies the filename which contains "
21752
"the DNS options. The <emphasis>directory</emphasis> line in the "
21753
"<filename>/etc/bind/named.conf.options</filename> file tells DNS where to "
21754
"look for files. All files BIND uses will be relative to this directory."
21755
msgstr ""
21756
21757
#: serverguide/C/dns.xml:80(para)
21758
msgid ""
21759
"The file named <filename>/etc/bind/db.root</filename> describes the root "
21760
"nameservers in the world. The servers change over time, so the "
21761
"<filename>/etc/bind/db.root</filename> file must be maintained now and then. "
21762
"This is usually done as updates to the <application>bind9</application> "
21763
"package. The <emphasis>zone</emphasis> section defines a master server, and "
21764
"it is stored in a file mentioned in the <emphasis>file</emphasis> option."
21765
msgstr ""
21766
21767
#: serverguide/C/dns.xml:90(para)
21768
msgid ""
21769
"It is possible to configure the same server to be a caching name server, "
21770
"primary master, and secondary master. A server can be the Start of Authority "
21771
"(SOA) for one zone, while providing secondary service for another zone. All "
21772
"the while providing caching services for hosts on the local LAN."
21773
msgstr ""
21774
21775
#: serverguide/C/dns.xml:98(title)
21776
msgid "Caching Nameserver"
21777
msgstr ""
21778
21779
#: serverguide/C/dns.xml:99(para)
21780
msgid ""
21781
"The default configuration is setup to act as a caching server. All that is "
21782
"required is simply adding the IP Addresses of your ISP's DNS servers. Simply "
21783
"uncomment and edit the following in "
21784
"<filename>/etc/bind/named.conf.options</filename>:"
21785
msgstr ""
21786
21787
#: serverguide/C/dns.xml:103(programlisting)
21788
#, no-wrap
21789
msgid ""
21790
"\n"
21791
"forwarders {\n"
21792
" 1.2.3.4;\n"
21793
" 5.6.7.8;\n"
21794
" };\n"
21795
msgstr ""
21796
21797
#: serverguide/C/dns.xml:110(para)
21798
msgid ""
21799
"Replace <emphasis>1.2.3.4</emphasis> and <emphasis>5.6.7.8</emphasis> with "
21800
"the IP Adresses of actual nameservers."
21801
msgstr ""
21802
21803
#: serverguide/C/dns.xml:114(para)
21804
msgid ""
21805
"Now restart the DNS server, to enable the new configuration. From a terminal "
21806
"prompt:"
21807
msgstr ""
21808
21809
#: serverguide/C/dns.xml:118(command) serverguide/C/dns.xml:194(command) serverguide/C/dns.xml:253(command) serverguide/C/dns.xml:312(command) serverguide/C/dns.xml:561(command)
21810
msgid "sudo /etc/init.d/bind9 restart"
21811
msgstr ""
21812
21813
#: serverguide/C/dns.xml:120(para)
21814
msgid ""
21815
"See <xref linkend=\"dns-testing-dig\"/> for information on testing a caching "
21816
"DNS server."
21817
msgstr ""
21818
21819
#: serverguide/C/dns.xml:125(title)
21820
msgid "Primary Master"
21821
msgstr ""
21822
21823
#: serverguide/C/dns.xml:126(para)
21824
msgid ""
21825
"In this section <application>BIND9</application> will be configured as the "
21826
"Primary Master for the domain <emphasis>example.com</emphasis>. Simply "
21827
"replace <emphasis role=\"italic\">example.com</emphasis> with your FQDN "
21828
"(Fully Qualified Domain Name)."
21829
msgstr ""
21830
21831
#: serverguide/C/dns.xml:132(title)
21832
msgid "Forward Zone File"
21833
msgstr ""
21834
21835
#: serverguide/C/dns.xml:133(para)
21836
msgid ""
21837
"To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the "
21838
"first step is to edit <filename>/etc/bind/named.conf.local</filename>:"
21839
msgstr ""
21840
21841
#: serverguide/C/dns.xml:137(programlisting)
21842
#, no-wrap
21843
msgid ""
21844
"\n"
21845
"zone \"example.com\" {\n"
21846
"\ttype master;\n"
21847
" file \"/etc/bind/db.example.com\";\n"
21848
"};\n"
21849
msgstr ""
21850
21851
#: serverguide/C/dns.xml:143(para)
21852
msgid ""
21853
"Now use an existing zone file as a template to create the "
21854
"<filename>/etc/bind/db.example.com</filename> file:"
21855
msgstr ""
21856
21857
#: serverguide/C/dns.xml:147(command)
21858
msgid "sudo cp /etc/bind/db.local /etc/bind/db.example.com"
21859
msgstr ""
21860
21861
#: serverguide/C/dns.xml:149(para)
21862
msgid ""
21863
"Edit the new zone file <filename>/etc/bind/db.example.com</filename> change "
21864
"<emphasis>localhost.</emphasis> to the FQDN of your server, leaving the "
21865
"additional \".\" at the end. Change <emphasis>127.0.0.1</emphasis> to the "
21866
"nameserver's IP Address and <emphasis>root.localhost</emphasis> to a valid "
21867
"email address, but with a \".\" instead of the usual \"@\" symbol, again "
21868
"leaving the \".\" at the end."
21869
msgstr ""
21870
21871
#: serverguide/C/dns.xml:155(para)
21872
msgid ""
21873
"Also, create an <emphasis>A record</emphasis> for <emphasis "
21874
"role=\"italic\">ns.example.com</emphasis>. The name server in this example:"
21875
msgstr ""
21876
21877
#: serverguide/C/dns.xml:159(programlisting)
21878
#, no-wrap
21879
msgid ""
21880
"\n"
21881
";\n"
21882
"; BIND data file for local loopback interface\n"
21883
";\n"
21884
"$TTL 604800\n"
21885
"@ IN SOA ns.example.com. root.example.com. (\n"
21886
" 2 ; Serial\n"
21887
" 604800 ; Refresh\n"
21888
" 86400 ; Retry\n"
21889
" 2419200 ; Expire\n"
21890
" 604800 ) ; Negative Cache TTL\n"
21891
";\n"
21892
"@ IN NS ns.example.com.\n"
21893
"@ IN A 127.0.0.1\n"
21894
"@ IN AAAA ::1\n"
21895
"ns IN A 192.168.1.10\n"
21896
msgstr ""
21897
21898
#: serverguide/C/dns.xml:176(para)
21899
msgid ""
21900
"You must increment the <emphasis>Serial Number</emphasis> every time you "
21901
"make changes to the zone file. If you make multiple changes before "
21902
"restarting BIND9, simply increment the Serial once."
21903
msgstr ""
21904
21905
#: serverguide/C/dns.xml:180(para)
21906
msgid ""
21907
"Now, you can add DNS records to the bottom of the zone file. See <xref "
21908
"linkend=\"dns-record-types\"/> for details."
21909
msgstr ""
21910
21911
#: serverguide/C/dns.xml:184(para)
21912
msgid ""
21913
"Many admins like to use the last date edited as the serial of a zone, such "
21914
"as <emphasis>2007010100</emphasis> which is yyyymmddss (where "
21915
"<emphasis>ss</emphasis> is the Serial Number)"
21916
msgstr ""
21917
21918
#: serverguide/C/dns.xml:189(para)
21919
msgid ""
21920
"Once you have made a change to the zone file "
21921
"<application>BIND9</application> will need to be restarted for the changes "
21922
"to take effect:"
21923
msgstr ""
21924
21925
#: serverguide/C/dns.xml:198(title)
21926
msgid "Reverse Zone File"
21927
msgstr ""
21928
21929
#: serverguide/C/dns.xml:199(para)
21930
msgid ""
21931
"Now that the zone is setup and resolving names to IP Adresses a "
21932
"<emphasis>Reverse zone</emphasis> is also required. A Reverse zone allows "
21933
"DNS to resolve an address to a name."
21934
msgstr ""
21935
21936
#: serverguide/C/dns.xml:203(para)
21937
msgid "Edit /etc/bind/named.conf.local and add the following:"
21938
msgstr ""
21939
21940
#: serverguide/C/dns.xml:206(programlisting)
21941
#, no-wrap
21942
msgid ""
21943
"\n"
21944
"zone \"1.168.192.in-addr.arpa\" {\n"
21945
" type master;\n"
21946
" notify no;\n"
21947
" file \"/etc/bind/db.192\";\n"
21948
"};\n"
21949
msgstr ""
21950
21951
#: serverguide/C/dns.xml:214(para)
21952
msgid ""
21953
"Replace <emphasis>1.168.192</emphasis> with the first three octets of "
21954
"whatever network you are using. Also, name the zone file "
21955
"<filename>/etc/bind/db.192</filename> appropriately. It should match the "
21956
"first octet of your network."
21957
msgstr ""
21958
21959
#: serverguide/C/dns.xml:219(para)
21960
msgid "Now create the <filename>/etc/bind/db.192</filename> file:"
21961
msgstr ""
21962
21963
#: serverguide/C/dns.xml:223(command)
21964
msgid "sudo cp /etc/bind/db.127 /etc/bind/db.192"
21965
msgstr ""
21966
21967
#: serverguide/C/dns.xml:225(para)
21968
msgid ""
21969
"Next edit <filename>/etc/bind/db.192</filename> changing the basically the "
21970
"same options as <filename>/etc/bind/db.example.com</filename>:"
21971
msgstr ""
21972
21973
#: serverguide/C/dns.xml:229(programlisting)
21974
#, no-wrap
21975
msgid ""
21976
"\n"
21977
";\n"
21978
"; BIND reverse data file for local loopback interface\n"
21979
";\n"
21980
"$TTL 604800\n"
21981
"@ IN SOA ns.example.com. root.example.com. (\n"
21982
" 2 ; Serial\n"
21983
" 604800 ; Refresh\n"
21984
" 86400 ; Retry\n"
21985
" 2419200 ; Expire\n"
21986
" 604800 ) ; Negative Cache TTL\n"
21987
";\n"
21988
"@ IN NS ns.\n"
21989
"10 IN PTR ns.example.com.\n"
21990
msgstr ""
21991
21992
#: serverguide/C/dns.xml:244(para)
21993
msgid ""
21994
"The <emphasis>Serial Number</emphasis> in the Reverse zone needs to be "
21995
"incremented on each changes as well. For each <emphasis>A record</emphasis> "
21996
"you configure in <filename>/etc/bind/db.example.com</filename> you need to "
21997
"create a <emphasis>PTR record</emphasis> in "
21998
"<filename>/etc/bind/db.192</filename>."
21999
msgstr ""
22000
22001
#: serverguide/C/dns.xml:249(para)
22002
msgid ""
22003
"After creating the reverse zone file restart "
22004
"<application>BIND9</application>:"
22005
msgstr ""
22006
22007
#: serverguide/C/dns.xml:258(title)
22008
msgid "Secondary Master"
22009
msgstr ""
22010
22011
#: serverguide/C/dns.xml:259(para)
22012
msgid ""
22013
"Once a <emphasis>Primary Master</emphasis> has been configured a "
22014
"<emphasis>Secondary Master</emphasis> is needed in order to maintain the "
22015
"availability of the domain should the Primary become unavailable."
22016
msgstr ""
22017
22018
#: serverguide/C/dns.xml:263(para)
22019
msgid ""
22020
"First, on the Primary Master server, the zone transfer needs to be allowed. "
22021
"Add the <emphasis>allow-transfer</emphasis> option to the example Forward "
22022
"and Reverse zone definitions in "
22023
"<filename>/etc/bind/named.conf.local</filename>:"
22024
msgstr ""
22025
22026
#: serverguide/C/dns.xml:267(programlisting)
22027
#, no-wrap
22028
msgid ""
22029
"\n"
22030
"zone \"example.com\" {\n"
22031
" type master;\n"
22032
"\tfile \"/etc/bind/db.example.com\";\n"
22033
" allow-transfer { 192.168.1.11; };\n"
22034
"};\n"
22035
"\n"
22036
"zone \"1.168.192.in-addr.arpa\" {\n"
22037
" type master;\n"
22038
" notify no;\n"
22039
" file \"/etc/bind/db.192\";\n"
22040
"\tallow-transfer { 192.168.1.11; };\n"
22041
"};\n"
22042
msgstr ""
22043
22044
#: serverguide/C/dns.xml:282(para)
22045
msgid ""
22046
"Replace <emphasis>192.168.1.11</emphasis> with the IP Address of your "
22047
"Secondary nameserver."
22048
msgstr ""
22049
22050
#: serverguide/C/dns.xml:286(para)
22051
msgid ""
22052
"Next, on the Secondary Master, install the <application>bind9</application> "
22053
"package the same way as on the Primary. Then edit the "
22054
"<filename>/etc/bind/named.conf.local</filename> and add the following "
22055
"declarations for the Forward and Reverse zones:"
22056
msgstr ""
22057
22058
#: serverguide/C/dns.xml:290(programlisting)
22059
#, no-wrap
22060
msgid ""
22061
"\n"
22062
"zone \"example.com\" {\n"
22063
"\ttype slave;\n"
22064
" file \"/var/cache/bind/db.example.com\";\n"
22065
" masters { 192.168.1.10; };\n"
22066
"}; \n"
22067
" \n"
22068
"zone \"1.168.192.in-addr.arpa\" {\n"
22069
"\ttype slave;\n"
22070
" file \"/var/cache/bind/db.192\";\n"
22071
" masters { 192.168.1.10; };\n"
22072
"};\n"
22073
msgstr ""
22074
22075
#: serverguide/C/dns.xml:304(para)
22076
msgid ""
22077
"Replace <emphasis>192.168.1.10</emphasis> with the IP Address of your "
22078
"Primary nameserver."
22079
msgstr ""
22080
22081
#: serverguide/C/dns.xml:308(para)
22082
msgid "Restart <application>BIND9</application> on the Secondary Master:"
22083
msgstr ""
22084
22085
#: serverguide/C/dns.xml:314(para)
22086
msgid ""
22087
"In <filename>/var/log/syslog</filename> you should see something similar to:"
22088
msgstr ""
22089
22090
#: serverguide/C/dns.xml:317(programlisting)
22091
#, no-wrap
22092
msgid ""
22093
"\n"
22094
"slave zone \"example.com\" (IN) loaded (serial 6)\n"
22095
"slave zone \"100.18.172.in-addr.arpa\" (IN) loaded (serial 3)\n"
22096
msgstr ""
22097
22098
#: serverguide/C/dns.xml:322(para)
22099
msgid ""
22100
"Note: A zone is only transferred if the <emphasis>Serial Number</emphasis> "
22101
"on the Primary is larger than the one on the Secondary."
22102
msgstr ""
22103
22104
#: serverguide/C/dns.xml:328(para)
22105
msgid ""
22106
"The default directory for non-authoritative zone files is "
22107
"<filename>/var/cache/bind/</filename>. This directory is also configured in "
22108
"<application>AppArmor</application> to allow the "
22109
"<application>named</application> daemon to write to. For more information on "
22110
"AppArmor see <xref linkend=\"apparmor\"/>."
22111
msgstr ""
22112
22113
#: serverguide/C/dns.xml:339(para)
22114
msgid ""
22115
"This section covers ways to help determine the cause when problems happen "
22116
"with DNS and <application>BIND9</application>."
22117
msgstr ""
22118
22119
#: serverguide/C/dns.xml:345(title)
22120
msgid "resolv.conf"
22121
msgstr ""
22122
22123
#: serverguide/C/dns.xml:346(para)
22124
msgid ""
22125
"The first step in testing <application>BIND9</application> is to add the "
22126
"nameserver's IP Address to a hosts resolver. The Primary nameserver should "
22127
"be configured as well as another host to double check things. Simply edit "
22128
"<filename>/etc/resolv.conf</filename> and add the following:"
22129
msgstr ""
22130
22131
#: serverguide/C/dns.xml:351(programlisting)
22132
#, no-wrap
22133
msgid ""
22134
"\n"
22135
"nameserver\t192.168.1.10\n"
22136
"nameserver\t192.168.1.11\n"
22137
msgstr ""
22138
22139
#: serverguide/C/dns.xml:356(para)
22140
msgid ""
22141
"You should also add the IP Address of the Secondary nameserver in case the "
22142
"Primary becomes unavailable."
22143
msgstr ""
22144
22145
#: serverguide/C/dns.xml:362(title)
22146
msgid "dig"
22147
msgstr ""
22148
22149
#: serverguide/C/dns.xml:363(para)
22150
msgid ""
22151
"If you installed the <application>dnsutils</application> package you can "
22152
"test your setup using the DNS lookup utility <application>dig</application>:"
22153
msgstr ""
22154
22155
#: serverguide/C/dns.xml:369(para)
22156
msgid ""
22157
"After installing <application>BIND9</application> use "
22158
"<application>dig</application> against the loopback interface to make sure "
22159
"it is listening on port 53. From a terminal prompt:"
22160
msgstr ""
22161
22162
#: serverguide/C/dns.xml:374(command)
22163
msgid "dig -x 127.0.0.1"
22164
msgstr ""
22165
22166
#: serverguide/C/dns.xml:376(para)
22167
msgid "You should see lines similar to the following in the command output:"
22168
msgstr ""
22169
22170
#: serverguide/C/dns.xml:379(programlisting)
22171
#, no-wrap
22172
msgid ""
22173
"\n"
22174
";; Query time: 1 msec\n"
22175
";; SERVER: 192.168.1.10#53(192.168.1.10)\n"
22176
msgstr ""
22177
22178
#: serverguide/C/dns.xml:385(para)
22179
msgid ""
22180
"If you have configured <application>BIND9</application> as a "
22181
"<emphasis>Caching</emphasis> nameserver \"dig\" an outside domain to check "
22182
"the query time:"
22183
msgstr ""
22184
22185
#: serverguide/C/dns.xml:390(command)
22186
msgid "dig ubuntu.com"
22187
msgstr ""
22188
22189
#: serverguide/C/dns.xml:392(para)
22190
msgid "Note the query time toward the end of the command output:"
22191
msgstr ""
22192
22193
#: serverguide/C/dns.xml:395(programlisting)
22194
#, no-wrap
22195
msgid ""
22196
"\n"
22197
";; Query time: 49 msec\n"
22198
msgstr ""
22199
22200
#: serverguide/C/dns.xml:398(para)
22201
msgid "After a second dig there should be improvement:"
22202
msgstr ""
22203
22204
#: serverguide/C/dns.xml:401(programlisting)
22205
#, no-wrap
22206
msgid ""
22207
"\n"
22208
";; Query time: 1 msec\n"
22209
msgstr ""
22210
22211
#: serverguide/C/dns.xml:408(title)
22212
msgid "ping"
22213
msgstr ""
22214
22215
#: serverguide/C/dns.xml:410(para)
22216
msgid ""
22217
"Now to demonstrate how applications make use of DNS to resolve a host name "
22218
"use the <application>ping</application> utility to send an ICMP echo "
22219
"request. From a terminal prompt enter:"
22220
msgstr ""
22221
22222
#: serverguide/C/dns.xml:416(command)
22223
msgid "ping example.com"
22224
msgstr ""
22225
22226
#: serverguide/C/dns.xml:418(para)
22227
msgid ""
22228
"This tests if the nameserver can resolve the name "
22229
"<emphasis>ns.example.com</emphasis> to an IP Address. The command output "
22230
"should resemble:"
22231
msgstr ""
22232
22233
#: serverguide/C/dns.xml:422(programlisting)
22234
#, no-wrap
22235
msgid ""
22236
"\n"
22237
"PING ns.example.com (192.168.1.10) 56(84) bytes of data.\n"
22238
"64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms\n"
22239
"64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms\n"
22240
msgstr ""
22241
22242
#: serverguide/C/dns.xml:429(title)
22243
msgid "named-checkzone"
22244
msgstr ""
22245
22246
#: serverguide/C/dns.xml:430(para)
22247
msgid ""
22248
"A great way to test your zone files is by using the <application>named-"
22249
"checkzone</application> utility installed with the "
22250
"<application>bind9</application> package. This utility allows you to make "
22251
"sure the configuration is correct before restarting "
22252
"<application>BIND9</application> and making the changes live."
22253
msgstr ""
22254
22255
#: serverguide/C/dns.xml:437(para)
22256
msgid ""
22257
"To test our example Forward zone file enter the following from a command "
22258
"prompt:"
22259
msgstr ""
22260
22261
#: serverguide/C/dns.xml:441(command)
22262
msgid "named-checkzone example.com /etc/bind/db.example.com"
22263
msgstr ""
22264
22265
#: serverguide/C/dns.xml:443(para)
22266
msgid ""
22267
"If everything is configured correctly you should see output similar to:"
22268
msgstr ""
22269
22270
#: serverguide/C/dns.xml:446(programlisting)
22271
#, no-wrap
22272
msgid ""
22273
"\n"
22274
"zone example.com/IN: loaded serial 6\n"
22275
"OK\n"
22276
msgstr ""
22277
22278
#: serverguide/C/dns.xml:452(para)
22279
msgid "Similarly, to test the Reverse zone file enter the following:"
22280
msgstr ""
22281
22282
#: serverguide/C/dns.xml:456(command)
22283
msgid "named-checkzone example.com /etc/bind/db.192"
22284
msgstr ""
22285
22286
#: serverguide/C/dns.xml:458(para)
22287
msgid "The output should be similar to:"
22288
msgstr ""
22289
22290
#: serverguide/C/dns.xml:461(programlisting)
22291
#, no-wrap
22292
msgid ""
22293
"\n"
22294
"zone example.com/IN: loaded serial 3\n"
22295
"OK\n"
22296
msgstr ""
22297
22298
#: serverguide/C/dns.xml:468(para)
22299
msgid ""
22300
"The <emphasis>Serial Number</emphasis> of your zone file will probably be "
22301
"different."
22302
msgstr ""
22303
22304
#: serverguide/C/dns.xml:475(title)
22305
msgid "Logging"
22306
msgstr ""
22307
22308
#: serverguide/C/dns.xml:476(para)
22309
msgid ""
22310
"<application>BIND9</application> has a wide variety of logging configuration "
22311
"options available. There are two main options. The "
22312
"<emphasis>channel</emphasis> option configures where logs go, and the "
22313
"<emphasis>category</emphasis> option determines what information to log."
22314
msgstr ""
22315
22316
#: serverguide/C/dns.xml:480(para)
22317
msgid "If no logging option is configured the default option is:"
22318
msgstr ""
22319
22320
#: serverguide/C/dns.xml:483(programlisting)
22321
#, no-wrap
22322
msgid ""
22323
"\n"
22324
"logging {\n"
22325
" category default { default_syslog; default_debug; };\n"
22326
" category unmatched { null; };\n"
22327
"};\n"
22328
msgstr ""
22329
22330
#: serverguide/C/dns.xml:489(para)
22331
msgid ""
22332
"This section covers configuring <application>BIND9</application> to send "
22333
"<emphasis>debug</emphasis> messages related to DNS queries to a separate "
22334
"file."
22335
msgstr ""
22336
22337
#: serverguide/C/dns.xml:494(para)
22338
msgid ""
22339
"First, we need to configure a channel to specify which file to send the "
22340
"messages to. Edit <filename>/etc/bind/named.conf.local</filename> and add "
22341
"the following:"
22342
msgstr ""
22343
22344
#: serverguide/C/dns.xml:498(programlisting)
22345
#, no-wrap
22346
msgid ""
22347
"\n"
22348
"logging {\n"
22349
" channel query.log { \n"
22350
" file \"/var/log/query.log\";\n"
22351
" severity debug 3; \n"
22352
" }; \n"
22353
"};\n"
22354
msgstr ""
22355
22356
#: serverguide/C/dns.xml:508(para)
22357
msgid "Next, configure a category to send all DNS queries to the query file:"
22358
msgstr ""
22359
22360
#: serverguide/C/dns.xml:511(programlisting)
22361
#, no-wrap
22362
msgid ""
22363
"\n"
22364
"logging {\n"
22365
" channel query.log { \n"
22366
" file \"/var/log/query.log\"; \n"
22367
" severity debug 3; \n"
22368
" }; \n"
22369
" <emphasis>category queries { query.log; };</emphasis> \n"
22370
"};\n"
22371
msgstr ""
22372
22373
#: serverguide/C/dns.xml:523(para)
22374
msgid ""
22375
"Note: the <emphasis>debug</emphasis> option can be set from 1 to 3. If a "
22376
"level isn't specified level 1 is the default."
22377
msgstr ""
22378
22379
#: serverguide/C/dns.xml:529(para)
22380
msgid ""
22381
"Since the <emphasis>named daemon</emphasis> runs as the "
22382
"<emphasis>bind</emphasis> user the <filename>/var/log/query.log</filename> "
22383
"file must be created and the ownership changed:"
22384
msgstr ""
22385
22386
#: serverguide/C/dns.xml:534(command)
22387
msgid "sudo touch /var/log/query.log"
22388
msgstr ""
22389
22390
#: serverguide/C/dns.xml:535(command)
22391
msgid "sudo chown bind /var/log/query.log"
22392
msgstr ""
22393
22394
#: serverguide/C/dns.xml:539(para)
22395
msgid ""
22396
"Before <application>named</application> daemon can write to the new log file "
22397
"the <application>AppArmor</application> profile must be updated. First, edit "
22398
"<filename>/etc/apparmor.d/usr.sbin.named</filename> and add:"
22399
msgstr ""
22400
22401
#: serverguide/C/dns.xml:543(programlisting)
22402
#, no-wrap
22403
msgid ""
22404
"\n"
22405
"/var/log/query.log w,\n"
22406
msgstr ""
22407
22408
#: serverguide/C/dns.xml:546(para)
22409
msgid "Next, reload the profile:"
22410
msgstr ""
22411
22412
#: serverguide/C/dns.xml:550(command)
22413
msgid "cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r"
22414
msgstr ""
22415
22416
#: serverguide/C/dns.xml:552(para)
22417
msgid ""
22418
"For more information on <application>AppArmor</application> see <xref "
22419
"linkend=\"apparmor\"/>"
22420
msgstr ""
22421
22422
#: serverguide/C/dns.xml:557(para)
22423
msgid ""
22424
"Now restart <application>BIND9</application> for the changes to take effect:"
22425
msgstr ""
22426
22427
#: serverguide/C/dns.xml:565(para)
22428
msgid ""
22429
"You should see the file <filename>/var/log/query.log</filename> fill with "
22430
"query information. This is a simple example of the "
22431
"<application>BIND9</application> logging options. For coverage of advanced "
22432
"options see <xref linkend=\"dns-more-info\"/>."
22433
msgstr ""
22434
22435
#: serverguide/C/dns.xml:574(title)
22436
msgid "Common Record Types"
22437
msgstr ""
22438
22439
#: serverguide/C/dns.xml:575(para)
22440
msgid "This section covers some of the most common DNS record types."
22441
msgstr ""
22442
22443
#: serverguide/C/dns.xml:580(para)
22444
msgid ""
22445
"<emphasis>A</emphasis> record: This record maps an IP Address to a hostname."
22446
msgstr ""
22447
22448
#: serverguide/C/dns.xml:583(programlisting)
22449
#, no-wrap
22450
msgid ""
22451
"\n"
22452
"www IN A 192.168.1.12\n"
22453
msgstr ""
22454
22455
#: serverguide/C/dns.xml:588(para)
22456
msgid ""
22457
"<emphasis>CNAME</emphasis> record: Used to create an alias to an existing A "
22458
"record. You cannot create a CNAME record pointing to another CNAME record."
22459
msgstr ""
22460
22461
#: serverguide/C/dns.xml:591(programlisting)
22462
#, no-wrap
22463
msgid ""
22464
"\n"
22465
"web IN CNAME www\n"
22466
msgstr ""
22467
22468
#: serverguide/C/dns.xml:596(para)
22469
msgid ""
22470
"<emphasis>MX</emphasis> record: Used to define where email should be sent "
22471
"to. Must point to an A record, not a CNAME."
22472
msgstr ""
22473
22474
#: serverguide/C/dns.xml:599(programlisting)
22475
#, no-wrap
22476
msgid ""
22477
"\n"
22478
" IN MX 1 mail.example.com.\n"
22479
"mail IN A 192.168.1.13\n"
22480
msgstr ""
22481
22482
#: serverguide/C/dns.xml:605(para)
22483
msgid ""
22484
"<emphasis>NS</emphasis> record: Used to define which servers serve copies of "
22485
"a zone. It must point to an A record, not a CNAME. This is where Primary and "
22486
"Secondary servers are defined."
22487
msgstr ""
22488
22489
#: serverguide/C/dns.xml:609(programlisting)
22490
#, no-wrap
22491
msgid ""
22492
"\n"
22493
" IN NS ns.example.com.\n"
22494
"\tIN NS ns2.example.com.\n"
22495
"ns IN A 192.168.1.10\n"
22496
"ns2\tIN A\t 192.168.1.11\n"
22497
msgstr ""
22498
22499
#: serverguide/C/dns.xml:622(para)
22500
msgid ""
22501
"The <ulink url=\"http://www.tldp.org/HOWTO/DNS-HOWTO.html\">DNS "
22502
"HOWTO</ulink> explains more advanced options for configuring BIND9."
22503
msgstr ""
22504
22505
#: serverguide/C/dns.xml:627(para)
22506
msgid ""
22507
"For in depth coverage of <emphasis>DNS</emphasis> and "
22508
"<application>BIND9</application> see <ulink "
22509
"url=\"http://www.bind9.net/\">Bind9.net</ulink>."
22510
msgstr ""
22511
22512
#: serverguide/C/dns.xml:632(para)
22513
msgid ""
22514
"<ulink url=\"http://www.oreilly.com/catalog/dns5/index.html\">DNS and "
22515
"BIND</ulink> is a popular book now in it's fifth edition."
22516
msgstr ""
22517
22518
#: serverguide/C/dns.xml:637(para)
22519
msgid ""
22520
"A great place to ask for <application>BIND9</application> assistance, and "
22521
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
22522
"server</emphasis> IRC channel on <ulink "
22523
"url=\"http://freenode.net\">freenode</ulink>."
22524
msgstr ""
22525
22526
#: serverguide/C/dns.xml:643(para)
22527
msgid ""
22528
"Also, see the <ulink "
22529
"url=\"https://help.ubuntu.com/community/BIND9ServerHowto\">BIND9 Server "
22530
"HOWTO</ulink> in the Ubuntu Wiki."
22531
msgstr ""
22532
22533
#: serverguide/C/databases.xml:13(title)
22534
msgid "Databases"
22535
msgstr ""
22536
22537
#: serverguide/C/databases.xml:14(para)
22538
msgid "Ubuntu provides two popular database servers. They are:"
22539
msgstr ""
22540
22541
#: serverguide/C/databases.xml:22(application) serverguide/C/databases.xml:157(title)
22542
msgid "PostgreSQL"
22543
msgstr ""
22544
22545
#: serverguide/C/databases.xml:25(para)
22546
msgid ""
22547
"They are available in the main repository. This section explains how to "
22548
"install and configure these database servers."
22549
msgstr ""
22550
22551
#: serverguide/C/databases.xml:32(para)
22552
msgid ""
22553
"MySQL is a fast, multi-threaded, multi-user, and robust SQL database server. "
22554
"It is intended for mission-critical, heavy-load production systems as well "
22555
"as for embedding into mass-deployed software."
22556
msgstr ""
22557
22558
#: serverguide/C/databases.xml:41(para)
22559
msgid "To install MySQL, run the following command from a terminal prompt:"
22560
msgstr ""
22561
22562
#: serverguide/C/databases.xml:46(command)
22563
msgid "sudo apt-get install mysql-server"
22564
msgstr ""
22565
22566
#: serverguide/C/databases.xml:48(para)
22567
msgid ""
22568
"During the installation process you will be prompted to enter a password for "
22569
"the <application>MySQL</application> root user."
22570
msgstr ""
22571
22572
#: serverguide/C/databases.xml:53(para)
22573
msgid ""
22574
"Once the installation is complete, the MySQL server should be started "
22575
"automatically. You can run the following command from a terminal prompt to "
22576
"check whether the MySQL server is running:"
22577
msgstr ""
22578
22579
#: serverguide/C/databases.xml:61(command)
22580
msgid "sudo netstat -tap | grep mysql"
22581
msgstr ""
22582
22583
#: serverguide/C/databases.xml:70(programlisting)
22584
#, no-wrap
22585
msgid ""
22586
"\n"
22587
"tcp 0 0 localhost:mysql *:* LISTEN "
22588
" 2556/mysqld\n"
22589
msgstr ""
22590
22591
#: serverguide/C/databases.xml:74(para)
22592
msgid ""
22593
"If the server is not running correctly, you can type the following command "
22594
"to start it:"
22595
msgstr ""
22596
22597
#: serverguide/C/databases.xml:79(command) serverguide/C/databases.xml:104(command)
22598
msgid "sudo /etc/init.d/mysql restart"
22599
msgstr ""
22600
22601
#: serverguide/C/databases.xml:85(para)
22602
msgid ""
22603
"You can edit the <filename>/etc/mysql/my.cnf</filename> file to configure "
22604
"the basic settings -- log file, port number, etc. For example, to configure "
22605
"<application>MySQL</application> to listen for connections from network "
22606
"hosts, change the <emphasis>bind-address</emphasis> directive to the "
22607
"server's IP address:"
22608
msgstr ""
22609
22610
#: serverguide/C/databases.xml:91(programlisting)
22611
#, no-wrap
22612
msgid ""
22613
"\n"
22614
"bind-address = 192.168.0.5\n"
22615
msgstr ""
22616
22617
#: serverguide/C/databases.xml:95(para)
22618
msgid "Replace 192.168.0.5 with the appropriate address."
22619
msgstr ""
22620
22621
#: serverguide/C/databases.xml:99(para)
22622
msgid ""
22623
"After making a change to <filename>/etc/mysql/my.cnf</filename> the "
22624
"<application>mysql</application> daemon will need to be restarted:"
22625
msgstr ""
22626
22627
#: serverguide/C/databases.xml:107(para)
22628
msgid ""
22629
"If you would like to change the "
22630
"<application>MySQL</application><emphasis>root</emphasis> password, in a "
22631
"terminal enter:"
22632
msgstr ""
22633
22634
#: serverguide/C/databases.xml:113(command)
22635
msgid "sudo dpkg-reconfigure mysql-server-5.1"
22636
msgstr ""
22637
22638
#: serverguide/C/databases.xml:116(para)
22639
msgid ""
22640
"The <application>mysql</application> daemon will be stopped, and you will be "
22641
"prompted to enter a new password."
22642
msgstr ""
22643
22644
#: serverguide/C/databases.xml:125(para)
22645
msgid ""
22646
"See the <ulink url=\"http://www.mysql.com/\">MySQL Home Page</ulink> for "
22647
"more information."
22648
msgstr ""
22649
22650
#: serverguide/C/databases.xml:130(para)
22651
msgid ""
22652
"The <emphasis>MySQL Handbook</emphasis> is also available in the "
22653
"<application>mysql-doc-5.0</application> package. To install the package "
22654
"enter the following in a terminal:"
22655
msgstr ""
22656
22657
#: serverguide/C/databases.xml:135(command)
22658
msgid "sudo apt-get install mysql-doc-5.0"
22659
msgstr ""
22660
22661
#: serverguide/C/databases.xml:137(para)
22662
msgid ""
22663
"The documentation is in HTML format, to view them enter "
22664
"<command>file:///usr/share/doc/mysql-doc-5.0/refman-5.0-en.html-"
22665
"chapter/index.html</command> in your browser's address bar."
22666
msgstr ""
22667
22668
#: serverguide/C/databases.xml:143(para) serverguide/C/databases.xml:290(para)
22669
msgid ""
22670
"For general SQL information see <ulink "
22671
"url=\"http://www.informit.com/store/product.aspx?isbn=0768664128\">Using SQL "
22672
"Special Edition</ulink> by Rafe Colburn."
22673
msgstr ""
22674
22675
#: serverguide/C/databases.xml:149(para)
22676
msgid ""
22677
"The <ulink url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache "
22678
"MySQL PHP Ubuntu Wiki</ulink> page also has useful information."
22679
msgstr ""
22680
22681
#: serverguide/C/databases.xml:158(para)
22682
msgid ""
22683
"PostgreSQL is an object-relational database system that has the features of "
22684
"traditional commercial database systems with enhancements to be found in "
22685
"next-generation DBMS systems."
22686
msgstr ""
22687
22688
#: serverguide/C/databases.xml:165(para)
22689
msgid ""
22690
"To install PostgreSQL, run the following command in the command prompt:"
22691
msgstr ""
22692
22693
#: serverguide/C/databases.xml:172(command)
22694
msgid "sudo apt-get install postgresql"
22695
msgstr ""
22696
22697
#: serverguide/C/databases.xml:176(para)
22698
msgid ""
22699
"Once the installation is complete, you should configure the PostgreSQL "
22700
"server based on your needs, although the default configuration is viable."
22701
msgstr ""
22702
22703
#: serverguide/C/databases.xml:184(para)
22704
msgid ""
22705
"By default, connection via TCP/IP is disabled. PostgreSQL supports multiple "
22706
"client authentication methods. By default, IDENT authentication method is "
22707
"used for <application>postgres</application> and local users. Please refer "
22708
"<ulink url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the "
22709
"PostgreSQL Administrator's Guide</ulink>."
22710
msgstr ""
22711
22712
#: serverguide/C/databases.xml:191(para)
22713
msgid ""
22714
"The following discussion assumes that you wish to enable TCP/IP connections "
22715
"and use the MD5 method for client authentication. PostgreSQL configuration "
22716
"files are stored in the "
22717
"<filename>/etc/postgresql/<version>/main</filename> directory. For "
22718
"example, if you install PostgreSQL 8.4, the configuration files are stored "
22719
"in the <filename>/etc/postgresql/8.4/main</filename> directory."
22720
msgstr ""
22721
22722
#: serverguide/C/databases.xml:201(para)
22723
msgid ""
22724
"To configure <emphasis>ident</emphasis> authentication, add entries to the "
22725
"<filename>/etc/postgresql/8.4/main/pg_ident.conf</filename> file."
22726
msgstr ""
22727
22728
#: serverguide/C/databases.xml:208(para)
22729
msgid ""
22730
"To enable TCP/IP connections, edit the file "
22731
"<filename>/etc/postgresql/8.4/main/postgresql.conf</filename>"
22732
msgstr ""
22733
22734
#: serverguide/C/databases.xml:210(para)
22735
msgid ""
22736
"Locate the line <emphasis>#listen_addresses = 'localhost'</emphasis> and "
22737
"change it to:"
22738
msgstr ""
22739
22740
#: serverguide/C/databases.xml:213(programlisting)
22741
#, no-wrap
22742
msgid ""
22743
"\n"
22744
"listen_addresses = 'localhost'\n"
22745
msgstr ""
22746
22747
#: serverguide/C/databases.xml:217(para)
22748
msgid ""
22749
"To allow other computers to connect to your "
22750
"<application>PostgreSQL</application> server replace 'localhost' with the "
22751
"<emphasis>IP Address</emphasis> of your server."
22752
msgstr ""
22753
22754
#: serverguide/C/databases.xml:222(para)
22755
msgid ""
22756
"You may also edit all other parameters, if you know what you are doing! For "
22757
"details, refer to the configuration file or to the PostgreSQL documentation."
22758
msgstr ""
22759
22760
#: serverguide/C/databases.xml:227(para)
22761
msgid ""
22762
"Now that we can connect to our <application>PostgreSQL</application> server, "
22763
"the next step is to set a password for the <emphasis>postgres</emphasis> "
22764
"user. Run the following command at a terminal prompt to connect to the "
22765
"default PostgreSQL template database:"
22766
msgstr ""
22767
22768
#: serverguide/C/databases.xml:234(command)
22769
msgid "sudo -u postgres psql template1"
22770
msgstr ""
22771
22772
#: serverguide/C/databases.xml:236(para)
22773
msgid ""
22774
"The above command connects to PostgreSQL database "
22775
"<emphasis>template1</emphasis> as user <emphasis>postgres</emphasis>. Once "
22776
"you connect to the PostgreSQL server, you will be at a SQL prompt. You can "
22777
"run the following SQL command at the <application>psql</application> prompt "
22778
"to configure the password for the user <emphasis "
22779
"role=\"italics\">postgres</emphasis>."
22780
msgstr ""
22781
22782
#: serverguide/C/databases.xml:244(command)
22783
msgid "ALTER USER postgres with encrypted password 'your_password';"
22784
msgstr ""
22785
22786
#: serverguide/C/databases.xml:246(para)
22787
msgid ""
22788
"After configuring the password, edit the file "
22789
"<filename>/etc/postgresql/8.4/main/pg_hba.conf</filename> to use "
22790
"<emphasis>MD5</emphasis> authentication with the "
22791
"<emphasis>postgres</emphasis> user:"
22792
msgstr ""
22793
22794
#: serverguide/C/databases.xml:252(programlisting)
22795
#, no-wrap
22796
msgid ""
22797
"\n"
22798
"local all postgres md5\n"
22799
msgstr ""
22800
22801
#: serverguide/C/databases.xml:256(para)
22802
msgid ""
22803
"Finally, you should restart the <application>PostgreSQL</application> "
22804
"service to initialize the new configuration. From a terminal prompt enter "
22805
"the following to restart <application>PostgreSQL</application>:"
22806
msgstr ""
22807
22808
#: serverguide/C/databases.xml:262(command)
22809
msgid "sudo /etc/init.d/postgresql-8.4 restart"
22810
msgstr ""
22811
22812
#: serverguide/C/databases.xml:265(para)
22813
msgid ""
22814
"The above configuration is not complete by any means. Please refer <ulink "
22815
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the PostgreSQL "
22816
"Administrator's Guide</ulink> to configure more parameters."
22817
msgstr ""
22818
22819
#: serverguide/C/databases.xml:276(para)
22820
msgid ""
22821
"As mentioned above the <ulink "
22822
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\">Administrator's "
22823
"Guide</ulink> is an excellent resource. The guide is also available in the "
22824
"<application>postgresql-doc-8.4</application> package. Execute the following "
22825
"in a terminal to install the package:"
22826
msgstr ""
22827
22828
#: serverguide/C/databases.xml:282(command)
22829
msgid "sudo apt-get install postgresql-doc-8.4"
22830
msgstr ""
22831
22832
#: serverguide/C/databases.xml:284(para)
22833
msgid ""
22834
"To view the guide enter <command>file:///usr/share/doc/postgresql-doc-"
22835
"8.4/html/index.html</command> into the address bar of your browser."
22836
msgstr ""
22837
22838
#: serverguide/C/databases.xml:296(para)
22839
msgid ""
22840
"Also, see the <ulink "
22841
"url=\"https://help.ubuntu.com/community/PostgreSQL\">PostgreSQL Ubuntu "
22842
"Wiki</ulink> page for more information."
22843
msgstr ""
22844
22845
#: serverguide/C/clustering.xml:13(title)
22846
msgid "Clustering"
22847
msgstr ""
22848
22849
#: serverguide/C/clustering.xml:16(title)
22850
msgid "DRBD"
22851
msgstr ""
22852
22853
#: serverguide/C/clustering.xml:18(para)
22854
msgid ""
22855
"Distributed Replicated Block Device (DRBD) mirrors block devices between "
22856
"multiple hosts. The replication is transparent to other applications on the "
22857
"host systems. Any block device hard disks, partitions, RAID devices, logical "
22858
"volumes, etc can be mirrored."
22859
msgstr ""
22860
22861
#: serverguide/C/clustering.xml:24(para)
22862
msgid ""
22863
"To get started using <application>drbd</application>, first install the "
22864
"necessary packages. From a terminal enter:"
22865
msgstr ""
22866
22867
#: serverguide/C/clustering.xml:29(command)
22868
msgid "sudo apt-get install drbd8-utils"
22869
msgstr ""
22870
22871
#: serverguide/C/clustering.xml:33(para)
22872
msgid ""
22873
"If you are using the <emphasis>virtual kernel</emphasis> as part of a "
22874
"virtual machine you will need to manually compile the "
22875
"<application>drbd</application> module. It may be easier to install the "
22876
"<application>linux-server</application> package inside the virtual machine."
22877
msgstr ""
22878
22879
#: serverguide/C/clustering.xml:40(para)
22880
msgid ""
22881
"This section covers setting up a <application>drbd</application> to "
22882
"replicate a separate <filename>/srv</filename> partition, with an "
22883
"<application>ext3</application> filesystem between two hosts. The partition "
22884
"size is not particularly relevant, but both partitions need to be the same "
22885
"size."
22886
msgstr ""
22887
22888
#: serverguide/C/clustering.xml:49(para)
22889
msgid ""
22890
"The two hosts in this example will be called <emphasis>drbd01</emphasis> and "
22891
"<emphasis>drbd02</emphasis>. They will need to have name resolution "
22892
"configured either through DNS or the <filename>/etc/hosts</filename> file. "
22893
"See <xref linkend=\"dns\"/> for details."
22894
msgstr ""
22895
22896
#: serverguide/C/clustering.xml:57(para)
22897
msgid ""
22898
"To configure <application>drbd</application>, on the first host edit "
22899
"<filename>/etc/drbd.conf</filename>:"
22900
msgstr ""
22901
22902
#: serverguide/C/clustering.xml:61(programlisting)
22903
#, no-wrap
22904
msgid ""
22905
"\n"
22906
"global { usage-count no; }\n"
22907
"common { syncer { rate 100M; } }\n"
22908
"resource r0 {\n"
22909
" protocol C;\n"
22910
" startup {\n"
22911
" wfc-timeout 15;\n"
22912
" degr-wfc-timeout 60;\n"
22913
" }\n"
22914
" net {\n"
22915
" cram-hmac-alg sha1;\n"
22916
" shared-secret \"secret\";\n"
22917
" }\n"
22918
" on drbd01 {\n"
22919
" device /dev/drbd0;\n"
22920
" disk /dev/sdb1;\n"
22921
" address 192.168.0.1:7788;\n"
22922
" meta-disk internal;\n"
22923
" }\n"
22924
" on drbd02 {\n"
22925
" device /dev/drbd0;\n"
22926
" disk /dev/sdb1;\n"
22927
" address 192.168.0.2:7788;\n"
22928
" meta-disk internal;\n"
22929
" }\n"
22930
"} \n"
22931
msgstr ""
22932
22933
#: serverguide/C/clustering.xml:90(para)
22934
msgid ""
22935
"There are many other options in <filename>/etc/drbd.conf</filename>, but for "
22936
"this example their default values are fine."
22937
msgstr ""
22938
22939
#: serverguide/C/clustering.xml:98(para)
22940
msgid "Now copy <filename>/etc/drbd.conf</filename> to the second host:"
22941
msgstr ""
22942
22943
#: serverguide/C/clustering.xml:103(command)
22944
msgid "scp /etc/drbd.conf drbd02:~"
22945
msgstr ""
22946
22947
#: serverguide/C/clustering.xml:109(para)
22948
msgid ""
22949
"And, on <emphasis>drbd02</emphasis> move the file to "
22950
"<filename>/etc</filename>:"
22951
msgstr ""
22952
22953
#: serverguide/C/clustering.xml:114(command)
22954
msgid "sudo mv drbd.conf /etc/"
22955
msgstr ""
22956
22957
#: serverguide/C/clustering.xml:120(para)
22958
msgid ""
22959
"Next, on both hosts, start the <application>drbd</application> daemon:"
22960
msgstr ""
22961
22962
#: serverguide/C/clustering.xml:125(command)
22963
msgid "sudo /etc/init.d/drbd start"
22964
msgstr ""
22965
22966
#: serverguide/C/clustering.xml:131(para)
22967
msgid ""
22968
"Now using the <application>drbdadm</application> utility initialize the meta "
22969
"data storage. On each server execute:"
22970
msgstr ""
22971
22972
#: serverguide/C/clustering.xml:137(command)
22973
msgid "sudo drbdadm create-md r0"
22974
msgstr ""
22975
22976
#: serverguide/C/clustering.xml:143(para)
22977
msgid ""
22978
"On the <emphasis>drbd01</emphasis>, or whichever host you wish to be the "
22979
"primary, enter the following:"
22980
msgstr ""
22981
22982
#: serverguide/C/clustering.xml:148(command)
22983
msgid "sudo drbdadm -- --overwrite-data-of-peer primary all"
22984
msgstr ""
22985
22986
#: serverguide/C/clustering.xml:154(para)
22987
msgid ""
22988
"After executing the above command, the data will start syncing with the "
22989
"secondary host. To watch the progresss, on <emphasis>drbd02</emphasis> enter "
22990
"the following:"
22991
msgstr ""
22992
22993
#: serverguide/C/clustering.xml:160(command)
22994
msgid "watch -n1 cat /proc/drbd"
22995
msgstr ""
22996
22997
#: serverguide/C/clustering.xml:163(para)
22998
msgid "To stop watching the output press <emphasis>Ctrl+c</emphasis>."
22999
msgstr ""
23000
23001
#: serverguide/C/clustering.xml:170(para)
23002
msgid ""
23003
"Finally, add a filesystem to <filename>/dev/drbd0</filename> and mount it:"
23004
msgstr ""
23005
23006
#: serverguide/C/clustering.xml:175(command)
23007
msgid "sudo mkfs.ext3 /dev/drbd0"
23008
msgstr ""
23009
23010
#: serverguide/C/clustering.xml:176(command) serverguide/C/clustering.xml:224(command)
23011
msgid "sudo mount /dev/drbd0 /srv"
23012
msgstr ""
23013
23014
#: serverguide/C/clustering.xml:186(para)
23015
msgid ""
23016
"To test that the data is actually syncing between the hosts copy some files "
23017
"on the <emphasis>drbd01</emphasis>, the primary, to "
23018
"<filename>/srv</filename>:"
23019
msgstr ""
23020
23021
#: serverguide/C/clustering.xml:195(para)
23022
msgid "Next, unmount <filename>/srv</filename>:"
23023
msgstr ""
23024
23025
#: serverguide/C/clustering.xml:203(para)
23026
msgid ""
23027
"<emphasis>Demote</emphasis> the <emphasis>primary</emphasis> server to the "
23028
"<emphasis>secondary</emphasis> role:"
23029
msgstr ""
23030
23031
#: serverguide/C/clustering.xml:208(command)
23032
msgid "sudo drbdadm secondary r0"
23033
msgstr ""
23034
23035
#: serverguide/C/clustering.xml:211(para)
23036
msgid ""
23037
"Now on the <emphasis>secondary</emphasis> server "
23038
"<emphasis>promote</emphasis> it to the <emphasis>primary</emphasis> role:"
23039
msgstr ""
23040
23041
#: serverguide/C/clustering.xml:216(command)
23042
msgid "sudo drbdadm primary r0"
23043
msgstr ""
23044
23045
#: serverguide/C/clustering.xml:219(para)
23046
msgid "Lastly, mount the partition:"
23047
msgstr ""
23048
23049
#: serverguide/C/clustering.xml:227(para)
23050
msgid ""
23051
"Using <emphasis>ls</emphasis> you should see "
23052
"<filename>/srv/default</filename> copied from the former "
23053
"<emphasis>primary</emphasis> host <emphasis>drbd01</emphasis>."
23054
msgstr ""
23055
23056
#: serverguide/C/clustering.xml:238(para)
23057
msgid ""
23058
"For more information on <application>DRBD</application> see the <ulink "
23059
"url=\"http://www.drbd.org/\">DRBD web site</ulink>."
23060
msgstr ""
23061
23062
#: serverguide/C/clustering.xml:243(para)
23063
msgid ""
23064
"The <ulink "
23065
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/drbd.conf.5.html\">dr"
23066
"bd.conf man page</ulink> contains details on the options not covered in this "
23067
"guide."
23068
msgstr ""
23069
23070
#: serverguide/C/clustering.xml:249(para)
23071
msgid ""
23072
"Also, see the <ulink "
23073
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/drbdadm.8.html\">drbd"
23074
"adm man page</ulink>."
23075
msgstr ""
23076
23077
#: serverguide/C/clustering.xml:254(para)
23078
msgid ""
23079
"The <ulink url=\"https://help.ubuntu.com/community/DRBD\">DRBD Ubuntu "
23080
"Wiki</ulink> page also has more information."
23081
msgstr ""
23082
23083
#: serverguide/C/chat.xml:13(title)
23084
msgid "Chat Applications"
23085
msgstr ""
23086
23087
#: serverguide/C/chat.xml:19(para)
23088
msgid ""
23089
"In this section, we will discuss how to install and configure a IRC server, "
23090
"<application>ircd-irc2</application>. We will also discuss how to install "
23091
"and configure Jabber, an instance messaging server."
23092
msgstr ""
23093
23094
#: serverguide/C/chat.xml:28(title)
23095
msgid "IRC Server"
23096
msgstr ""
23097
23098
#: serverguide/C/chat.xml:30(para)
23099
msgid ""
23100
"The Ubuntu repository has many Internet Relay Chat servers. This section "
23101
"explains how to install and configure the original IRC server "
23102
"<application>ircd-irc2</application>."
23103
msgstr ""
23104
23105
#: serverguide/C/chat.xml:39(para)
23106
msgid ""
23107
"To install <application>ircd-irc2</application>, run the following command "
23108
"in the command prompt:"
23109
msgstr ""
23110
23111
#: serverguide/C/chat.xml:45(command)
23112
msgid "sudo apt-get install ircd-irc2"
23113
msgstr ""
23114
23115
#: serverguide/C/chat.xml:48(para)
23116
msgid ""
23117
"The configuration files are stored in <filename>/etc/ircd</filename> "
23118
"directory. The documents are available in <filename>/usr/share/doc/ircd-"
23119
"irc2</filename> directory."
23120
msgstr ""
23121
23122
#: serverguide/C/chat.xml:59(para)
23123
msgid ""
23124
"The IRC settings can be done in the configuration file "
23125
"<filename>/etc/ircd/ircd.conf</filename>. You can set the IRC host name in "
23126
"this file by editing the following line:"
23127
msgstr ""
23128
23129
#: serverguide/C/chat.xml:64(programlisting)
23130
#, no-wrap
23131
msgid ""
23132
"\n"
23133
"M:irc.localhost::Debian ircd default configuration::000A\n"
23134
msgstr ""
23135
23136
#: serverguide/C/chat.xml:68(para)
23137
msgid ""
23138
"Please make sure you add DNS aliases for the IRC host name. For instance, if "
23139
"you set irc.livecipher.com as IRC host name, please make sure "
23140
"irc.livecipher.com is resolvable in your Domain Name Server. The IRC host "
23141
"name should not be same as the host name."
23142
msgstr ""
23143
23144
#: serverguide/C/chat.xml:75(para)
23145
msgid ""
23146
"The IRC admin details can be configured by editting the following line:"
23147
msgstr ""
23148
23149
#: serverguide/C/chat.xml:80(programlisting)
23150
#, no-wrap
23151
msgid ""
23152
"\n"
23153
"A:Organization, IRC dept.:Daemon <ircd@example.irc.org>:Client "
23154
"Server::IRCnet:\n"
23155
msgstr ""
23156
23157
#: serverguide/C/chat.xml:84(para)
23158
msgid ""
23159
"You should add specific lines to configure the list of IRC ports to listen "
23160
"on, to configure Operator credentials, to configure client authentication, "
23161
"etc. For details, please refer to the example configuration file "
23162
"<filename>/usr/share/doc/ircd-irc2/ircd.conf.example.gz</filename>."
23163
msgstr ""
23164
23165
#: serverguide/C/chat.xml:92(para)
23166
msgid ""
23167
"The IRC banner to be displayed in the IRC client, when the user connects to "
23168
"the server can be set in <filename>/etc/ircd/ircd.motd</filename> file."
23169
msgstr ""
23170
23171
#: serverguide/C/chat.xml:97(para)
23172
msgid ""
23173
"After making necessary changes to the configuration file, you can restart "
23174
"the IRC server using following command:"
23175
msgstr ""
23176
23177
#: serverguide/C/chat.xml:101(programlisting)
23178
#, no-wrap
23179
msgid ""
23180
"\n"
23181
"sudo /etc/init.d/ircd-irc2 restart\n"
23182
msgstr ""
23183
23184
#: serverguide/C/chat.xml:109(para)
23185
msgid ""
23186
"You may also be interested to take a look at other IRC servers available in "
23187
"Ubuntu Repository. It includes, <application>ircd-ircu</application> and "
23188
"<application>ircd-hybrid</application>."
23189
msgstr ""
23190
23191
#: serverguide/C/chat.xml:117(para)
23192
msgid ""
23193
"Refer to <ulink url=\"http://www.irc.org/tech_docs/ircnet/faq.html\">IRCD "
23194
"FAQ</ulink> for more details about the IRC Server."
23195
msgstr ""
23196
23197
#: serverguide/C/chat.xml:124(para)
23198
msgid ""
23199
"Also, the <ulink url=\"https://help.ubuntu.com/community/ircd\">Ubuntu Wiki "
23200
"IRCD</ulink> page has more information."
23201
msgstr ""
23202
23203
#: serverguide/C/chat.xml:132(title)
23204
msgid "Jabber Instant Messaging Server"
23205
msgstr ""
23206
23207
#: serverguide/C/chat.xml:134(para)
23208
msgid ""
23209
"<emphasis>Jabber</emphasis> a popular instant message protocol is based on "
23210
"XMPP, an open standard for instant messaging, and used by many popular "
23211
"applications. This section covers setting up a <emphasis>Jabberd "
23212
"2</emphasis> server on a local LAN. This configuration can also be adapted "
23213
"to providing messaging services to users over the Internet."
23214
msgstr ""
23215
23216
#: serverguide/C/chat.xml:143(para)
23217
msgid "To install <application>jabberd2</application>, in a terminal enter:"
23218
msgstr ""
23219
23220
#: serverguide/C/chat.xml:148(command)
23221
msgid "sudo apt-get install jabberd2"
23222
msgstr ""
23223
23224
#: serverguide/C/chat.xml:155(para)
23225
msgid ""
23226
"A couple of XML configuration files will be used to configure "
23227
"<application>jabberd2</application> for <emphasis>Berkely DB</emphasis> user "
23228
"authentication. This is a very simple form of authentication. However, "
23229
"<application>jabberd2</application> can be configured to use LDAP, MySQL, "
23230
"Postgresql, etc for for user authentication."
23231
msgstr ""
23232
23233
#: serverguide/C/chat.xml:162(para)
23234
msgid "First, edit <filename>/etc/jabberd2/sm.xml</filename> changing:"
23235
msgstr ""
23236
23237
#: serverguide/C/chat.xml:166(programlisting)
23238
#, no-wrap
23239
msgid ""
23240
"\n"
23241
" <id>jabber.example.com</id>\n"
23242
msgstr ""
23243
23244
#: serverguide/C/chat.xml:171(para)
23245
msgid ""
23246
"Replace <emphasis>jabber.example.com</emphasis> with the hostname, or other "
23247
"id, of your server."
23248
msgstr ""
23249
23250
#: serverguide/C/chat.xml:176(para)
23251
msgid "Now in the <storage> section change the <driver> to:"
23252
msgstr ""
23253
23254
#: serverguide/C/chat.xml:180(programlisting)
23255
#, no-wrap
23256
msgid ""
23257
"\n"
23258
" <driver>db</driver>\n"
23259
msgstr ""
23260
23261
#: serverguide/C/chat.xml:184(para)
23262
msgid ""
23263
"Next, edit <filename>/etc/jabberd2/c2s.xml</filename> in the "
23264
"<emphasis><local></emphasis> section change:"
23265
msgstr ""
23266
23267
#: serverguide/C/chat.xml:188(programlisting)
23268
#, no-wrap
23269
msgid ""
23270
"\n"
23271
" <id>jabber.example.com</id>\n"
23272
msgstr ""
23273
23274
#: serverguide/C/chat.xml:192(para)
23275
msgid ""
23276
"And in the <authreg> section adjust the <module> section to:"
23277
msgstr ""
23278
23279
#: serverguide/C/chat.xml:196(programlisting)
23280
#, no-wrap
23281
msgid ""
23282
"\n"
23283
" <module>db</module>\n"
23284
msgstr ""
23285
23286
#: serverguide/C/chat.xml:200(para)
23287
msgid ""
23288
"Finally, restart <application>jabberd2</application> to enable the new "
23289
"settings:"
23290
msgstr ""
23291
23292
#: serverguide/C/chat.xml:205(command)
23293
msgid "sudo /etc/init.d/jabberd2 restart"
23294
msgstr ""
23295
23296
#: serverguide/C/chat.xml:208(para)
23297
msgid ""
23298
"You should now be able to connect to the server using a Jabber client like "
23299
"<application>Pidgin</application> for example."
23300
msgstr ""
23301
23302
#: serverguide/C/chat.xml:213(para)
23303
msgid ""
23304
"The advantage of using Berkeley DB for user data is that after being "
23305
"configured no additional maintenance is required. If you need more control "
23306
"over user accounts and credentials another authentication method is "
23307
"recommended."
23308
msgstr ""
23309
23310
#: serverguide/C/chat.xml:225(para)
23311
msgid ""
23312
"The <ulink url=\"http://codex.xiaoka.com/wiki/jabberd2:start\">Jabberd2 Web "
23313
"Site</ulink> contains more details on configuring "
23314
"<application>Jabberd2</application>."
23315
msgstr ""
23316
23317
#: serverguide/C/chat.xml:231(para)
23318
msgid ""
23319
"For more authentication options see the <ulink "
23320
"url=\"http://jabberd2.xiaoka.com/wiki/InstallGuide\">Jabberd2 Install "
23321
"Guide</ulink>."
23322
msgstr ""
23323
23324
#: serverguide/C/chat.xml:236(para)
23325
msgid ""
23326
"Also, the <ulink "
23327
"url=\"https://help.ubuntu.com/community/SettingUpJabberServer\">Setting Up "
23328
"Jabber Server Ubuntu Wiki</ulink> page has more information."
23329
msgstr ""
23330
23331
#: serverguide/C/backups.xml:13(title)
23332
msgid "Backups"
23333
msgstr ""
23334
23335
#: serverguide/C/backups.xml:14(para)
23336
msgid ""
23337
"There are many ways to backup an Ubuntu installation. The most important "
23338
"thing about backups is to develop a <emphasis>backup plan</emphasis> "
23339
"consisting of what to backup, where to back it up to, and how to restore it."
23340
msgstr ""
23341
23342
#: serverguide/C/backups.xml:18(para)
23343
msgid ""
23344
"The following sections discuss various ways of accomplishing these tasks."
23345
msgstr ""
23346
23347
#: serverguide/C/backups.xml:22(title)
23348
msgid "Shell Scripts"
23349
msgstr ""
23350
23351
#: serverguide/C/backups.xml:23(para)
23352
msgid ""
23353
"One of the simplest ways to backup a system is using a <emphasis>shell "
23354
"script</emphasis>. For example, a script can be used to configure which "
23355
"directories to backup, and use those directories as arguments to the "
23356
"<application>tar</application> utility creating an archive file. The archive "
23357
"file can then be moved or copied to another location. The archive can also "
23358
"be created on a remote file system such as an <emphasis>NFS</emphasis> mount."
23359
msgstr ""
23360
23361
#: serverguide/C/backups.xml:29(para)
23362
msgid ""
23363
"The <application>tar</application> utility creates one archive file out of "
23364
"many files or directories. <application>tar</application> can also filter "
23365
"the files through compression utilities reducing the size of the archive "
23366
"file."
23367
msgstr ""
23368
23369
#: serverguide/C/backups.xml:35(title)
23370
msgid "Simple Shell Script"
23371
msgstr ""
23372
23373
#: serverguide/C/backups.xml:36(para)
23374
msgid ""
23375
"The following shell script uses <application>tar</application> to create an "
23376
"archive file on a remotely mounted NFS file system. The archive filename is "
23377
"determined using additional command line utilities."
23378
msgstr ""
23379
23380
#: serverguide/C/backups.xml:40(programlisting)
23381
#, no-wrap
23382
msgid ""
23383
"\n"
23384
"#!/bin/sh\n"
23385
"####################################\n"
23386
"#\n"
23387
"# Backup to NFS mount script.\n"
23388
"#\n"
23389
"####################################\n"
23390
"\n"
23391
"# What to backup. \n"
23392
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23393
"\n"
23394
"# Where to backup to.\n"
23395
"dest=\"/mnt/backup\"\n"
23396
"\n"
23397
"# Create archive filename.\n"
23398
"day=$(date +%A)\n"
23399
"hostname=$(hostname -s)\n"
23400
"archive_file=\"$hostname-$day.tgz\"\n"
23401
"\n"
23402
"# Print start status message.\n"
23403
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23404
"date\n"
23405
"echo\n"
23406
"\n"
23407
"# Backup the files using tar.\n"
23408
"tar czf $dest/$archive_file $backup_files\n"
23409
"\n"
23410
"# Print end status message.\n"
23411
"echo\n"
23412
"echo \"Backup finished\"\n"
23413
"date\n"
23414
"\n"
23415
"# Long listing of files in $dest to check file sizes.\n"
23416
"ls -lh $dest\n"
23417
msgstr ""
23418
23419
#: serverguide/C/backups.xml:77(para)
23420
msgid ""
23421
"<emphasis>$backup_files:</emphasis> a variable listing which directories you "
23422
"would like to backup. The list should be customized to fit your needs."
23423
msgstr ""
23424
23425
#: serverguide/C/backups.xml:83(para)
23426
msgid ""
23427
"<emphasis>$day:</emphasis> a variable holding the day of the week (Monday, "
23428
"Tuesday, Wednesday, etc). This is used to create an archive file for each "
23429
"day of the week, giving a backup history of seven days. There are other ways "
23430
"to accomplish this including other ways using the "
23431
"<application>date</application> utility."
23432
msgstr ""
23433
23434
#: serverguide/C/backups.xml:90(para)
23435
msgid ""
23436
"<emphasis>$hostname:</emphasis> variable containing the "
23437
"<emphasis>short</emphasis> hostname of the system. Using the hostname in the "
23438
"archive filename gives you the option of placing daily archive files from "
23439
"multiple systems in the same directory."
23440
msgstr ""
23441
23442
#: serverguide/C/backups.xml:97(para)
23443
msgid "<emphasis>$archive_file:</emphasis> the full archive filename."
23444
msgstr ""
23445
23446
#: serverguide/C/backups.xml:102(para)
23447
msgid ""
23448
"<emphasis>$dest:</emphasis> destination of the archive file. The directory "
23449
"needs to be created and in this case <emphasis>mounted</emphasis> before "
23450
"executing the backup script. See <xref linkend=\"network-file-system\"/> for "
23451
"details using <emphasis>NFS</emphasis>."
23452
msgstr ""
23453
23454
#: serverguide/C/backups.xml:109(para)
23455
msgid ""
23456
"<emphasis>status messages:</emphasis> optional messages printed to the "
23457
"console using the <application>echo</application> utility."
23458
msgstr ""
23459
23460
#: serverguide/C/backups.xml:115(para)
23461
msgid ""
23462
"<emphasis>tar czf $dest/$archive_file $backup_files:</emphasis> the "
23463
"<application>tar</application> command used to create the archive file."
23464
msgstr ""
23465
23466
#: serverguide/C/backups.xml:121(para)
23467
msgid "<emphasis>c:</emphasis> creates an archive."
23468
msgstr ""
23469
23470
#: serverguide/C/backups.xml:126(para)
23471
msgid ""
23472
"<emphasis>z:</emphasis> filter the archive through the "
23473
"<application>gzip</application> utility compressing the archive."
23474
msgstr ""
23475
23476
#: serverguide/C/backups.xml:131(para)
23477
msgid ""
23478
"<emphasis>f:</emphasis> use archive file. Otherwise the "
23479
"<application>tar</application> output will be sent to STDOUT."
23480
msgstr ""
23481
23482
#: serverguide/C/backups.xml:138(para)
23483
msgid ""
23484
"<emphasis>ls -lh $dest:</emphasis> optional statement prints a <emphasis>-"
23485
"l</emphasis> long listing in <emphasis>-h</emphasis> human readable format "
23486
"of the destination directory. This is useful for a quick file size check of "
23487
"the archive file. This check should not replace testing the archive file."
23488
msgstr ""
23489
23490
#: serverguide/C/backups.xml:145(para)
23491
msgid ""
23492
"This is a simple example of a backup shell script. There are large amount of "
23493
"options that can be included in a backup script. See <xref linkend=\"backup-"
23494
"shellscript-references\"/> for links to resources providing more in depth "
23495
"shell scripting information."
23496
msgstr ""
23497
23498
#: serverguide/C/backups.xml:152(title)
23499
msgid "Executing the Script"
23500
msgstr ""
23501
23502
#: serverguide/C/backups.xml:154(title)
23503
msgid "Executing from a Terminal"
23504
msgstr ""
23505
23506
#: serverguide/C/backups.xml:155(para)
23507
msgid ""
23508
"The simplest way of executing the above backup script is to copy and paste "
23509
"the contents into a file. <filename>backup.sh</filename> for example. Then "
23510
"from a terminal prompt:"
23511
msgstr ""
23512
23513
#: serverguide/C/backups.xml:160(command)
23514
msgid "sudo bash backup.sh"
23515
msgstr ""
23516
23517
#: serverguide/C/backups.xml:162(para)
23518
msgid ""
23519
"This is a great way to test the script to make sure everything works as "
23520
"expected."
23521
msgstr ""
23522
23523
#: serverguide/C/backups.xml:167(title)
23524
msgid "Executing with cron"
23525
msgstr ""
23526
23527
#: serverguide/C/backups.xml:168(para)
23528
msgid ""
23529
"The <application>cron</application> utility can be used to automate the "
23530
"script execution. The <application>cron</application> daemon allows the "
23531
"execution of scripts, or commands, at a specified time and date."
23532
msgstr ""
23533
23534
#: serverguide/C/backups.xml:172(para)
23535
msgid ""
23536
"<application>cron</application> is configured through entries in a "
23537
"<filename>crontab</filename> file. <filename>crontab</filename> files are "
23538
"separated into fields:"
23539
msgstr ""
23540
23541
#: serverguide/C/backups.xml:176(programlisting)
23542
#, no-wrap
23543
msgid ""
23544
"\n"
23545
"# m h dom mon dow command\n"
23546
msgstr ""
23547
23548
#: serverguide/C/backups.xml:181(para)
23549
msgid ""
23550
"<emphasis>m:</emphasis> minute the command executes on between 0 and 59."
23551
msgstr ""
23552
23553
#: serverguide/C/backups.xml:186(para)
23554
msgid ""
23555
"<emphasis>h:</emphasis> hour the command executes on between 0 and 23."
23556
msgstr ""
23557
23558
#: serverguide/C/backups.xml:191(para)
23559
msgid "<emphasis>dom:</emphasis> day of month the command executes on."
23560
msgstr ""
23561
23562
#: serverguide/C/backups.xml:196(para)
23563
msgid ""
23564
"<emphasis>mon:</emphasis> the month the command executes on between 1 and 12."
23565
msgstr ""
23566
23567
#: serverguide/C/backups.xml:201(para)
23568
msgid ""
23569
"<emphasis>dow:</emphasis> the day of the week the command executes on "
23570
"between 0 and 7. Sunday may be specified by using 0 or 7, both values are "
23571
"valid."
23572
msgstr ""
23573
23574
#: serverguide/C/backups.xml:206(para)
23575
msgid "<emphasis>command:</emphasis> the command to execute."
23576
msgstr ""
23577
23578
#: serverguide/C/backups.xml:211(para)
23579
msgid ""
23580
"To add or change entries in a <filename>crontab</filename> file the "
23581
"<application>crontab -e</application> command should be used. Also, the "
23582
"contents of a <filename>crontab</filename> file can be viewed using the "
23583
"<application>crontab -l</application> command."
23584
msgstr ""
23585
23586
#: serverguide/C/backups.xml:215(para)
23587
msgid ""
23588
"To execute the <application>backup.sh</application> script listed above "
23589
"using <application>cron</application>. Enter the following from a terminal "
23590
"prompt:"
23591
msgstr ""
23592
23593
#: serverguide/C/backups.xml:220(command)
23594
msgid "sudo crontab -e"
23595
msgstr ""
23596
23597
#: serverguide/C/backups.xml:223(para)
23598
msgid ""
23599
"Using <application>sudo</application> with the <application>crontab -"
23600
"e</application> command edits the <emphasis>root</emphasis> user's crontab. "
23601
"This is necessary if you are backing up directories only the root user has "
23602
"access to."
23603
msgstr ""
23604
23605
#: serverguide/C/backups.xml:228(para)
23606
msgid "Add the following entry to the <filename>crontab</filename> file:"
23607
msgstr ""
23608
23609
#: serverguide/C/backups.xml:231(programlisting)
23610
#, no-wrap
23611
msgid ""
23612
"\n"
23613
"# m h dom mon dow command\n"
23614
"0 0 * * * bash /usr/local/bin/backup.sh\n"
23615
msgstr ""
23616
23617
#: serverguide/C/backups.xml:235(para)
23618
msgid ""
23619
"The <application>backup.sh</application> script will now be executed every "
23620
"day at 12:00 am."
23621
msgstr ""
23622
23623
#: serverguide/C/backups.xml:239(para)
23624
msgid ""
23625
"The <application>backup.sh</application> script will need to be copied to "
23626
"the <filename>/usr/local/bin/</filename> directory in order for this entry "
23627
"to execute properly. The script can reside anywhere on the file system "
23628
"simply change the script path appropriately."
23629
msgstr ""
23630
23631
#: serverguide/C/backups.xml:244(para)
23632
msgid ""
23633
"For more in depth <application>crontab</application> options see <xref "
23634
"linkend=\"backup-shellscript-references\"/>."
23635
msgstr ""
23636
23637
#: serverguide/C/backups.xml:250(title)
23638
msgid "Restoring from the Archive"
23639
msgstr ""
23640
23641
#: serverguide/C/backups.xml:251(para)
23642
msgid ""
23643
"Once an archive has been created it is important to test the archive. The "
23644
"archive can be tested by listing the files it contains, but the best test is "
23645
"to <emphasis>restore</emphasis> a file from the archive."
23646
msgstr ""
23647
23648
#: serverguide/C/backups.xml:257(para)
23649
msgid "To see a listing of the archive contents. From a terminal prompt:"
23650
msgstr ""
23651
23652
#: serverguide/C/backups.xml:261(command)
23653
msgid "tar -tzvf /mnt/backup/host-Monday.tgz"
23654
msgstr ""
23655
23656
#: serverguide/C/backups.xml:265(para)
23657
msgid "To restore a file from the archive to a different directory enter:"
23658
msgstr ""
23659
23660
#: serverguide/C/backups.xml:269(command)
23661
msgid "tar -xzvf /mnt/backup/host-Monday.tgz -C /tmp etc/hosts"
23662
msgstr ""
23663
23664
#: serverguide/C/backups.xml:271(para)
23665
msgid ""
23666
"The <emphasis>-C</emphasis> option to <application>tar</application> "
23667
"redirects the extracted files to the specified directory. The above example "
23668
"will extract the <filename>/etc/hosts</filename> file to "
23669
"<filename>/tmp/etc/hosts</filename>. <application>tar</application> "
23670
"recreates the directory structure that it contains."
23671
msgstr ""
23672
23673
#: serverguide/C/backups.xml:276(para)
23674
msgid ""
23675
"Also, notice the leading <emphasis>\"/\"</emphasis> is left off the path of "
23676
"the file to restore."
23677
msgstr ""
23678
23679
#: serverguide/C/backups.xml:281(para)
23680
msgid "To restore all files in the archive enter the following:"
23681
msgstr ""
23682
23683
#: serverguide/C/backups.xml:285(command)
23684
msgid "cd /"
23685
msgstr ""
23686
23687
#: serverguide/C/backups.xml:286(command)
23688
msgid "sudo tar -xzvf /mnt/backup/host-Monday.tgz"
23689
msgstr ""
23690
23691
#: serverguide/C/backups.xml:291(para)
23692
msgid "This will overwrite the files currently on the file system."
23693
msgstr ""
23694
23695
#: serverguide/C/backups.xml:300(para)
23696
msgid ""
23697
"For more information on shell scripting see the <ulink "
23698
"url=\"http://tldp.org/LDP/abs/html/\">Advanced Bash-Scripting Guide</ulink>"
23699
msgstr ""
23700
23701
#: serverguide/C/backups.xml:305(para)
23702
msgid ""
23703
"The book <ulink url=\"http://safari.samspublishing.com/0672323583\">Teach "
23704
"Yourself Shell Programming in 24 Hours</ulink> is available online and a "
23705
"great resource for shell scripting."
23706
msgstr ""
23707
23708
#: serverguide/C/backups.xml:311(para)
23709
msgid ""
23710
"The <ulink url=\"https://help.ubuntu.com/community/CronHowto\">CronHowto "
23711
"Wiki Page</ulink> contains details on advanced "
23712
"<application>cron</application> options."
23713
msgstr ""
23714
23715
#: serverguide/C/backups.xml:318(para)
23716
msgid ""
23717
"See the <ulink url=\"http://www.gnu.org/software/tar/manual/index.html\">GNU "
23718
"tar Manual</ulink> for more <application>tar</application> options."
23719
msgstr ""
23720
23721
#: serverguide/C/backups.xml:324(para)
23722
msgid ""
23723
"The Wikipedia <ulink "
23724
"url=\"http://en.wikipedia.org/wiki/Backup_rotation_scheme\">Backup Rotation "
23725
"Scheme</ulink> article contains information on other backup rotation schemes."
23726
msgstr ""
23727
23728
#: serverguide/C/backups.xml:330(para)
23729
msgid ""
23730
"The shell script uses <application>tar</application> to create the archive, "
23731
"but there many other command line utilities that can be used. For example:"
23732
msgstr ""
23733
23734
#: serverguide/C/backups.xml:336(para)
23735
msgid ""
23736
"<ulink url=\"http://www.gnu.org/software/cpio/\">cpio</ulink>: used to copy "
23737
"files to and from archives."
23738
msgstr ""
23739
23740
#: serverguide/C/backups.xml:341(para)
23741
msgid ""
23742
"<ulink url=\"http://www.gnu.org/software/coreutils/\">dd</ulink>: part of "
23743
"the <application>coreutils</application> package. A low level utility that "
23744
"can copy data from one format to another"
23745
msgstr ""
23746
23747
#: serverguide/C/backups.xml:347(para)
23748
msgid ""
23749
"<ulink url=\"http://www.rsnapshot.org/\">rsnapshot</ulink>: a file system "
23750
"snap shot utility used to create copies of an entire file system."
23751
msgstr ""
23752
23753
#: serverguide/C/backups.xml:358(title)
23754
msgid "Archive Rotation"
23755
msgstr ""
23756
23757
#: serverguide/C/backups.xml:359(para)
23758
msgid ""
23759
"The shell script in section <xref linkend=\"backup-shellscripts\"/> only "
23760
"allows for seven different archives. For a server whose data doesn't change "
23761
"often this may be enough. If the server has a large amount of data a more "
23762
"robust rotation scheme should be used."
23763
msgstr ""
23764
23765
#: serverguide/C/backups.xml:365(title)
23766
msgid "Rotating NFS Archives"
23767
msgstr ""
23768
23769
#: serverguide/C/backups.xml:366(para)
23770
msgid ""
23771
"In this section the shell script will be slightly modified to implement a "
23772
"grandfather-father-son rotation scheme (monthly-weekly-daily):"
23773
msgstr ""
23774
23775
#: serverguide/C/backups.xml:372(para)
23776
msgid ""
23777
"The rotation will do a <emphasis>daily</emphasis> backup Sunday through "
23778
"Friday."
23779
msgstr ""
23780
23781
#: serverguide/C/backups.xml:377(para)
23782
msgid ""
23783
"On Saturday a <emphasis>weekly</emphasis> backup is done giving you four "
23784
"weekly backups a month."
23785
msgstr ""
23786
23787
#: serverguide/C/backups.xml:382(para)
23788
msgid ""
23789
"The <emphasis>monthly</emphasis> backup is done on the first of the month "
23790
"rotating two monthly backups based on if the month is odd or even."
23791
msgstr ""
23792
23793
#: serverguide/C/backups.xml:388(para)
23794
msgid "Here is the new script:"
23795
msgstr ""
23796
23797
#: serverguide/C/backups.xml:391(programlisting)
23798
#, no-wrap
23799
msgid ""
23800
"\n"
23801
"#!/bin/bash\n"
23802
"####################################\n"
23803
"#\n"
23804
"# Backup to NFS mount script with\n"
23805
"# grandfather-father-son rotation.\n"
23806
"#\n"
23807
"####################################\n"
23808
"\n"
23809
"# What to backup. \n"
23810
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23811
"\n"
23812
"# Where to backup to.\n"
23813
"dest=\"/mnt/backup\"\n"
23814
"\n"
23815
"# Setup variables for the archive filename.\n"
23816
"day=$(date +%A)\n"
23817
"hostname=$(hostname -s)\n"
23818
"\n"
23819
"# Find which week of the month 1-4 it is.\n"
23820
"day_num=$(date +%d)\n"
23821
"if (( $day_num <= 7 )); then\n"
23822
" week_file=\"$hostname-week1.tgz\"\n"
23823
"elif (( $day_num > 7 && $day_num <= 14 )); then\n"
23824
" week_file=\"$hostname-week2.tgz\"\n"
23825
"elif (( $day_num > 14 && $day_num <= 21 )); then\n"
23826
" week_file=\"$hostname-week3.tgz\"\n"
23827
"elif (( $day_num > 21 && $day_num < 32 )); then\n"
23828
" week_file=\"$hostname-week4.tgz\"\n"
23829
"fi\n"
23830
"\n"
23831
"# Find if the Month is odd or even.\n"
23832
"month_num=$(date +%m)\n"
23833
"month=$(expr $month_num % 2)\n"
23834
"if [ $month -eq 0 ]; then\n"
23835
" month_file=\"$hostname-month2.tgz\"\n"
23836
"else\n"
23837
" month_file=\"$hostname-month1.tgz\"\n"
23838
"fi\n"
23839
"\n"
23840
"# Create archive filename.\n"
23841
"if [ $day_num == 1 ]; then\n"
23842
"\tarchive_file=$month_file\n"
23843
"elif [ $day != \"Saturday\" ]; then\n"
23844
" archive_file=\"$hostname-$day.tgz\"\n"
23845
"else \n"
23846
"\tarchive_file=$week_file\n"
23847
"fi\n"
23848
"\n"
23849
"# Print start status message.\n"
23850
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23851
"date\n"
23852
"echo\n"
23853
"\n"
23854
"# Backup the files using tar.\n"
23855
"tar czf $dest/$archive_file $backup_files\n"
23856
"\n"
23857
"# Print end status message.\n"
23858
"echo\n"
23859
"echo \"Backup finished\"\n"
23860
"date\n"
23861
"\n"
23862
"# Long listing of files in $dest to check file sizes.\n"
23863
"ls -lh $dest/\n"
23864
msgstr ""
23865
23866
#: serverguide/C/backups.xml:456(para)
23867
msgid ""
23868
"The script can be executed using the same methods as in <xref "
23869
"linkend=\"backup-executing-shellscript\"/>."
23870
msgstr ""
23871
23872
#: serverguide/C/backups.xml:459(para)
23873
msgid ""
23874
"It is good practice to take backup media off site in case of a disaster. In "
23875
"the shell script example the backup media is another server providing an NFS "
23876
"share. In all likelihood taking the NFS server to another location would not "
23877
"be practical. Depending upon connection speeds it may be an option to copy "
23878
"the archive file over a WAN link to a server in another location."
23879
msgstr ""
23880
23881
#: serverguide/C/backups.xml:465(para)
23882
msgid ""
23883
"Another option is to copy the archive file to an external hard drive which "
23884
"can then be taken off site. Since the price of external hard drives continue "
23885
"to decrease it may be cost affective to use two drives for each archive "
23886
"level. This would allow you to have one external drive attached to the "
23887
"backup server and one in another location."
23888
msgstr ""
23889
23890
#: serverguide/C/backups.xml:472(title)
23891
msgid "Tape Drives"
23892
msgstr ""
23893
23894
#: serverguide/C/backups.xml:473(para)
23895
msgid ""
23896
"A tape drive attached to the server can be used instead of a NFS share. "
23897
"Using a tape drive simplifies archive rotation, and taking the media off "
23898
"site as well."
23899
msgstr ""
23900
23901
#: serverguide/C/backups.xml:477(para)
23902
msgid ""
23903
"When using a tape drive the filename portions of the script aren't needed "
23904
"because the date is sent directly to the tape device. Some commands to "
23905
"manipulate the tape are needed. This is accomplished using "
23906
"<application>mt</application>, a magnetic tape control utility part of the "
23907
"<application>cpio</application> package."
23908
msgstr ""
23909
23910
#: serverguide/C/backups.xml:482(para)
23911
msgid "Here is the shell script modified to use a tape drive:"
23912
msgstr ""
23913
23914
#: serverguide/C/backups.xml:485(programlisting)
23915
#, no-wrap
23916
msgid ""
23917
"\n"
23918
"#!/bin/bash\n"
23919
"####################################\n"
23920
"#\n"
23921
"# Backup to tape drive script.\n"
23922
"#\n"
23923
"####################################\n"
23924
"\n"
23925
"# What to backup. \n"
23926
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23927
"\n"
23928
"# Where to backup to.\n"
23929
"dest=\"/dev/st0\"\n"
23930
"\n"
23931
"# Print start status message.\n"
23932
"echo \"Backing up $backup_files to $dest\"\n"
23933
"date\n"
23934
"echo\n"
23935
"\n"
23936
"# Make sure the tape is rewound.\n"
23937
"mt -f $dest rewind\n"
23938
"\n"
23939
"# Backup the files using tar.\n"
23940
"tar czf $dest $backup_files\n"
23941
"\n"
23942
"# Rewind and eject the tape.\n"
23943
"mt -f $dest rewoffl\n"
23944
"\n"
23945
"# Print end status message.\n"
23946
"echo\n"
23947
"echo \"Backup finished\"\n"
23948
"date\n"
23949
msgstr ""
23950
23951
#: serverguide/C/backups.xml:519(para)
23952
msgid ""
23953
"The default device name for a SCSI tape drive is "
23954
"<filename>/dev/st0</filename>. Use the appropriate device path for your "
23955
"system."
23956
msgstr ""
23957
23958
#: serverguide/C/backups.xml:524(para)
23959
msgid ""
23960
"Restoring from a tape drive is basically the same as restoring from a file. "
23961
"Simply rewind the tape and use the device path instead of a file path. For "
23962
"example to restore the <filename>/etc/hosts</filename> file to "
23963
"<filename>/tmp/etc/hosts</filename>:"
23964
msgstr ""
23965
23966
#: serverguide/C/backups.xml:529(command)
23967
msgid "mt -f /dev/st0 rewind"
23968
msgstr ""
23969
23970
#: serverguide/C/backups.xml:530(command)
23971
msgid "tar -xzf /dev/st0 -C /tmp etc/hosts"
23972
msgstr ""
23973
23974
#: serverguide/C/backups.xml:535(title)
23975
msgid "Bacula"
23976
msgstr ""
23977
23978
#: serverguide/C/backups.xml:536(para)
23979
msgid ""
23980
"<application>Bacula</application> is a backup program enabling you to "
23981
"backup, restore, and verify data across your network. There are Bacula "
23982
"clients for Linux, Windows, and Mac OSX. Making it a cross platform network "
23983
"wide solution."
23984
msgstr ""
23985
23986
#: serverguide/C/backups.xml:542(para)
23987
msgid ""
23988
"<application>Bacula</application> is made up of several components and "
23989
"services used to manage which files to backup and where to back them up to:"
23990
msgstr ""
23991
23992
#: serverguide/C/backups.xml:548(para)
23993
msgid ""
23994
"<application>Bacula Director:</application> a service that controls all "
23995
"backup, restore, verify, and archive operations."
23996
msgstr ""
23997
23998
#: serverguide/C/backups.xml:553(para)
23999
msgid ""
24000
"<application>Bacula Console:</application> an application allowing "
24001
"communication with the Director. There are three versions of the Console:"
24002
msgstr ""
24003
24004
#: serverguide/C/backups.xml:558(para)
24005
msgid "Text based command line version."
24006
msgstr ""
24007
24008
#: serverguide/C/backups.xml:559(para)
24009
msgid "Gnome based GTK+ Graphical User Interface (GUI) interface."
24010
msgstr ""
24011
24012
#: serverguide/C/backups.xml:560(para)
24013
msgid "wxWidgets GUI interface."
24014
msgstr ""
24015
24016
#: serverguide/C/backups.xml:564(para)
24017
msgid ""
24018
"<application>Bacula File:</application> also known as the "
24019
"<application>Bacula Client</application> program. This application is "
24020
"installed on machines to be backed up, and is responsible for the data "
24021
"requested by the Director."
24022
msgstr ""
24023
24024
#: serverguide/C/backups.xml:570(para)
24025
msgid ""
24026
"<application>Bacula Storage:</application> the programs that perform the "
24027
"storage and recovery of data to the physical media."
24028
msgstr ""
24029
24030
#: serverguide/C/backups.xml:575(para)
24031
msgid ""
24032
"<application>Bacula Catalog:</application> is responsible for maintaining "
24033
"the file indexes and volume databases for all files backed up, enabling "
24034
"quick location and restoration of archived files. The Catalog supports three "
24035
"different databases MySQL, PostgreSQL, and SQLite."
24036
msgstr ""
24037
24038
#: serverguide/C/backups.xml:581(para)
24039
msgid ""
24040
"<application>Bacula Monitor:</application> allows the monitoring of the "
24041
"Director, File daemons, and Storage daemons. Currently the Monitor is only "
24042
"available as a GTK+ GUI application."
24043
msgstr ""
24044
24045
#: serverguide/C/backups.xml:587(para)
24046
msgid ""
24047
"These services and applications can be run on multiple servers and clients, "
24048
"or they can be installed on one machine if backing up a single disk or "
24049
"volume."
24050
msgstr ""
24051
24052
#: serverguide/C/backups.xml:594(para)
24053
msgid ""
24054
"There are multiple packages containing the different "
24055
"<application>Bacula</application> components. To install Bacula, from a "
24056
"terminal prompt enter:"
24057
msgstr ""
24058
24059
#: serverguide/C/backups.xml:599(command)
24060
msgid "sudo apt-get install bacula"
24061
msgstr ""
24062
24063
#: serverguide/C/backups.xml:601(para)
24064
msgid ""
24065
"By default installing the <application>bacula</application> package will use "
24066
"a <application>MySQL</application> database for the Catalog. If you want to "
24067
"use SQLite or PostgreSQL, for the Catalog, install <application>bacula-"
24068
"director-sqlite3</application> or <application>bacula-director-"
24069
"pgsql</application> respectively."
24070
msgstr ""
24071
24072
#: serverguide/C/backups.xml:607(para)
24073
msgid ""
24074
"During the install process you will be asked to supply credentials for the "
24075
"database <emphasis>administrator</emphasis> and the "
24076
"<emphasis>bacula</emphasis> database <emphasis>owner</emphasis>. The "
24077
"database administrator will need to have the appropriate rights to create a "
24078
"database, see <xref linkend=\"mysql\"/> for more information."
24079
msgstr ""
24080
24081
#: serverguide/C/backups.xml:617(para)
24082
msgid ""
24083
"<application>Bacula</application> configuration files are formatted based on "
24084
"<emphasis>resources</emphasis> comprising of <emphasis>directives</emphasis> "
24085
"surrounded by <quote>{}</quote> braces. Each Bacula component has an "
24086
"individual file in the <filename role=\"directory\">/etc/bacula</filename> "
24087
"directory."
24088
msgstr ""
24089
24090
#: serverguide/C/backups.xml:622(para)
24091
msgid ""
24092
"The various <application>Bacula</application> components must authorize "
24093
"themselves to each other. This is accomplished using the "
24094
"<emphasis>password</emphasis> directive. For example, the "
24095
"<emphasis>Storage</emphasis> resource password in the "
24096
"<filename>/etc/bacula/bacula-dir.conf</filename> file must match the "
24097
"<emphasis>Director</emphasis> resource password in "
24098
"<filename>/etc/bacula/bacula-sd.conf</filename>."
24099
msgstr ""
24100
24101
#: serverguide/C/backups.xml:628(para)
24102
msgid ""
24103
"By default the backup job named <emphasis>Client1</emphasis> is configured "
24104
"to archive the <application>Bacula</application> Catalog. If you plan on "
24105
"using the server to backup more than one client you should change the name "
24106
"of this job to something more descriptive. To change the name edit "
24107
"<filename>/etc/bacula/bacula-dir.conf</filename>:"
24108
msgstr ""
24109
24110
#: serverguide/C/backups.xml:633(programlisting)
24111
#, no-wrap
24112
msgid ""
24113
"\n"
24114
"#\n"
24115
"# Define the main nightly save backup job\n"
24116
"# By default, this job will back up to disk in \n"
24117
"Job {\n"
24118
" Name = \"BackupServer\"\n"
24119
" JobDefs = \"DefaultJob\"\n"
24120
" Write Bootstrap = \"/var/lib/bacula/Client1.bsr\"\n"
24121
"}\n"
24122
msgstr ""
24123
24124
#: serverguide/C/backups.xml:644(para)
24125
msgid ""
24126
"The example above changes the job name to <emphasis>BackupServer</emphasis> "
24127
"matching the machine's host name. Replace <quote>BackupServer</quote> with "
24128
"your appropriate hostname, or other descriptive name."
24129
msgstr ""
24130
24131
#: serverguide/C/backups.xml:649(para)
24132
msgid ""
24133
"The <emphasis>Console</emphasis> can be used to query the "
24134
"<emphasis>Director</emphasis> about jobs, but to use the Console with a "
24135
"<emphasis>non-root</emphasis> user, the user needs to be in the "
24136
"<emphasis>bacula</emphasis> group. To add a user to the bacula group enter "
24137
"the following from a terminal:"
24138
msgstr ""
24139
24140
#: serverguide/C/backups.xml:655(command)
24141
msgid "sudo adduser $username bacula"
24142
msgstr ""
24143
24144
#: serverguide/C/backups.xml:658(para)
24145
msgid ""
24146
"Replace <emphasis>$username</emphasis> with the actual username. Also, if "
24147
"you are adding the current user to the group you should log out and back in "
24148
"for the new permissions to take effect."
24149
msgstr ""
24150
24151
#: serverguide/C/backups.xml:665(title)
24152
msgid "Localhost Backup"
24153
msgstr ""
24154
24155
#: serverguide/C/backups.xml:666(para)
24156
msgid ""
24157
"This section describes how to backup specified directories on a single host "
24158
"to a local tape drive."
24159
msgstr ""
24160
24161
#: serverguide/C/backups.xml:671(para)
24162
msgid ""
24163
"First, the <emphasis>Storage</emphasis> device needs to be configured. Edit "
24164
"<filename>/etc/bacula/bacula-sd.conf</filename> add:"
24165
msgstr ""
24166
24167
#: serverguide/C/backups.xml:674(programlisting)
24168
#, no-wrap
24169
msgid ""
24170
"\n"
24171
"Device {\n"
24172
" Name = \"Tape Drive\"\n"
24173
" Device Type = tape\n"
24174
" Media Type = DDS-4\n"
24175
" Archive Device = /dev/st0\n"
24176
" Hardware end of medium = No;\n"
24177
" AutomaticMount = yes; # when device opened, read it\n"
24178
" AlwaysOpen = Yes;\n"
24179
" RemovableMedia = yes;\n"
24180
" RandomAccess = no;\n"
24181
" Alert Command = \"sh -c 'tapeinfo -f %c | grep TapeAlert'\"\n"
24182
"}\n"
24183
msgstr ""
24184
24185
#: serverguide/C/backups.xml:688(para)
24186
msgid ""
24187
"The example is for a <emphasis>DDS-4</emphasis> tape drive. Adjust the Media "
24188
"Type and Archive Device to match your hardware."
24189
msgstr ""
24190
24191
#: serverguide/C/backups.xml:691(para)
24192
msgid "You could also uncomment one of the other examples in the file."
24193
msgstr ""
24194
24195
#: serverguide/C/backups.xml:696(para)
24196
msgid ""
24197
"After editing <filename>/etc/bacula/bacula-sd.conf</filename> the "
24198
"<application>Storage</application> daemon will need to be restarted:"
24199
msgstr ""
24200
24201
#: serverguide/C/backups.xml:701(command)
24202
msgid "sudo /etc/init.d/bacula-sd restart"
24203
msgstr ""
24204
24205
#: serverguide/C/backups.xml:705(para)
24206
msgid ""
24207
"Now add a <emphasis>Storage</emphasis> resource in "
24208
"<filename>/etc/bacula/bacula-dir.conf</filename> to use the new Device:"
24209
msgstr ""
24210
24211
#: serverguide/C/backups.xml:708(programlisting)
24212
#, no-wrap
24213
msgid ""
24214
"\n"
24215
"# Definition of \"Tape Drive\" storage device\n"
24216
"Storage {\n"
24217
" Name = TapeDrive\n"
24218
" # Do not use \"localhost\" here \n"
24219
" Address = backupserver # N.B. Use a fully qualified name "
24220
"here\n"
24221
" SDPort = 9103\n"
24222
" Password = \"Cv70F6pf1t6pBopT4vQOnigDrR0v3LT3Cgkiyj\"\n"
24223
" Device = \"Tape Drive\"\n"
24224
" Media Type = tape\n"
24225
"}\n"
24226
msgstr ""
24227
24228
#: serverguide/C/backups.xml:720(para)
24229
msgid ""
24230
"The <emphasis>Address</emphasis> directive needs to be the Fully Qualified "
24231
"Domain Name (FQDN) of the server. Change <emphasis>backupserver</emphasis> "
24232
"to the actual host name."
24233
msgstr ""
24234
24235
#: serverguide/C/backups.xml:724(para)
24236
msgid ""
24237
"Also, make sure the <emphasis>Password</emphasis> directive matches the "
24238
"password string in <filename>/etc/bacula/bacula-sd.conf</filename>."
24239
msgstr ""
24240
24241
#: serverguide/C/backups.xml:730(para)
24242
msgid ""
24243
"Create a new <emphasis>FileSet</emphasis>, which will determine what "
24244
"directories to backup, by adding:"
24245
msgstr ""
24246
24247
#: serverguide/C/backups.xml:733(programlisting)
24248
#, no-wrap
24249
msgid ""
24250
"\n"
24251
"# LocalhostBacup FileSet.\n"
24252
"FileSet {\n"
24253
" Name = \"LocalhostFiles\"\n"
24254
" Include {\n"
24255
" Options {\n"
24256
" signature = MD5\n"
24257
" compression=GZIP\n"
24258
" }\n"
24259
" File = /etc\n"
24260
" File = /home\n"
24261
" }\n"
24262
"}\n"
24263
msgstr ""
24264
24265
#: serverguide/C/backups.xml:747(para)
24266
msgid ""
24267
"This <emphasis>FileSet</emphasis> will backup the <filename "
24268
"role=\"directory\">/etc</filename> and <filename "
24269
"role=\"directory\">/home</filename> directories. The "
24270
"<emphasis>Options</emphasis> resource directives configure the FileSet to "
24271
"create a MD5 signature for each file backed up, and to compress the files "
24272
"using GZIP."
24273
msgstr ""
24274
24275
#: serverguide/C/backups.xml:754(para)
24276
msgid "Next, create a new <emphasis>Schedule</emphasis> for the backup job:"
24277
msgstr ""
24278
24279
#: serverguide/C/backups.xml:757(programlisting)
24280
#, no-wrap
24281
msgid ""
24282
"\n"
24283
"# LocalhostBackup Schedule -- Daily.\n"
24284
"Schedule {\n"
24285
" Name = \"LocalhostDaily\"\n"
24286
" Run = Full daily at 00:01\n"
24287
"}\n"
24288
msgstr ""
24289
24290
#: serverguide/C/backups.xml:764(para)
24291
msgid ""
24292
"The job will run every day at 00:01 or 12:01 am. There are many other "
24293
"scheduling options available."
24294
msgstr ""
24295
24296
#: serverguide/C/backups.xml:769(para)
24297
msgid "Finally create the <emphasis>Job</emphasis>:"
24298
msgstr ""
24299
24300
#: serverguide/C/backups.xml:772(programlisting)
24301
#, no-wrap
24302
msgid ""
24303
"\n"
24304
"# Localhost backup.\n"
24305
"Job {\n"
24306
" Name = \"LocalhostBackup\"\n"
24307
" JobDefs = \"DefaultJob\"\n"
24308
" Enabled = yes\n"
24309
" Level = Full\n"
24310
" FileSet = \"LocalhostFiles\"\n"
24311
" Schedule = \"LocalhostDaily\"\n"
24312
" Storage = TapeDrive\n"
24313
" Write Bootstrap = \"/var/lib/bacula/LocalhostBackup.bsr\"\n"
24314
"} \n"
24315
msgstr ""
24316
24317
#: serverguide/C/backups.xml:785(para)
24318
msgid ""
24319
"The job will do a <emphasis>Full</emphasis> backup every day to the tape "
24320
"drive."
24321
msgstr ""
24322
24323
#: serverguide/C/backups.xml:790(para)
24324
msgid ""
24325
"Each tape used will need to have a <emphasis>Label</emphasis>. If the "
24326
"current tape does not have a label <application>Bacula</application> will "
24327
"send an email letting you know. To label a tape using the "
24328
"<application>Console</application> enter the following from a terminal:"
24329
msgstr ""
24330
24331
#: serverguide/C/backups.xml:796(command)
24332
msgid "bconsole"
24333
msgstr ""
24334
24335
#: serverguide/C/backups.xml:800(para)
24336
msgid "At the Bacula Console prompt enter:"
24337
msgstr ""
24338
24339
#: serverguide/C/backups.xml:804(command)
24340
msgid "label"
24341
msgstr ""
24342
24343
#: serverguide/C/backups.xml:808(para)
24344
msgid ""
24345
"You will then be prompted for the <emphasis>Storage</emphasis> resource:"
24346
msgstr ""
24347
24348
#: serverguide/C/backups.xml:818(userinput)
24349
#, no-wrap
24350
msgid "2"
24351
msgstr ""
24352
24353
#: serverguide/C/backups.xml:812(computeroutput)
24354
#, no-wrap
24355
msgid ""
24356
"\n"
24357
"Automatically selected Catalog: MyCatalog\n"
24358
"Using Catalog \"MyCatalog\"\n"
24359
"The defined Storage resources are:\n"
24360
" 1: File\n"
24361
" 2: TapeDrive\n"
24362
"Select Storage resource (1-2):<placeholder-1/>\n"
24363
msgstr ""
24364
24365
#: serverguide/C/backups.xml:823(para)
24366
msgid "Enter the new <emphasis>Volume</emphasis> name:"
24367
msgstr ""
24368
24369
#: serverguide/C/backups.xml:828(userinput)
24370
#, no-wrap
24371
msgid "Sunday"
24372
msgstr ""
24373
24374
#: serverguide/C/backups.xml:827(computeroutput)
24375
#, no-wrap
24376
msgid ""
24377
"\n"
24378
"Enter new Volume name: <placeholder-1/>\n"
24379
"Defined Pools:\n"
24380
" 1: Default\n"
24381
" 2: Scratch"
24382
msgstr ""
24383
24384
#: serverguide/C/backups.xml:833(para)
24385
msgid "Replace <emphasis>Sunday</emphasis> with the desired label."
24386
msgstr ""
24387
24388
#: serverguide/C/backups.xml:838(para)
24389
msgid "Now, select the <emphasis>Pool</emphasis>:"
24390
msgstr ""
24391
24392
#: serverguide/C/backups.xml:843(userinput)
24393
#, no-wrap
24394
msgid "1"
24395
msgstr ""
24396
24397
#: serverguide/C/backups.xml:842(computeroutput)
24398
#, no-wrap
24399
msgid ""
24400
"\n"
24401
"Select the Pool (1-2): <placeholder-1/>\n"
24402
"Connecting to Storage daemon TapeDrive at backupserver:9103 ...\n"
24403
"Sending label command for Volume \"Sunday\" Slot 0 ...\n"
24404
msgstr ""
24405
24406
#: serverguide/C/backups.xml:850(para)
24407
msgid ""
24408
"Congratulations, you have now configured <emphasis>Bacula</emphasis> to "
24409
"backup the localhost to an attached tape drive."
24410
msgstr ""
24411
24412
#: serverguide/C/backups.xml:858(para)
24413
msgid ""
24414
"For more <emphasis>Bacula</emphasis> configuration options refer to the "
24415
"<ulink url=\"http://www.bacula.org/en/rel-manual/index.html\">Bacula User's "
24416
"Manual</ulink>"
24417
msgstr ""
24418
24419
#: serverguide/C/backups.xml:864(para)
24420
msgid ""
24421
"The <ulink url=\"http://www.bacula.org/\">Bacula Home Page</ulink> contains "
24422
"the latest Bacula news and developments."
24423
msgstr ""
24424
24425
#: serverguide/C/backups.xml:869(para)
24426
msgid ""
24427
"Also, see the <ulink url=\"https://help.ubuntu.com/community/Bacula\">Bacula "
24428
"Ubuntu Wiki</ulink> page."
24429
msgstr ""
24430
24431
#. Put one translator per line, in the form of NAME <EMAIL>, YEAR1, YEAR2
24432
#: serverguide/C/backups.xml:0(None)
24433
msgid "translator-credits"
24434
msgstr ""
24435
"Launchpad Contributions:\n"
24436
" Андон Сикавица https://launchpad.net/~andon-sikavica"
Loggerhead is a web-based interface for Breezy
Version: 2.0.1