« back to all changes in this revision
Viewing changes to serverguide/po/bg.po
- browse files at revision 94
- compare with another revision
- download diff
- download tarball
- view history from revision 94
- Committer: Bazaar Package Importer
- Author(s): Matthew East
- Date: 2010-09-19 11:35:42 UTC
- Revision ID: james.westby@ubuntu.com-20100919113542-mbxqe7yuo4ggnrw3
Tags: 10.10.3
* Amend font-family for browser startpage (LP: #195590)
* Add translations from Launchpad
* Add translations from Launchpad
- files added:
- internet/po/nn.po
- files removed:
- serverguide
- serverguide/C
- serverguide/po
- serverguide/sample
- files modified:
- about-ubuntu/po/ace.po
added
removed
serverguide/po/bg.po
1
# Bulgarian translation for ubuntu-docs
2
# Copyright (c) 2009 Rosetta Contributors and Canonical Ltd 2009
3
# This file is distributed under the same license as the ubuntu-docs package.
4
# FIRST AUTHOR <EMAIL@ADDRESS>, 2009.
5
#
6
msgid ""
7
msgstr ""
8
"Project-Id-Version: ubuntu-docs\n"
9
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
10
"POT-Creation-Date: 2010-03-29 08:26+0100\n"
11
"PO-Revision-Date: 2009-10-20 03:07+0000\n"
12
"Last-Translator: Krasimir Chonov <mk2616@abv.bg>\n"
13
"Language-Team: Bulgarian <bg@li.org>\n"
14
"MIME-Version: 1.0\n"
15
"Content-Type: text/plain; charset=UTF-8\n"
16
"Content-Transfer-Encoding: 8bit\n"
17
"X-Launchpad-Export-Date: 2010-04-17 14:51+0000\n"
18
"X-Generator: Launchpad (build Unknown)\n"
19
20
#: serverguide/C/serverguide-C.omf:6(creator) serverguide/C/serverguide-C.omf:7(maintainer)
21
msgid "ubuntu-doc@lists.ubuntu.com (Ubuntu Documentation Project)"
22
msgstr "ubuntu-doc@lists.ubuntu.com (Проектът за документация на Ubuntu)"
23
24
#: serverguide/C/serverguide-C.omf:8(title) serverguide/C/serverguide-C.omf:11(description) serverguide/C/serverguide.xml:14(title) serverguide/C/bookinfo.xml:13(title)
25
msgid "Ubuntu Server Guide"
26
msgstr "Ръководство за Ubuntu Server"
27
28
#: serverguide/C/serverguide-C.omf:9(date)
29
msgid "2007-09-30"
30
msgstr "2007-09-30"
31
32
#: serverguide/C/windows-networking.xml:13(title)
33
msgid "Windows Networking"
34
msgstr "Мрежа на Windows"
35
36
#: serverguide/C/windows-networking.xml:15(para)
37
msgid ""
38
"Computer networks are often comprised of diverse systems, and while "
39
"operating a network made up entirely of Ubuntu desktop and server computers "
40
"would certainly be fun, some network environments must consist of both "
41
"Ubuntu and <trademark class=\"registered\">Microsoft</trademark><trademark "
42
"class=\"registered\">Windows</trademark> systems working together in "
43
"harmony. This section of the <phrase>Ubuntu</phrase> Server Guide introduces "
44
"principles and tools used in configuring your Ubuntu Server for sharing "
45
"network resources with Windows computers."
46
msgstr ""
47
"Компютърните мрежи често са изложени на риск от други системи. Мрежа "
48
"изградена изцяло от компютри с Ubuntu със сигурност ще бъде защитена. Някои "
49
"мрежови среди изискват постоянна работа и с Ubuntu и с <trademark "
50
"class=\"registered\">Microsoft</trademark><trademark "
51
"class=\"registered\">Windows</trademark>, които трябва да работят заедно без "
52
"да създават проблеми. Този раздел на Сървърното ръководство на "
53
"<phrase>Ubuntu</phrase> представя принципите и инструментите, които се "
54
"използват за конфигуриране на вашия Ubuntu Server за споделяне на мрежови "
55
"ресурси с Windows компютри."
56
57
#: serverguide/C/windows-networking.xml:25(title) serverguide/C/virtualization.xml:402(title) serverguide/C/security.xml:354(title) serverguide/C/remote-administration.xml:22(title) serverguide/C/package-management.xml:20(title) serverguide/C/introduction.xml:13(title)
58
msgid "Introduction"
59
msgstr "Въведение"
60
61
#: serverguide/C/windows-networking.xml:27(para)
62
msgid ""
63
"Successfully networking your Ubuntu system with Windows clients involves "
64
"providing and integrating with services common to Windows environments. Such "
65
"services assist the sharing of data and information about the computers and "
66
"users involved in the network, and may be classified under three major "
67
"categories of functionality:"
68
msgstr ""
69
70
#: serverguide/C/windows-networking.xml:35(para)
71
msgid ""
72
"<emphasis role=\"bold\">File and Printer Sharing Services</emphasis>. Using "
73
"the Server Message Block (SMB) protocol to facilitate the sharing of files, "
74
"folders, volumes, and the sharing of printers throughout the network."
75
msgstr ""
76
77
#: serverguide/C/windows-networking.xml:41(para)
78
msgid ""
79
"<emphasis role=\"bold\">Directory Services</emphasis>. Sharing vital "
80
"information about the computers and users of the network with such "
81
"technologies as the Lightweight Directory Access Protocol (LDAP) and "
82
"Microsoft <trademark class=\"registered\">Active Directory</trademark>."
83
msgstr ""
84
85
#: serverguide/C/windows-networking.xml:48(para)
86
msgid ""
87
"<emphasis role=\"bold\">Authentication and Access</emphasis>. Establishing "
88
"the identity of a computer or user of the network and determining the "
89
"information the computer or user is authorized to access using such "
90
"principles and technologies as file permissions, group policies, and the "
91
"Kerberos authentication service."
92
msgstr ""
93
94
#: serverguide/C/windows-networking.xml:56(para)
95
msgid ""
96
"Fortunately, your Ubuntu system may provide all such facilities to Windows "
97
"clients and share network resources among them. One of the principal pieces "
98
"of software your Ubuntu system includes for Windows networking is the Samba "
99
"suite of SMB server applications and tools."
100
msgstr ""
101
102
#: serverguide/C/windows-networking.xml:62(para)
103
msgid ""
104
"This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some "
105
"of the common Samba use cases, and how to install and configure the "
106
"necessary packages. Additional detailed documentation and information on "
107
"Samba can be found on the <ulink url=\"http://www.samba.org\">Samba "
108
"website</ulink>."
109
msgstr ""
110
111
#: serverguide/C/windows-networking.xml:70(title)
112
msgid "Samba File Server"
113
msgstr "Файлов сървър Samba"
114
115
#: serverguide/C/windows-networking.xml:72(para)
116
msgid ""
117
"One of the most common ways to network Ubuntu and Windows computers is to "
118
"configure Samba as a File Server. This section covers setting up a "
119
"<application>Samba</application> server to share files with Windows clients."
120
msgstr ""
121
122
#: serverguide/C/windows-networking.xml:77(para)
123
msgid ""
124
"The server will be configured to share files with any client on the network "
125
"without prompting for a password. If your environment requires stricter "
126
"Access Controls see <xref linkend=\"samba-fileprint-security\"/>"
127
msgstr ""
128
129
#: serverguide/C/windows-networking.xml:83(title) serverguide/C/windows-networking.xml:287(title) serverguide/C/windows-networking.xml:1302(title) serverguide/C/web-servers.xml:41(title) serverguide/C/web-servers.xml:675(title) serverguide/C/web-servers.xml:816(title) serverguide/C/web-servers.xml:940(title) serverguide/C/vpn.xml:33(title) serverguide/C/virtualization.xml:62(title) serverguide/C/virtualization.xml:2014(title) serverguide/C/vcs.xml:28(title) serverguide/C/vcs.xml:86(title) serverguide/C/vcs.xml:405(title) serverguide/C/remote-administration.xml:52(title) serverguide/C/remote-administration.xml:233(title) serverguide/C/network-config.xml:937(title) serverguide/C/network-auth.xml:52(title) serverguide/C/network-auth.xml:1581(title) serverguide/C/network-auth.xml:2092(title) serverguide/C/network-auth.xml:2483(title) serverguide/C/monitoring.xml:42(title) serverguide/C/monitoring.xml:428(title) serverguide/C/mail.xml:40(title) serverguide/C/mail.xml:496(title) serverguide/C/mail.xml:674(title) serverguide/C/mail.xml:823(title) serverguide/C/mail.xml:1315(title) serverguide/C/lamp-applications.xml:108(title) serverguide/C/lamp-applications.xml:287(title) serverguide/C/lamp-applications.xml:423(title) serverguide/C/installation.xml:13(title) serverguide/C/installation.xml:957(title) serverguide/C/file-server.xml:347(title) serverguide/C/file-server.xml:462(title) serverguide/C/dns.xml:23(title) serverguide/C/databases.xml:40(title) serverguide/C/databases.xml:164(title) serverguide/C/chat.xml:37(title) serverguide/C/chat.xml:141(title) serverguide/C/backups.xml:593(title)
130
msgid "Installation"
131
msgstr "Инсталиране"
132
133
#: serverguide/C/windows-networking.xml:85(para)
134
msgid ""
135
"The first step is to install the <application>samba</application> package. "
136
"From a terminal prompt enter:"
137
msgstr ""
138
"Първата стъпка е да инсталирате пакета <application>samba</application> "
139
"package. В терминал напишете:"
140
141
#: serverguide/C/windows-networking.xml:90(command) serverguide/C/windows-networking.xml:299(command)
142
msgid "sudo apt-get install samba"
143
msgstr "sudo apt-get install samba"
144
145
#: serverguide/C/windows-networking.xml:93(para)
146
msgid ""
147
"That's all there is to it; you are now ready to configure Samba to share "
148
"files."
149
msgstr ""
150
"Това е всичко; сега сте готови да конфигурирате Samba за споделяне на "
151
"файлове."
152
153
#: serverguide/C/windows-networking.xml:99(title) serverguide/C/windows-networking.xml:304(title) serverguide/C/web-servers.xml:61(title) serverguide/C/web-servers.xml:726(title) serverguide/C/web-servers.xml:827(title) serverguide/C/web-servers.xml:967(title) serverguide/C/web-servers.xml:1067(title) serverguide/C/vpn.xml:138(title) serverguide/C/virtualization.xml:2088(title) serverguide/C/vcs.xml:39(title) serverguide/C/vcs.xml:423(title) serverguide/C/remote-administration.xml:74(title) serverguide/C/remote-administration.xml:258(title) serverguide/C/package-management.xml:387(title) serverguide/C/network-config.xml:959(title) serverguide/C/network-auth.xml:2131(title) serverguide/C/network-auth.xml:2504(title) serverguide/C/monitoring.xml:187(title) serverguide/C/monitoring.xml:454(title) serverguide/C/mail.xml:505(title) serverguide/C/mail.xml:684(title) serverguide/C/mail.xml:908(title) serverguide/C/mail.xml:1344(title) serverguide/C/lamp-applications.xml:128(title) serverguide/C/lamp-applications.xml:314(title) serverguide/C/lamp-applications.xml:453(title) serverguide/C/file-server.xml:360(title) serverguide/C/file-server.xml:488(title) serverguide/C/dns.xml:39(title) serverguide/C/databases.xml:84(title) serverguide/C/databases.xml:183(title) serverguide/C/clustering.xml:47(title) serverguide/C/chat.xml:57(title) serverguide/C/chat.xml:153(title) serverguide/C/backups.xml:616(title)
154
msgid "Configuration"
155
msgstr "Настройка"
156
157
#: serverguide/C/windows-networking.xml:101(para)
158
msgid ""
159
"The main Samba configuration file is located in "
160
"<filename>/etc/samba/smb.conf</filename>. The default configuration file has "
161
"a significant amount of comments in order to document various configuration "
162
"directives."
163
msgstr ""
164
165
#: serverguide/C/windows-networking.xml:106(para)
166
msgid ""
167
"Not all the available options are included in the default configuration "
168
"file. See the <filename>smb.conf</filename><application>man</application> "
169
"page or the <ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
170
"Collection/\">Samba HOWTO Collection</ulink> for more details."
171
msgstr ""
172
173
#: serverguide/C/windows-networking.xml:116(para)
174
msgid ""
175
"First, edit the following key/value pairs in the "
176
"<emphasis>[global]</emphasis> section of "
177
"<filename>/etc/samba/smb.conf</filename>:"
178
msgstr ""
179
180
#: serverguide/C/windows-networking.xml:121(programlisting) serverguide/C/windows-networking.xml:311(programlisting) serverguide/C/windows-networking.xml:776(programlisting) serverguide/C/windows-networking.xml:990(programlisting)
181
#, no-wrap
182
msgid ""
183
"\n"
184
" workgroup = EXAMPLE\n"
185
" ...\n"
186
" security = user\n"
187
msgstr ""
188
189
#: serverguide/C/windows-networking.xml:127(para)
190
msgid ""
191
"The <emphasis>security</emphasis> parameter is farther down in the [global] "
192
"section, and is commented by default. Also, change "
193
"<emphasis>EXAMPLE</emphasis> to better match your environment."
194
msgstr ""
195
196
#: serverguide/C/windows-networking.xml:135(para)
197
msgid ""
198
"Create a new section at the bottom of the file, or uncomment one of the "
199
"examples, for the directory to be shared:"
200
msgstr ""
201
202
#: serverguide/C/windows-networking.xml:139(programlisting)
203
#, no-wrap
204
msgid ""
205
"\n"
206
"[share]\n"
207
" comment = Ubuntu File Server Share\n"
208
" path = /srv/samba/share\n"
209
" browsable = yes\n"
210
" guest ok = yes\n"
211
" read only = no\n"
212
" create mask = 0755\n"
213
msgstr ""
214
215
#: serverguide/C/windows-networking.xml:151(para)
216
msgid ""
217
"<emphasis>comment:</emphasis> a short description of the share. Adjust to "
218
"fit your needs."
219
msgstr ""
220
221
#: serverguide/C/windows-networking.xml:156(para)
222
msgid "<emphasis>path:</emphasis> the path to the directory to share."
223
msgstr ""
224
225
#: serverguide/C/windows-networking.xml:159(para)
226
msgid ""
227
"This example uses <filename>/srv/samba/sharename</filename> because, "
228
"according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, "
229
"<ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
230
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is where site-"
231
"specific data should be served. Technically Samba shares can be placed "
232
"anywhere on the filesystem as long as the permissions are correct, but "
233
"adhering to standards is recommended."
234
msgstr ""
235
236
#: serverguide/C/windows-networking.xml:168(para)
237
msgid ""
238
"<emphasis>browsable:</emphasis> enables Windows clients to browse the shared "
239
"directory using <application>Windows Explorer</application>."
240
msgstr ""
241
242
#: serverguide/C/windows-networking.xml:174(para)
243
msgid ""
244
"<emphasis>guest ok:</emphasis> allows clients to connect to the share "
245
"without supplying a password."
246
msgstr ""
247
248
#: serverguide/C/windows-networking.xml:179(para)
249
msgid ""
250
"<emphasis>read only:</emphasis> determines if the share is read only or if "
251
"write privileges are granted. Write privileges are allowed only when the "
252
"value is <emphasis>no</emphasis>, as is seen in this example. If the value "
253
"is <emphasis>yes</emphasis>, then access to the share is read only."
254
msgstr ""
255
256
#: serverguide/C/windows-networking.xml:184(para)
257
msgid ""
258
"<emphasis>create mask:</emphasis> determines the permissions new files will "
259
"have when created."
260
msgstr ""
261
262
#: serverguide/C/windows-networking.xml:193(para)
263
msgid ""
264
"Now that <application>Samba</application> is configured, the directory needs "
265
"to be created and the permissions changed. From a terminal enter:"
266
msgstr ""
267
268
#: serverguide/C/windows-networking.xml:199(command)
269
msgid "sudo mkdir -p /srv/samba/share"
270
msgstr ""
271
272
#: serverguide/C/windows-networking.xml:200(command)
273
msgid "sudo chown nobody.nogroup /srv/samba/share/"
274
msgstr ""
275
276
#: serverguide/C/windows-networking.xml:204(para)
277
msgid ""
278
"The <emphasis>-p</emphasis> switch tells mkdir to create the entire "
279
"directory tree if it doesn't exist. Change the share name to fit your "
280
"environment."
281
msgstr ""
282
283
#: serverguide/C/windows-networking.xml:213(para)
284
msgid ""
285
"Finally, restart the <application>samba</application> services to enable the "
286
"new configuration:"
287
msgstr ""
288
289
#: serverguide/C/windows-networking.xml:218(command) serverguide/C/windows-networking.xml:331(command) serverguide/C/windows-networking.xml:468(command) serverguide/C/windows-networking.xml:567(command) serverguide/C/windows-networking.xml:937(command) serverguide/C/windows-networking.xml:1047(command) serverguide/C/windows-networking.xml:1162(command) serverguide/C/network-auth.xml:1860(command)
290
msgid "sudo /etc/init.d/samba restart"
291
msgstr ""
292
293
#: serverguide/C/windows-networking.xml:225(para)
294
msgid ""
295
"Once again, the above configuration gives all access to any client on the "
296
"local network. For a more secure configuration see <xref linkend=\"samba-"
297
"fileprint-security\"/>."
298
msgstr ""
299
300
#: serverguide/C/windows-networking.xml:231(para)
301
msgid ""
302
"From a Windows client you should now be able to browse to the Ubuntu file "
303
"server and see the shared directory. To check that everything is working try "
304
"creating a directory from Windows."
305
msgstr ""
306
307
#: serverguide/C/windows-networking.xml:236(para)
308
msgid ""
309
"To create additional shares simply create new <emphasis>[dir]</emphasis> "
310
"sections in <filename>/etc/samba/smb.conf</filename>, and restart "
311
"<emphasis>Samba</emphasis>. Just make sure that the directory you want to "
312
"share actually exists and the permissions are correct."
313
msgstr ""
314
315
#: serverguide/C/windows-networking.xml:243(title) serverguide/C/windows-networking.xml:341(title) serverguide/C/windows-networking.xml:696(title) serverguide/C/windows-networking.xml:1066(title) serverguide/C/windows-networking.xml:1273(title) serverguide/C/virtualization.xml:366(title) serverguide/C/virtualization.xml:1168(title) serverguide/C/reporting-bugs.xml:304(title) serverguide/C/remote-administration.xml:491(title) serverguide/C/network-config.xml:569(title) serverguide/C/network-config.xml:824(title) serverguide/C/network-auth.xml:1531(title) serverguide/C/network-auth.xml:1975(title) serverguide/C/network-auth.xml:2579(title) serverguide/C/network-auth.xml:3087(title) serverguide/C/installation.xml:892(title) serverguide/C/installation.xml:1173(title) serverguide/C/databases.xml:122(title) serverguide/C/databases.xml:273(title) serverguide/C/backups.xml:855(title)
316
msgid "Resources"
317
msgstr ""
318
319
#: serverguide/C/windows-networking.xml:247(para) serverguide/C/windows-networking.xml:345(para) serverguide/C/windows-networking.xml:700(para) serverguide/C/windows-networking.xml:1070(para)
320
msgid ""
321
"For in depth Samba configurations see the <ulink "
322
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
323
"Collection</ulink>"
324
msgstr ""
325
326
#: serverguide/C/windows-networking.xml:253(para) serverguide/C/windows-networking.xml:351(para) serverguide/C/windows-networking.xml:706(para) serverguide/C/windows-networking.xml:1076(para)
327
msgid ""
328
"The guide is also available in <ulink "
329
"url=\"http://www.amazon.com/exec/obidos/tg/detail/-/0131882228\">printed "
330
"format</ulink>."
331
msgstr ""
332
333
#: serverguide/C/windows-networking.xml:259(para) serverguide/C/windows-networking.xml:357(para)
334
msgid ""
335
"O'Reilly's <ulink "
336
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
337
"another good reference."
338
msgstr ""
339
340
#: serverguide/C/windows-networking.xml:265(para) serverguide/C/windows-networking.xml:368(para) serverguide/C/windows-networking.xml:731(para) serverguide/C/windows-networking.xml:1100(para) serverguide/C/windows-networking.xml:1286(para)
341
msgid ""
342
"The <ulink url=\"https://help.ubuntu.com/community/Samba\">Ubuntu Wiki Samba "
343
"</ulink> page."
344
msgstr ""
345
346
#: serverguide/C/windows-networking.xml:274(title)
347
msgid "Samba Print Server"
348
msgstr ""
349
350
#: serverguide/C/windows-networking.xml:276(para)
351
msgid ""
352
"Another common use of Samba is to configure it to share printers installed, "
353
"either locally or over the network, on an Ubuntu server. Similar to <xref "
354
"linkend=\"samba-fileserver\"/> this section will configure Samba to allow "
355
"any client on the local network to use the installed printers without "
356
"prompting for a username and password."
357
msgstr ""
358
359
#: serverguide/C/windows-networking.xml:282(para)
360
msgid ""
361
"For a more secure configuration see <xref linkend=\"samba-fileprint-"
362
"security\"/>."
363
msgstr ""
364
365
#: serverguide/C/windows-networking.xml:289(para)
366
msgid ""
367
"Before installing and configuring Samba it is best to already have a working "
368
"<application>CUPS</application> installation. See <xref linkend=\"cups\"/> "
369
"for details."
370
msgstr ""
371
372
#: serverguide/C/windows-networking.xml:294(para)
373
msgid ""
374
"To install the <application>samba</application> package, from a terminal "
375
"enter:"
376
msgstr ""
377
378
#: serverguide/C/windows-networking.xml:305(para)
379
msgid ""
380
"After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change "
381
"the <emphasis>workgroup</emphasis> attribute to what is appropriate for your "
382
"network, and change <emphasis>security</emphasis> to <emphasis "
383
"role=\"italic\">share</emphasis>:"
384
msgstr ""
385
386
#: serverguide/C/windows-networking.xml:317(para)
387
msgid ""
388
"In the <emphasis>[printers]</emphasis> section change the <emphasis>guest "
389
"ok</emphasis> option to <emphasis role=\"italic\">yes</emphasis>:"
390
msgstr ""
391
392
#: serverguide/C/windows-networking.xml:321(programlisting)
393
#, no-wrap
394
msgid ""
395
"\n"
396
" browsable = yes\n"
397
" guest ok = yes\n"
398
msgstr ""
399
400
#: serverguide/C/windows-networking.xml:326(para)
401
msgid "After editing <filename>smb.conf</filename> restart Samba:"
402
msgstr ""
403
404
#: serverguide/C/windows-networking.xml:334(para)
405
msgid ""
406
"The default Samba configuration will automatically share any printers "
407
"installed. Simply install the printer locally on your Windows clients."
408
msgstr ""
409
410
#: serverguide/C/windows-networking.xml:363(para)
411
msgid ""
412
"Also, see the <ulink url=\"http://www.cups.org/\">CUPS Website</ulink> for "
413
"more information on configuring CUPS."
414
msgstr ""
415
416
#: serverguide/C/windows-networking.xml:377(title)
417
msgid "Securing a Samba File and Print Server"
418
msgstr ""
419
420
#: serverguide/C/windows-networking.xml:380(title)
421
msgid "Samba Security Modes"
422
msgstr ""
423
424
#: serverguide/C/windows-networking.xml:382(para)
425
msgid ""
426
"There are two security levels available to the Common Internet Filesystem "
427
"(CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-"
428
"level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation "
429
"allows more flexibility, providing four ways of implementing user-level "
430
"security and one way to implement share-level:"
431
msgstr ""
432
433
#: serverguide/C/windows-networking.xml:391(para)
434
msgid ""
435
"<emphasis>security = user:</emphasis> requires clients to supply a username "
436
"and password to connect to shares. Samba user accounts are separate from "
437
"system accounts, but the <application>libpam-smbpass</application> package "
438
"will sync system users and passwords with the Samba user database."
439
msgstr ""
440
441
#: serverguide/C/windows-networking.xml:398(para)
442
msgid ""
443
"<emphasis>security = domain:</emphasis> this mode allows the Samba server to "
444
"appear to Windows clients as a Primary Domain Controller (PDC), Backup "
445
"Domain Controller (BDC), or a Domain Member Server (DMS). See <xref "
446
"linkend=\"samba-dc\"/> for further information."
447
msgstr ""
448
449
#: serverguide/C/windows-networking.xml:405(para)
450
msgid ""
451
"<emphasis>security = ADS:</emphasis> allows the Samba server to join an "
452
"Active Directory domain as a native member. See <xref linkend=\"samba-ad-"
453
"integration\"/> for details."
454
msgstr ""
455
456
#: serverguide/C/windows-networking.xml:411(para)
457
msgid ""
458
"<emphasis>security = server:</emphasis> this mode is left over from before "
459
"Samba could become a member server, and due to some security issues should "
460
"not be used. See the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
461
"HOWTO-Collection/ServerType.html#id349531\">Server Security</ulink> section "
462
"of the Samba guide for more details."
463
msgstr ""
464
465
#: serverguide/C/windows-networking.xml:419(para)
466
msgid ""
467
"<emphasis>security = share:</emphasis> allows clients to connect to shares "
468
"without supplying a username and password."
469
msgstr ""
470
471
#: serverguide/C/windows-networking.xml:426(para)
472
msgid ""
473
"The security mode you choose will depend on your environment and what you "
474
"need the Samba server to accomplish."
475
msgstr ""
476
477
#: serverguide/C/windows-networking.xml:432(title)
478
msgid "Security = User"
479
msgstr ""
480
481
#: serverguide/C/windows-networking.xml:434(para)
482
msgid ""
483
"This section will reconfigure the Samba file and print server, from <xref "
484
"linkend=\"samba-fileserver\"/> and <xref linkend=\"samba-printserver\"/>, to "
485
"require authentication."
486
msgstr ""
487
488
#: serverguide/C/windows-networking.xml:439(para)
489
msgid ""
490
"First, install the <application>libpam-smbpass</application> package which "
491
"will sync the system users to the Samba user database:"
492
msgstr ""
493
494
#: serverguide/C/windows-networking.xml:445(command)
495
msgid "sudo apt-get install libpam-smbpass"
496
msgstr ""
497
498
#: serverguide/C/windows-networking.xml:449(para)
499
msgid ""
500
"If you chose the <emphasis>Samba Server</emphasis> task during installation "
501
"<application>libpam-smbpass</application> is already installed."
502
msgstr ""
503
504
#: serverguide/C/windows-networking.xml:455(para)
505
msgid ""
506
"Edit <filename>/etc/samba/smb.conf</filename>, and in the "
507
"<emphasis>[share]</emphasis> section change:"
508
msgstr ""
509
510
#: serverguide/C/windows-networking.xml:459(programlisting)
511
#, no-wrap
512
msgid ""
513
"\n"
514
" guest ok = no\n"
515
msgstr ""
516
517
#: serverguide/C/windows-networking.xml:463(para)
518
msgid "Finally, restart Samba for the new settings to take effect:"
519
msgstr ""
520
521
#: serverguide/C/windows-networking.xml:471(para)
522
msgid ""
523
"Now when connecting to the shared directories or printers you should be "
524
"prompted for a username and password."
525
msgstr ""
526
527
#: serverguide/C/windows-networking.xml:476(para)
528
msgid ""
529
"If you choose to map a network drive to the share you can check the "
530
"<quote>Reconnect at Logon</quote> check box, which will require you to only "
531
"enter the username and password once, at least until the password changes."
532
msgstr ""
533
534
#: serverguide/C/windows-networking.xml:484(title)
535
msgid "Share Security"
536
msgstr ""
537
538
#: serverguide/C/windows-networking.xml:486(para)
539
msgid ""
540
"There are several options available to increase the security for each "
541
"individual shared directory. Using the <emphasis>[share]</emphasis> example, "
542
"this section will cover some common options."
543
msgstr ""
544
545
#: serverguide/C/windows-networking.xml:492(title)
546
msgid "Groups"
547
msgstr ""
548
549
#: serverguide/C/windows-networking.xml:494(para)
550
msgid ""
551
"Groups define a collection of computers or users which have a common level "
552
"of access to particular network resources and offer a level of granularity "
553
"in controlling access to such resources. For example, if a group <emphasis "
554
"role=\"italic\">qa</emphasis> is defined and contains the users <emphasis "
555
"role=\"italic\">freda</emphasis>, <emphasis "
556
"role=\"italic\">danika</emphasis>, and <emphasis "
557
"role=\"italic\">rob</emphasis> and a second group <emphasis "
558
"role=\"italic\">support</emphasis> is defined and consists of users "
559
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
560
"role=\"italic\">jeremy</emphasis>, and <emphasis "
561
"role=\"italic\">vincent</emphasis> then certain network resources configured "
562
"to allow access by the <emphasis role=\"italic\">qa</emphasis> group will "
563
"subsequently enable access by freda, danika, and rob, but not jeremy or "
564
"vincent. Since the user <emphasis role=\"italic\">danika</emphasis> belongs "
565
"to both the <emphasis role=\"italic\">qa</emphasis> and <emphasis "
566
"role=\"italic\">support</emphasis> groups, she will be able to access "
567
"resources configured for access by both groups, whereas all other users will "
568
"have only access to resources explicitly allowing the group they are part of."
569
msgstr ""
570
571
#: serverguide/C/windows-networking.xml:508(para)
572
msgid ""
573
"By default Samba looks for the local system groups defined in "
574
"<filename>/etc/group</filename> to determine which users belong to which "
575
"groups. For more information on adding and removing users from groups see "
576
"<xref linkend=\"adding-deleting-users\"/>."
577
msgstr ""
578
579
#: serverguide/C/windows-networking.xml:514(para)
580
msgid ""
581
"When defining groups in the Samba configuration file, "
582
"<filename>/etc/samba/smb.conf</filename>, the recognized syntax is to "
583
"preface the group name with an \"@\" symbol. For example, if you wished to "
584
"define a group named <emphasis role=\"italic\">sysadmin</emphasis> in a "
585
"certain section of the <filename>/etc/samba/smb.conf</filename>, you would "
586
"do so by entering the group name as <emphasis "
587
"role=\"bold\">@sysadmin</emphasis>."
588
msgstr ""
589
590
#: serverguide/C/windows-networking.xml:523(title)
591
msgid "File Permissions"
592
msgstr ""
593
594
#: serverguide/C/windows-networking.xml:525(para)
595
msgid ""
596
"File Permissions define the explicit rights a computer or user has to a "
597
"particular directory, file, or set of files. Such permissions may be defined "
598
"by editing the <filename>/etc/samba/smb.conf</filename> file and specifying "
599
"the explicit permissions of a defined file share."
600
msgstr ""
601
602
#: serverguide/C/windows-networking.xml:531(para)
603
msgid ""
604
"For example, if you have defined a Samba share called "
605
"<emphasis>share</emphasis> and wish to give <emphasis role=\"italic\">read-"
606
"only</emphasis> permissions to the group of users known as <emphasis "
607
"role=\"italic\">qa</emphasis>, but wanted to allow writing to the share by "
608
"the group called <emphasis role=\"italic\">sysadmin</emphasis> and the user "
609
"named <emphasis role=\"italic\">vincent</emphasis>, then you could edit the "
610
"<filename>/etc/samba/smb.conf</filename> file, and add the following entries "
611
"under the <emphasis>[share]</emphasis> entry:"
612
msgstr ""
613
614
#: serverguide/C/windows-networking.xml:540(programlisting)
615
#, no-wrap
616
msgid ""
617
"\n"
618
" read list = @qa\n"
619
" write list = @sysadmin, vincent\n"
620
msgstr ""
621
622
#: serverguide/C/windows-networking.xml:545(para)
623
msgid ""
624
"Another possible Samba permission is to declare "
625
"<emphasis>administrative</emphasis> permissions to a particular shared "
626
"resource. Users having administrative permissions may read, write, or modify "
627
"any information contained in the resource the user has been given explicit "
628
"administrative permissions to."
629
msgstr ""
630
631
#: serverguide/C/windows-networking.xml:551(para)
632
msgid ""
633
"For example, if you wanted to give the user <emphasis "
634
"role=\"italic\">melissa</emphasis> administrative permissions to the "
635
"<emphasis role=\"italic\">share</emphasis> example, you would edit the "
636
"<filename>/etc/samba/smb.conf</filename> file, and add the following line "
637
"under the <emphasis>[share]</emphasis> entry:"
638
msgstr ""
639
640
#: serverguide/C/windows-networking.xml:558(programlisting)
641
#, no-wrap
642
msgid ""
643
"\n"
644
" admin users = melissa\n"
645
msgstr ""
646
647
#: serverguide/C/windows-networking.xml:562(para)
648
msgid ""
649
"After editing <filename>/etc/samba/smb.conf</filename>, restart Samba for "
650
"the changes to take effect:"
651
msgstr ""
652
653
#: serverguide/C/windows-networking.xml:571(para)
654
msgid ""
655
"For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> "
656
"to work the Samba security mode must <emphasis>not</emphasis> be set to "
657
"<emphasis role=\"italic\">security = share</emphasis>"
658
msgstr ""
659
660
#: serverguide/C/windows-networking.xml:577(para)
661
msgid ""
662
"Now that Samba has been configured to limit which groups have access to the "
663
"shared directory, the filesystem permissions need to be updated."
664
msgstr ""
665
666
#: serverguide/C/windows-networking.xml:582(para)
667
msgid ""
668
"Traditional Linux file permissions do not map well to Windows NT Access "
669
"Control Lists (ACLs). Fortunately POSIX ACLs are available on Ubuntu servers "
670
"providing more fine grained control. For example, to enable ACLs on "
671
"<filename>/srv</filename> an EXT3 filesystem, edit "
672
"<filename>/etc/fstab</filename> adding the <emphasis>acl</emphasis> option:"
673
msgstr ""
674
675
#: serverguide/C/windows-networking.xml:589(programlisting)
676
#, no-wrap
677
msgid ""
678
"\n"
679
"UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl "
680
"0 1\n"
681
msgstr ""
682
683
#: serverguide/C/windows-networking.xml:593(para)
684
msgid "Then remount the partition:"
685
msgstr ""
686
687
#: serverguide/C/windows-networking.xml:598(command)
688
msgid "sudo mount -v -o remount /srv"
689
msgstr ""
690
691
#: serverguide/C/windows-networking.xml:602(para)
692
msgid ""
693
"The above example assumes <filename>/srv</filename> on a separate partition. "
694
"If <filename>/srv</filename>, or wherever you have configured your share "
695
"path, is part of the <filename>/</filename> partition a reboot may be "
696
"required."
697
msgstr ""
698
699
#: serverguide/C/windows-networking.xml:609(para)
700
msgid ""
701
"To match the Samba configuration above the <emphasis>sysadmin</emphasis> "
702
"group will be given read, write, and execute permissions to "
703
"<filename>/srv/samba/share</filename>, the <emphasis>qa</emphasis> group "
704
"will be given read and execute permissions, and the files will be owned by "
705
"the username <emphasis>melissa</emphasis>. Enter the following in a terminal:"
706
msgstr ""
707
708
#: serverguide/C/windows-networking.xml:617(command)
709
msgid "sudo chown -R melissa /srv/samba/share/"
710
msgstr ""
711
712
#: serverguide/C/windows-networking.xml:618(command)
713
msgid "sudo chgrp -R sysadmin /srv/samba/share/"
714
msgstr ""
715
716
#: serverguide/C/windows-networking.xml:619(command)
717
msgid "sudo setfacl -R -m g:qa:rx /srv/samba/share/"
718
msgstr ""
719
720
#: serverguide/C/windows-networking.xml:623(para)
721
msgid ""
722
"The <application>setfacl</application> command above gives "
723
"<emphasis>execute</emphasis> permissions to all files in the "
724
"<filename>/srv/samba/share</filename> directory, which you may or may not "
725
"want."
726
msgstr ""
727
728
#: serverguide/C/windows-networking.xml:629(para)
729
msgid ""
730
"Now from a Windows client you should notice the new file permissions are "
731
"implemented. See the <application>acl</application> and "
732
"<application>setfacl</application> man pages for more information on POSIX "
733
"ACLs."
734
msgstr ""
735
736
#: serverguide/C/windows-networking.xml:637(title)
737
msgid "Samba AppArmor Profile"
738
msgstr ""
739
740
#: serverguide/C/windows-networking.xml:639(para)
741
msgid ""
742
"Ubuntu comes with the <application>AppArmor</application> security module, "
743
"which provides mandatory access controls. The default AppArmor profile for "
744
"Samba will need to be adapted to your configuration. For more details on "
745
"using AppArmor see <xref linkend=\"apparmor\"/>."
746
msgstr ""
747
748
#: serverguide/C/windows-networking.xml:645(para)
749
msgid ""
750
"There are default AppArmor profiles for <filename>/usr/sbin/smbd</filename> "
751
"and <filename>/usr/sbin/nmbd</filename>, the Samba daemon binaries, as part "
752
"of the <application>apparmor-profiles</application> packages. To install the "
753
"package, from a terminal prompt enter:"
754
msgstr ""
755
756
#: serverguide/C/windows-networking.xml:652(command) serverguide/C/security.xml:925(command)
757
msgid "sudo apt-get install apparmor-profiles"
758
msgstr ""
759
760
#: serverguide/C/windows-networking.xml:656(para)
761
msgid "This package contains profiles for several other binaries."
762
msgstr ""
763
764
#: serverguide/C/windows-networking.xml:661(para)
765
msgid ""
766
"By default the profiles for <application>smbd</application> and "
767
"<application>nmbd</application> are in <emphasis>complain</emphasis> mode "
768
"allowing Samba to work without modifying the profile, and only logging "
769
"errors. To place the <application>smbd</application> profile into "
770
"<emphasis>enforce</emphasis> mode, and have Samba work as expected, the "
771
"profile will need to be modified to reflect any directories that are shared."
772
msgstr ""
773
774
#: serverguide/C/windows-networking.xml:668(para)
775
msgid ""
776
"Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information "
777
"for <emphasis>[share]</emphasis> from the file server example:"
778
msgstr ""
779
780
#: serverguide/C/windows-networking.xml:673(programlisting)
781
#, no-wrap
782
msgid ""
783
"\n"
784
" /srv/samba/share/ r,\n"
785
" /srv/samba/share/** rwkix,\n"
786
msgstr ""
787
788
#: serverguide/C/windows-networking.xml:678(para)
789
msgid ""
790
"Now place the profile into <emphasis>enforce</emphasis> and reload it:"
791
msgstr ""
792
793
#: serverguide/C/windows-networking.xml:683(command)
794
msgid "sudo aa-enforce /usr/sbin/smbd"
795
msgstr ""
796
797
#: serverguide/C/windows-networking.xml:684(command)
798
msgid "cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r"
799
msgstr ""
800
801
#: serverguide/C/windows-networking.xml:687(para)
802
msgid ""
803
"You should now be able to read, write, and execute files in the shared "
804
"directory as normal, and the <application>smbd</application> binary will "
805
"have access to only the configured files and directories. Be sure to add "
806
"entries for each directory you configure Samba to share. Also, any errors "
807
"will be logged to <filename>/var/log/syslog</filename>."
808
msgstr ""
809
810
#: serverguide/C/windows-networking.xml:712(para) serverguide/C/windows-networking.xml:1082(para)
811
msgid ""
812
"O'Reilly's <ulink "
813
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
814
"also a good reference."
815
msgstr ""
816
817
#: serverguide/C/windows-networking.xml:718(para)
818
msgid ""
819
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-"
820
"samba.html\">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to "
821
"security."
822
msgstr ""
823
824
#: serverguide/C/windows-networking.xml:724(para)
825
msgid ""
826
"For more information on Samba and ACLs see the <ulink "
827
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
828
"Collection/AccessControls.html#id397568\">Samba ACLs page </ulink>."
829
msgstr ""
830
831
#: serverguide/C/windows-networking.xml:740(title)
832
msgid "Samba as a Domain Controller"
833
msgstr ""
834
835
#: serverguide/C/windows-networking.xml:742(para)
836
msgid ""
837
"Although it cannot act as an Active Directory Primary Domain Controller "
838
"(PDC), a Samba server can be configured to appear as a Windows NT4-style "
839
"domain controller. A major advantage of this configuration is the ability to "
840
"centralize user and machine credentials. Samba can also use multiple "
841
"backends to store the user information."
842
msgstr ""
843
844
#: serverguide/C/windows-networking.xml:749(title)
845
msgid "Primary Domain Controller"
846
msgstr ""
847
848
#: serverguide/C/windows-networking.xml:751(para)
849
msgid ""
850
"This section covers configuring Samba as a Primary Domain Controller (PDC) "
851
"using the default smbpasswd backend."
852
msgstr ""
853
854
#: serverguide/C/windows-networking.xml:758(para)
855
msgid ""
856
"First, install Samba, and <application>libpam-smbpass</application> to sync "
857
"the user accounts, by entering the following in a terminal prompt:"
858
msgstr ""
859
860
#: serverguide/C/windows-networking.xml:764(command) serverguide/C/windows-networking.xml:980(command)
861
msgid "sudo apt-get install samba libpam-smbpass"
862
msgstr ""
863
864
#: serverguide/C/windows-networking.xml:770(para)
865
msgid ""
866
"Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. "
867
"The <emphasis>security</emphasis> mode should be set to <emphasis "
868
"role=\"italic\">user</emphasis>, and the <emphasis>workgroup</emphasis> "
869
"should relate to your organization:"
870
msgstr ""
871
872
#: serverguide/C/windows-networking.xml:785(para)
873
msgid ""
874
"In the commented <quote>Domains</quote> section add or uncomment the "
875
"following:"
876
msgstr ""
877
878
#: serverguide/C/windows-networking.xml:789(programlisting)
879
#, no-wrap
880
msgid ""
881
"\n"
882
" domain logons = yes\n"
883
" logon path = \\\\%N\\%U\\profile\n"
884
" logon drive = H:\n"
885
" logon home = \\\\%N\\%U\n"
886
" logon script = logon.cmd\n"
887
" add machine script = sudo /usr/sbin/useradd -N -g machines -c Machine -d "
888
"/var/lib/samba -s /bin/false %u\n"
889
msgstr ""
890
891
#: serverguide/C/windows-networking.xml:800(para)
892
msgid ""
893
"<emphasis>domain logons:</emphasis> provides the netlogon service causing "
894
"Samba to act as a domain controller."
895
msgstr ""
896
897
#: serverguide/C/windows-networking.xml:805(para)
898
msgid ""
899
"<emphasis>logon path:</emphasis> places the user's Windows profile into "
900
"their home directory. It is also possible to configure a "
901
"<emphasis>[profiles]</emphasis> share placing all profiles under a single "
902
"directory."
903
msgstr ""
904
905
#: serverguide/C/windows-networking.xml:811(para)
906
msgid ""
907
"<emphasis>logon drive:</emphasis> specifies the home directory local path."
908
msgstr ""
909
910
#: serverguide/C/windows-networking.xml:816(para)
911
msgid ""
912
"<emphasis>logon home:</emphasis> specifies the home directory location."
913
msgstr ""
914
915
#: serverguide/C/windows-networking.xml:821(para)
916
msgid ""
917
"<emphasis>logon script:</emphasis> determines the script to be run locally "
918
"once a user has logged in. The script needs to be placed in the "
919
"<emphasis>[netlogon]</emphasis> share."
920
msgstr ""
921
922
#: serverguide/C/windows-networking.xml:827(para)
923
msgid ""
924
"<emphasis>add machine script:</emphasis> a script that will automatically "
925
"create the <emphasis>Machine Trust Account</emphasis> needed for a "
926
"workstation to join the domain."
927
msgstr ""
928
929
#: serverguide/C/windows-networking.xml:831(para)
930
msgid ""
931
"In this example the <emphasis>machines</emphasis> group will need to be "
932
"created using the <application>addgroup</application> utility see <xref "
933
"linkend=\"adding-deleting-users\"/> for details."
934
msgstr ""
935
936
#: serverguide/C/windows-networking.xml:839(para)
937
msgid ""
938
"If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the "
939
"<emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options "
940
"commented."
941
msgstr ""
942
943
#: serverguide/C/windows-networking.xml:848(para)
944
msgid ""
945
"Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis "
946
"role=\"italic\">logon home</emphasis> to be mapped:"
947
msgstr ""
948
949
#: serverguide/C/windows-networking.xml:853(programlisting)
950
#, no-wrap
951
msgid ""
952
"\n"
953
"[homes]\n"
954
" comment = Home Directories\n"
955
" browseable = no\n"
956
" read only = no\n"
957
" create mask = 0700\n"
958
" directory mask = 0700\n"
959
" valid users = %S\n"
960
msgstr ""
961
962
#: serverguide/C/windows-networking.xml:866(para)
963
msgid ""
964
"When configured as a domain controller a <emphasis>[netlogon]</emphasis> "
965
"share needs to be configured. To enable the share, uncomment:"
966
msgstr ""
967
968
#: serverguide/C/windows-networking.xml:871(programlisting)
969
#, no-wrap
970
msgid ""
971
"\n"
972
"[netlogon]\n"
973
" comment = Network Logon Service\n"
974
" path = /srv/samba/netlogon\n"
975
" guest ok = yes\n"
976
" read only = yes\n"
977
" share modes = no\n"
978
msgstr ""
979
980
#: serverguide/C/windows-networking.xml:881(para)
981
msgid ""
982
"The original <emphasis>netlogon</emphasis> share path is "
983
"<filename>/home/samba/netlogon</filename>, but according to the Filesystem "
984
"Hierarchy Standard (FHS), <ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
985
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is the correct "
986
"location for site-specific data provided by the system."
987
msgstr ""
988
989
#: serverguide/C/windows-networking.xml:892(para)
990
msgid ""
991
"Now create the <filename role=\"directory\">netlogon</filename> directory, "
992
"and an empty (for now) <filename>logon.cmd</filename> script file:"
993
msgstr ""
994
995
#: serverguide/C/windows-networking.xml:898(command)
996
msgid "sudo mkdir -p /srv/samba/netlogon"
997
msgstr ""
998
999
#: serverguide/C/windows-networking.xml:899(command)
1000
msgid "sudo touch /srv/samba/netlogon/logon.cmd"
1001
msgstr ""
1002
1003
#: serverguide/C/windows-networking.xml:902(para)
1004
msgid ""
1005
"You can enter any normal Windows logon script commands in "
1006
"<filename>logon.cmd</filename> to customize the client's environment."
1007
msgstr ""
1008
1009
#: serverguide/C/windows-networking.xml:910(para)
1010
msgid ""
1011
"With <emphasis>root</emphasis> being disabled by default, in order to join a "
1012
"workstation to the domain, a system group needs to be mapped to the Windows "
1013
"<emphasis>Domain Admins</emphasis> group. Using the "
1014
"<application>net</application> utility, from a terminal enter:"
1015
msgstr ""
1016
1017
#: serverguide/C/windows-networking.xml:917(command)
1018
msgid ""
1019
"sudo net groupmap add ntgroup=\"Domain Admins\" unixgroup=sysadmin rid=512 "
1020
"type=d"
1021
msgstr ""
1022
1023
#: serverguide/C/windows-networking.xml:921(para)
1024
msgid ""
1025
"Change <emphasis role=\"italic\">sysadmin</emphasis> to whichever group you "
1026
"prefer. Also, the user used to join the domain needs to be a member of the "
1027
"<emphasis>sysadmin</emphasis> group, as well as a member of the system "
1028
"<emphasis>admin</emphasis> group. The <emphasis>admin</emphasis> group "
1029
"allows <application>sudo</application> use."
1030
msgstr ""
1031
1032
#: serverguide/C/windows-networking.xml:932(para)
1033
msgid "Finally, restart Samba to enable the new domain controller:"
1034
msgstr ""
1035
1036
#: serverguide/C/windows-networking.xml:943(para)
1037
msgid ""
1038
"You should now be able to join Windows clients to the Domain in the same "
1039
"manner as joining them to an NT4 domain running on a Windows server."
1040
msgstr ""
1041
1042
#: serverguide/C/windows-networking.xml:953(title)
1043
msgid "Backup Domain Controller"
1044
msgstr ""
1045
1046
#: serverguide/C/windows-networking.xml:955(para)
1047
msgid ""
1048
"With a Primary Domain Controller (PDC) on the network it is best to have a "
1049
"Backup Domain Controller (BDC) as well. This will allow clients to "
1050
"authenticate in case the PDC becomes unavailable."
1051
msgstr ""
1052
1053
#: serverguide/C/windows-networking.xml:960(para)
1054
msgid ""
1055
"When configuring Samba as a BDC you need a way to sync account information "
1056
"with the PDC. There are multiple ways of accomplishing this "
1057
"<application>scp</application>, <application>rsync</application>, or by "
1058
"using <application>LDAP</application> as the <emphasis>passdb "
1059
"backend</emphasis>."
1060
msgstr ""
1061
1062
#: serverguide/C/windows-networking.xml:966(para)
1063
msgid ""
1064
"Using LDAP is the most robust way to sync account information, because both "
1065
"domain controllers can use the same information in real time. However, "
1066
"setting up a LDAP server may be overly complicated for a small number of "
1067
"user and computer accounts. See <xref linkend=\"samba-ldap\"/> for details."
1068
msgstr ""
1069
1070
#: serverguide/C/windows-networking.xml:975(para)
1071
msgid ""
1072
"First, install <application>samba</application> and <application>libpam-"
1073
"smbpass</application>. From a terminal enter:"
1074
msgstr ""
1075
1076
#: serverguide/C/windows-networking.xml:986(para)
1077
msgid ""
1078
"Now, edit <filename>/etc/samba/smb.conf</filename> and uncomment the "
1079
"following in the <emphasis>[global]</emphasis>:"
1080
msgstr ""
1081
1082
#: serverguide/C/windows-networking.xml:999(para)
1083
msgid "In the commented <emphasis>Domains</emphasis> uncomment or add:"
1084
msgstr ""
1085
1086
#: serverguide/C/windows-networking.xml:1003(programlisting)
1087
#, no-wrap
1088
msgid ""
1089
"\n"
1090
" domain logons = yes\n"
1091
" domain master = no\n"
1092
msgstr ""
1093
1094
#: serverguide/C/windows-networking.xml:1011(para)
1095
msgid ""
1096
"Make sure a user has rights to read the files in "
1097
"<filename>/var/lib/samba</filename>. For example, to allow users in the "
1098
"<emphasis>admin</emphasis> group to <application>scp</application> the "
1099
"files, enter:"
1100
msgstr ""
1101
1102
#: serverguide/C/windows-networking.xml:1017(command)
1103
msgid "sudo chgrp -R admin /var/lib/samba"
1104
msgstr ""
1105
1106
#: serverguide/C/windows-networking.xml:1023(para)
1107
msgid ""
1108
"Next, sync the user accounts, using <application>scp</application> to copy "
1109
"the <filename>/var/lib/samba</filename> directory from the PDC:"
1110
msgstr ""
1111
1112
#: serverguide/C/windows-networking.xml:1029(command)
1113
msgid "sudo scp -r username@pdc:/var/lib/samba /var/lib"
1114
msgstr ""
1115
1116
#: serverguide/C/windows-networking.xml:1033(para)
1117
msgid ""
1118
"Replace <emphasis>username</emphasis> with a valid username and "
1119
"<emphasis>pdc</emphasis> with the hostname or IP Address of your actual PDC."
1120
msgstr ""
1121
1122
#: serverguide/C/windows-networking.xml:1042(para)
1123
msgid "Finally, restart <application>samba</application>:"
1124
msgstr ""
1125
1126
#: serverguide/C/windows-networking.xml:1053(para)
1127
msgid ""
1128
"You can test that your Backup Domain controller is working by stopping the "
1129
"Samba daemon on the PDC, then trying to login to a Windows client joined to "
1130
"the domain."
1131
msgstr ""
1132
1133
#: serverguide/C/windows-networking.xml:1058(para)
1134
msgid ""
1135
"Another thing to keep in mind is if you have configured the <emphasis>logon "
1136
"home</emphasis> option as a directory on the PDC, and the PDC becomes "
1137
"unavailable, access to the user's <emphasis>Home</emphasis> drive will also "
1138
"be unavailable. For this reason it is best to configure the <emphasis>logon "
1139
"home</emphasis> to reside on a separate file server from the PDC and BDC."
1140
msgstr ""
1141
1142
#: serverguide/C/windows-networking.xml:1088(para)
1143
msgid ""
1144
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-"
1145
"pdc.html\">Chapter 4</ulink> of the Samba HOWTO Collection explains setting "
1146
"up a Primary Domain Controller."
1147
msgstr ""
1148
1149
#: serverguide/C/windows-networking.xml:1094(para)
1150
msgid ""
1151
"<ulink url=\"http://us3.samba.org/samba/docs/man/Samba-HOWTO-"
1152
"Collection/samba-bdc.html\">Chapter 5</ulink> of the Samba HOWTO Collection "
1153
"explains setting up a Backup Domain Controller."
1154
msgstr ""
1155
1156
#: serverguide/C/windows-networking.xml:1109(title)
1157
msgid "Samba Active Directory Integration"
1158
msgstr ""
1159
1160
#: serverguide/C/windows-networking.xml:1112(title)
1161
msgid "Accessing a Samba Share"
1162
msgstr ""
1163
1164
#: serverguide/C/windows-networking.xml:1114(para)
1165
msgid ""
1166
"Another, use for Samba is to integrate into an existing Windows network. "
1167
"Once part of an Active Directory domain, Samba can provide file and print "
1168
"services to AD users."
1169
msgstr ""
1170
1171
#: serverguide/C/windows-networking.xml:1119(para)
1172
msgid ""
1173
"The simplest way to join an AD domain is to use <application>Likewise-"
1174
"open</application>. For detailed instructions see <xref linkend=\"likewise-"
1175
"open\"/>."
1176
msgstr ""
1177
1178
#: serverguide/C/windows-networking.xml:1124(para)
1179
msgid ""
1180
"Once part of the domain, enter the following command in the terminal prompt:"
1181
msgstr ""
1182
1183
#: serverguide/C/windows-networking.xml:1129(command)
1184
msgid "sudo apt-get install samba smbfs smbclient"
1185
msgstr ""
1186
1187
#: serverguide/C/windows-networking.xml:1132(para)
1188
msgid ""
1189
"Since the <application>likewise-open</application> and "
1190
"<application>samba</application> packages use separate "
1191
"<filename>secrets.tdb</filename> files, a symlink will need to be created in "
1192
"<filename role=\"directory\">/var/lib/samba</filename>:"
1193
msgstr ""
1194
1195
#: serverguide/C/windows-networking.xml:1138(command)
1196
msgid "sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig"
1197
msgstr ""
1198
1199
#: serverguide/C/windows-networking.xml:1139(command)
1200
msgid "sudo ln -s /etc/samba/secrets.tdb /var/lib/samba"
1201
msgstr ""
1202
1203
#: serverguide/C/windows-networking.xml:1142(para)
1204
msgid "Next, edit <filename>/etc/samba/smb.conf</filename> changing:"
1205
msgstr ""
1206
1207
#: serverguide/C/windows-networking.xml:1146(programlisting)
1208
#, no-wrap
1209
msgid ""
1210
"\n"
1211
" workgroup = EXAMPLE\n"
1212
" ...\n"
1213
" security = ads\n"
1214
" realm = EXAMPLE.COM\n"
1215
" ...\n"
1216
" idmap backend = lwopen\n"
1217
" idmap uid = 50-9999999999\n"
1218
" idmap gid = 50-9999999999\n"
1219
msgstr ""
1220
1221
#: serverguide/C/windows-networking.xml:1157(para)
1222
msgid ""
1223
"Restart <application>samba</application> for the new settings to take effect:"
1224
msgstr ""
1225
1226
#: serverguide/C/windows-networking.xml:1165(para)
1227
msgid ""
1228
"You should now be able to access any <application>Samba</application> shares "
1229
"from a Windows client. However, be sure to give the appropriate AD users or "
1230
"groups access to the share directory. See <xref linkend=\"samba-fileprint-"
1231
"security\"/> for more details."
1232
msgstr ""
1233
1234
#: serverguide/C/windows-networking.xml:1173(title)
1235
msgid "Accessing a Windows Share"
1236
msgstr ""
1237
1238
#: serverguide/C/windows-networking.xml:1175(para)
1239
msgid ""
1240
"Now that the Samba server is part of the Active Directory domain you can "
1241
"access any Windows server shares:"
1242
msgstr ""
1243
1244
#: serverguide/C/windows-networking.xml:1182(para)
1245
msgid ""
1246
"To mount a Windows file share enter the following in a terminal prompt:"
1247
msgstr ""
1248
1249
#: serverguide/C/windows-networking.xml:1186(command)
1250
msgid "mount.cifs //fs01.example.com/share mount_point"
1251
msgstr ""
1252
1253
#: serverguide/C/windows-networking.xml:1189(para)
1254
msgid ""
1255
"It is also possible to access shares on computers not part of an AD domain, "
1256
"but a username and password will need to be provided."
1257
msgstr ""
1258
1259
#: serverguide/C/windows-networking.xml:1197(para)
1260
msgid ""
1261
"To mount the share during boot place an entry in "
1262
"<filename>/etc/fstab</filename>, for example:"
1263
msgstr ""
1264
1265
#: serverguide/C/windows-networking.xml:1201(programlisting)
1266
#, no-wrap
1267
msgid ""
1268
"\n"
1269
"//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw "
1270
"0 0\n"
1271
msgstr ""
1272
1273
#: serverguide/C/windows-networking.xml:1208(para)
1274
msgid ""
1275
"Another way to copy files from a Windows server is to use the "
1276
"<application>smbclient</application> utility. To list the files in a Windows "
1277
"share:"
1278
msgstr ""
1279
1280
#: serverguide/C/windows-networking.xml:1214(command)
1281
msgid "smbclient //fs01.example.com/share -k -c \"ls\""
1282
msgstr ""
1283
1284
#: serverguide/C/windows-networking.xml:1220(para)
1285
msgid "To copy a file from the share, enter:"
1286
msgstr ""
1287
1288
#: serverguide/C/windows-networking.xml:1225(command)
1289
msgid "smbclient //fs01.example.com/share -k -c \"get file.txt\""
1290
msgstr ""
1291
1292
#: serverguide/C/windows-networking.xml:1228(para)
1293
msgid ""
1294
"This will copy the <filename>file.txt</filename> into the current directory."
1295
msgstr ""
1296
1297
#: serverguide/C/windows-networking.xml:1235(para)
1298
msgid "And to copy a file to the share:"
1299
msgstr ""
1300
1301
#: serverguide/C/windows-networking.xml:1240(command)
1302
msgid "smbclient //fs01.example.com/share -k -c \"put /etc/hosts hosts\""
1303
msgstr ""
1304
1305
#: serverguide/C/windows-networking.xml:1243(para)
1306
msgid ""
1307
"This will copy the <filename>/etc/hosts</filename> to "
1308
"<filename>//fs01.example.com/share/hosts</filename>."
1309
msgstr ""
1310
1311
#: serverguide/C/windows-networking.xml:1250(para)
1312
msgid ""
1313
"The <emphasis>-c</emphasis> option used above allows you to execute the "
1314
"<application>smbclient</application> command all at once. This is useful for "
1315
"scripting and minor file operations. To enter the <emphasis>smb: \\"
1316
"></emphasis> prompt, a FTP like prompt where you can execute normal file "
1317
"and directory commands, simply execute:"
1318
msgstr ""
1319
1320
#: serverguide/C/windows-networking.xml:1257(command)
1321
msgid "smbclient //fs01.example.com/share -k"
1322
msgstr ""
1323
1324
#: serverguide/C/windows-networking.xml:1264(para)
1325
msgid ""
1326
"Replace all instances of <emphasis>fs01.example.com/share</emphasis>, "
1327
"<emphasis>//192.168.0.5/share</emphasis>, "
1328
"<emphasis>username=steve,password=secret</emphasis>, and "
1329
"<emphasis>file.txt</emphasis> with your server's IP, hostname, share name, "
1330
"file name, and an actual username and password with rights to the share."
1331
msgstr ""
1332
1333
#: serverguide/C/windows-networking.xml:1275(para)
1334
msgid ""
1335
"For more <application>smbclient</application> options see the man page: "
1336
"<command>man smbclient</command>, also available <ulink "
1337
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/smbclient.1.html\">on"
1338
"line</ulink>."
1339
msgstr ""
1340
1341
#: serverguide/C/windows-networking.xml:1280(para)
1342
msgid ""
1343
"The <application>mount.cifs</application><ulink "
1344
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/mount.cifs.8.html\">m"
1345
"an page</ulink> is also useful for more detailed information."
1346
msgstr ""
1347
1348
#: serverguide/C/windows-networking.xml:1293(title)
1349
msgid "Likewise Open"
1350
msgstr ""
1351
1352
#: serverguide/C/windows-networking.xml:1295(para)
1353
msgid ""
1354
"<application>Likewise Open</application> simplifies the necessary "
1355
"configuration needed to authenticate a Linux machine to an Active Directory "
1356
"domain. Based on <application>winbind</application>, the "
1357
"<application>likewise-open</application> package takes the pain out of "
1358
"integrating Ubuntu authentication into an existing Windows network."
1359
msgstr ""
1360
1361
#: serverguide/C/windows-networking.xml:1304(para)
1362
msgid ""
1363
"There are two ways to use Likewise Open, <application>likewise-"
1364
"open</application> the command line utility and <application>likewise-open-"
1365
"gui</application>. This section focuses on the command line utility."
1366
msgstr ""
1367
1368
#: serverguide/C/windows-networking.xml:1309(para)
1369
msgid ""
1370
"To install the <application>likewise-open</application> package, open a "
1371
"terminal prompt and enter:"
1372
msgstr ""
1373
1374
#: serverguide/C/windows-networking.xml:1314(command)
1375
msgid "sudo apt-get install likewise-open"
1376
msgstr ""
1377
1378
#: serverguide/C/windows-networking.xml:1319(title)
1379
msgid "Joining a Domain"
1380
msgstr ""
1381
1382
#: serverguide/C/windows-networking.xml:1321(para)
1383
msgid ""
1384
"The main executable file of the <application>likewise-open</application> "
1385
"package is <filename>/usr/bin/domainjoin-cli</filename>, which is used to "
1386
"join your computer to the domain. Before you join a domain you will need to "
1387
"make sure you have:"
1388
msgstr ""
1389
1390
#: serverguide/C/windows-networking.xml:1329(para)
1391
msgid ""
1392
"Access to an Active Directory user with appropriate rights to join the "
1393
"domain."
1394
msgstr ""
1395
1396
#: serverguide/C/windows-networking.xml:1334(para)
1397
msgid ""
1398
"The <emphasis>Fully Qualified Domain Name</emphasis> (FQDN) of the domain "
1399
"you want to join. If your AD domain does not match a valid domain such as "
1400
"<emphasis role=\"italic\">example.com</emphasis>, it is likely that it has "
1401
"the form of <emphasis>domainname.local</emphasis>."
1402
msgstr ""
1403
1404
#: serverguide/C/windows-networking.xml:1341(para)
1405
msgid ""
1406
"DNS for the domain setup properly. In a production AD environment this "
1407
"should be the case. Proper Microsoft DNS is needed so that client "
1408
"workstations can determine the Active Directory domain is available."
1409
msgstr ""
1410
1411
#: serverguide/C/windows-networking.xml:1345(para)
1412
msgid ""
1413
"If you don't have a Windows DNS server on your network, see <xref "
1414
"linkend=\"likewise-open-ms-dns\"/> for details."
1415
msgstr ""
1416
1417
#: serverguide/C/windows-networking.xml:1352(para)
1418
msgid "To join a domain, from a terminal prompt enter:"
1419
msgstr ""
1420
1421
#: serverguide/C/windows-networking.xml:1357(command)
1422
msgid "sudo domainjoin-cli join example.com Administrator"
1423
msgstr ""
1424
1425
#: serverguide/C/windows-networking.xml:1361(para)
1426
msgid ""
1427
"Replace <emphasis>example.com</emphasis> with your domain name, and "
1428
"<emphasis>Administrator</emphasis> with the appropriate user name."
1429
msgstr ""
1430
1431
#: serverguide/C/windows-networking.xml:1367(para)
1432
msgid ""
1433
"You will then be prompted for the user's password. If all goes well a "
1434
"<emphasis>SUCCESS</emphasis> message should be printed to the console."
1435
msgstr ""
1436
1437
#: serverguide/C/windows-networking.xml:1373(para)
1438
msgid ""
1439
"After joining the domain, it is necessary to reboot before attempting to "
1440
"authenticate against the domain."
1441
msgstr ""
1442
1443
#: serverguide/C/windows-networking.xml:1379(para)
1444
msgid ""
1445
"After successfully joining an Ubuntu machine to an Active Directory domain "
1446
"you can authenticate using any valid AD user. To login you will need to "
1447
"enter the user name as 'domain\\username'. For example to ssh to a server "
1448
"joined to the domain enter:"
1449
msgstr ""
1450
1451
#: serverguide/C/windows-networking.xml:1386(command)
1452
msgid "ssh 'example\\steve'@hostname"
1453
msgstr ""
1454
1455
#: serverguide/C/windows-networking.xml:1390(para)
1456
msgid ""
1457
"If configuring a Desktop the user name will need to be prefixed with "
1458
"<emphasis role=\"italic\">domain\\</emphasis> in the graphical logon as well."
1459
msgstr ""
1460
1461
#: serverguide/C/windows-networking.xml:1396(para)
1462
msgid ""
1463
"To make likewise-open use a default domain, you can add the following "
1464
"statement to <filename>/etc/samba/lwiauthd.conf</filename>:"
1465
msgstr ""
1466
1467
#: serverguide/C/windows-networking.xml:1400(programlisting)
1468
#, no-wrap
1469
msgid ""
1470
"\n"
1471
"winbind use default domain = yes\n"
1472
msgstr ""
1473
1474
#: serverguide/C/windows-networking.xml:1404(para)
1475
msgid "Then restart the <application>likewise-open</application> daemons:"
1476
msgstr ""
1477
1478
#: serverguide/C/windows-networking.xml:1409(command)
1479
msgid "sudo /etc/init.d/likewise-open restart"
1480
msgstr ""
1481
1482
#: serverguide/C/windows-networking.xml:1413(para)
1483
msgid ""
1484
"Once configured for a <emphasis>default domain</emphasis> the <emphasis "
1485
"role=\"italic\">'domain\\'</emphasis> is no longer required, users can login "
1486
"using only their username."
1487
msgstr ""
1488
1489
#: serverguide/C/windows-networking.xml:1419(para)
1490
msgid ""
1491
"The <application>domainjoin-cli</application> utility can also be used to "
1492
"leave the domain. From a terminal:"
1493
msgstr ""
1494
1495
#: serverguide/C/windows-networking.xml:1424(command)
1496
msgid "sudo domainjoin-cli leave"
1497
msgstr ""
1498
1499
#: serverguide/C/windows-networking.xml:1429(title) serverguide/C/security.xml:1777(title)
1500
msgid "Other Utilities"
1501
msgstr ""
1502
1503
#: serverguide/C/windows-networking.xml:1431(para)
1504
msgid ""
1505
"The <application>likewise-open</application> package comes with a few other "
1506
"utilities that may be useful for gathering information about the Active "
1507
"Directory environment. These utilities are used to join the machine to the "
1508
"domain, and are the same as those available in the <application>samba-"
1509
"common</application> and <application>winbind</application> packages:"
1510
msgstr ""
1511
1512
#: serverguide/C/windows-networking.xml:1440(para)
1513
msgid ""
1514
"<application>lwinet</application>: Returns information about the network and "
1515
"the domain."
1516
msgstr ""
1517
1518
#: serverguide/C/windows-networking.xml:1445(para)
1519
msgid ""
1520
"<application>lwimsg</application>: Allows interaction with the "
1521
"<application>likewise-winbindd</application> daemon."
1522
msgstr ""
1523
1524
#: serverguide/C/windows-networking.xml:1450(para)
1525
msgid ""
1526
"<application>lwiinfo</application>: Displays information about various parts "
1527
"of the Domain."
1528
msgstr ""
1529
1530
#: serverguide/C/windows-networking.xml:1456(para)
1531
msgid "Please refer to each utility's man page specific for details."
1532
msgstr ""
1533
1534
#: serverguide/C/windows-networking.xml:1462(title) serverguide/C/mail.xml:351(title) serverguide/C/mail.xml:1598(title) serverguide/C/dns.xml:338(title)
1535
msgid "Troubleshooting"
1536
msgstr ""
1537
1538
#: serverguide/C/windows-networking.xml:1466(para)
1539
msgid ""
1540
"If the client has trouble joining the domain, double check that the "
1541
"Microsoft DNS is listed first in <filename>/etc/resolv.conf</filename>. For "
1542
"example:"
1543
msgstr ""
1544
1545
#: serverguide/C/windows-networking.xml:1471(programlisting)
1546
#, no-wrap
1547
msgid ""
1548
"\n"
1549
"nameserver 192.168.0.1\n"
1550
msgstr ""
1551
1552
#: serverguide/C/windows-networking.xml:1476(para)
1553
msgid ""
1554
"For more information when joining a domain, use the <emphasis>--loglevel "
1555
"verbose</emphasis> or <emphasis>--advanced</emphasis> option of the "
1556
"<application>domainjoin-cli</application> utility:"
1557
msgstr ""
1558
1559
#: serverguide/C/windows-networking.xml:1482(command)
1560
msgid "sudo domainjoin-cli --loglevel verbose join example.com Administrator"
1561
msgstr ""
1562
1563
#: serverguide/C/windows-networking.xml:1486(para)
1564
msgid ""
1565
"If an Active Directory user has trouble logging in, check the "
1566
"<filename>/var/log/auth.log</filename> for details."
1567
msgstr ""
1568
1569
#: serverguide/C/windows-networking.xml:1491(para)
1570
msgid ""
1571
"When joining an Ubuntu Desktop workstation to a domain, you may need to edit "
1572
"<filename>/etc/nsswitch.conf</filename> if your AD domain uses the <emphasis "
1573
"role=\"italic\">.local</emphasis> syntax. In order to join the domain the "
1574
"<emphasis>\"mdns4\"</emphasis> entry should be removed from the "
1575
"<emphasis>hosts</emphasis> option. For example:"
1576
msgstr ""
1577
1578
#: serverguide/C/windows-networking.xml:1497(programlisting)
1579
#, no-wrap
1580
msgid ""
1581
"\n"
1582
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
1583
msgstr ""
1584
1585
#: serverguide/C/windows-networking.xml:1501(para)
1586
msgid "Change the above to:"
1587
msgstr ""
1588
1589
#: serverguide/C/windows-networking.xml:1505(programlisting)
1590
#, no-wrap
1591
msgid ""
1592
"\n"
1593
"hosts: files dns [NOTFOUND=return]\n"
1594
msgstr ""
1595
1596
#: serverguide/C/windows-networking.xml:1509(para)
1597
msgid "Then restart networking by entering:"
1598
msgstr ""
1599
1600
#: serverguide/C/windows-networking.xml:1514(command) serverguide/C/network-config.xml:559(command)
1601
msgid "sudo /etc/init.d/networking restart"
1602
msgstr ""
1603
1604
#: serverguide/C/windows-networking.xml:1517(para)
1605
msgid "You should now be able to join the Active Directory domain."
1606
msgstr ""
1607
1608
#: serverguide/C/windows-networking.xml:1525(title)
1609
msgid "Microsoft DNS"
1610
msgstr ""
1611
1612
#: serverguide/C/windows-networking.xml:1527(para)
1613
msgid ""
1614
"The following are instructions for installing DNS on an Active Directory "
1615
"domain controller running Windows Server 2003, but the instructions should "
1616
"be similar for other versions:"
1617
msgstr ""
1618
1619
#: serverguide/C/windows-networking.xml:1536(para)
1620
msgid ""
1621
"Click "
1622
"<menuchoice><guimenuitem>Start</guimenuitem><guimenuitem>Administrative Tools"
1623
"</guimenuitem><guimenuitem>Manage Your Server</guimenuitem></menuchoice>. "
1624
"This will open the <application>Server Role Mangement</application> utility."
1625
msgstr ""
1626
1627
#: serverguide/C/windows-networking.xml:1544(para)
1628
msgid "Click <guilabel>Add or remove a role</guilabel>"
1629
msgstr ""
1630
1631
#: serverguide/C/windows-networking.xml:1545(para) serverguide/C/windows-networking.xml:1547(para) serverguide/C/windows-networking.xml:1550(para)
1632
msgid "Click Next"
1633
msgstr ""
1634
1635
#: serverguide/C/windows-networking.xml:1546(para)
1636
msgid "Select \"DNS Server\""
1637
msgstr ""
1638
1639
#: serverguide/C/windows-networking.xml:1548(para)
1640
msgid "Click Next again to proceed"
1641
msgstr ""
1642
1643
#: serverguide/C/windows-networking.xml:1549(para)
1644
msgid "Select \"Create a forward lookup zone\" if it is not selected."
1645
msgstr ""
1646
1647
#: serverguide/C/windows-networking.xml:1551(para)
1648
msgid ""
1649
"Make sure \"This server maintains the zone\" is selected and click Next."
1650
msgstr ""
1651
1652
#: serverguide/C/windows-networking.xml:1552(para)
1653
msgid "Enter your domain name and click Next"
1654
msgstr ""
1655
1656
#: serverguide/C/windows-networking.xml:1553(para)
1657
msgid "Click Next to \"Allow only secure dynamic updates\""
1658
msgstr ""
1659
1660
#: serverguide/C/windows-networking.xml:1555(para)
1661
msgid ""
1662
"Enter the IP for DNS servers to forward queries to, or Select \"No, it "
1663
"should not forward queries\" and click Next."
1664
msgstr ""
1665
1666
#: serverguide/C/windows-networking.xml:1559(para) serverguide/C/windows-networking.xml:1560(para)
1667
msgid "Click Finish"
1668
msgstr ""
1669
1670
#: serverguide/C/windows-networking.xml:1562(para)
1671
msgid ""
1672
"DNS is now installed and can be further configured using the "
1673
"<application>Microsoft Management Console</application> DNS snap-in."
1674
msgstr ""
1675
1676
#: serverguide/C/windows-networking.xml:1570(para)
1677
msgid "Click Start"
1678
msgstr ""
1679
1680
#: serverguide/C/windows-networking.xml:1571(para)
1681
msgid "Control Panel"
1682
msgstr ""
1683
1684
#: serverguide/C/windows-networking.xml:1572(para)
1685
msgid "Network Connections"
1686
msgstr ""
1687
1688
#: serverguide/C/windows-networking.xml:1573(para)
1689
msgid "Right Click \"Local Area Connection\""
1690
msgstr ""
1691
1692
#: serverguide/C/windows-networking.xml:1574(para)
1693
msgid "Click Properties"
1694
msgstr ""
1695
1696
#: serverguide/C/windows-networking.xml:1575(para)
1697
msgid "Double click \"Internet Protocol (TCP/IP)\""
1698
msgstr ""
1699
1700
#: serverguide/C/windows-networking.xml:1576(para)
1701
msgid "Enter the Server's IP Address as the \"Preferred DNS server\""
1702
msgstr ""
1703
1704
#: serverguide/C/windows-networking.xml:1577(para)
1705
msgid "Click Ok"
1706
msgstr ""
1707
1708
#: serverguide/C/windows-networking.xml:1578(para)
1709
msgid "Click Ok again to save the settings"
1710
msgstr ""
1711
1712
#: serverguide/C/windows-networking.xml:1567(para)
1713
msgid ""
1714
"Next, configure the Server to use itself for DNS queries: <placeholder-1/>"
1715
msgstr ""
1716
1717
#: serverguide/C/windows-networking.xml:1585(title) serverguide/C/web-servers.xml:624(title) serverguide/C/web-servers.xml:772(title) serverguide/C/web-servers.xml:922(title) serverguide/C/web-servers.xml:1017(title) serverguide/C/web-servers.xml:1239(title) serverguide/C/vpn.xml:303(title) serverguide/C/virtualization.xml:1840(title) serverguide/C/virtualization.xml:2165(title) serverguide/C/vcs.xml:539(title) serverguide/C/security.xml:877(title) serverguide/C/security.xml:1211(title) serverguide/C/security.xml:1626(title) serverguide/C/security.xml:1817(title) serverguide/C/remote-administration.xml:203(title) serverguide/C/package-management.xml:454(title) serverguide/C/other-apps.xml:330(title) serverguide/C/network-config.xml:1006(title) serverguide/C/network-config.xml:1107(title) serverguide/C/monitoring.xml:391(title) serverguide/C/monitoring.xml:527(title) serverguide/C/mail.xml:459(title) serverguide/C/mail.xml:643(title) serverguide/C/mail.xml:795(title) serverguide/C/mail.xml:1217(title) serverguide/C/mail.xml:1646(title) serverguide/C/lamp-applications.xml:259(title) serverguide/C/lamp-applications.xml:388(title) serverguide/C/lamp-applications.xml:496(title) serverguide/C/file-server.xml:284(title) serverguide/C/file-server.xml:436(title) serverguide/C/file-server.xml:619(title) serverguide/C/dns.xml:572(title) serverguide/C/clustering.xml:234(title) serverguide/C/chat.xml:107(title) serverguide/C/chat.xml:221(title) serverguide/C/backups.xml:297(title)
1718
msgid "References"
1719
msgstr ""
1720
1721
#: serverguide/C/windows-networking.xml:1587(para)
1722
msgid ""
1723
"Please refer to the <ulink "
1724
"url=\"http://www.likewisesoftware.com/\">Likewise</ulink> home page for "
1725
"further information."
1726
msgstr ""
1727
1728
#: serverguide/C/windows-networking.xml:1591(para)
1729
msgid ""
1730
"For more <application>domainjoin-cli</application> options see the man page: "
1731
"<command>man domainjoin-cli</command>."
1732
msgstr ""
1733
1734
#: serverguide/C/windows-networking.xml:1595(para)
1735
msgid ""
1736
"Also, see the <ulink "
1737
"url=\"https://help.ubuntu.com/community/LikewiseOpen\">Ubuntu Wiki "
1738
"LikewiseOpen</ulink> page."
1739
msgstr ""
1740
1741
#: serverguide/C/web-servers.xml:13(title)
1742
msgid "Web Servers"
1743
msgstr ""
1744
1745
#: serverguide/C/web-servers.xml:14(para)
1746
msgid ""
1747
"A Web server is a software responsible for accepting HTTP requests from "
1748
"clients, which are known as Web browsers, and serving them HTTP responses "
1749
"along with optional data contents, which usually are Web pages such as HTML "
1750
"documents and linked objects (images, etc.)."
1751
msgstr ""
1752
1753
#: serverguide/C/web-servers.xml:19(title)
1754
msgid "HTTPD - Apache2 Web Server"
1755
msgstr ""
1756
1757
#: serverguide/C/web-servers.xml:20(para)
1758
msgid ""
1759
"Apache is the most commonly used Web Server on Linux systems. Web Servers "
1760
"are used to serve Web Pages requested by client computers. Clients typically "
1761
"request and view Web Pages using Web Browser applications such as "
1762
"<application>Firefox</application>, <application>Opera</application>, or "
1763
"<application>Mozilla</application>."
1764
msgstr ""
1765
1766
#: serverguide/C/web-servers.xml:24(para)
1767
msgid ""
1768
"Users enter a Uniform Resource Locator (URL) to point to a Web server by "
1769
"means of its Fully Qualified Domain Name (FQDN) and a path to the required "
1770
"resource. For example, to view the home page of the <ulink "
1771
"url=\"http://www.ubuntu.com\">Ubuntu Web site</ulink> a user will enter only "
1772
"the FQDN. To request specific information about <ulink "
1773
"url=\"http://www.ubuntu.com/support/paid\">paid support</ulink>, a user will "
1774
"enter the FQDN followed by a path."
1775
msgstr ""
1776
1777
#: serverguide/C/web-servers.xml:29(para)
1778
msgid ""
1779
"The most common protocol used to transfer Web pages is the Hyper Text "
1780
"Transfer Protocol (HTTP). Protocols such as Hyper Text Transfer Protocol "
1781
"over Secure Sockets Layer (HTTPS), and File Transfer Protocol (FTP), a "
1782
"protocol for uploading and downloading files, are also supported."
1783
msgstr ""
1784
1785
#: serverguide/C/web-servers.xml:33(para)
1786
msgid ""
1787
"Apache Web Servers are often used in combination with the "
1788
"<application>MySQL</application> database engine, the HyperText Preprocessor "
1789
"(<application>PHP</application>) scripting language, and other popular "
1790
"scripting languages such as <application>Python</application> and "
1791
"<application>Perl</application>. This configuration is termed LAMP (Linux, "
1792
"Apache, MySQL and Perl/Python/PHP) and forms a powerful and robust platform "
1793
"for the development and deployment of Web-based applications."
1794
msgstr ""
1795
1796
#: serverguide/C/web-servers.xml:42(para)
1797
msgid ""
1798
"The <application>Apache2</application> web server is available in Ubuntu "
1799
"Linux. To install Apache2:"
1800
msgstr ""
1801
1802
#: serverguide/C/web-servers.xml:48(para)
1803
msgid "At a terminal prompt enter the following command:"
1804
msgstr ""
1805
1806
#: serverguide/C/web-servers.xml:53(command)
1807
msgid "sudo apt-get install apache2"
1808
msgstr ""
1809
1810
#: serverguide/C/web-servers.xml:63(para)
1811
msgid ""
1812
"Apache2 is configured by placing <emphasis>directives</emphasis> in plain "
1813
"text configuration files. These <emphasis>directives</emphasis> are "
1814
"separated between the following files and directories:"
1815
msgstr ""
1816
1817
#: serverguide/C/web-servers.xml:71(para)
1818
msgid ""
1819
"<emphasis>apache2.conf:</emphasis> the main Apache2 configuration file. "
1820
"Contains settings that are <emphasis>global</emphasis> to Apache2."
1821
msgstr ""
1822
1823
#: serverguide/C/web-servers.xml:77(para)
1824
msgid ""
1825
"<emphasis>conf.d:</emphasis> contains configuration files which apply "
1826
"<emphasis>globally</emphasis> to Apache2. Other packages that use Apache2 to "
1827
"serve content may add files, or symlinks, to this directory."
1828
msgstr ""
1829
1830
#: serverguide/C/web-servers.xml:83(para)
1831
msgid ""
1832
"<emphasis>envvars:</emphasis> file where Apache2 "
1833
"<emphasis>environment</emphasis> variables are set."
1834
msgstr ""
1835
1836
#: serverguide/C/web-servers.xml:88(para)
1837
msgid ""
1838
"<emphasis>httpd.conf:</emphasis> historically the main Apache2 configuration "
1839
"file, named after the <application>httpd</application> daemon. The file can "
1840
"be used for <emphasis>user specific</emphasis> configuration options that "
1841
"globally effect Apache2."
1842
msgstr ""
1843
1844
#: serverguide/C/web-servers.xml:95(para)
1845
msgid ""
1846
"<emphasis>mods-available:</emphasis> this directory contains configuration "
1847
"files to both load <emphasis>modules</emphasis> and configure them. Not all "
1848
"modules will have specific configuration files, however."
1849
msgstr ""
1850
1851
#: serverguide/C/web-servers.xml:101(para)
1852
msgid ""
1853
"<emphasis>mods-enabled:</emphasis> holds <emphasis>symlinks</emphasis> to "
1854
"the files in <filename>/etc/apache2/mods-available</filename>. When a module "
1855
"configuration file is symlinked it will be enabled the next time "
1856
"<application>apache2</application> is restarted."
1857
msgstr ""
1858
1859
#: serverguide/C/web-servers.xml:108(para)
1860
msgid ""
1861
"<emphasis>ports.conf:</emphasis> houses the directives that determine which "
1862
"TCP ports Apache2 is listening on."
1863
msgstr ""
1864
1865
#: serverguide/C/web-servers.xml:113(para)
1866
msgid ""
1867
"<emphasis>sites-available:</emphasis> this directory has configuration files "
1868
"for Apache2 <emphasis>Virtual Hosts</emphasis>. Virtual Hosts allow Apache2 "
1869
"to be configured for multiple sites that have separate configurations."
1870
msgstr ""
1871
1872
#: serverguide/C/web-servers.xml:119(para)
1873
msgid ""
1874
"<emphasis>sites-enabled:</emphasis> like mods-enabled, <filename "
1875
"role=\"directory\">sites-enabled</filename> contains symlinks to the "
1876
"<filename>/etc/apache2/sites-available</filename> directory. Similarly when "
1877
"a configuration file in sites-available is symlinked, the site configured by "
1878
"it will be active once Apache2 is restarted."
1879
msgstr ""
1880
1881
#: serverguide/C/web-servers.xml:127(para)
1882
msgid ""
1883
"In addition, other configuration files may be added using the "
1884
"<emphasis>Include</emphasis> directive, and wildcards can be used to include "
1885
"many configuration files. Any directive may be placed in any of these "
1886
"configuration files. Changes to the main configuration files are only "
1887
"recognized by Apache2 when it is started or restarted."
1888
msgstr ""
1889
1890
#: serverguide/C/web-servers.xml:136(para)
1891
msgid ""
1892
"The server also reads a file containing mime document types; the filename is "
1893
"set by the <emphasis>TypesConfig</emphasis> directive, and is "
1894
"<filename>/etc/mime.types</filename> by default."
1895
msgstr ""
1896
1897
#: serverguide/C/web-servers.xml:141(title)
1898
msgid "Basic Settings"
1899
msgstr ""
1900
1901
#: serverguide/C/web-servers.xml:142(para)
1902
msgid ""
1903
"This section explains Apache2 server essential configuration parameters. "
1904
"Refer to the <ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
1905
"Documentation</ulink> for more details."
1906
msgstr ""
1907
1908
#: serverguide/C/web-servers.xml:150(para)
1909
msgid ""
1910
"Apache2 ships with a virtual-host-friendly default configuration. That is, "
1911
"it is configured with a single default virtual host (using the "
1912
"<emphasis>VirtualHost</emphasis> directive) which can modified or used as-is "
1913
"if you have a single site, or used as a template for additional virtual "
1914
"hosts if you have multiple sites. If left alone, the default virtual host "
1915
"will serve as your default site, or the site users will see if the URL they "
1916
"enter does not match the <emphasis>ServerName</emphasis> directive of any of "
1917
"your custom sites. To modify the default virtual host, edit the file "
1918
"<filename>/etc/apache2/sites-available/default</filename>."
1919
msgstr ""
1920
1921
#: serverguide/C/web-servers.xml:163(para)
1922
msgid ""
1923
"The directives set for a virtual host only apply to that particular virtual "
1924
"host. If a directive is set server-wide and not defined within the virtual "
1925
"host settings, the default setting is used. For example, you can define a "
1926
"Webmaster email address and not define individual email addresses for each "
1927
"virtual host."
1928
msgstr ""
1929
1930
#: serverguide/C/web-servers.xml:171(para)
1931
msgid ""
1932
"If you wish to configure a new virtual host or site, copy that file into the "
1933
"same directory with a name you choose. For example:"
1934
msgstr ""
1935
1936
#: serverguide/C/web-servers.xml:177(command)
1937
msgid ""
1938
"sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-"
1939
"available/mynewsite"
1940
msgstr ""
1941
1942
#: serverguide/C/web-servers.xml:180(para)
1943
msgid ""
1944
"Edit the new file to configure the new site using some of the directives "
1945
"described below."
1946
msgstr ""
1947
1948
#: serverguide/C/web-servers.xml:187(para)
1949
msgid ""
1950
"The <emphasis>ServerAdmin</emphasis> directive specifies the email address "
1951
"to be advertised for the server's administrator. The default value is "
1952
"webmaster@localhost. This should be changed to an email address that is "
1953
"delivered to you (if you are the server's administrator). If your website "
1954
"has a problem, Apache2 will display an error message containing this email "
1955
"address to report the problem to. Find this directive in your site's "
1956
"configuration file in /etc/apache2/sites-available."
1957
msgstr ""
1958
1959
#: serverguide/C/web-servers.xml:198(para)
1960
msgid ""
1961
"The <emphasis>Listen</emphasis> directive specifies the port, and optionally "
1962
"the IP address, Apache2 should listen on. If the IP address is not "
1963
"specified, Apache2 will listen on all IP addresses assigned to the machine "
1964
"it runs on. The default value for the Listen directive is 80. Change this to "
1965
"127.0.0.1:80 to cause Apache2 to listen only on your loopback interface so "
1966
"that it will not be available to the Internet, to (for example) 81 to change "
1967
"the port that it listens on, or leave it as is for normal operation. This "
1968
"directive can be found and changed in its own file, "
1969
"<filename>/etc/apache2/ports.conf</filename>"
1970
msgstr ""
1971
1972
#: serverguide/C/web-servers.xml:211(para)
1973
msgid ""
1974
"The <emphasis>ServerName</emphasis> directive is optional and specifies what "
1975
"FQDN your site should answer to. The default virtual host has no ServerName "
1976
"directive specified, so it will respond to all requests that do not match a "
1977
"ServerName directive in another virtual host. If you have just acquired the "
1978
"domain name ubunturocks.com and wish to host it on your Ubuntu server, the "
1979
"value of the ServerName directive in your virtual host configuration file "
1980
"should be ubunturocks.com. Add this directive to the new virtual host file "
1981
"you created earlier (<filename>/etc/apache2/sites-"
1982
"available/mynewsite</filename>)."
1983
msgstr ""
1984
1985
#: serverguide/C/web-servers.xml:223(para)
1986
msgid ""
1987
"You may also want your site to respond to www.ubunturocks.com, since many "
1988
"users will assume the www prefix is appropriate. Use the "
1989
"<emphasis>ServerAlias</emphasis> directive for this. You may also use "
1990
"wildcards in the ServerAlias directive."
1991
msgstr ""
1992
1993
#: serverguide/C/web-servers.xml:230(para)
1994
msgid ""
1995
"For example, the following configuration will cause your site to respond to "
1996
"any domain request ending in <emphasis>.ubunturocks.com</emphasis>."
1997
msgstr ""
1998
1999
#: serverguide/C/web-servers.xml:236(programlisting)
2000
#, no-wrap
2001
msgid ""
2002
"\n"
2003
"ServerAlias *.ubunturocks.com\n"
2004
msgstr ""
2005
2006
#: serverguide/C/web-servers.xml:242(para)
2007
msgid ""
2008
"The <emphasis>DocumentRoot</emphasis> directive specifies where Apache2 "
2009
"should look for the files that make up the site. The default value is "
2010
"/var/www. No site is configured there, but if you uncomment the "
2011
"<emphasis>RedirectMatch</emphasis> directive in "
2012
"<filename>/etc/apache2/apache2.conf</filename> requests will be redirected "
2013
"to /var/www/apache2-default where the default Apache2 site awaits. Change "
2014
"this value in your site's virtual host file, and remember to create that "
2015
"directory if necessary!"
2016
msgstr ""
2017
2018
#: serverguide/C/web-servers.xml:254(para)
2019
msgid ""
2020
"The /etc/apache2/sites-available directory is <emphasis role=\"bold\"> "
2021
"not</emphasis> parsed by Apache2. Symbolic links in /etc/apache2/sites-"
2022
"enabled point to \"available\" sites."
2023
msgstr ""
2024
2025
#: serverguide/C/web-servers.xml:260(para)
2026
msgid ""
2027
"Enable the new <emphasis>VirtualHost</emphasis> using the "
2028
"<application>a2ensite</application> utility and restart Apache2:"
2029
msgstr ""
2030
2031
#: serverguide/C/web-servers.xml:266(command)
2032
msgid "sudo a2ensite mynewsite"
2033
msgstr ""
2034
2035
#: serverguide/C/web-servers.xml:267(command) serverguide/C/web-servers.xml:285(command) serverguide/C/web-servers.xml:538(command) serverguide/C/web-servers.xml:547(command) serverguide/C/web-servers.xml:606(command) serverguide/C/mail.xml:932(command) serverguide/C/lamp-applications.xml:228(command)
2036
msgid "sudo /etc/init.d/apache2 restart"
2037
msgstr ""
2038
2039
#: serverguide/C/web-servers.xml:271(para)
2040
msgid ""
2041
"Be sure to replace <emphasis>mynewsite</emphasis> with a more descriptive "
2042
"name for the VirtualHost. One method is to name the file after the "
2043
"<emphasis>ServerName</emphasis> directive of the VirtualHost."
2044
msgstr ""
2045
2046
#: serverguide/C/web-servers.xml:278(para)
2047
msgid ""
2048
"Similarly, use the <application>a2dissite</application> utility to disable "
2049
"sites. This is can be useful when troubleshooting configuration problems "
2050
"with multiple VirtualHosts:"
2051
msgstr ""
2052
2053
#: serverguide/C/web-servers.xml:284(command)
2054
msgid "sudo a2dissite mynewsite"
2055
msgstr ""
2056
2057
#: serverguide/C/web-servers.xml:290(title)
2058
msgid "Default Settings"
2059
msgstr ""
2060
2061
#: serverguide/C/web-servers.xml:292(para)
2062
msgid ""
2063
"This section explains configuration of the Apache2 server default settings. "
2064
"For example, if you add a virtual host, the settings you configure for the "
2065
"virtual host take precedence for that virtual host. For a directive not "
2066
"defined within the virtual host settings, the default value is used."
2067
msgstr ""
2068
2069
#: serverguide/C/web-servers.xml:304(para)
2070
msgid ""
2071
"The <emphasis>DirectoryIndex</emphasis> is the default page served by the "
2072
"server when a user requests an index of a directory by specifying a forward "
2073
"slash (/) at the end of the directory name."
2074
msgstr ""
2075
2076
#: serverguide/C/web-servers.xml:311(para)
2077
msgid ""
2078
"For example, when a user requests the page "
2079
"http://www.example.com/this_directory/, he or she will get either the "
2080
"DirectoryIndex page if it exists, a server-generated directory list if it "
2081
"does not and the Indexes option is specified, or a Permission Denied page if "
2082
"neither is true. The server will try to find one of the files listed in the "
2083
"DirectoryIndex directive and will return the first one it finds. If it does "
2084
"not find any of these files and if <emphasis>Options Indexes</emphasis> is "
2085
"set for that directory, the server will generate and return a list, in HTML "
2086
"format, of the subdirectories and files in the directory. The default value, "
2087
"found in <filename>/etc/apache2/mods-available/dir.conf</filename> is "
2088
"\"index.html index.cgi index.pl index.php index.xhtml index.htm\". Thus, if "
2089
"Apache2 finds a file in a requested directory matching any of these names, "
2090
"the first will be displayed."
2091
msgstr ""
2092
2093
#: serverguide/C/web-servers.xml:332(para)
2094
msgid ""
2095
"The <emphasis>ErrorDocument</emphasis> directive allows you to specify a "
2096
"file for Apache2 to use for specific error events. For example, if a user "
2097
"requests a resource that does not exist, a 404 error will occur, and per "
2098
"Apache2's default configuration, the file "
2099
"<filename>/usr/share/apache2/error/HTTP_NOT_FOUND.html.var </filename> will "
2100
"be displayed. That file is not in the server's DocumentRoot, but there is an "
2101
"Alias directive in <filename>/etc/apache2/apache2.conf</filename> that "
2102
"redirects requests to the /error directory to "
2103
"<filename>/usr/share/apache2/error/</filename>."
2104
msgstr ""
2105
2106
#: serverguide/C/web-servers.xml:344(para)
2107
msgid ""
2108
"To see a list of the default ErrorDocument directives, use this command:"
2109
msgstr ""
2110
2111
#: serverguide/C/web-servers.xml:350(command)
2112
msgid "grep ErrorDocument /etc/apache2/apache2.conf"
2113
msgstr ""
2114
2115
#: serverguide/C/web-servers.xml:355(para)
2116
msgid ""
2117
"By default, the server writes the transfer log to the file "
2118
"<filename>/var/log/apache2/access.log</filename>. You can change this on a "
2119
"per-site basis in your virtual host configuration files with the "
2120
"<emphasis>CustomLog</emphasis> directive, or omit it to accept the default, "
2121
"specified in <filename> /etc/apache2/apache2.conf</filename>. You may also "
2122
"specify the file to which errors are logged, via the "
2123
"<emphasis>ErrorLog</emphasis> directive, whose default is "
2124
"<filename>/var/log/apache2/error.log</filename>. These are kept separate "
2125
"from the transfer logs to aid in troubleshooting problems with your Apache2 "
2126
"server. You may also specify the <emphasis>LogLevel</emphasis> (the default "
2127
"value is \"warn\") and the <emphasis>LogFormat</emphasis> (see <filename> "
2128
"/etc/apache2/apache2.conf</filename> for the default value)."
2129
msgstr ""
2130
2131
#: serverguide/C/web-servers.xml:370(para)
2132
msgid ""
2133
"Some options are specified on a per-directory basis rather than per-server. "
2134
"<emphasis>Options</emphasis> is one of these directives. A Directory stanza "
2135
"is enclosed in XML-like tags, like so:"
2136
msgstr ""
2137
2138
#: serverguide/C/web-servers.xml:376(programlisting)
2139
#, no-wrap
2140
msgid ""
2141
"\n"
2142
"<Directory /var/www/mynewsite>\n"
2143
"...\n"
2144
"</Directory>\n"
2145
msgstr ""
2146
2147
#: serverguide/C/web-servers.xml:382(para)
2148
msgid ""
2149
"The <emphasis>Options</emphasis> directive within a Directory stanza accepts "
2150
"one or more of the following values (among others), separated by spaces:"
2151
msgstr ""
2152
2153
#: serverguide/C/web-servers.xml:394(para)
2154
msgid ""
2155
"Most files should not be executed as CGI scripts. This would be very "
2156
"dangerous. CGI scripts should kept in a directory separate from and outside "
2157
"your DocumentRoot, and only this directory should have the ExecCGI option "
2158
"set. This is the default, and the default location for CGI scripts is "
2159
"<filename>/usr/lib/cgi-bin</filename>."
2160
msgstr ""
2161
2162
#: serverguide/C/web-servers.xml:389(para)
2163
msgid ""
2164
"<emphasis role=\"bold\">ExecCGI</emphasis> - Allow execution of CGI scripts. "
2165
"CGI scripts are not executed if this option is not chosen. <placeholder-1/>"
2166
msgstr ""
2167
2168
#: serverguide/C/web-servers.xml:405(para)
2169
msgid ""
2170
"<emphasis role=\"bold\">Includes</emphasis> - Allow server-side includes. "
2171
"Server-side includes allow an HTML file to <emphasis> include</emphasis> "
2172
"other files. This is not a common option. See <ulink "
2173
"url=\"http://httpd.apache.org/docs/2.2/howto/ssi.html\">the Apache2 SSI "
2174
"HOWTO</ulink> for more information."
2175
msgstr ""
2176
2177
#: serverguide/C/web-servers.xml:414(para)
2178
msgid ""
2179
"<emphasis role=\"bold\">IncludesNOEXEC</emphasis> - Allow server-side "
2180
"includes, but disable the <emphasis>#exec</emphasis> and "
2181
"<emphasis>#include</emphasis> commands in CGI scripts."
2182
msgstr ""
2183
2184
#: serverguide/C/web-servers.xml:426(para)
2185
msgid ""
2186
"For security reasons, this should usually not be set, and certainly should "
2187
"not be set on your DocumentRoot directory. Enable this option carefully on a "
2188
"per-directory basis only if you are certain you want users to see the entire "
2189
"contents of the directory."
2190
msgstr ""
2191
2192
#: serverguide/C/web-servers.xml:421(para)
2193
msgid ""
2194
"<emphasis role=\"bold\">Indexes</emphasis> - Display a formatted list of the "
2195
"directory's contents, if no <emphasis>DirectoryIndex</emphasis> (such as "
2196
"index.html) exists in the requested directory. <placeholder-1/>"
2197
msgstr ""
2198
2199
#: serverguide/C/web-servers.xml:436(para)
2200
msgid ""
2201
"<emphasis role=\"bold\">Multiview</emphasis> - Support content-negotiated "
2202
"multiviews; this option is disabled by default for security reasons. See the "
2203
"<ulink "
2204
"url=\"http://httpd.apache.org/docs/2.2/mod/mod_negotiation.html#multiviews\">"
2205
"Apache2 documentation on this option</ulink>."
2206
msgstr ""
2207
2208
#: serverguide/C/web-servers.xml:444(para)
2209
msgid ""
2210
"<emphasis role=\"bold\">SymLinksIfOwnerMatch</emphasis> - Only follow "
2211
"symbolic links if the target file or directory has the same owner as the "
2212
"link."
2213
msgstr ""
2214
2215
#: serverguide/C/web-servers.xml:456(title)
2216
msgid "httpd Settings"
2217
msgstr ""
2218
2219
#: serverguide/C/web-servers.xml:458(para)
2220
msgid ""
2221
"This section explains some basic <application>httpd</application> daemon "
2222
"configuration settings."
2223
msgstr ""
2224
2225
#: serverguide/C/web-servers.xml:462(para)
2226
msgid ""
2227
"<emphasis role=\"bold\">LockFile</emphasis> - The LockFile directive sets "
2228
"the path to the lockfile used when the server is compiled with either "
2229
"USE_FCNTL_SERIALIZED_ACCEPT or USE_FLOCK_SERIALIZED_ACCEPT. It must be "
2230
"stored on the local disk. It should be left to the default value unless the "
2231
"logs directory is located on an NFS share. If this is the case, the default "
2232
"value should be changed to a location on the local disk and to a directory "
2233
"that is readable only by root."
2234
msgstr ""
2235
2236
#: serverguide/C/web-servers.xml:471(para)
2237
msgid ""
2238
"<emphasis role=\"bold\">PidFile</emphasis> - The PidFile directive sets the "
2239
"file in which the server records its process ID (pid). This file should only "
2240
"be readable by root. In most cases, it should be left to the default value."
2241
msgstr ""
2242
2243
#: serverguide/C/web-servers.xml:477(para)
2244
msgid ""
2245
"<emphasis role=\"bold\">User</emphasis> - The User directive sets the userid "
2246
"used by the server to answer requests. This setting determines the server's "
2247
"access. Any files inaccessible to this user will also be inaccessible to "
2248
"your website's visitors. The default value for User is www-data."
2249
msgstr ""
2250
2251
#: serverguide/C/web-servers.xml:484(para)
2252
msgid ""
2253
"Unless you know exactly what you are doing, do not set the User directive to "
2254
"root. Using root as the User will create large security holes for your Web "
2255
"server."
2256
msgstr ""
2257
2258
#: serverguide/C/web-servers.xml:490(para)
2259
msgid ""
2260
"The Group directive is similar to the User directive. Group sets the group "
2261
"under which the server will answer requests. The default group is also www-"
2262
"data."
2263
msgstr ""
2264
2265
#: serverguide/C/web-servers.xml:496(title)
2266
msgid "Apache2 Modules"
2267
msgstr ""
2268
2269
#: serverguide/C/web-servers.xml:498(para)
2270
msgid ""
2271
"Apache2 is a modular server. This implies that only the most basic "
2272
"functionality is included in the core server. Extended features are "
2273
"available through modules which can be loaded into Apache2. By default, a "
2274
"base set of modules is included in the server at compile-time. If the server "
2275
"is compiled to use dynamically loaded modules, then modules can be compiled "
2276
"separately, and added at any time using the LoadModule directive. Otherwise, "
2277
"Apache2 must be recompiled to add or remove modules."
2278
msgstr ""
2279
2280
#: serverguide/C/web-servers.xml:510(para)
2281
msgid ""
2282
"Ubuntu compiles Apache2 to allow the dynamic loading of modules. "
2283
"Configuration directives may be conditionally included on the presence of a "
2284
"particular module by enclosing them in an "
2285
"<emphasis><IfModule></emphasis> block."
2286
msgstr ""
2287
2288
#: serverguide/C/web-servers.xml:517(para)
2289
msgid ""
2290
"You can install additional Apache2 modules and use them with your Web "
2291
"server. For example, run the following command from a terminal prompt to "
2292
"install the <emphasis>MySQL Authentication</emphasis> module:"
2293
msgstr ""
2294
2295
#: serverguide/C/web-servers.xml:524(command)
2296
msgid "sudo apt-get install libapache2-mod-auth-mysql"
2297
msgstr ""
2298
2299
#: serverguide/C/web-servers.xml:527(para)
2300
msgid ""
2301
"See the <filename>/etc/apache2/mods-available</filename> directory, for "
2302
"additional modules."
2303
msgstr ""
2304
2305
#: serverguide/C/web-servers.xml:531(para)
2306
msgid ""
2307
"Use the <application>a2enmod</application> utility to enable a module:"
2308
msgstr ""
2309
2310
#: serverguide/C/web-servers.xml:537(command)
2311
msgid "sudo a2enmod auth_mysql"
2312
msgstr ""
2313
2314
#: serverguide/C/web-servers.xml:541(para)
2315
msgid "Similarly, <application>a2dismod</application> will disable a module:"
2316
msgstr ""
2317
2318
#: serverguide/C/web-servers.xml:546(command)
2319
msgid "sudo a2dismod auth_mysql"
2320
msgstr ""
2321
2322
#: serverguide/C/web-servers.xml:553(title)
2323
msgid "HTTPS Configuration"
2324
msgstr ""
2325
2326
#: serverguide/C/web-servers.xml:555(para)
2327
msgid ""
2328
"The <application>mod_ssl</application> module adds an important feature to "
2329
"the Apache2 server - the ability to encrypt communications. Thus, when your "
2330
"browser is communicating using SSL, the https:// prefix is used at the "
2331
"beginning of the Uniform Resource Locator (URL) in the browser navigation "
2332
"bar."
2333
msgstr ""
2334
2335
#: serverguide/C/web-servers.xml:564(para)
2336
msgid ""
2337
"The <application>mod_ssl</application> module is available in "
2338
"<application>apache2-common</application> package. Execute the following "
2339
"command from a terminal prompt to enable the "
2340
"<application>mod_ssl</application> module:"
2341
msgstr ""
2342
2343
#: serverguide/C/web-servers.xml:571(command)
2344
msgid "sudo a2enmod ssl"
2345
msgstr ""
2346
2347
#: serverguide/C/web-servers.xml:574(para)
2348
msgid ""
2349
"There is a default HTTPS configuration file in <filename>/etc/apache2/sites-"
2350
"available/default-ssl</filename>. In order for "
2351
"<application>Apache2</application> to provide HTTPS, a "
2352
"<emphasis>certificate</emphasis> and <emphasis>key</emphasis> file are also "
2353
"needed. The default HTTPS configuration will use a certificate and key "
2354
"generated by the <application>ssl-cert</application> package. They are good "
2355
"for testing, but the auto-generated certificate and key should be replaced "
2356
"by a certificate specific to the site or server. For information on "
2357
"generating a key and obtaining a certificate see <xref "
2358
"linkend=\"certificates-and-security\"/>"
2359
msgstr ""
2360
2361
#: serverguide/C/web-servers.xml:584(para)
2362
msgid ""
2363
"To configure <application>Apache2</application> for HTTPS, enter the "
2364
"following:"
2365
msgstr ""
2366
2367
#: serverguide/C/web-servers.xml:589(command)
2368
msgid "sudo a2ensite default-ssl"
2369
msgstr ""
2370
2371
#: serverguide/C/web-servers.xml:593(para)
2372
msgid ""
2373
"The directories <filename>/etc/ssl/certs</filename> and "
2374
"<filename>/etc/ssl/private</filename> are the default locations. If you "
2375
"install the certificate and key in another directory make sure to change "
2376
"<emphasis>SSLCertificateFile</emphasis> and "
2377
"<emphasis>SSLCertificateKeyFile</emphasis> appropriately."
2378
msgstr ""
2379
2380
#: serverguide/C/web-servers.xml:600(para)
2381
msgid ""
2382
"With Apache2 now configured for HTTPS, restart the service to enable the new "
2383
"settings:"
2384
msgstr ""
2385
2386
#: serverguide/C/web-servers.xml:611(para)
2387
msgid ""
2388
"Depending on how you obtained your certificate you may need to enter a "
2389
"passphrase when <application>Apache2</application> starts."
2390
msgstr ""
2391
2392
#: serverguide/C/web-servers.xml:617(para)
2393
msgid ""
2394
"You can access the secure server pages by typing https://your_hostname/url/ "
2395
"in your browser address bar."
2396
msgstr ""
2397
2398
#: serverguide/C/web-servers.xml:628(para)
2399
msgid ""
2400
"<ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
2401
"Documentation</ulink> contains in depth information on Apache2 configuration "
2402
"directives. Also, see the <application>apache2-doc</application> package for "
2403
"the official Apache2 docs."
2404
msgstr ""
2405
2406
#: serverguide/C/web-servers.xml:635(para)
2407
msgid ""
2408
"See the <ulink url=\"http://www.modssl.org/docs/\">Mod SSL "
2409
"Documentation</ulink> site for more SSL related information."
2410
msgstr ""
2411
2412
#: serverguide/C/web-servers.xml:641(para)
2413
msgid ""
2414
"O'Reilly's <ulink url=\"http://oreilly.com/catalog/9780596001919/\">Apache "
2415
"Cookbook</ulink> is a good resource for accomplishing specific Apache2 "
2416
"configurations."
2417
msgstr ""
2418
2419
#: serverguide/C/web-servers.xml:647(para)
2420
msgid ""
2421
"For Ubuntu specific Apache2 questions, ask in the <emphasis>#ubuntu-"
2422
"server</emphasis> IRC channel on <ulink "
2423
"url=\"http://freenode.net/\">freenode.net</ulink>."
2424
msgstr ""
2425
2426
#: serverguide/C/web-servers.xml:653(para)
2427
msgid ""
2428
"Usually integrated with PHP and MySQL the <ulink "
2429
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2430
"Ubuntu Wiki </ulink> page is a good resource."
2431
msgstr ""
2432
2433
#: serverguide/C/web-servers.xml:664(title)
2434
msgid "PHP5 - Scripting Language"
2435
msgstr ""
2436
2437
#: serverguide/C/web-servers.xml:665(para)
2438
msgid ""
2439
"PHP is a general-purpose scripting language suited for Web development. The "
2440
"PHP script can be embedded into HTML. This section explains how to install "
2441
"and configure PHP5 in Ubuntu System with Apache2 and MySQL."
2442
msgstr ""
2443
2444
#: serverguide/C/web-servers.xml:669(para)
2445
msgid ""
2446
"This section assumes you have installed and configured Apache2 Web Server "
2447
"and MySQL Database Server. You can refer to Apache2 section and MySQL "
2448
"sections in this document to install and configure Apache2 and MySQL "
2449
"respectively."
2450
msgstr ""
2451
2452
#: serverguide/C/web-servers.xml:676(para)
2453
msgid "The PHP5 is available in Ubuntu Linux."
2454
msgstr ""
2455
2456
#: serverguide/C/web-servers.xml:678(para)
2457
msgid ""
2458
"To install PHP5 you can enter the following command in the terminal prompt: "
2459
"<screen>\n"
2460
"<command>sudo apt-get install php5 libapache2-mod-php5</command>\n"
2461
"</screen>"
2462
msgstr ""
2463
2464
#: serverguide/C/web-servers.xml:687(para)
2465
msgid ""
2466
"You can run PHP5 scripts from command line. To run PHP5 scripts from command "
2467
"line you should install <application>php5-cli</application> package. To "
2468
"install <application>php5-cli</application> you can enter the following "
2469
"command in the terminal prompt: <screen>\n"
2470
"<command>sudo apt-get install php5-cli</command>\n"
2471
"</screen>"
2472
msgstr ""
2473
2474
#: serverguide/C/web-servers.xml:696(para)
2475
msgid ""
2476
"You can also execute PHP5 scripts without installing PHP5 Apache module. To "
2477
"accomplish this, you should install <application>php5-cgi</application> "
2478
"package. You can run the following command in a terminal prompt to install "
2479
"<application>php5-cgi</application> package: <screen>\n"
2480
"<command>sudo apt-get install php5-cgi</command>\n"
2481
"</screen>"
2482
msgstr ""
2483
2484
#: serverguide/C/web-servers.xml:706(para)
2485
msgid ""
2486
"To use <application>MySQL</application> with PHP5 you should install "
2487
"<application>php5-mysql</application> package. To install <application>php5-"
2488
"mysql</application> you can enter the following command in the terminal "
2489
"prompt: <screen>\n"
2490
"<command>sudo apt-get install php5-mysql</command>\n"
2491
"</screen>"
2492
msgstr ""
2493
2494
#: serverguide/C/web-servers.xml:714(para)
2495
msgid ""
2496
"Similarly, to use <application>PostgreSQL</application> with PHP5 you should "
2497
"install <application>php5-pgsql</application> package. To install "
2498
"<application>php5-pgsql</application> you can enter the following command in "
2499
"the terminal prompt: <screen>\n"
2500
"<command>sudo apt-get install php5-pgsql</command>\n"
2501
"</screen>"
2502
msgstr ""
2503
2504
#: serverguide/C/web-servers.xml:727(para)
2505
msgid ""
2506
"Once you install PHP5, you can run PHP5 scripts from your web browser. If "
2507
"you have installed <application>php5-cli</application> package, you can run "
2508
"PHP5 scripts from your command prompt."
2509
msgstr ""
2510
2511
#: serverguide/C/web-servers.xml:734(para)
2512
msgid ""
2513
"By default, the Apache 2 Web server is configured to run PHP5 scripts. In "
2514
"other words, the PHP5 module is enabled in Apache2 Web server automatically "
2515
"when you install the module. Please verify if the files "
2516
"<filename>/etc/apache2/mods-enabled/php5.conf</filename> and "
2517
"<filename>/etc/apache2/mods-enabled/php5.load</filename> exist. If they do "
2518
"not exists, you can enable the module using <command>a2enmod</command> "
2519
"command."
2520
msgstr ""
2521
2522
#: serverguide/C/web-servers.xml:745(para)
2523
msgid ""
2524
"Once you install PHP5 related packages and enabled PHP5 Apache 2 module, you "
2525
"should restart Apache2 Web server to run PHP5 scripts. You can run the "
2526
"following command at a terminal prompt to restart your web server: "
2527
"<screen><command>sudo /etc/init.d/apache2 restart</command> </screen>"
2528
msgstr ""
2529
2530
#: serverguide/C/web-servers.xml:753(title) serverguide/C/mail.xml:320(title) serverguide/C/mail.xml:1569(title) serverguide/C/dns.xml:343(title) serverguide/C/clustering.xml:184(title)
2531
msgid "Testing"
2532
msgstr ""
2533
2534
#: serverguide/C/web-servers.xml:754(para)
2535
msgid ""
2536
"To verify your installation, you can run following PHP5 phpinfo script:"
2537
msgstr ""
2538
2539
#: serverguide/C/web-servers.xml:757(programlisting)
2540
#, no-wrap
2541
msgid ""
2542
"\n"
2543
"<?php\n"
2544
" phpinfo();\n"
2545
"?>\n"
2546
msgstr ""
2547
2548
#: serverguide/C/web-servers.xml:762(para)
2549
msgid ""
2550
"You can save the content in a file <filename>phpinfo.php</filename> and "
2551
"place it under <command>DocumentRoot</command> directory of Apache2 Web "
2552
"server. When point your browser to "
2553
"<filename>http://hostname/phpinfo.php</filename>, it would display values of "
2554
"various PHP5 configuration parameters."
2555
msgstr ""
2556
2557
#: serverguide/C/web-servers.xml:776(para)
2558
msgid ""
2559
"For more in depth information see <ulink "
2560
"url=\"http://www.php.net/docs.php\">php.net</ulink> documentation."
2561
msgstr ""
2562
2563
#: serverguide/C/web-servers.xml:781(para)
2564
msgid ""
2565
"There are a plethora of books on PHP. Two good books from O'Reilly are "
2566
"<ulink url=\"http://oreilly.com/catalog/9780596005603/\">Learning PHP "
2567
"5</ulink> and the <ulink "
2568
"url=\"http://oreilly.com/catalog/9781565926813/\">PHP Cook Book</ulink>."
2569
msgstr ""
2570
2571
#: serverguide/C/web-servers.xml:788(para)
2572
msgid ""
2573
"Also, see the <ulink "
2574
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2575
"Ubuntu Wiki</ulink> page for more information."
2576
msgstr ""
2577
2578
#: serverguide/C/web-servers.xml:799(title)
2579
msgid "Squid - Proxy Server"
2580
msgstr ""
2581
2582
#: serverguide/C/web-servers.xml:800(para)
2583
msgid ""
2584
"Squid is a full-featured web proxy cache server application which provides "
2585
"proxy and cache services for Hyper Text Transport Protocol (HTTP), File "
2586
"Transfer Protocol (FTP), and other popular network protocols. Squid can "
2587
"implement caching and proxying of Secure Sockets Layer (SSL) requests and "
2588
"caching of Domain Name Server (DNS) lookups, and perform transparent "
2589
"caching. Squid also supports a wide variety of caching protocols, such as "
2590
"Internet Cache Protocol, (ICP) the Hyper Text Caching Protocol, (HTCP) the "
2591
"Cache Array Routing Protocol (CARP), and the Web Cache Coordination "
2592
"Protocol. (WCCP)"
2593
msgstr ""
2594
2595
#: serverguide/C/web-servers.xml:808(para)
2596
msgid ""
2597
"The Squid proxy cache server is an excellent solution to a variety of proxy "
2598
"and caching server needs, and scales from the branch office to enterprise "
2599
"level networks while providing extensive, granular access control mechanisms "
2600
"and monitoring of critical parameters via the Simple Network Management "
2601
"Protocol (SNMP). When selecting a computer system for use as a dedicated "
2602
"Squid proxy, or caching servers, ensure your system is configured with a "
2603
"large amount of physical memory, as Squid maintains an in-memory cache for "
2604
"increased performance."
2605
msgstr ""
2606
2607
#: serverguide/C/web-servers.xml:817(para)
2608
msgid ""
2609
"At a terminal prompt, enter the following command to install the Squid "
2610
"server:"
2611
msgstr ""
2612
2613
#: serverguide/C/web-servers.xml:822(command)
2614
msgid "sudo apt-get install squid"
2615
msgstr ""
2616
2617
#: serverguide/C/web-servers.xml:828(para)
2618
msgid ""
2619
"Squid is configured by editing the directives contained within the "
2620
"<filename>/etc/squid/squid.conf</filename> configuration file. The following "
2621
"examples illustrate some of the directives which may be modified to affect "
2622
"the behavior of the Squid server. For more in-depth configuration of Squid, "
2623
"see the References section."
2624
msgstr ""
2625
2626
#: serverguide/C/web-servers.xml:834(para)
2627
msgid ""
2628
"Prior to editing the configuration file, you should make a copy of the "
2629
"original file and protect it from writing so you will have the original "
2630
"settings as a reference, and to re-use as necessary."
2631
msgstr ""
2632
2633
#: serverguide/C/web-servers.xml:837(para)
2634
msgid ""
2635
"Copy the <filename>/etc/squid/squid.conf</filename> file and protect it from "
2636
"writing with the following commands entered at a terminal prompt:"
2637
msgstr ""
2638
2639
#: serverguide/C/web-servers.xml:842(command)
2640
msgid "sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original"
2641
msgstr ""
2642
2643
#: serverguide/C/web-servers.xml:843(command)
2644
msgid "sudo chmod a-w /etc/squid/squid.conf.original"
2645
msgstr ""
2646
2647
#: serverguide/C/web-servers.xml:849(para)
2648
msgid ""
2649
"To set your Squid server to listen on TCP port 8888 instead of the default "
2650
"TCP port 3128, change the http_port directive as such:"
2651
msgstr ""
2652
2653
#: serverguide/C/web-servers.xml:853(programlisting)
2654
#, no-wrap
2655
msgid ""
2656
"\n"
2657
"http_port 8888\n"
2658
msgstr ""
2659
2660
#: serverguide/C/web-servers.xml:858(para)
2661
msgid ""
2662
"Change the visible_hostname directive in order to give the Squid server a "
2663
"specific hostname. This hostname does not necessarily need to be the "
2664
"computer's hostname. In this example it is set to <emphasis>weezie</emphasis>"
2665
msgstr ""
2666
2667
#: serverguide/C/web-servers.xml:862(programlisting)
2668
#, no-wrap
2669
msgid ""
2670
"\n"
2671
"visible_hostname weezie\n"
2672
msgstr ""
2673
2674
#: serverguide/C/web-servers.xml:867(para)
2675
msgid ""
2676
"Using Squid's access control, you may configure use of Internet services "
2677
"proxied by Squid to be available only users with certain Internet Protocol "
2678
"(IP) addresses. For example, we will illustrate access by users of the "
2679
"192.168.42.0/24 subnetwork only:"
2680
msgstr ""
2681
2682
#: serverguide/C/web-servers.xml:872(para) serverguide/C/web-servers.xml:892(para)
2683
msgid ""
2684
"Add the following to the <emphasis role=\"bold\">bottom</emphasis> of the "
2685
"ACL section of your <filename>/etc/squid/squid.conf</filename> file:"
2686
msgstr ""
2687
2688
#: serverguide/C/web-servers.xml:875(programlisting)
2689
#, no-wrap
2690
msgid ""
2691
"\n"
2692
"acl fortytwo_network src 192.168.42.0/24\n"
2693
msgstr ""
2694
2695
#: serverguide/C/web-servers.xml:878(para) serverguide/C/web-servers.xml:899(para)
2696
msgid ""
2697
"Then, add the following to the <emphasis role=\"bold\">top</emphasis> of the "
2698
"http_access section of your <filename>/etc/squid/squid.conf</filename> file:"
2699
msgstr ""
2700
2701
#: serverguide/C/web-servers.xml:882(programlisting)
2702
#, no-wrap
2703
msgid ""
2704
"\n"
2705
"http_access allow fortytwo_network\n"
2706
msgstr ""
2707
2708
#: serverguide/C/web-servers.xml:887(para)
2709
msgid ""
2710
"Using the excellent access control features of Squid, you may configure use "
2711
"of Internet services proxied by Squid to be available only during normal "
2712
"business hours. For example, we'll illustrate access by employees of a "
2713
"business which is operating between 9:00AM and 5:00PM, Monday through "
2714
"Friday, and which uses the 10.1.42.0/42 subnetwork:"
2715
msgstr ""
2716
2717
#: serverguide/C/web-servers.xml:895(programlisting)
2718
#, no-wrap
2719
msgid ""
2720
"\n"
2721
"acl biz_network src 10.1.42.0/24\n"
2722
"acl biz_hours time M T W T F 9:00-17:00\n"
2723
msgstr ""
2724
2725
#: serverguide/C/web-servers.xml:903(programlisting)
2726
#, no-wrap
2727
msgid ""
2728
"\n"
2729
"http_access allow biz_network biz_hours\n"
2730
msgstr ""
2731
2732
#: serverguide/C/web-servers.xml:910(para)
2733
msgid ""
2734
"After making changes to the <filename>/etc/squid/squid.conf</filename> file, "
2735
"save the file and restart the <application>squid</application> server "
2736
"application to effect the changes using the following command entered at a "
2737
"terminal prompt:"
2738
msgstr ""
2739
2740
#: serverguide/C/web-servers.xml:917(command)
2741
msgid "sudo /etc/init.d/squid restart"
2742
msgstr ""
2743
2744
#: serverguide/C/web-servers.xml:924(ulink)
2745
msgid "Squid Website"
2746
msgstr ""
2747
2748
#: serverguide/C/web-servers.xml:926(para)
2749
msgid ""
2750
"<ulink url=\"https://help.ubuntu.com/community/Squid\">Ubuntu Wiki "
2751
"Squid</ulink> page."
2752
msgstr ""
2753
2754
#: serverguide/C/web-servers.xml:933(title)
2755
msgid "Ruby on Rails"
2756
msgstr ""
2757
2758
#: serverguide/C/web-servers.xml:934(para)
2759
msgid ""
2760
"Ruby on Rails is an open source web framework for developing database backed "
2761
"web applications. It is optimized for sustainable productivity of the "
2762
"programmer since it lets the programmer to write code by favouring "
2763
"convention over configuration."
2764
msgstr ""
2765
2766
#: serverguide/C/web-servers.xml:941(para)
2767
msgid ""
2768
"Before installing <application>Rails</application> you should install "
2769
"<application>Apache</application> and <application>MySQL</application>. To "
2770
"install the <application>Apache</application> package, please refer to <xref "
2771
"linkend=\"httpd\"/>. For instructions on installing "
2772
"<application>MySQL</application> refer to <xref linkend=\"mysql\"/>."
2773
msgstr ""
2774
2775
#: serverguide/C/web-servers.xml:949(para)
2776
msgid ""
2777
"Once you have <application>Apache</application> and "
2778
"<application>MySQL</application> packages installed, you are ready to "
2779
"install <application>Ruby on Rails</application> package."
2780
msgstr ""
2781
2782
#: serverguide/C/web-servers.xml:956(para)
2783
msgid ""
2784
"To install the <application>Ruby</application> base packages and "
2785
"<application>Ruby on Rails</application>, you can enter the following "
2786
"command in the terminal prompt:"
2787
msgstr ""
2788
2789
#: serverguide/C/web-servers.xml:962(command)
2790
msgid "sudo apt-get install rails"
2791
msgstr ""
2792
2793
#: serverguide/C/web-servers.xml:968(para)
2794
msgid ""
2795
"Modify the <filename>/etc/apache2/sites-available/default</filename> "
2796
"configuration file to setup your domains."
2797
msgstr ""
2798
2799
#: serverguide/C/web-servers.xml:972(para)
2800
msgid ""
2801
"The first thing to change is the <emphasis>DocumentRoot</emphasis> directive:"
2802
msgstr ""
2803
2804
#: serverguide/C/web-servers.xml:976(programlisting)
2805
#, no-wrap
2806
msgid ""
2807
"\n"
2808
"DocumentRoot /path/to/rails/application/public\n"
2809
msgstr ""
2810
2811
#: serverguide/C/web-servers.xml:979(para)
2812
msgid ""
2813
"Next, change the <Directory \"/path/to/rails/application/public\"> "
2814
"directive:"
2815
msgstr ""
2816
2817
#: serverguide/C/web-servers.xml:983(programlisting)
2818
#, no-wrap
2819
msgid ""
2820
"\n"
2821
"<Directory \"/path/to/rails/application/public\">\n"
2822
" Options Indexes FollowSymLinks MultiViews ExecCGI\n"
2823
" AllowOverride All\n"
2824
" Order allow,deny\n"
2825
" allow from all\n"
2826
" AddHandler cgi-script .cgi\n"
2827
"</Directory>\n"
2828
msgstr ""
2829
2830
#: serverguide/C/web-servers.xml:993(para)
2831
msgid ""
2832
"You should also enable the <application>mod_rewrite</application> module for "
2833
"Apache. To enable <application>mod_rewrite</application> module, please "
2834
"enter the following command in a terminal prompt:"
2835
msgstr ""
2836
2837
#: serverguide/C/web-servers.xml:999(command)
2838
msgid "sudo a2enmod rewrite"
2839
msgstr ""
2840
2841
#: serverguide/C/web-servers.xml:1002(para)
2842
msgid ""
2843
"Finally you will need to change the ownership of the "
2844
"<filename>/path/to/rails/application/public</filename> and "
2845
"<filename>/path/to/rails/application/tmp</filename> directories to the user "
2846
"used to run the <application>Apache</application> process:"
2847
msgstr ""
2848
2849
#: serverguide/C/web-servers.xml:1008(command)
2850
msgid "sudo chown -R www-data:www-data /path/to/rails/application/public"
2851
msgstr ""
2852
2853
#: serverguide/C/web-servers.xml:1009(command)
2854
msgid "sudo chown -R www-data:www-data /path/to/rails/application/tmp"
2855
msgstr ""
2856
2857
#: serverguide/C/web-servers.xml:1012(para)
2858
msgid ""
2859
"That's it! Now you have your Server ready for your <application>Ruby on "
2860
"Rails</application> applications."
2861
msgstr ""
2862
2863
#: serverguide/C/web-servers.xml:1021(para)
2864
msgid ""
2865
"See the <ulink url=\"http://rubyonrails.org/\">Ruby on Rails</ulink> website "
2866
"for more information."
2867
msgstr ""
2868
2869
#: serverguide/C/web-servers.xml:1026(para)
2870
msgid ""
2871
"Also <ulink url=\"http://pragprog.com/titles/rails3/agile-web-development-"
2872
"with-rails-third-edition\">Agile Development with Rails</ulink> is a great "
2873
"resource."
2874
msgstr ""
2875
2876
#: serverguide/C/web-servers.xml:1032(para)
2877
msgid ""
2878
"Another place for more information is the <ulink "
2879
"url=\"https://help.ubuntu.com/community/RubyOnRails\">Ruby on Rails Ubuntu "
2880
"Wiki</ulink> page."
2881
msgstr ""
2882
2883
#: serverguide/C/web-servers.xml:1043(title)
2884
msgid "Apache Tomcat"
2885
msgstr ""
2886
2887
#: serverguide/C/web-servers.xml:1044(para)
2888
msgid ""
2889
"Apache Tomcat is a web container that allows you to serve Java Servlets and "
2890
"JSP (Java Server Pages) web applications."
2891
msgstr ""
2892
2893
#: serverguide/C/web-servers.xml:1046(para)
2894
msgid ""
2895
"The <application>Tomcat 6.0</application> packages in Ubuntu support two "
2896
"different ways of running Tomcat. You can install them as a classic unique "
2897
"system-wide instance, that will be started at boot time and will run as the "
2898
"tomcat6 unpriviledged user. But you can also deploy private instances that "
2899
"will run with your own user rights, and that you should start and stop by "
2900
"yourself. This second way is particularly useful in a development server "
2901
"context where multiple users need to test on their own private Tomcat "
2902
"instances."
2903
msgstr ""
2904
2905
#: serverguide/C/web-servers.xml:1056(title)
2906
msgid "System-wide installation"
2907
msgstr ""
2908
2909
#: serverguide/C/web-servers.xml:1057(para)
2910
msgid ""
2911
"To install the <application>Tomcat</application> server, you can enter the "
2912
"following command in the terminal prompt:"
2913
msgstr ""
2914
2915
#: serverguide/C/web-servers.xml:1060(command)
2916
msgid "sudo apt-get install tomcat6"
2917
msgstr ""
2918
2919
#: serverguide/C/web-servers.xml:1062(para)
2920
msgid ""
2921
"This will install a Tomcat server with just a default ROOT webapp that "
2922
"displays a minimal \"It works\" page by default."
2923
msgstr ""
2924
2925
#: serverguide/C/web-servers.xml:1068(para)
2926
msgid ""
2927
"Tomcat configuration files can be found in "
2928
"<filename>/etc/tomcat6</filename>. Only a few common configuration tweaks "
2929
"will be described here, please see <ulink "
2930
"url=\"http://tomcat.apache.org/tomcat-6.0-doc/index.html\">Tomcat 6.0 "
2931
"documentation</ulink> for more."
2932
msgstr ""
2933
2934
#: serverguide/C/web-servers.xml:1074(title)
2935
msgid "Changing default ports"
2936
msgstr ""
2937
2938
#: serverguide/C/web-servers.xml:1075(para)
2939
msgid ""
2940
"By default Tomcat 6.0 runs a HTTP connector on port 8080 and an AJP "
2941
"connector on port 8009. You might want to change those default ports to "
2942
"avoid conflict with another server on the system. This is done by changing "
2943
"the following lines in <filename>/etc/tomcat6/server.xml</filename>:"
2944
msgstr ""
2945
2946
#: serverguide/C/web-servers.xml:1080(programlisting)
2947
#, no-wrap
2948
msgid ""
2949
"\n"
2950
"<Connector port=\"8080\" protocol=\"HTTP/1.1\" \n"
2951
" connectionTimeout=\"20000\" \n"
2952
" redirectPort=\"8443\" />\n"
2953
"...\n"
2954
"<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\" "
2955
"/>\n"
2956
msgstr ""
2957
2958
#: serverguide/C/web-servers.xml:1089(title)
2959
msgid "Changing JVM used"
2960
msgstr ""
2961
2962
#: serverguide/C/web-servers.xml:1090(para)
2963
msgid ""
2964
"By default Tomcat will run preferably with OpenJDK-6, then try Sun's JVM, "
2965
"then try some other JVMs. If you have various JVMs installed, you can set "
2966
"which should be used by setting JAVA_HOME in "
2967
"<filename>/etc/default/tomcat6</filename>:"
2968
msgstr ""
2969
2970
#: serverguide/C/web-servers.xml:1094(programlisting)
2971
#, no-wrap
2972
msgid ""
2973
"\n"
2974
"JAVA_HOME=/usr/lib/jvm/java-6-sun\n"
2975
msgstr ""
2976
2977
#: serverguide/C/web-servers.xml:1099(title)
2978
msgid "Declaring users and roles"
2979
msgstr ""
2980
2981
#: serverguide/C/web-servers.xml:1100(para)
2982
msgid ""
2983
"Usernames, passwords and roles (groups) can be defined centrally in a "
2984
"Servlet container. In Tomcat 6.0 this is done in the "
2985
"<filename>/etc/tomcat6/tomcat-users.xml</filename> file:"
2986
msgstr ""
2987
2988
#: serverguide/C/web-servers.xml:1103(programlisting)
2989
#, no-wrap
2990
msgid ""
2991
"\n"
2992
"<role rolename=\"admin\"/>\n"
2993
"<user username=\"tomcat\" password=\"s3cret\" roles=\"admin\"/>\n"
2994
msgstr ""
2995
2996
#: serverguide/C/web-servers.xml:1111(title)
2997
msgid "Using Tomcat standard webapps"
2998
msgstr ""
2999
3000
#: serverguide/C/web-servers.xml:1112(para)
3001
msgid ""
3002
"Tomcat is shipped with webapps that you can install for documentation, "
3003
"administration or demo purposes."
3004
msgstr ""
3005
3006
#: serverguide/C/web-servers.xml:1115(title)
3007
msgid "Tomcat documentation"
3008
msgstr ""
3009
3010
#: serverguide/C/web-servers.xml:1116(para)
3011
msgid ""
3012
"The <application>tomcat6-docs</application> package contains Tomcat 6.0 "
3013
"documentation, packaged as a webapp that you can access by default at "
3014
"http://yourserver:8080/docs. You can install it by entering the following "
3015
"command in the terminal prompt:"
3016
msgstr ""
3017
3018
#: serverguide/C/web-servers.xml:1121(command)
3019
msgid "sudo apt-get install tomcat6-docs"
3020
msgstr ""
3021
3022
#: serverguide/C/web-servers.xml:1125(title)
3023
msgid "Tomcat administration webapps"
3024
msgstr ""
3025
3026
#: serverguide/C/web-servers.xml:1126(para)
3027
msgid ""
3028
"The <application>tomcat6-admin</application> package contains two webapps "
3029
"that can be used to administer the Tomcat server using a web interface. You "
3030
"can install them by entering the following command in the terminal prompt:"
3031
msgstr ""
3032
3033
#: serverguide/C/web-servers.xml:1131(command)
3034
msgid "sudo apt-get install tomcat6-admin"
3035
msgstr ""
3036
3037
#: serverguide/C/web-servers.xml:1133(para)
3038
msgid ""
3039
"The first one is the <emphasis>manager</emphasis> webapp, which you can "
3040
"access by default at http://yourserver:8080/manager/html. It is primarily "
3041
"used to get server status and restart webapps."
3042
msgstr ""
3043
3044
#: serverguide/C/web-servers.xml:1136(para)
3045
msgid ""
3046
"Access to the <emphasis>manager</emphasis> application is protected by "
3047
"default: you need to define a user with the role \"manager\" in "
3048
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3049
msgstr ""
3050
3051
#: serverguide/C/web-servers.xml:1140(para)
3052
msgid ""
3053
"The second one is the <emphasis>host-manager</emphasis> webapp, which you "
3054
"can access by default at http://yourserver:8080/host-manager/html. It can be "
3055
"used to create virtual hosts dynamically."
3056
msgstr ""
3057
3058
#: serverguide/C/web-servers.xml:1144(para)
3059
msgid ""
3060
"Access to the <emphasis>host-manager</emphasis> application is also "
3061
"protected by default: you need to define a user with the role \"admin\" in "
3062
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3063
msgstr ""
3064
3065
#: serverguide/C/web-servers.xml:1149(para)
3066
msgid ""
3067
"For security reasons, the tomcat6 user cannot write to the "
3068
"<filename>/etc/tomcat6</filename> directory by default. Some features in "
3069
"these admin webapps (application deployment, virtual host creation) need "
3070
"write access to that directory. If you want to use these features execute "
3071
"the following, to give users in the tomcat6 group the necessary rights:"
3072
msgstr ""
3073
3074
#: serverguide/C/web-servers.xml:1156(command)
3075
msgid "sudo chgrp -R tomcat6 /etc/tomcat6"
3076
msgstr ""
3077
3078
#: serverguide/C/web-servers.xml:1157(command)
3079
msgid "sudo chmod -R g+w /etc/tomcat6"
3080
msgstr ""
3081
3082
#: serverguide/C/web-servers.xml:1162(title)
3083
msgid "Tomcat examples webapps"
3084
msgstr ""
3085
3086
#: serverguide/C/web-servers.xml:1163(para)
3087
msgid ""
3088
"The <application>tomcat6-examples</application> package contains two webapps "
3089
"that can be used to test or demonstrate Servlets and JSP features, which you "
3090
"can access them by default at http://yourserver:8080/examples. You can "
3091
"install them by entering the following command in the terminal prompt:"
3092
msgstr ""
3093
3094
#: serverguide/C/web-servers.xml:1169(command)
3095
msgid "sudo apt-get install tomcat6-examples"
3096
msgstr ""
3097
3098
#: serverguide/C/web-servers.xml:1175(title)
3099
msgid "Using private instances"
3100
msgstr ""
3101
3102
#: serverguide/C/web-servers.xml:1176(para)
3103
msgid ""
3104
"Tomcat is heavily used in development and testing scenarios where using a "
3105
"single system-wide instance doesn't meet the requirements of multiple users "
3106
"on a single system. The Tomcat 6.0 packages in Ubuntu come with tools to "
3107
"help deploy your own user-oriented instances, allowing every user on a "
3108
"system to run (without root rights) separate private instances while still "
3109
"using the system-installed libraries."
3110
msgstr ""
3111
3112
#: serverguide/C/web-servers.xml:1183(para)
3113
msgid ""
3114
"It is possible to run the system-wide instance and the private instances in "
3115
"parallel, as long as they do not use the same TCP ports."
3116
msgstr ""
3117
3118
#: serverguide/C/web-servers.xml:1187(title)
3119
msgid "Installing private instance support"
3120
msgstr ""
3121
3122
#: serverguide/C/web-servers.xml:1188(para)
3123
msgid ""
3124
"You can install everything necessary to run private instances by entering "
3125
"the following command in the terminal prompt:"
3126
msgstr ""
3127
3128
#: serverguide/C/web-servers.xml:1191(command)
3129
msgid "sudo apt-get install tomcat6-user"
3130
msgstr ""
3131
3132
#: serverguide/C/web-servers.xml:1195(title)
3133
msgid "Creating a private instance"
3134
msgstr ""
3135
3136
#: serverguide/C/web-servers.xml:1196(para)
3137
msgid ""
3138
"You can create a private instance directory by entering the following "
3139
"command in the terminal prompt:"
3140
msgstr ""
3141
3142
#: serverguide/C/web-servers.xml:1199(command)
3143
msgid "tomcat6-instance-create my-instance"
3144
msgstr ""
3145
3146
#: serverguide/C/web-servers.xml:1201(para)
3147
msgid ""
3148
"This will create a new <filename>my-instance</filename> directory with all "
3149
"the necessary subdirectories and scripts. You can for example install your "
3150
"common libraries in the <filename>lib/</filename> subdirectory and deploy "
3151
"your webapps in the <filename>webapps/</filename> subdirectory. No webapps "
3152
"are deployed by default."
3153
msgstr ""
3154
3155
#: serverguide/C/web-servers.xml:1209(title)
3156
msgid "Configuring your private instance"
3157
msgstr ""
3158
3159
#: serverguide/C/web-servers.xml:1210(para)
3160
msgid ""
3161
"You will find the classic Tomcat configuration files for your private "
3162
"instance in the <filename>conf/</filename> subdirectory. You should for "
3163
"example certainly edit the <filename>conf/server.xml</filename> file to "
3164
"change the default ports used by your private Tomcat instance to avoid "
3165
"conflict with other instances that might be running."
3166
msgstr ""
3167
3168
#: serverguide/C/web-servers.xml:1218(title)
3169
msgid "Starting/stopping your private instance"
3170
msgstr ""
3171
3172
#: serverguide/C/web-servers.xml:1219(para)
3173
msgid ""
3174
"You can start your private instance by entering the following command in the "
3175
"terminal prompt (supposing your instance is located in the <filename>my-"
3176
"instance</filename> directory):"
3177
msgstr ""
3178
3179
#: serverguide/C/web-servers.xml:1223(command)
3180
msgid "my-instance/bin/startup.sh"
3181
msgstr ""
3182
3183
#: serverguide/C/web-servers.xml:1225(para)
3184
msgid ""
3185
"You should check the <filename>logs/</filename> subdirectory for any error. "
3186
"If you have a <emphasis>java.net.BindException: Address already in "
3187
"use<null>:8080</emphasis> error, it means that the port you're using "
3188
"is already taken and that you should change it."
3189
msgstr ""
3190
3191
#: serverguide/C/web-servers.xml:1230(para)
3192
msgid ""
3193
"You can stop your instance by entering the following command in the terminal "
3194
"prompt (supposing your instance is located in the <filename>my-"
3195
"instance</filename> directory):"
3196
msgstr ""
3197
3198
#: serverguide/C/web-servers.xml:1234(command)
3199
msgid "my-instance/bin/shutdown.sh"
3200
msgstr ""
3201
3202
#: serverguide/C/web-servers.xml:1243(para)
3203
msgid ""
3204
"See the <ulink url=\"http://tomcat.apache.org/\">Apache Tomcat</ulink> "
3205
"website for more information."
3206
msgstr ""
3207
3208
#: serverguide/C/web-servers.xml:1248(para)
3209
msgid ""
3210
"<ulink url=\"http://oreilly.com/catalog/9780596003180/\">Tomcat: The "
3211
"Definitive Guide</ulink> is a good resource for building web applications "
3212
"with Tomcat."
3213
msgstr ""
3214
3215
#: serverguide/C/web-servers.xml:1254(para)
3216
msgid ""
3217
"For additional books see the <ulink "
3218
"url=\"http://wiki.apache.org/tomcat/Tomcat/Books\">Tomcat Books</ulink> list "
3219
"page."
3220
msgstr ""
3221
3222
#: serverguide/C/web-servers.xml:1259(para)
3223
msgid ""
3224
"Also, see the<ulink "
3225
"url=\"https://help.ubuntu.com/community/ApacheTomcat5\">Ubuntu Wiki Apache "
3226
"Tomcat</ulink> page."
3227
msgstr ""
3228
3229
#: serverguide/C/vpn.xml:13(title)
3230
msgid "VPN"
3231
msgstr ""
3232
3233
#: serverguide/C/vpn.xml:15(para)
3234
msgid ""
3235
"A Virtual Private Network, or <emphasis>VPN</emphasis>, is an encrypted "
3236
"network connection between two or more networks. There are several ways to "
3237
"create a VPN using software as well as dedicated hardware appliances. This "
3238
"chapter will cover installing and configuring "
3239
"<application>OpenVPN</application> to create a VPN between two servers."
3240
msgstr ""
3241
3242
#: serverguide/C/vpn.xml:23(title)
3243
msgid "OpenVPN"
3244
msgstr ""
3245
3246
#: serverguide/C/vpn.xml:25(para)
3247
msgid ""
3248
"OpenVPN uses Public Key Infrastructure (PKI) to encrypt VPN traffic between "
3249
"nodes. A simple way of setting up a VPN with OpenVPN is to connect the "
3250
"clients through a bridge interface on the VPN server. This guide will assume "
3251
"that one VPN node, the server in this case, has a bridge interface "
3252
"configured. For more information on setting up a bridge see <xref "
3253
"linkend=\"bridging\"/>."
3254
msgstr ""
3255
3256
#: serverguide/C/vpn.xml:35(para)
3257
msgid "To install <application>openvpn</application> in a terminal enter:"
3258
msgstr ""
3259
3260
#: serverguide/C/vpn.xml:41(command) serverguide/C/vpn.xml:257(command)
3261
msgid "sudo apt-get install openvpn"
3262
msgstr ""
3263
3264
#: serverguide/C/vpn.xml:45(title)
3265
msgid "Server Certificates"
3266
msgstr ""
3267
3268
#: serverguide/C/vpn.xml:47(para)
3269
msgid ""
3270
"Now that the <application>openvpn</application> package is installed, the "
3271
"certificates for the VPN server need to be created."
3272
msgstr ""
3273
3274
#: serverguide/C/vpn.xml:52(para)
3275
msgid ""
3276
"First, copy the <filename>easy-rsa</filename> directory to "
3277
"<filename>/etc/openvpn</filename>. This will ensure that any changes to the "
3278
"scripts will not be lost when the package is updated. You will also need to "
3279
"adjust permissions in the <filename>easy-rsa</filename> directory to allow "
3280
"the current user permission to create files. From a terminal enter:"
3281
msgstr ""
3282
3283
#: serverguide/C/vpn.xml:59(command)
3284
msgid "sudo mkdir /etc/openvpn/easy-rsa/"
3285
msgstr ""
3286
3287
#: serverguide/C/vpn.xml:60(command)
3288
msgid ""
3289
"sudo cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-"
3290
"rsa/"
3291
msgstr ""
3292
3293
#: serverguide/C/vpn.xml:61(command)
3294
msgid "sudo chown -R $USER /etc/openvpn/easy-rsa/"
3295
msgstr ""
3296
3297
#: serverguide/C/vpn.xml:64(para)
3298
msgid ""
3299
"Next, edit <filename>/etc/openvpn/easy-rsa/vars</filename> adjusting the "
3300
"following to your environment:"
3301
msgstr ""
3302
3303
#: serverguide/C/vpn.xml:68(programlisting)
3304
#, no-wrap
3305
msgid ""
3306
"\n"
3307
"export KEY_COUNTRY=\"US\"\n"
3308
"export KEY_PROVINCE=\"NC\"\n"
3309
"export KEY_CITY=\"Winston-Salem\"\n"
3310
"export KEY_ORG=\"Example Company\"\n"
3311
"export KEY_EMAIL=\"steve@example.com\"\n"
3312
msgstr ""
3313
3314
#: serverguide/C/vpn.xml:76(para)
3315
msgid "Enter the following to create the server certificates:"
3316
msgstr ""
3317
3318
#: serverguide/C/vpn.xml:81(command) serverguide/C/vpn.xml:102(command)
3319
msgid "cd /etc/openvpn/easy-rsa/"
3320
msgstr ""
3321
3322
#: serverguide/C/vpn.xml:82(command) serverguide/C/vpn.xml:103(command)
3323
msgid "source vars"
3324
msgstr ""
3325
3326
#: serverguide/C/vpn.xml:83(command)
3327
msgid "./clean-all"
3328
msgstr ""
3329
3330
#: serverguide/C/vpn.xml:84(command)
3331
msgid "./build-dh"
3332
msgstr ""
3333
3334
#: serverguide/C/vpn.xml:85(command)
3335
msgid "./pkitool --initca"
3336
msgstr ""
3337
3338
#: serverguide/C/vpn.xml:86(command)
3339
msgid "./pkitool --server server"
3340
msgstr ""
3341
3342
#: serverguide/C/vpn.xml:87(command)
3343
msgid "cd keys"
3344
msgstr ""
3345
3346
#: serverguide/C/vpn.xml:88(command)
3347
msgid "openvpn --genkey --secret ta.key"
3348
msgstr ""
3349
3350
#: serverguide/C/vpn.xml:89(command)
3351
msgid "sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/"
3352
msgstr ""
3353
3354
#: serverguide/C/vpn.xml:94(title)
3355
msgid "Client Certificates"
3356
msgstr ""
3357
3358
#: serverguide/C/vpn.xml:96(para)
3359
msgid ""
3360
"The VPN client will also need a certificate to authenticate itself to the "
3361
"server. To create the certificate, enter the following in a terminal:"
3362
msgstr ""
3363
3364
#: serverguide/C/vpn.xml:104(command)
3365
msgid "./pkitool hostname"
3366
msgstr ""
3367
3368
#: serverguide/C/vpn.xml:108(para)
3369
msgid ""
3370
"Replace <emphasis>hostname</emphasis> with the actual hostname of the "
3371
"machine connecting to the VPN."
3372
msgstr ""
3373
3374
#: serverguide/C/vpn.xml:113(para)
3375
msgid "Copy the following files to the client:"
3376
msgstr ""
3377
3378
#: serverguide/C/vpn.xml:118(para)
3379
msgid "/etc/openvpn/ca.crt"
3380
msgstr ""
3381
3382
#: serverguide/C/vpn.xml:119(para)
3383
msgid "/etc/openvpn/easy-rsa/keys/hostname.crt"
3384
msgstr ""
3385
3386
#: serverguide/C/vpn.xml:120(para)
3387
msgid "/etc/openvpn/easy-rsa/keys/hostname.key"
3388
msgstr ""
3389
3390
#: serverguide/C/vpn.xml:121(para)
3391
msgid "/etc/openvpn/ta.key"
3392
msgstr ""
3393
3394
#: serverguide/C/vpn.xml:125(para)
3395
msgid ""
3396
"Remember to adjust the above file names for your client machine's "
3397
"<emphasis>hostname</emphasis>."
3398
msgstr ""
3399
3400
#: serverguide/C/vpn.xml:130(para)
3401
msgid ""
3402
"It is best to use a secure method to copy the certificate and key files. The "
3403
"<application>scp</application> utility is a good choice, but copying the "
3404
"files to removable media then to the client, also works well."
3405
msgstr ""
3406
3407
#: serverguide/C/vpn.xml:141(title) serverguide/C/vcs.xml:107(title)
3408
msgid "Server Configuration"
3409
msgstr ""
3410
3411
#: serverguide/C/vpn.xml:143(para)
3412
msgid ""
3413
"Now configure the <application>openvpn</application> server by creating "
3414
"<filename>/etc/openvpn/server.conf</filename> from the example file. In a "
3415
"terminal enter:"
3416
msgstr ""
3417
3418
#: serverguide/C/vpn.xml:149(command)
3419
msgid ""
3420
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz "
3421
"/etc/openvpn/"
3422
msgstr ""
3423
3424
#: serverguide/C/vpn.xml:150(command)
3425
msgid "sudo gzip -d /etc/openvpn/server.conf.gz"
3426
msgstr ""
3427
3428
#: serverguide/C/vpn.xml:153(para)
3429
msgid ""
3430
"Edit <filename>/etc/openvpn/server.conf</filename> changing the following "
3431
"options to:"
3432
msgstr ""
3433
3434
#: serverguide/C/vpn.xml:157(programlisting)
3435
#, no-wrap
3436
msgid ""
3437
"\n"
3438
"local 172.18.100.101\n"
3439
"dev tap0\n"
3440
"up \"/etc/openvpn/up.sh br0\"\n"
3441
"down \"/etc/openvpn/down.sh br0\"\n"
3442
";server 10.8.0.0 255.255.255.0\n"
3443
"server-bridge 172.18.100.101 255.255.255.0 172.18.100.105 172.18.100.200\n"
3444
"push \"route 172.18.100.1 255.255.255.0\"\n"
3445
"push \"dhcp-option DNS 172.18.100.20\"\n"
3446
"push \"dhcp-option DOMAIN example.com\"\n"
3447
"tls-auth ta.key 0 # This file is secret\n"
3448
"user nobody\n"
3449
"group nogroup\n"
3450
msgstr ""
3451
3452
#: serverguide/C/vpn.xml:174(para)
3453
msgid ""
3454
"<emphasis>local</emphasis>: is the IP address of the bridge interface."
3455
msgstr ""
3456
3457
#: serverguide/C/vpn.xml:179(para)
3458
msgid ""
3459
"<emphasis>server-bridge</emphasis>: needed when the configuration uses "
3460
"bridging. The <emphasis>172.18.100.101 255.255.255.0</emphasis> portion is "
3461
"the bridge interface and mask. The IP range <emphasis>172.18.100.105 "
3462
"172.18.100.200</emphasis> is the range of IP addresses that will be assigned "
3463
"to clients."
3464
msgstr ""
3465
3466
#: serverguide/C/vpn.xml:186(para)
3467
msgid ""
3468
"<emphasis>push</emphasis>: are directives to add networking options for "
3469
"clients."
3470
msgstr ""
3471
3472
#: serverguide/C/vpn.xml:191(para)
3473
msgid ""
3474
"<emphasis>user and group</emphasis>: configure which user and group the "
3475
"<application>openvpn</application> daemon executes as."
3476
msgstr ""
3477
3478
#: serverguide/C/vpn.xml:198(para)
3479
msgid ""
3480
"Replace all IP addresses and domain names above with those of your network."
3481
msgstr ""
3482
3483
#: serverguide/C/vpn.xml:203(para)
3484
msgid ""
3485
"Next, create a couple of helper scripts to add the <emphasis>tap</emphasis> "
3486
"interface to the bridge. Create <filename>/etc/openvpn/up.sh</filename>:"
3487
msgstr ""
3488
3489
#: serverguide/C/vpn.xml:207(programlisting)
3490
#, no-wrap
3491
msgid ""
3492
"\n"
3493
"#!/bin/sh\n"
3494
"\n"
3495
"BR=$1\n"
3496
"DEV=$2\n"
3497
"MTU=$3\n"
3498
"/sbin/ifconfig $DEV mtu $MTU promisc up\n"
3499
"/usr/sbin/brctl addif $BR $DEV\n"
3500
msgstr ""
3501
3502
#: serverguide/C/vpn.xml:217(para)
3503
msgid "And <filename>/etc/openvpn/down.sh</filename>:"
3504
msgstr ""
3505
3506
#: serverguide/C/vpn.xml:221(programlisting)
3507
#, no-wrap
3508
msgid ""
3509
"\n"
3510
"#!/bin/sh\n"
3511
"\n"
3512
"BR=$1\n"
3513
"DEV=$2\n"
3514
"\n"
3515
"/usr/sbin/brctl delif $BR $DEV\n"
3516
"/sbin/ifconfig $DEV down\n"
3517
msgstr ""
3518
3519
#: serverguide/C/vpn.xml:231(para)
3520
msgid "Then make them executable:"
3521
msgstr ""
3522
3523
#: serverguide/C/vpn.xml:236(command)
3524
msgid "sudo chmod 755 /etc/openvpn/down.sh"
3525
msgstr ""
3526
3527
#: serverguide/C/vpn.xml:237(command)
3528
msgid "sudo chmod 755 /etc/openvpn/up.sh"
3529
msgstr ""
3530
3531
#: serverguide/C/vpn.xml:240(para)
3532
msgid ""
3533
"After configuring the server, restart <application>openvpn</application> by "
3534
"entering:"
3535
msgstr ""
3536
3537
#: serverguide/C/vpn.xml:245(command) serverguide/C/vpn.xml:293(command)
3538
msgid "sudo /etc/init.d/openvpn restart"
3539
msgstr ""
3540
3541
#: serverguide/C/vpn.xml:250(title)
3542
msgid "Client Configuration"
3543
msgstr ""
3544
3545
#: serverguide/C/vpn.xml:252(para)
3546
msgid "First, install <application>openvpn</application> on the client:"
3547
msgstr ""
3548
3549
#: serverguide/C/vpn.xml:260(para)
3550
msgid ""
3551
"Then with the server configured and the client certificates copied to the "
3552
"<filename>/etc/openvpn/</filename> directory, create a client configuration "
3553
"file by copying the example. In a terminal on the client machine enter:"
3554
msgstr ""
3555
3556
#: serverguide/C/vpn.xml:266(command)
3557
msgid ""
3558
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf "
3559
"/etc/openvpn"
3560
msgstr ""
3561
3562
#: serverguide/C/vpn.xml:269(para)
3563
msgid ""
3564
"Now edit <filename>/etc/openvpn/client.conf</filename> changing the "
3565
"following options:"
3566
msgstr ""
3567
3568
#: serverguide/C/vpn.xml:273(programlisting)
3569
#, no-wrap
3570
msgid ""
3571
"\n"
3572
"dev tap\n"
3573
"remote vpn.example.com 1194\n"
3574
"cert hostname.crt\n"
3575
"key hostname.key\n"
3576
"tls-auth ta.key 1\n"
3577
msgstr ""
3578
3579
#: serverguide/C/vpn.xml:282(para)
3580
msgid ""
3581
"Replace <emphasis>vpn.example.com</emphasis> with the hostname of your VPN "
3582
"server, and <emphasis>hostname.*</emphasis> with the actual certificate and "
3583
"key filenames."
3584
msgstr ""
3585
3586
#: serverguide/C/vpn.xml:288(para)
3587
msgid "Finally, restart <application>openvpn</application>:"
3588
msgstr ""
3589
3590
#: serverguide/C/vpn.xml:296(para)
3591
msgid "You should now be able to connect to the remote LAN through the VPN."
3592
msgstr ""
3593
3594
#: serverguide/C/vpn.xml:307(para)
3595
msgid ""
3596
"See the <ulink url=\"http://openvpn.net/\">OpenVPN</ulink> website for "
3597
"additional information."
3598
msgstr ""
3599
3600
#: serverguide/C/vpn.xml:312(para)
3601
msgid ""
3602
"Also, Pakt's <ulink url=\"http://www.packtpub.com/openvpn/book\">OpenVPN: "
3603
"Building and Integrating Virtual Private Networks</ulink> is a good resource."
3604
msgstr ""
3605
3606
#: serverguide/C/vpn.xml:318(para)
3607
msgid ""
3608
"Another source of further information is the <ulink "
3609
"url=\"https://help.ubuntu.com/community/OpenVPN\">Ubuntu Wiki "
3610
"OpenVPN</ulink> page."
3611
msgstr ""
3612
3613
#: serverguide/C/virtualization.xml:13(title)
3614
msgid "Virtualization"
3615
msgstr ""
3616
3617
#: serverguide/C/virtualization.xml:14(para)
3618
msgid ""
3619
"Virtualization is being adopted in many different environments and "
3620
"situations. If you are a developer, virtualization can provide you with a "
3621
"contained environment where you can safely do almost any sort of development "
3622
"safe from messing up your main working environment. If you are a systems "
3623
"administrator, you can use virtualization to more easily separate your "
3624
"services and move them around based on demand."
3625
msgstr ""
3626
3627
#: serverguide/C/virtualization.xml:20(para)
3628
msgid ""
3629
"The default virtualization technology supported in Ubuntu is "
3630
"<application>KVM</application>, a technology that takes advantage of "
3631
"virtualization extensions built into Intel and AMD hardware. For hardware "
3632
"without virtualization extensions <application>Xen</application> and "
3633
"<application>Qemu</application> are popular solutions."
3634
msgstr ""
3635
3636
#: serverguide/C/virtualization.xml:27(title)
3637
msgid "libvirt"
3638
msgstr ""
3639
3640
#: serverguide/C/virtualization.xml:28(para)
3641
msgid ""
3642
"The <application>libvirt</application> library is used to interface with "
3643
"different virtualization technologies. Before getting started with "
3644
"<application>libvirt</application> it is best to make sure your hardware "
3645
"supports the necessary virtualization extensions for "
3646
"<application>KVM</application>. Enter the following from a terminal prompt:"
3647
msgstr ""
3648
3649
#: serverguide/C/virtualization.xml:35(command)
3650
msgid "kvm-ok"
3651
msgstr ""
3652
3653
#: serverguide/C/virtualization.xml:37(para)
3654
msgid ""
3655
"A message will be printed informing you if your CPU "
3656
"<emphasis>does</emphasis> or <emphasis>does not</emphasis> support hardware "
3657
"virtualization."
3658
msgstr ""
3659
3660
#: serverguide/C/virtualization.xml:41(para)
3661
msgid ""
3662
"On most computer whose processor supports virtualization, it is necessary to "
3663
"activate an option in the BIOS to enable it."
3664
msgstr ""
3665
3666
#: serverguide/C/virtualization.xml:47(title)
3667
msgid "Virtual Networking"
3668
msgstr ""
3669
3670
#: serverguide/C/virtualization.xml:49(para)
3671
msgid ""
3672
"There are a few different ways to allow a virtual machine access to the "
3673
"external network. The default virtual network configuration is "
3674
"<emphasis>usermode</emphasis> networking, which uses the SLIRP protocol and "
3675
"traffic is NATed through the host interface to the outside network."
3676
msgstr ""
3677
3678
#: serverguide/C/virtualization.xml:54(para)
3679
msgid ""
3680
"To enable external hosts to directly access services on virtual machines a "
3681
"<emphasis>bridge</emphasis> needs to be configured. This allows the virtual "
3682
"interfaces to connect to the outside network through the physical interface, "
3683
"making them appear as normal hosts to the rest of the network. For "
3684
"information on setting up a bridge see <xref linkend=\"bridging\"/>."
3685
msgstr ""
3686
3687
#: serverguide/C/virtualization.xml:63(para)
3688
msgid "To install the necessary packages, from a terminal prompt enter:"
3689
msgstr ""
3690
3691
#: serverguide/C/virtualization.xml:67(command)
3692
msgid "sudo apt-get install kvm libvirt-bin"
3693
msgstr ""
3694
3695
#: serverguide/C/virtualization.xml:69(para)
3696
msgid ""
3697
"After installing <application>libvirt-bin</application>, the user used to "
3698
"manage virtual machines will need to be added to the "
3699
"<emphasis>libvirtd</emphasis> group. Doing so will grant the user access to "
3700
"the advanced networking options."
3701
msgstr ""
3702
3703
#: serverguide/C/virtualization.xml:73(para)
3704
msgid "In a terminal enter:"
3705
msgstr ""
3706
3707
#: serverguide/C/virtualization.xml:77(command)
3708
msgid "sudo adduser $USER libvirtd"
3709
msgstr ""
3710
3711
#: serverguide/C/virtualization.xml:80(para)
3712
msgid ""
3713
"If the user chosen is the current user, you will need to log out and back in "
3714
"for the new group membership to take effect."
3715
msgstr ""
3716
3717
#: serverguide/C/virtualization.xml:84(para)
3718
msgid ""
3719
"You are now ready to install a <emphasis>Guest</emphasis> operating system. "
3720
"Installing a virtual machine follows the same process as installing the "
3721
"operating system directly on the hardware. You either need a way to automate "
3722
"the installation, or a keyboard and monitor will need to be attached to the "
3723
"physical machine."
3724
msgstr ""
3725
3726
#: serverguide/C/virtualization.xml:89(para)
3727
msgid ""
3728
"In the case of virtual machines a Graphical User Interface (GUI) is "
3729
"analogous to using a physical keyboard and mouse. Instead of installing a "
3730
"GUI the <application>virt-viewer</application> application can be used to "
3731
"connect to a virtual machine's console using <application>VNC</application>. "
3732
"See <xref linkend=\"libvirt-virt-viewer\"/> for more information."
3733
msgstr ""
3734
3735
#: serverguide/C/virtualization.xml:94(para)
3736
msgid ""
3737
"There are several ways to automate the Ubuntu installation process, for "
3738
"example using preseeds, kickstart, etc. Refer to the <ulink "
3739
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
3740
"Installation Guide</ulink> for details."
3741
msgstr ""
3742
3743
#: serverguide/C/virtualization.xml:98(para)
3744
msgid ""
3745
"Yet another way to install an Ubuntu virtual machine is to use "
3746
"<application>ubuntu-vm-builder</application>. <application>ubuntu-vm-"
3747
"builder</application> allows you to setup advanced partitions, execute "
3748
"custom post-install scripts, etc. For details see <xref linkend=\"jeos-and-"
3749
"vmbuilder\"/>"
3750
msgstr ""
3751
3752
#: serverguide/C/virtualization.xml:104(title)
3753
msgid "virt-install"
3754
msgstr ""
3755
3756
#: serverguide/C/virtualization.xml:105(para)
3757
msgid ""
3758
"<application>virt-install</application> is part of the <application>python-"
3759
"virtinst</application> package. To install it, from a terminal prompt enter:"
3760
msgstr ""
3761
3762
#: serverguide/C/virtualization.xml:109(command)
3763
msgid "sudo apt-get install python-virtinst"
3764
msgstr ""
3765
3766
#: serverguide/C/virtualization.xml:111(para)
3767
msgid ""
3768
"There are several options available when using <application>virt-"
3769
"install</application>. For example:"
3770
msgstr ""
3771
3772
#: serverguide/C/virtualization.xml:115(command)
3773
msgid ""
3774
"sudo virt-install -n web_devel -r 256 -f web_devel.img \\ -s 4 -c jeos.iso --"
3775
"accelerate \\ --connect=qemu:///system --vnc \\ --noautoconsole -v"
3776
msgstr ""
3777
3778
#: serverguide/C/virtualization.xml:122(para)
3779
msgid ""
3780
"<emphasis>-n web_devel:</emphasis> the name of the new virtual machine will "
3781
"be <emphasis>web_devel</emphasis> in this example."
3782
msgstr ""
3783
3784
#: serverguide/C/virtualization.xml:127(para)
3785
msgid ""
3786
"<emphasis>-r 256:</emphasis> specifies the amount of memory the virtual "
3787
"machine will use."
3788
msgstr ""
3789
3790
#: serverguide/C/virtualization.xml:132(para)
3791
msgid ""
3792
"<emphasis>-f web_devel.img:</emphasis> indicates the path to the virtual "
3793
"disk which can be a file, partition, or logical volume. In this example a "
3794
"file named <filename>web_devel.img</filename>."
3795
msgstr ""
3796
3797
#: serverguide/C/virtualization.xml:138(para)
3798
msgid "<emphasis>-s 4:</emphasis> the size of the virtual disk."
3799
msgstr ""
3800
3801
#: serverguide/C/virtualization.xml:143(para)
3802
msgid ""
3803
"<emphasis>-c jeos.iso:</emphasis> file to be used as a virtual CDROM. The "
3804
"file can be either an ISO file or the path to the host's CDROM device."
3805
msgstr ""
3806
3807
#: serverguide/C/virtualization.xml:149(para)
3808
msgid ""
3809
"<emphasis>--accelerate:</emphasis> enables the kernel's acceleration "
3810
"technologies."
3811
msgstr ""
3812
3813
#: serverguide/C/virtualization.xml:154(para)
3814
msgid ""
3815
"<emphasis>--vnc:</emphasis> exports the guest's virtual console using VNC."
3816
msgstr ""
3817
3818
#: serverguide/C/virtualization.xml:159(para)
3819
msgid ""
3820
"<emphasis>--noautoconsole:</emphasis> will not automatically connect to the "
3821
"virtual machine's console."
3822
msgstr ""
3823
3824
#: serverguide/C/virtualization.xml:164(para)
3825
msgid "<emphasis>-v:</emphasis> creates a fully virtualized guest."
3826
msgstr ""
3827
3828
#: serverguide/C/virtualization.xml:169(para)
3829
msgid ""
3830
"After launching <application>virt-install</application> you can connect to "
3831
"the virtual machine's console either locally using a GUI or with the "
3832
"<application>virt-viewer</application> utility."
3833
msgstr ""
3834
3835
#: serverguide/C/virtualization.xml:175(title)
3836
msgid "virt-clone"
3837
msgstr ""
3838
3839
#: serverguide/C/virtualization.xml:176(para)
3840
msgid ""
3841
"The <application>virt-clone</application> application can be used to copy "
3842
"one virtual machine to another. For example:"
3843
msgstr ""
3844
3845
#: serverguide/C/virtualization.xml:180(command)
3846
msgid ""
3847
"sudo virt-clone -o web_devel -n database_devel -f "
3848
"/path/to/database_devel.img --connect=qemu:///system"
3849
msgstr ""
3850
3851
#: serverguide/C/virtualization.xml:184(para)
3852
msgid "<emphasis>-o:</emphasis> original virtual machine."
3853
msgstr ""
3854
3855
#: serverguide/C/virtualization.xml:189(para)
3856
msgid "<emphasis>-n:</emphasis> name of the new virtual machine."
3857
msgstr ""
3858
3859
#: serverguide/C/virtualization.xml:194(para)
3860
msgid ""
3861
"<emphasis>-f:</emphasis> path to the file, logical volume, or partition to "
3862
"be used by the new virtual machine."
3863
msgstr ""
3864
3865
#: serverguide/C/virtualization.xml:199(para)
3866
msgid ""
3867
"<emphasis>--connect:</emphasis> specifies which hypervisor to connect to."
3868
msgstr ""
3869
3870
#: serverguide/C/virtualization.xml:204(para)
3871
msgid ""
3872
"Also, use <emphasis>-d</emphasis> or <emphasis>--debug</emphasis> option to "
3873
"help troubleshoot problems with <application>virt-clone</application>."
3874
msgstr ""
3875
3876
#: serverguide/C/virtualization.xml:209(para)
3877
msgid ""
3878
"Replace <emphasis>web_devel</emphasis> and "
3879
"<emphasis>database_devel</emphasis> with appropriate virtual machine names."
3880
msgstr ""
3881
3882
#: serverguide/C/virtualization.xml:215(title)
3883
msgid "Virtual Machine Management"
3884
msgstr ""
3885
3886
#: serverguide/C/virtualization.xml:217(title)
3887
msgid "virsh"
3888
msgstr ""
3889
3890
#: serverguide/C/virtualization.xml:218(para)
3891
msgid ""
3892
"There are several utilities available to manage virtual machines and "
3893
"<application>libvirt</application>. The <application>virsh</application> "
3894
"utility can be used from the command line. Some examples:"
3895
msgstr ""
3896
3897
#: serverguide/C/virtualization.xml:224(para)
3898
msgid "To list running virtual machines:"
3899
msgstr ""
3900
3901
#: serverguide/C/virtualization.xml:228(command)
3902
msgid "virsh -c qemu:///system list"
3903
msgstr ""
3904
3905
#: serverguide/C/virtualization.xml:232(para)
3906
msgid "To start a virtual machine:"
3907
msgstr ""
3908
3909
#: serverguide/C/virtualization.xml:236(command)
3910
msgid "virsh -c qemu:///system start web_devel"
3911
msgstr ""
3912
3913
#: serverguide/C/virtualization.xml:240(para)
3914
msgid "Similarly, to start a virtual machine at boot:"
3915
msgstr ""
3916
3917
#: serverguide/C/virtualization.xml:244(command)
3918
msgid "virsh -c qemu:///system autostart web_devel"
3919
msgstr ""
3920
3921
#: serverguide/C/virtualization.xml:248(para)
3922
msgid "Reboot a virtual machine with:"
3923
msgstr ""
3924
3925
#: serverguide/C/virtualization.xml:252(command)
3926
msgid "virsh -c qemu:///system reboot web_devel"
3927
msgstr ""
3928
3929
#: serverguide/C/virtualization.xml:256(para)
3930
msgid ""
3931
"The <emphasis>state</emphasis> of virtual machines can be saved to a file in "
3932
"order to be restored later. The following will save the virtual machine "
3933
"state into a file named according to the date:"
3934
msgstr ""
3935
3936
#: serverguide/C/virtualization.xml:261(command)
3937
msgid "virsh -c qemu:///system save web_devel web_devel-022708.state"
3938
msgstr ""
3939
3940
#: serverguide/C/virtualization.xml:263(para)
3941
msgid "Once saved the virtual machine will no longer be running."
3942
msgstr ""
3943
3944
#: serverguide/C/virtualization.xml:268(para)
3945
msgid "A saved virtual machine can be restored using:"
3946
msgstr ""
3947
3948
#: serverguide/C/virtualization.xml:272(command)
3949
msgid "virsh -c qemu:///system restore web_devel-022708.state"
3950
msgstr ""
3951
3952
#: serverguide/C/virtualization.xml:276(para)
3953
msgid "To shutdown a virtual machine do:"
3954
msgstr ""
3955
3956
#: serverguide/C/virtualization.xml:280(command)
3957
msgid "virsh -c qemu:///system shutdown web_devel"
3958
msgstr ""
3959
3960
#: serverguide/C/virtualization.xml:284(para)
3961
msgid "A CDROM device can be mounted in a virtual machine by entering:"
3962
msgstr ""
3963
3964
#: serverguide/C/virtualization.xml:288(command)
3965
msgid "virsh -c qemu:///system attach-disk web_devel /dev/cdrom /media/cdrom"
3966
msgstr ""
3967
3968
#: serverguide/C/virtualization.xml:293(para)
3969
msgid ""
3970
"In the above examples replace <emphasis>web_devel</emphasis> with the "
3971
"appropriate virtual machine name, and <filename>web_devel-"
3972
"022708.state</filename> with a descriptive file name."
3973
msgstr ""
3974
3975
#: serverguide/C/virtualization.xml:300(title)
3976
msgid "Virtual Machine Manager"
3977
msgstr ""
3978
3979
#: serverguide/C/virtualization.xml:301(para)
3980
msgid ""
3981
"The <application>virt-manager</application> package contains a graphical "
3982
"utility to manage local and remote virtual machines. To install virt-manager "
3983
"enter:"
3984
msgstr ""
3985
3986
#: serverguide/C/virtualization.xml:306(command)
3987
msgid "sudo apt-get install virt-manager"
3988
msgstr ""
3989
3990
#: serverguide/C/virtualization.xml:308(para)
3991
msgid ""
3992
"Since <application>virt-manager</application> requires a Graphical User "
3993
"Interface (GUI) environment it is recommended to be installed on a "
3994
"workstation or test machine instead of a production server. To connect to "
3995
"the local <application>libvirt</application> service enter:"
3996
msgstr ""
3997
3998
#: serverguide/C/virtualization.xml:314(command)
3999
msgid "virt-manager -c qemu:///system"
4000
msgstr ""
4001
4002
#: serverguide/C/virtualization.xml:316(para)
4003
msgid ""
4004
"You can connect to the <application>libvirt</application> service running on "
4005
"another host by entering the following in a terminal prompt:"
4006
msgstr ""
4007
4008
#: serverguide/C/virtualization.xml:320(command)
4009
msgid "virt-manager -c qemu+ssh://virtnode1.mydomain.com/system"
4010
msgstr ""
4011
4012
#: serverguide/C/virtualization.xml:323(para)
4013
msgid ""
4014
"The above example assumes that <application>SSH</application> connectivity "
4015
"between the management system and virtnode1.mydomain.com has already been "
4016
"configured, and uses SSH keys for authentication. SSH "
4017
"<emphasis>keys</emphasis> are needed because "
4018
"<application>libvirt</application> sends the password prompt to another "
4019
"process. For details on configuring <application>SSH</application> see <xref "
4020
"linkend=\"openssh-server\"/>"
4021
msgstr ""
4022
4023
#: serverguide/C/virtualization.xml:333(title)
4024
msgid "Virtual Machine Viewer"
4025
msgstr ""
4026
4027
#: serverguide/C/virtualization.xml:334(para)
4028
msgid ""
4029
"The <application>virt-viewer</application> application allows you to connect "
4030
"to a virtual machine's console. <application>virt-viewer</application> does "
4031
"require a Graphical User Interface (GUI) to interface with the virtual "
4032
"machine."
4033
msgstr ""
4034
4035
#: serverguide/C/virtualization.xml:338(para)
4036
msgid ""
4037
"To install <application>virt-viewer</application> from a terminal enter:"
4038
msgstr ""
4039
4040
#: serverguide/C/virtualization.xml:342(command)
4041
msgid "sudo apt-get install virt-viewer"
4042
msgstr ""
4043
4044
#: serverguide/C/virtualization.xml:344(para)
4045
msgid ""
4046
"Once a virtual machine is installed and running you can connect to the "
4047
"virtual machine's console by using:"
4048
msgstr ""
4049
4050
#: serverguide/C/virtualization.xml:348(command)
4051
msgid "virt-viewer -c qemu:///system web_devel"
4052
msgstr ""
4053
4054
#: serverguide/C/virtualization.xml:350(para)
4055
msgid ""
4056
"Similar to <application>virt-manager</application>, <application>virt-"
4057
"viewer</application> can connect to a remote host using "
4058
"<emphasis>SSH</emphasis> with key authentication, as well:"
4059
msgstr ""
4060
4061
#: serverguide/C/virtualization.xml:355(command)
4062
msgid "virt-viewer -c qemu+ssh://virtnode1.mydomain.com/system web_devel"
4063
msgstr ""
4064
4065
#: serverguide/C/virtualization.xml:357(para)
4066
msgid ""
4067
"Be sure to replace <emphasis role=\"italic\">web_devel</emphasis> with the "
4068
"appropriate virtual machine name."
4069
msgstr ""
4070
4071
#: serverguide/C/virtualization.xml:360(para)
4072
msgid ""
4073
"If configured to use a <emphasis>bridged</emphasis> network interface you "
4074
"can also setup <application>SSH</application> access to the virtual machine. "
4075
"See <xref linkend=\"openssh-server\"/> and <xref linkend=\"bridging\"/> for "
4076
"more details."
4077
msgstr ""
4078
4079
#: serverguide/C/virtualization.xml:369(para)
4080
msgid ""
4081
"See the <ulink url=\"http://kvm.qumranet.com/kvmwiki\">KVM</ulink> home page "
4082
"for more details."
4083
msgstr ""
4084
4085
#: serverguide/C/virtualization.xml:374(para)
4086
msgid ""
4087
"For more information on <application>libvirt</application> see the <ulink "
4088
"url=\"http://libvirt.org/\">libvirt home page</ulink>"
4089
msgstr ""
4090
4091
#: serverguide/C/virtualization.xml:379(para)
4092
msgid ""
4093
"The <ulink url=\"http://virt-manager.et.redhat.com/\">Virtual Machine "
4094
"Manager</ulink> site has more information on <application>virt-"
4095
"manager</application> development."
4096
msgstr ""
4097
4098
#: serverguide/C/virtualization.xml:385(para)
4099
msgid ""
4100
"Also, stop by the <emphasis>#ubuntu-virt</emphasis> IRC channel on <ulink "
4101
"url=\"http://freenode.net/\">freenode</ulink> to discuss virtualization "
4102
"technology in Ubuntu."
4103
msgstr ""
4104
4105
#: serverguide/C/virtualization.xml:391(para)
4106
msgid ""
4107
"Another good resource is the <ulink "
4108
"url=\"https://help.ubuntu.com/community/KVM\">Ubuntu Wiki KVM</ulink> page."
4109
msgstr ""
4110
4111
#: serverguide/C/virtualization.xml:399(title)
4112
msgid "JeOS and vmbuilder"
4113
msgstr ""
4114
4115
#: serverguide/C/virtualization.xml:405(title)
4116
msgid "What is JeOS"
4117
msgstr ""
4118
4119
#: serverguide/C/virtualization.xml:407(para)
4120
msgid ""
4121
"Ubuntu <emphasis>JeOS</emphasis> (pronounced \"Juice\") is an efficient "
4122
"variant of the Ubuntu Server operating system, configured specifically for "
4123
"virtual appliances. No longer available as a CD-ROM ISO for download, but "
4124
"only as an option either:"
4125
msgstr ""
4126
4127
#: serverguide/C/virtualization.xml:414(para)
4128
msgid ""
4129
"While installing from the Server Edition ISO (pressing "
4130
"<emphasis>F4</emphasis> on the first screen will allow you to pick \"Minimal "
4131
"installation\", which is the package selection equivalent to JeOS)."
4132
msgstr ""
4133
4134
#: serverguide/C/virtualization.xml:420(para)
4135
msgid "Or to be built using Ubuntu's vmbuilder, which is described here."
4136
msgstr ""
4137
4138
#: serverguide/C/virtualization.xml:426(para)
4139
msgid ""
4140
"JeOS is a specialized installation of Ubuntu Server Edition with a tuned "
4141
"kernel that only contains the base elements needed to run within a "
4142
"virtualized environment."
4143
msgstr ""
4144
4145
#: serverguide/C/virtualization.xml:431(para)
4146
msgid ""
4147
"Ubuntu JeOS has been tuned to take advantage of key performance technologies "
4148
"in the latest virtualization products from VMware. This combination of "
4149
"reduced size and optimized performance ensures that Ubuntu JeOS Edition "
4150
"delivers a highly efficient use of server resources in large virtual "
4151
"deployments."
4152
msgstr ""
4153
4154
#: serverguide/C/virtualization.xml:437(para)
4155
msgid ""
4156
"Without unnecessary drivers, and only the minimal required packages, ISVs "
4157
"can configure their supporting OS exactly as they require. They have the "
4158
"peace of mind that updates, whether for security or enhancement reasons, "
4159
"will be limited to the bare minimum of what is required in their specific "
4160
"environment. In turn, users deploying virtual appliances built on top of "
4161
"JeOS will have to go through fewer updates and therefore less maintenance "
4162
"than they would have had to with a standard full installation of a server."
4163
msgstr ""
4164
4165
#: serverguide/C/virtualization.xml:446(title)
4166
msgid "What is vmbuilder"
4167
msgstr ""
4168
4169
#: serverguide/C/virtualization.xml:448(para)
4170
msgid ""
4171
"With vmbuilder, there is no need to download a JeOS ISO anymore. vmbuilder "
4172
"will fetch the various package and build a virtual machine tailored for your "
4173
"needs in about a minute. vmbuilder is a script that automates the process of "
4174
"creating a ready to use Linux based VM. The currently supported hypervisors "
4175
"are KVM and Xen."
4176
msgstr ""
4177
4178
#: serverguide/C/virtualization.xml:454(para)
4179
msgid ""
4180
"You can pass command line options to add extra packages, remove packages, "
4181
"choose which version of Ubuntu, which mirror etc. On recent hardware with "
4182
"plenty of RAM, tmpdir in <filename>/dev/shm</filename> or using a tmpfs, and "
4183
"a local mirror, you can bootstrap a VM in less than a minute."
4184
msgstr ""
4185
4186
#: serverguide/C/virtualization.xml:460(para)
4187
msgid ""
4188
"First introduced as a shell script in Ubuntu 8.04 LTS, <application>ubuntu-"
4189
"vm-builder</application> started with little emphasis as a hack to help "
4190
"developers test their new code in a virtual machine without having to "
4191
"restart from scratch each time. As a few Ubuntu administrators started to "
4192
"notice this script, a few of them went on improving it and adapting it for "
4193
"so many use case that Soren Hansen (the author of the script and Ubuntu "
4194
"virtualization specialist, not the golf player) decided to rewrite it from "
4195
"scratch for Intrepid as a python script with a few new design goals:"
4196
msgstr ""
4197
4198
#: serverguide/C/virtualization.xml:470(para)
4199
msgid "Develop it so that it can be reused by other distributions."
4200
msgstr ""
4201
4202
#: serverguide/C/virtualization.xml:475(para)
4203
msgid ""
4204
"Use a plugin mechanisms for all virtualization interactions so that others "
4205
"can easily add logic for other virtualization environments."
4206
msgstr ""
4207
4208
#: serverguide/C/virtualization.xml:480(para)
4209
msgid ""
4210
"Provide an easy to maintain web interface as an option to the command line "
4211
"interface."
4212
msgstr ""
4213
4214
#: serverguide/C/virtualization.xml:486(para)
4215
msgid "But the general principles and commands remain the same."
4216
msgstr ""
4217
4218
#: serverguide/C/virtualization.xml:493(title)
4219
msgid "Initial Setup"
4220
msgstr ""
4221
4222
#: serverguide/C/virtualization.xml:495(para)
4223
msgid ""
4224
"It is assumed that you have installed and configured "
4225
"<application>libvirt</application> and <application>KVM</application> "
4226
"locally on the machine you are using. For details on how to perform this, "
4227
"please refer to:"
4228
msgstr ""
4229
4230
#: serverguide/C/virtualization.xml:507(para)
4231
msgid ""
4232
"The <ulink url=\"https://help.ubuntu.com/community/KVM\">KVM</ulink> Wiki "
4233
"page."
4234
msgstr ""
4235
4236
#: serverguide/C/virtualization.xml:513(para)
4237
msgid ""
4238
"We also assume that you know how to use a text based text editor such as "
4239
"nano or vi. If you have not used any of them before, you can get an overview "
4240
"of the various text editors available by reading the <ulink "
4241
"url=\"https://help.ubuntu.com/community/PowerUsersTextEditors\">PowerUsersTex"
4242
"tEditors</ulink> page. This tutorial has been done on KVM, but the general "
4243
"principle should remain on other virtualization technologies."
4244
msgstr ""
4245
4246
#: serverguide/C/virtualization.xml:521(title)
4247
msgid "Install vmbuilder"
4248
msgstr ""
4249
4250
#: serverguide/C/virtualization.xml:523(para)
4251
msgid ""
4252
"The name of the package that we need to install is <application>python-vm-"
4253
"builder</application>. In a terminal prompt enter:"
4254
msgstr ""
4255
4256
#: serverguide/C/virtualization.xml:528(command)
4257
msgid "sudo apt-get install python-vm-builder"
4258
msgstr ""
4259
4260
#: serverguide/C/virtualization.xml:532(para)
4261
msgid ""
4262
"If you are running Hardy, you can still perform most of this using the older "
4263
"version of the package named <application>ubuntu-vm-builder</application>, "
4264
"there are only a few changes to the syntax of the tool."
4265
msgstr ""
4266
4267
#: serverguide/C/virtualization.xml:541(title)
4268
msgid "Defining Your Virtual Machine"
4269
msgstr ""
4270
4271
#: serverguide/C/virtualization.xml:543(para)
4272
msgid ""
4273
"Defining a virtual machine with Ubuntu's vmbuilder is quite simple, but here "
4274
"are a few thing to consider:"
4275
msgstr ""
4276
4277
#: serverguide/C/virtualization.xml:549(para)
4278
msgid ""
4279
"If you plan on shipping a virtual appliance, do not assume that the end-user "
4280
"will know how to extend disk size to fit their need, so either plan for a "
4281
"large virtual disk to allow for your appliance to grow, or explain fairly "
4282
"well in your documentation how to allocate more space. It might actually be "
4283
"a good idea to store data on some separate external storage."
4284
msgstr ""
4285
4286
#: serverguide/C/virtualization.xml:556(para)
4287
msgid ""
4288
"Given that RAM is much easier to allocate in a VM, RAM size should be set to "
4289
"whatever you think is a safe minimum for your appliance."
4290
msgstr ""
4291
4292
#: serverguide/C/virtualization.xml:562(para)
4293
msgid ""
4294
"The <application>vmbuilder</application> command has 2 main parameters: the "
4295
"<emphasis>virtualization technology (hypervisor)</emphasis> and the targeted "
4296
"<emphasis>distribution</emphasis>. Optional parameters are quite numerous "
4297
"and can be found using the following command:"
4298
msgstr ""
4299
4300
#: serverguide/C/virtualization.xml:568(command)
4301
msgid "vmbuilder --help"
4302
msgstr ""
4303
4304
#: serverguide/C/virtualization.xml:572(title)
4305
msgid "Base Parameters"
4306
msgstr ""
4307
4308
#: serverguide/C/virtualization.xml:574(para)
4309
msgid ""
4310
"As this example is based on <application>KVM</application> and Ubuntu 10.04 "
4311
"LTS (Lucid Lynx), and we are likely to rebuild the same virtual machine "
4312
"multiple time, we'll invoke vmbuilder with the following first parameters:"
4313
msgstr ""
4314
4315
#: serverguide/C/virtualization.xml:580(command)
4316
msgid ""
4317
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4318
"libvirt qemu:///system"
4319
msgstr ""
4320
4321
#: serverguide/C/virtualization.xml:583(para)
4322
msgid ""
4323
"The <emphasis>--suite</emphasis> defines the Ubuntu release, the <emphasis>--"
4324
"flavour</emphasis> specifies that we want to use the virtual kernel (that's "
4325
"the one used to build a JeOS image), the <emphasis>--arch</emphasis> tells "
4326
"that we want to use a 32 bit machine, the <emphasis>-o</emphasis> tells "
4327
"vmbuilder to overwrite the previous version of the VM and the <emphasis>--"
4328
"libvirt</emphasis> tells to inform the local virtualization environment to "
4329
"add the resulting VM to the list of available machines."
4330
msgstr ""
4331
4332
#: serverguide/C/virtualization.xml:591(para)
4333
msgid "Notes:"
4334
msgstr ""
4335
4336
#: serverguide/C/virtualization.xml:597(para)
4337
msgid ""
4338
"Because of the nature of operations performed by vmbuilder, it needs to have "
4339
"root privilege, hence the use of sudo."
4340
msgstr ""
4341
4342
#: serverguide/C/virtualization.xml:602(para)
4343
msgid ""
4344
"If your virtual machine needs to use more than 3Gb of ram, you should build "
4345
"a 64 bit machine (--arch amd64)."
4346
msgstr ""
4347
4348
#: serverguide/C/virtualization.xml:607(para)
4349
msgid ""
4350
"Until Ubuntu 8.10, the virtual kernel was only built for 32 bit "
4351
"architecture, so if you want to define an amd64 machine on Hardy, you should "
4352
"use <emphasis>--flavour</emphasis> server instead."
4353
msgstr ""
4354
4355
#: serverguide/C/virtualization.xml:615(title)
4356
msgid "JeOS Installation Parameters"
4357
msgstr ""
4358
4359
#: serverguide/C/virtualization.xml:618(title)
4360
msgid "JeOS Networking"
4361
msgstr ""
4362
4363
#: serverguide/C/virtualization.xml:621(title)
4364
msgid "Assigning a fixed IP address"
4365
msgstr ""
4366
4367
#: serverguide/C/virtualization.xml:623(para)
4368
msgid ""
4369
"As a virtual appliance that may be deployed on various very different "
4370
"networks, it is very difficult to know what the actual network will look "
4371
"like. In order to simplify configuration, it is a good idea to take an "
4372
"approach similar to what network hardware vendors usually do, namely "
4373
"assigning an initial fixed IP address to the appliance in a private class "
4374
"network that you will provide in your documentation. An address in the range "
4375
"192.168.0.0/255 is usually a good choice."
4376
msgstr ""
4377
4378
#: serverguide/C/virtualization.xml:630(para)
4379
msgid "To do this we'll use the following parameters:"
4380
msgstr ""
4381
4382
#: serverguide/C/virtualization.xml:636(para)
4383
msgid ""
4384
"<emphasis>--ip ADDRESS</emphasis>: IP address in dotted form (defaults to "
4385
"dhcp if not specified)"
4386
msgstr ""
4387
4388
#: serverguide/C/virtualization.xml:641(para)
4389
msgid ""
4390
"<emphasis>--mask VALUE</emphasis>: IP mask in dotted form (default: "
4391
"255.255.255.0)"
4392
msgstr ""
4393
4394
#: serverguide/C/virtualization.xml:646(para)
4395
msgid "<emphasis>--net VALUE</emphasis>: IP net address (default: X.X.X.0)"
4396
msgstr ""
4397
4398
#: serverguide/C/virtualization.xml:651(para)
4399
msgid "<emphasis>--bcast VALUE</emphasis>: IP broadcast (default: X.X.X.255)"
4400
msgstr ""
4401
4402
#: serverguide/C/virtualization.xml:656(para)
4403
msgid "<emphasis>--gw ADDRESS</emphasis>: Gateway address (default: X.X.X.1)"
4404
msgstr ""
4405
4406
#: serverguide/C/virtualization.xml:661(para)
4407
msgid ""
4408
"<emphasis>--dns ADDRESS</emphasis>: Name server address (default: X.X.X.1)"
4409
msgstr ""
4410
4411
#: serverguide/C/virtualization.xml:667(para)
4412
msgid ""
4413
"We assume for now that default values are good enough, so the resulting "
4414
"invocation becomes:"
4415
msgstr ""
4416
4417
#: serverguide/C/virtualization.xml:672(command)
4418
msgid ""
4419
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4420
"libvirt qemu:///system --ip 192.168.0.100"
4421
msgstr ""
4422
4423
#: serverguide/C/virtualization.xml:677(title)
4424
msgid "Modifying the libvirt Template to use Bridging"
4425
msgstr ""
4426
4427
#: serverguide/C/virtualization.xml:679(para)
4428
msgid ""
4429
"Because our appliance will be likely to need to be accessed by remote hosts, "
4430
"we need to configure libvirt so that the appliance uses bridge networking. "
4431
"To do this we use vmbuilder template mechanism to modify the default one."
4432
msgstr ""
4433
4434
#: serverguide/C/virtualization.xml:684(para)
4435
msgid ""
4436
"In our working directory we create the template hierarchy and copy the "
4437
"default template:"
4438
msgstr ""
4439
4440
#: serverguide/C/virtualization.xml:689(command)
4441
msgid "mkdir -p VMBuilder/plugins/libvirt/templates"
4442
msgstr ""
4443
4444
#: serverguide/C/virtualization.xml:690(command)
4445
msgid "cp /etc/vmbuilder/libvirt/* VMBuilder/plugins/libvirt/templates/"
4446
msgstr ""
4447
4448
#: serverguide/C/virtualization.xml:693(para)
4449
msgid ""
4450
"We can then edit "
4451
"<filename>VMBuilder/plugins/libvirt/templates/libvirtxml.tmpl</filename> to "
4452
"change:"
4453
msgstr ""
4454
4455
#: serverguide/C/virtualization.xml:697(programlisting)
4456
#, no-wrap
4457
msgid ""
4458
"\n"
4459
" <interface type='network'>\n"
4460
" <source network='default'/>\n"
4461
" </interface>\n"
4462
msgstr ""
4463
4464
#: serverguide/C/virtualization.xml:703(para)
4465
msgid "To:"
4466
msgstr ""
4467
4468
#: serverguide/C/virtualization.xml:707(programlisting)
4469
#, no-wrap
4470
msgid ""
4471
"\n"
4472
" <interface type='bridge'>\n"
4473
" <source bridge='br0'/>\n"
4474
" </interface>\n"
4475
msgstr ""
4476
4477
#: serverguide/C/virtualization.xml:717(title) serverguide/C/installation.xml:459(title)
4478
msgid "Partitioning"
4479
msgstr ""
4480
4481
#: serverguide/C/virtualization.xml:719(para)
4482
msgid ""
4483
"Partitioning of the virtual appliance will have to take into consideration "
4484
"what you are planning to do with is. Because most appliances want to have a "
4485
"separate storage for data, having a separate <filename>/var</filename> would "
4486
"make sense."
4487
msgstr ""
4488
4489
#: serverguide/C/virtualization.xml:724(para)
4490
msgid ""
4491
"In order to do this vmbuilder provides us with <emphasis>--part</emphasis>:"
4492
msgstr ""
4493
4494
#: serverguide/C/virtualization.xml:728(programlisting)
4495
#, no-wrap
4496
msgid ""
4497
"\n"
4498
"--part PATH\n"
4499
" Allows you to specify a partition table in a partition file, located at "
4500
"PATH. Each line of the partition file should specify\n"
4501
" (root first):\n"
4502
" mountpoint size\n"
4503
" where size is in megabytes. You can have up to 4 virtual disks, a new "
4504
"disk starts on a\n"
4505
" line with ’---’. ie :\n"
4506
" root 1000\n"
4507
" /opt 1000\n"
4508
" swap 256\n"
4509
" ---\n"
4510
" /var 2000\n"
4511
" /log 1500\n"
4512
msgstr ""
4513
4514
#: serverguide/C/virtualization.xml:743(para)
4515
msgid ""
4516
"In our case we will define a text file name "
4517
"<filename>vmbuilder.partition</filename> which will contain the following:"
4518
msgstr ""
4519
4520
#: serverguide/C/virtualization.xml:747(programlisting)
4521
#, no-wrap
4522
msgid ""
4523
"\n"
4524
"root 8000\n"
4525
"swap 4000\n"
4526
"---\n"
4527
"/var 20000\n"
4528
msgstr ""
4529
4530
#: serverguide/C/virtualization.xml:755(para)
4531
msgid ""
4532
"Note that as we are using virtual disk images, the actual sizes that we put "
4533
"here are maximum sizes for these volumes."
4534
msgstr ""
4535
4536
#: serverguide/C/virtualization.xml:760(para)
4537
msgid "Our command line now looks like:"
4538
msgstr ""
4539
4540
#: serverguide/C/virtualization.xml:765(command)
4541
msgid ""
4542
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4543
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition"
4544
msgstr ""
4545
4546
#: serverguide/C/virtualization.xml:770(para)
4547
msgid ""
4548
"Using a \"\\\" in a command will allow long command strings to wrap to the "
4549
"next line."
4550
msgstr ""
4551
4552
#: serverguide/C/virtualization.xml:777(title)
4553
msgid "User and Password"
4554
msgstr ""
4555
4556
#: serverguide/C/virtualization.xml:779(para)
4557
msgid ""
4558
"Again setting up a virtual appliance, you will need to provide a default "
4559
"user and password that is generic so that you can include it in your "
4560
"documentation. We will see later on in this tutorial how we will provide "
4561
"some security by defining a script that will be run the first time a user "
4562
"actually logs in the appliance, that will, among other things, ask him to "
4563
"change his password. In this example I will use <emphasis>'user'</emphasis> "
4564
"as my user name, and <emphasis>'default'</emphasis> as the password."
4565
msgstr ""
4566
4567
#: serverguide/C/virtualization.xml:787(para)
4568
msgid "To do this we use the following optional parameters:"
4569
msgstr ""
4570
4571
#: serverguide/C/virtualization.xml:793(para)
4572
msgid ""
4573
"<emphasis>--user USERNAME:</emphasis> Sets the name of the user to be added. "
4574
"Default: ubuntu."
4575
msgstr ""
4576
4577
#: serverguide/C/virtualization.xml:798(para)
4578
msgid ""
4579
"<emphasis>--name FULLNAME:</emphasis> Sets the full name of the user to be "
4580
"added. Default: Ubuntu."
4581
msgstr ""
4582
4583
#: serverguide/C/virtualization.xml:803(para)
4584
msgid ""
4585
"<emphasis>--pass PASSWORD:</emphasis> Sets the password for the user. "
4586
"Default: ubuntu."
4587
msgstr ""
4588
4589
#: serverguide/C/virtualization.xml:809(para)
4590
msgid "Our resulting command line becomes:"
4591
msgstr ""
4592
4593
#: serverguide/C/virtualization.xml:814(command)
4594
msgid ""
4595
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4596
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition \\ --"
4597
"user user --name user --pass default"
4598
msgstr ""
4599
4600
#: serverguide/C/virtualization.xml:822(title)
4601
msgid "Installing Required Packages"
4602
msgstr ""
4603
4604
#: serverguide/C/virtualization.xml:824(para)
4605
msgid ""
4606
"In this example we will be installing a package "
4607
"<application>(Limesurvey)</application> that accesses a "
4608
"<application>MySQL</application> database and has a web interface. We will "
4609
"therefore require our OS to provide us with:"
4610
msgstr ""
4611
4612
#: serverguide/C/virtualization.xml:831(para)
4613
msgid "Apache"
4614
msgstr ""
4615
4616
#: serverguide/C/virtualization.xml:832(para)
4617
msgid "PHP"
4618
msgstr ""
4619
4620
#: serverguide/C/virtualization.xml:833(para) serverguide/C/databases.xml:19(trademark) serverguide/C/databases.xml:31(title)
4621
msgid "MySQL"
4622
msgstr ""
4623
4624
#: serverguide/C/virtualization.xml:834(para) serverguide/C/remote-administration.xml:20(title)
4625
msgid "OpenSSH Server"
4626
msgstr ""
4627
4628
#: serverguide/C/virtualization.xml:835(para)
4629
msgid "Limesurvey (as an example application that we have packaged)"
4630
msgstr ""
4631
4632
#: serverguide/C/virtualization.xml:838(para)
4633
msgid ""
4634
"This is done using vmbuilder by specifying the --addpkg option multiple "
4635
"times:"
4636
msgstr ""
4637
4638
#: serverguide/C/virtualization.xml:842(programlisting)
4639
#, no-wrap
4640
msgid ""
4641
"\n"
4642
"--addpkg PKG\n"
4643
" Install PKG into the guest (can be specfied multiple times)\n"
4644
msgstr ""
4645
4646
#: serverguide/C/virtualization.xml:847(para)
4647
msgid ""
4648
"However, due to the way vmbuilder operates, packages that have to ask "
4649
"questions to the user during the post install phase are not supported and "
4650
"should instead be installed while interactivity can occur. This is the case "
4651
"of Limesurvey, which we will have to install later, once the user logs in."
4652
msgstr ""
4653
4654
#: serverguide/C/virtualization.xml:853(para)
4655
msgid ""
4656
"Other packages that ask simple debconf question, such as <application>mysql-"
4657
"server</application> asking to set a password, the package can be installed "
4658
"immediately, but we will have to reconfigure it the first time the user logs "
4659
"in."
4660
msgstr ""
4661
4662
#: serverguide/C/virtualization.xml:859(para)
4663
msgid ""
4664
"If some packages that we need to install are not in main, we need to enable "
4665
"the additional repositories using --comp and --ppa:"
4666
msgstr ""
4667
4668
#: serverguide/C/virtualization.xml:863(programlisting)
4669
#, no-wrap
4670
msgid ""
4671
"\n"
4672
"--components COMP1,COMP2,...,COMPN\n"
4673
" A comma separated list of distro components to include (e.g. "
4674
"main,universe). This defaults\n"
4675
" to \"main\"\n"
4676
"--ppa=PPA Add ppa belonging to PPA to the vm's sources.list.\n"
4677
msgstr ""
4678
4679
#: serverguide/C/virtualization.xml:870(para)
4680
msgid ""
4681
"Limesurvey not being part of the archive at the moment, we'll specify it's "
4682
"PPA (personal package archive) address so that it is added to the VM "
4683
"<filename>/etc/apt/source.list</filename>, so we add the following options "
4684
"to the command line:"
4685
msgstr ""
4686
4687
#: serverguide/C/virtualization.xml:876(command)
4688
msgid ""
4689
"--addpkg apache2 --addpkg apache2-mpm-prefork --addpkg apache2-utils --"
4690
"addpkg apache2.2-common \\ --addpkg dbconfig-common --addpkg libapache2-mod-"
4691
"php5 --addpkg mysql-client --addpkg php5-cli \\ --addpkg php5-gd --addpkg "
4692
"php5-ldap --addpkg php5-mysql --addpkg wwwconfig-common \\ --addpkg mysql-"
4693
"server --ppa nijaba"
4694
msgstr ""
4695
4696
#: serverguide/C/virtualization.xml:883(title)
4697
msgid "OpenSSH"
4698
msgstr ""
4699
4700
#: serverguide/C/virtualization.xml:885(para)
4701
msgid ""
4702
"Another convenient tool that we want to have on our appliance is OpenSSH, as "
4703
"it will allow our admins to access the appliance remotely. However, pushing "
4704
"in the wild an appliance with a pre-installed OpenSSH server is a big "
4705
"security risk as all these server will share the same secret key, making it "
4706
"very easy for hackers to target our appliance with all the tools they need "
4707
"to crack it open in a breeze. As for the user password, we will instead rely "
4708
"on a script that will install OpenSSH the first time a user logs in so that "
4709
"the key generated will be different for each appliance. For this we'll use a "
4710
"<emphasis>--firstboot</emphasis> script, as it does not need any user "
4711
"interaction."
4712
msgstr ""
4713
4714
#: serverguide/C/virtualization.xml:897(title)
4715
msgid "Speed Considerations"
4716
msgstr ""
4717
4718
#: serverguide/C/virtualization.xml:900(title)
4719
msgid "Package Caching"
4720
msgstr ""
4721
4722
#: serverguide/C/virtualization.xml:902(para)
4723
msgid ""
4724
"When vmbuilder creates builds your system, it has to go fetch each one of "
4725
"the packages that composes it over the network to one of the official "
4726
"repositories, which, depending on your internet connection speed and the "
4727
"load of the mirror, can have a big impact on the actual build time. In order "
4728
"to reduce this, it is recommended to either have a local repository (which "
4729
"can be created using <application>apt-mirror</application>) or using a "
4730
"caching proxy such as <application>apt-proxy</application>. The later option "
4731
"being much simpler to implement and requiring less disk space, it is the one "
4732
"we will pick in this tutorial. To install it, simply type:"
4733
msgstr ""
4734
4735
#: serverguide/C/virtualization.xml:912(command)
4736
msgid "sudo apt-get install apt-proxy"
4737
msgstr ""
4738
4739
#: serverguide/C/virtualization.xml:915(para)
4740
msgid ""
4741
"Once this is complete, your (empty) proxy is ready for use on "
4742
"http://mirroraddress:9999 and will find ubuntu repository under /ubuntu. For "
4743
"vmbuilder to use it, we'll have to use the <emphasis>--mirror</emphasis> "
4744
"option:"
4745
msgstr ""
4746
4747
#: serverguide/C/virtualization.xml:920(programlisting)
4748
#, no-wrap
4749
msgid ""
4750
"\n"
4751
"--mirror=URL Use Ubuntu mirror at URL instead of the default, which\n"
4752
" is http://archive.ubuntu.com/ubuntu for official\n"
4753
" arches and http://ports.ubuntu.com/ubuntu-ports\n"
4754
" otherwise\n"
4755
msgstr ""
4756
4757
#: serverguide/C/virtualization.xml:927(para)
4758
msgid "So we add to the command line:"
4759
msgstr ""
4760
4761
#: serverguide/C/virtualization.xml:932(command)
4762
msgid "--mirror http://mirroraddress:9999/ubuntu"
4763
msgstr ""
4764
4765
#: serverguide/C/virtualization.xml:936(para)
4766
msgid ""
4767
"The mirror address specified here will also be used in the "
4768
"<filename>/etc/apt/sources.list</filename> of the newly created guest, so it "
4769
"is useful to specify here an address that can be resolved by the guest or to "
4770
"plan on reseting this address later on, such as in a <emphasis>--"
4771
"firstboot</emphasis> script."
4772
msgstr ""
4773
4774
#: serverguide/C/virtualization.xml:945(title)
4775
msgid "Install a Local Mirror"
4776
msgstr ""
4777
4778
#: serverguide/C/virtualization.xml:947(para)
4779
msgid ""
4780
"If we are in a larger environment, it may make sense to setup a local mirror "
4781
"of the Ubuntu repositories. The package apt-mirror provides you with a "
4782
"script that will handle the mirroring for you. You should plan on having "
4783
"about 20 gigabyte of free space per supported release and architecture."
4784
msgstr ""
4785
4786
#: serverguide/C/virtualization.xml:953(para)
4787
msgid ""
4788
"By default, <application>apt-mirror</application> uses the configuration "
4789
"file in <filename>/etc/apt/mirror.list</filename>. As it is set up, it will "
4790
"replicate only the architecture of the local machine. If you would like to "
4791
"support other architectures on your mirror, simply duplicate the lines "
4792
"starting with “deb”, replacing the deb keyword by /deb-{arch} where arch can "
4793
"be i386, amd64, etc... For example, on an amd64 machine, to have the i386 "
4794
"archives as well, you will have:"
4795
msgstr ""
4796
4797
#: serverguide/C/virtualization.xml:960(programlisting)
4798
#, no-wrap
4799
msgid ""
4800
"\n"
4801
"deb http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4802
"multiverse \n"
4803
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4804
"multiverse\n"
4805
"\n"
4806
"deb http://archive.ubuntu.com/ubuntu lucid-updates main restricted universe "
4807
"multiverse \n"
4808
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-updates main restricted "
4809
"universe multiverse \n"
4810
"\n"
4811
"deb http://archive.ubuntu.com/ubuntu/ lucid-backports main restricted "
4812
"universe multiverse \n"
4813
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-backports main restricted "
4814
"universe multiverse \n"
4815
"\n"
4816
"deb http://security.ubuntu.com/ubuntu lucid-security main restricted "
4817
"universe multiverse \n"
4818
"/deb-i386 http://security.ubuntu.com/ubuntu lucid-security main restricted "
4819
"universe multiverse \n"
4820
"\n"
4821
"deb http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4822
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4823
"installer \n"
4824
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4825
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4826
"installer \n"
4827
msgstr ""
4828
4829
#: serverguide/C/virtualization.xml:977(para)
4830
msgid ""
4831
"Notice that the source packages are not mirrored as they are seldom used "
4832
"compared to the binaries and they do take a lot more space, but they can be "
4833
"easily added to the list."
4834
msgstr ""
4835
4836
#: serverguide/C/virtualization.xml:982(para)
4837
msgid ""
4838
"Once the mirror has finished replicating (and this can be quite long), you "
4839
"need to configure Apache so that your mirror files (in "
4840
"<filename>/var/spool/apt-mirror</filename> if you did not change the "
4841
"default), are published by your Apache server. For more information on "
4842
"Apache see <xref linkend=\"httpd\"/>."
4843
msgstr ""
4844
4845
#: serverguide/C/virtualization.xml:991(title)
4846
msgid "Installing in a RAM Disk"
4847
msgstr ""
4848
4849
#: serverguide/C/virtualization.xml:993(para)
4850
msgid ""
4851
"As you can easily imagine, writing to RAM is a <emphasis>LOT</emphasis> "
4852
"faster than writing to disk. If you have some free memory, letting vmbuilder "
4853
"perform its operation in a RAMdisk will help a lot and the option <emphasis>-"
4854
"-tmpfs</emphasis> will help you do just that:"
4855
msgstr ""
4856
4857
#: serverguide/C/virtualization.xml:999(programlisting)
4858
#, no-wrap
4859
msgid ""
4860
"\n"
4861
"--tmpfs OPTS Use a tmpfs as the working directory, specifying its\n"
4862
" size or \"-\" to use tmpfs default (suid,dev,size=1G).\n"
4863
msgstr ""
4864
4865
#: serverguide/C/virtualization.xml:1004(para)
4866
msgid ""
4867
"So adding <command>--tmpfs -</command> sounds like a very good idea if you "
4868
"have 1G of free ram."
4869
msgstr ""
4870
4871
#: serverguide/C/virtualization.xml:1011(title)
4872
msgid "Package the Application"
4873
msgstr ""
4874
4875
#: serverguide/C/virtualization.xml:1013(para)
4876
msgid "Two option are available to us:"
4877
msgstr ""
4878
4879
#: serverguide/C/virtualization.xml:1019(para)
4880
msgid ""
4881
"The recommended method to do so is to make a <emphasis>Debian</emphasis> "
4882
"package. Since this is outside of the scope of this tutorial, we will not "
4883
"perform this here and invite the reader to read the documentation on how to "
4884
"do this in the <ulink url=\"https://wiki.ubuntu.com/PackagingGuide\">Ubuntu "
4885
"Packaging Guide</ulink>. In this case it is also a good idea to setup a "
4886
"repository for your package so that updates can be conveniently pulled from "
4887
"it. See the <ulink url=\"http://www.debian-"
4888
"administration.org/articles/286\">Debian Administration</ulink> article for "
4889
"a tutorial on this."
4890
msgstr ""
4891
4892
#: serverguide/C/virtualization.xml:1028(para)
4893
msgid ""
4894
"Manually install the application under <filename>/opt</filename> as "
4895
"recommended by the <ulink url=\"http://www.pathname.com/fhs/\">FHS "
4896
"guidelines</ulink>."
4897
msgstr ""
4898
4899
#: serverguide/C/virtualization.xml:1035(para)
4900
msgid ""
4901
"In our case we'll use <application>Limesurvey</application> as example web "
4902
"application for which we wish to provide a virtual appliance. As noted "
4903
"before, we've made a version of the package available in a PPA (Personal "
4904
"Package Archive)."
4905
msgstr ""
4906
4907
#: serverguide/C/virtualization.xml:1042(title)
4908
msgid "Finishing Install"
4909
msgstr ""
4910
4911
#: serverguide/C/virtualization.xml:1045(title)
4912
msgid "First Boot"
4913
msgstr ""
4914
4915
#: serverguide/C/virtualization.xml:1047(para)
4916
msgid ""
4917
"As we mentioned earlier, the first time the machine boots we'll need to "
4918
"install <application>openssh-server</application> so that the key generated "
4919
"for it is unique for each machine. To do this, we'll write a script called "
4920
"<filename>boot.sh</filename> as follows:"
4921
msgstr ""
4922
4923
#: serverguide/C/virtualization.xml:1053(programlisting)
4924
#, no-wrap
4925
msgid ""
4926
"\n"
4927
"# This script will run the first time the virtual machine boots\n"
4928
"# It is ran as root.\n"
4929
"\n"
4930
"apt-get update\n"
4931
"apt-get install -qqy --force-yes openssh-server\n"
4932
msgstr ""
4933
4934
#: serverguide/C/virtualization.xml:1061(para)
4935
msgid ""
4936
"And we add the <command>--firstboot boot.sh</command> option to our command "
4937
"line."
4938
msgstr ""
4939
4940
#: serverguide/C/virtualization.xml:1067(title)
4941
msgid "First Login"
4942
msgstr ""
4943
4944
#: serverguide/C/virtualization.xml:1069(para)
4945
msgid ""
4946
"Mysql and Limesurvey needing some user interaction during their setup, we'll "
4947
"set them up the first time a user logs in using a script named login.sh. "
4948
"We'll also use this script to let the user specify:"
4949
msgstr ""
4950
4951
#: serverguide/C/virtualization.xml:1075(para)
4952
msgid "His own password"
4953
msgstr ""
4954
4955
#: serverguide/C/virtualization.xml:1076(para)
4956
msgid "Define the keyboard and other locale info he wants to use"
4957
msgstr ""
4958
4959
#: serverguide/C/virtualization.xml:1079(para)
4960
msgid "So we'll define <filename>login.sh</filename> as follows:"
4961
msgstr ""
4962
4963
#: serverguide/C/virtualization.xml:1083(programlisting)
4964
#, no-wrap
4965
msgid ""
4966
"\n"
4967
"# This script is ran the first time a user logs in\n"
4968
"\n"
4969
"echo \"Your appliance is about to be finished to be set up.\"\n"
4970
"echo \"In order to do it, we'll need to ask you a few questions,\"\n"
4971
"echo \"starting by changing your user password.\"\n"
4972
"\n"
4973
"passwd\n"
4974
"\n"
4975
"#give the opportunity to change the keyboard\n"
4976
"sudo dpkg-reconfigure console-setup\n"
4977
"\n"
4978
"#configure the mysql server root password\n"
4979
"sudo dpkg-reconfigure mysql-server-5.0\n"
4980
"\n"
4981
"#install limesurvey\n"
4982
"sudo apt-get install -qqy --force-yes limesurvey\n"
4983
"\n"
4984
"echo \"Your appliance is now configured. To use it point your\"\n"
4985
"echo \"browser to http://serverip/limesurvey/admin\"\n"
4986
msgstr ""
4987
4988
#: serverguide/C/virtualization.xml:1105(para)
4989
msgid ""
4990
"And we add the <command>--firstlogin login.sh</command> option to our "
4991
"command line."
4992
msgstr ""
4993
4994
#: serverguide/C/virtualization.xml:1112(title)
4995
msgid "Useful Additions"
4996
msgstr ""
4997
4998
#: serverguide/C/virtualization.xml:1115(title)
4999
msgid "Configuring Automatic Updates"
5000
msgstr ""
5001
5002
#: serverguide/C/virtualization.xml:1117(para)
5003
msgid ""
5004
"To have your system be configured to update itself on a regular basis, we "
5005
"will just install <application>unattended-upgrades</application>, so we add "
5006
"the following option to our command line:"
5007
msgstr ""
5008
5009
#: serverguide/C/virtualization.xml:1123(command)
5010
msgid "--addpkg unattended-upgrades"
5011
msgstr ""
5012
5013
#: serverguide/C/virtualization.xml:1126(para)
5014
msgid ""
5015
"As we have put our application package in a PPA, the process will update not "
5016
"only the system, but also the application each time we update the version in "
5017
"the PPA."
5018
msgstr ""
5019
5020
#: serverguide/C/virtualization.xml:1133(title)
5021
msgid "ACPI Event Handling"
5022
msgstr ""
5023
5024
#: serverguide/C/virtualization.xml:1135(para)
5025
msgid ""
5026
"For your virtual machine to be able to handle restart and shutdown events it "
5027
"is being sent, it is a good idea to install the acpid package as well. To do "
5028
"this we just add the following option:"
5029
msgstr ""
5030
5031
#: serverguide/C/virtualization.xml:1141(command)
5032
msgid "--addpkg acpid"
5033
msgstr ""
5034
5035
#: serverguide/C/virtualization.xml:1147(title)
5036
msgid "Final Command"
5037
msgstr ""
5038
5039
#: serverguide/C/virtualization.xml:1149(para)
5040
msgid "Here is the command with all the options discussed above:"
5041
msgstr ""
5042
5043
#: serverguide/C/virtualization.xml:1154(command)
5044
msgid ""
5045
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o \\ -"
5046
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition --user "
5047
"user \\ --name user --pass default --addpkg apache2 --addpkg apache2-mpm-"
5048
"prefork \\ --addpkg apache2-utils --addpkg apache2.2-common --addpkg "
5049
"dbconfig-common \\ --addpkg libapache2-mod-php5 --addpkg mysql-client --"
5050
"addpkg php5-cli \\ --addpkg php5-gd --addpkg php5-ldap --addpkg php5-mysql --"
5051
"addpkg wwwconfig-common \\ --addpkg mysql-server --addpkg unattended-"
5052
"upgrades --addpkg acpid --ppa nijaba \\ --mirror "
5053
"http://mirroraddress:9999/ubuntu --tmpfs - --firstboot boot.sh \\ --"
5054
"firstlogin login.sh es"
5055
msgstr ""
5056
5057
#: serverguide/C/virtualization.xml:1169(para)
5058
msgid ""
5059
"If you are interested in learning more, have questions or suggestions, "
5060
"please contact the Ubuntu Server Team at:"
5061
msgstr ""
5062
5063
#: serverguide/C/virtualization.xml:1174(para)
5064
msgid "IRC: #ubuntu-server on freenode"
5065
msgstr ""
5066
5067
#: serverguide/C/virtualization.xml:1179(para)
5068
msgid ""
5069
"Mailing list: <ulink url=\"https://lists.ubuntu.com/mailman/listinfo/ubuntu-"
5070
"server\">ubuntu-server at lists.ubuntu.com</ulink>"
5071
msgstr ""
5072
5073
#: serverguide/C/virtualization.xml:1184(para)
5074
msgid ""
5075
"Also, see the <ulink "
5076
"url=\"https://help.ubuntu.com/community/JeOSVMBuilder\">JeOSVMBuilder Ubuntu "
5077
"Wiki</ulink> page."
5078
msgstr ""
5079
5080
#: serverguide/C/virtualization.xml:1192(title)
5081
msgid "UEC"
5082
msgstr ""
5083
5084
#: serverguide/C/virtualization.xml:1195(title) serverguide/C/network-auth.xml:2026(title) serverguide/C/monitoring.xml:15(title) serverguide/C/lamp-applications.xml:17(title) serverguide/C/installation.xml:928(title) serverguide/C/dns.xml:64(title) serverguide/C/chat.xml:17(title) serverguide/C/backups.xml:541(title)
5085
msgid "Overview"
5086
msgstr ""
5087
5088
#: serverguide/C/virtualization.xml:1197(para)
5089
msgid ""
5090
"This tutorial covers <application>UEC</application> installation from the "
5091
"Ubuntu 10.04 LTS Server Edition CD, and assumes a basic network topology, "
5092
"with a single system serving as the <emphasis>\"all-in-one "
5093
"controller\"</emphasis>, and one or more nodes attached."
5094
msgstr ""
5095
5096
#: serverguide/C/virtualization.xml:1202(para)
5097
msgid ""
5098
"From this Tutorial you will learn how to install, configure, register and "
5099
"perform several operations on a basic <application>UEC</application> setup "
5100
"that results in a cloud with a one controller <emphasis>\"front-"
5101
"end\"</emphasis> and one or several node(s) for running Virtual Machine (VM) "
5102
"instances. You will also use examples to help get you started using your own "
5103
"private compute cloud."
5104
msgstr ""
5105
5106
#: serverguide/C/virtualization.xml:1210(title)
5107
msgid "Prerequisites"
5108
msgstr ""
5109
5110
#: serverguide/C/virtualization.xml:1212(para)
5111
msgid ""
5112
"To deploy a minimal cloud infrastructure, you’ll need at least "
5113
"<emphasis>two</emphasis> dedicated systems:"
5114
msgstr ""
5115
5116
#: serverguide/C/virtualization.xml:1218(para)
5117
msgid "A front end."
5118
msgstr ""
5119
5120
#: serverguide/C/virtualization.xml:1223(para)
5121
msgid "One or more node(s)."
5122
msgstr ""
5123
5124
#: serverguide/C/virtualization.xml:1229(para)
5125
msgid ""
5126
"The following are recommendations, rather than fixed requirements. However, "
5127
"our experience in developing this documentation indicated the following "
5128
"suggestions."
5129
msgstr ""
5130
5131
#: serverguide/C/virtualization.xml:1234(title)
5132
msgid "Front End Requirements"
5133
msgstr ""
5134
5135
#: serverguide/C/virtualization.xml:1236(para)
5136
msgid "Use the following table for a system that will run one or more of:"
5137
msgstr ""
5138
5139
#: serverguide/C/virtualization.xml:1241(para)
5140
msgid "Cloud Controller (CLC)"
5141
msgstr ""
5142
5143
#: serverguide/C/virtualization.xml:1242(para)
5144
msgid "Cluster Controller (CC)"
5145
msgstr ""
5146
5147
#: serverguide/C/virtualization.xml:1243(para)
5148
msgid "Walrus (the S3-like storage service)"
5149
msgstr ""
5150
5151
#: serverguide/C/virtualization.xml:1244(para)
5152
msgid "Storage Controller (SC)"
5153
msgstr ""
5154
5155
#: serverguide/C/virtualization.xml:1248(title)
5156
msgid "UEC Front End Requirements"
5157
msgstr ""
5158
5159
#: serverguide/C/virtualization.xml:1256(para) serverguide/C/virtualization.xml:1318(para)
5160
msgid "Hardware"
5161
msgstr ""
5162
5163
#: serverguide/C/virtualization.xml:1257(para) serverguide/C/virtualization.xml:1319(para)
5164
msgid "Minimum"
5165
msgstr ""
5166
5167
#: serverguide/C/virtualization.xml:1258(para) serverguide/C/virtualization.xml:1320(para)
5168
msgid "Suggested"
5169
msgstr ""
5170
5171
#: serverguide/C/virtualization.xml:1259(para) serverguide/C/virtualization.xml:1321(para)
5172
msgid "Notes"
5173
msgstr ""
5174
5175
#: serverguide/C/virtualization.xml:1264(para) serverguide/C/virtualization.xml:1326(para)
5176
msgid "CPU"
5177
msgstr ""
5178
5179
#: serverguide/C/virtualization.xml:1265(para)
5180
msgid "1 GHz"
5181
msgstr ""
5182
5183
#: serverguide/C/virtualization.xml:1266(para)
5184
msgid "2 x 2 GHz"
5185
msgstr ""
5186
5187
#: serverguide/C/virtualization.xml:1267(para)
5188
msgid ""
5189
"For an <emphasis>all-in-one</emphasis> front end, it helps to have at least "
5190
"a dual core processor."
5191
msgstr ""
5192
5193
#: serverguide/C/virtualization.xml:1270(para) serverguide/C/virtualization.xml:1332(para)
5194
msgid "Memory"
5195
msgstr ""
5196
5197
#: serverguide/C/virtualization.xml:1271(para)
5198
msgid "512 MB"
5199
msgstr ""
5200
5201
#: serverguide/C/virtualization.xml:1272(para)
5202
msgid "2 GB"
5203
msgstr ""
5204
5205
#: serverguide/C/virtualization.xml:1273(para)
5206
msgid "The Java web front end benefits from lots of available memory."
5207
msgstr ""
5208
5209
#: serverguide/C/virtualization.xml:1276(para) serverguide/C/virtualization.xml:1338(para)
5210
msgid "Disk"
5211
msgstr ""
5212
5213
#: serverguide/C/virtualization.xml:1277(para) serverguide/C/virtualization.xml:1339(para)
5214
msgid "5400 RPM IDE"
5215
msgstr ""
5216
5217
#: serverguide/C/virtualization.xml:1278(para)
5218
msgid "7200 RPM SATA"
5219
msgstr ""
5220
5221
#: serverguide/C/virtualization.xml:1279(para)
5222
msgid ""
5223
"Slower disks will work, but will yield much longer instance startup times."
5224
msgstr ""
5225
5226
#: serverguide/C/virtualization.xml:1282(para) serverguide/C/virtualization.xml:1344(para)
5227
msgid "Disk Space"
5228
msgstr ""
5229
5230
#: serverguide/C/virtualization.xml:1283(para) serverguide/C/virtualization.xml:1345(para)
5231
msgid "40 GB"
5232
msgstr ""
5233
5234
#: serverguide/C/virtualization.xml:1284(para)
5235
msgid "200 GB"
5236
msgstr ""
5237
5238
#: serverguide/C/virtualization.xml:1285(para)
5239
msgid ""
5240
"40GB is only enough space for only a single image, cache, etc., Eucalyptus "
5241
"does not like to run out of disk space."
5242
msgstr ""
5243
5244
#: serverguide/C/virtualization.xml:1288(para) serverguide/C/virtualization.xml:1350(para) serverguide/C/network-config.xml:13(title)
5245
msgid "Networking"
5246
msgstr ""
5247
5248
#: serverguide/C/virtualization.xml:1289(para) serverguide/C/virtualization.xml:1351(para)
5249
msgid "100 Mbps"
5250
msgstr ""
5251
5252
#: serverguide/C/virtualization.xml:1290(para) serverguide/C/virtualization.xml:1352(para)
5253
msgid "1000 Mbps"
5254
msgstr ""
5255
5256
#: serverguide/C/virtualization.xml:1291(para) serverguide/C/virtualization.xml:1353(para)
5257
msgid ""
5258
"Machine images are hundreds of MB, and need to be copied over the network to "
5259
"nodes."
5260
msgstr ""
5261
5262
#: serverguide/C/virtualization.xml:1299(title)
5263
msgid "Node Requirements"
5264
msgstr ""
5265
5266
#: serverguide/C/virtualization.xml:1301(para)
5267
msgid "The other system(s) are <emphasis>nodes</emphasis>, which will run::"
5268
msgstr ""
5269
5270
#: serverguide/C/virtualization.xml:1306(para)
5271
msgid "the Node Controller (NC)"
5272
msgstr ""
5273
5274
#: serverguide/C/virtualization.xml:1310(title)
5275
msgid "UEC Node Requirements"
5276
msgstr ""
5277
5278
#: serverguide/C/virtualization.xml:1327(para)
5279
msgid "VT Extensions"
5280
msgstr ""
5281
5282
#: serverguide/C/virtualization.xml:1328(para)
5283
msgid "VT, 64-bit, Multicore"
5284
msgstr ""
5285
5286
#: serverguide/C/virtualization.xml:1329(para)
5287
msgid ""
5288
"64-bit can run both i386, and amd64 instances; by default, Eucalyptus will "
5289
"only run 1 VM per CPU core on a Node."
5290
msgstr ""
5291
5292
#: serverguide/C/virtualization.xml:1333(para)
5293
msgid "1 GB"
5294
msgstr ""
5295
5296
#: serverguide/C/virtualization.xml:1334(para)
5297
msgid "4 GB"
5298
msgstr ""
5299
5300
#: serverguide/C/virtualization.xml:1335(para)
5301
msgid "Additional memory means more, and larger guests."
5302
msgstr ""
5303
5304
#: serverguide/C/virtualization.xml:1340(para)
5305
msgid "7200 RPM SATA or SCSI"
5306
msgstr ""
5307
5308
#: serverguide/C/virtualization.xml:1341(para)
5309
msgid ""
5310
"Eucalyptus nodes are disk-intensive; I/O wait will likely be the performance "
5311
"bottleneck."
5312
msgstr ""
5313
5314
#: serverguide/C/virtualization.xml:1346(para)
5315
msgid "100 GB"
5316
msgstr ""
5317
5318
#: serverguide/C/virtualization.xml:1347(para)
5319
msgid ""
5320
"Images will be cached locally, Eucalyptus does not like to run out of disk "
5321
"space."
5322
msgstr ""
5323
5324
#: serverguide/C/virtualization.xml:1363(title)
5325
msgid "Installing the Cloud/Cluster/Storage/Walrus Front End Server"
5326
msgstr ""
5327
5328
#: serverguide/C/virtualization.xml:1367(para)
5329
msgid "Download the Ubuntu 10.04 LTS Server ISO file, and burn it to a CD."
5330
msgstr ""
5331
5332
#: serverguide/C/virtualization.xml:1372(para) serverguide/C/virtualization.xml:1418(para)
5333
msgid ""
5334
"When you boot, select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5335
msgstr ""
5336
5337
#: serverguide/C/virtualization.xml:1377(para)
5338
msgid ""
5339
"When asked whether you want a <emphasis>“Cluster”</emphasis> or a "
5340
"<emphasis>“Node”</emphasis> install, select <emphasis>“Cluster”</emphasis>."
5341
msgstr ""
5342
5343
#: serverguide/C/virtualization.xml:1383(para)
5344
msgid ""
5345
"It will ask two other cloud-specific questions during the course of the "
5346
"install:"
5347
msgstr ""
5348
5349
#: serverguide/C/virtualization.xml:1388(para)
5350
msgid "Name of your cluster."
5351
msgstr ""
5352
5353
#: serverguide/C/virtualization.xml:1391(para)
5354
msgid "e.g. <emphasis>cluster1</emphasis>."
5355
msgstr ""
5356
5357
#: serverguide/C/virtualization.xml:1394(para)
5358
msgid ""
5359
"A range of public IP addresses on the LAN that the cloud can allocate to "
5360
"instances."
5361
msgstr ""
5362
5363
#: serverguide/C/virtualization.xml:1397(para)
5364
msgid "e.g. <emphasis>192.168.1.200-192.168.1.249</emphasis>."
5365
msgstr ""
5366
5367
#: serverguide/C/virtualization.xml:1405(title)
5368
msgid "Installing the Node Controller(s)"
5369
msgstr ""
5370
5371
#: serverguide/C/virtualization.xml:1407(para)
5372
msgid ""
5373
"The node controller install is even simpler. Just make sure that you are "
5374
"connected to the network on which the cloud/cluster controller is already "
5375
"running."
5376
msgstr ""
5377
5378
#: serverguide/C/virtualization.xml:1413(para)
5379
msgid "Boot from the same ISO on the node(s)."
5380
msgstr ""
5381
5382
#: serverguide/C/virtualization.xml:1423(para)
5383
msgid "Select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5384
msgstr ""
5385
5386
#: serverguide/C/virtualization.xml:1428(para)
5387
msgid ""
5388
"It should detect the Cluster and preselect <emphasis>“Node”</emphasis> "
5389
"install for you."
5390
msgstr ""
5391
5392
#: serverguide/C/virtualization.xml:1433(para)
5393
msgid "Confirm the partitioning scheme."
5394
msgstr ""
5395
5396
#: serverguide/C/virtualization.xml:1438(para)
5397
msgid ""
5398
"The rest of the installation should proceed uninterrupted; complete the "
5399
"installation and reboot the node."
5400
msgstr ""
5401
5402
#: serverguide/C/virtualization.xml:1446(title)
5403
msgid "Register the Node(s)"
5404
msgstr ""
5405
5406
#: serverguide/C/virtualization.xml:1448(para)
5407
msgid ""
5408
"Nodes are the physical systems within <application>UEC</application> that "
5409
"actually run the virtual machine instances of the cloud."
5410
msgstr ""
5411
5412
#: serverguide/C/virtualization.xml:1452(para)
5413
msgid ""
5414
"Once one or more Ubuntu Server node(s) are installed and running the "
5415
"<application>eucalyptus-nc</application> service, log onto the "
5416
"<emphasis>Cloud Controller (CLC)</emphasis> and run:"
5417
msgstr ""
5418
5419
#: serverguide/C/virtualization.xml:1458(command)
5420
msgid "sudo euca_conf --no-rsync --discover-nodes"
5421
msgstr ""
5422
5423
#: serverguide/C/virtualization.xml:1461(para)
5424
msgid ""
5425
"This will discover the systems on the network running the "
5426
"<application>eucalyptus-nc</application> service, and the administrator can "
5427
"confirm the registration of each node by its IP address."
5428
msgstr ""
5429
5430
#: serverguide/C/virtualization.xml:1467(para)
5431
msgid ""
5432
"If you get prompted for passwords, or receive errors from scp, you may need "
5433
"to revisit the key synchronization instructions at <ulink "
5434
"url=\"https://help.ubuntu.com/community/UEC/NodeInstallation\">UEC/NodeInstal"
5435
"lation</ulink>."
5436
msgstr ""
5437
5438
#: serverguide/C/virtualization.xml:1475(title)
5439
msgid "Obtain Credentials"
5440
msgstr ""
5441
5442
#: serverguide/C/virtualization.xml:1477(para)
5443
msgid ""
5444
"After installing and booting the <emphasis>Cloud Controller</emphasis>, "
5445
"users of the cloud will need to retrieve their credentials. This can be done "
5446
"either through a web browser, or at the command line."
5447
msgstr ""
5448
5449
#: serverguide/C/virtualization.xml:1483(title)
5450
msgid "From a Web Browser"
5451
msgstr ""
5452
5453
#: serverguide/C/virtualization.xml:1487(para)
5454
msgid ""
5455
"From your web browser (either remotely or on your Ubuntu server) access the "
5456
"following URL:"
5457
msgstr ""
5458
5459
#: serverguide/C/virtualization.xml:1490(programlisting) serverguide/C/virtualization.xml:1743(programlisting)
5460
#, no-wrap
5461
msgid ""
5462
"\n"
5463
"https://<cloud-controller-ip-address>:8443/\n"
5464
msgstr ""
5465
5466
#: serverguide/C/virtualization.xml:1495(para)
5467
msgid ""
5468
"You must use a secure connection, so make sure you use \"https\" not "
5469
"\"http\" in your URL. You will get a security certificate warning. You will "
5470
"have to add an exception to view the page. If you do not accept it you will "
5471
"not be able to view the Eucalyptus configuration page."
5472
msgstr ""
5473
5474
#: serverguide/C/virtualization.xml:1503(para)
5475
msgid ""
5476
"Use username <emphasis>'admin'</emphasis> and password "
5477
"<emphasis>'admin'</emphasis> for the first time login (you will be prompted "
5478
"to change your password)."
5479
msgstr ""
5480
5481
#: serverguide/C/virtualization.xml:1509(para)
5482
msgid ""
5483
"Then follow the on-screen instructions to update the admin password and "
5484
"email address."
5485
msgstr ""
5486
5487
#: serverguide/C/virtualization.xml:1514(para)
5488
msgid ""
5489
"Once the first time configuration process is completed, click the "
5490
"<emphasis>'credentials'</emphasis> tab located in the top-left portion of "
5491
"the screen."
5492
msgstr ""
5493
5494
#: serverguide/C/virtualization.xml:1520(para)
5495
msgid ""
5496
"Click the <emphasis>'Download Credentials'</emphasis> button to get your "
5497
"certificates."
5498
msgstr ""
5499
5500
#: serverguide/C/virtualization.xml:1525(para)
5501
msgid "Save them to <filename>~/.euca</filename>."
5502
msgstr ""
5503
5504
#: serverguide/C/virtualization.xml:1530(para)
5505
msgid ""
5506
"Unzip the downloaded zip file into a safe location "
5507
"(<filename>~/.euca</filename>)."
5508
msgstr ""
5509
5510
#: serverguide/C/virtualization.xml:1534(command)
5511
msgid "unzip -d ~/.euca mycreds.zip"
5512
msgstr ""
5513
5514
#: serverguide/C/virtualization.xml:1541(title)
5515
msgid "From a Command Line"
5516
msgstr ""
5517
5518
#: serverguide/C/virtualization.xml:1545(para)
5519
msgid ""
5520
"Alternatively, if you are on the command line of the <emphasis>Cloud "
5521
"Controller</emphasis>, you can run:"
5522
msgstr ""
5523
5524
#: serverguide/C/virtualization.xml:1549(command)
5525
msgid "mkdir -p ~/.euca"
5526
msgstr ""
5527
5528
#: serverguide/C/virtualization.xml:1550(command)
5529
msgid "chmod 700 ~/.euca"
5530
msgstr ""
5531
5532
#: serverguide/C/virtualization.xml:1551(command)
5533
msgid "cd ~/.euca"
5534
msgstr ""
5535
5536
#: serverguide/C/virtualization.xml:1552(command)
5537
msgid "sudo euca_conf --get-credentials mycreds.zip"
5538
msgstr ""
5539
5540
#: serverguide/C/virtualization.xml:1553(command)
5541
msgid "unzip mycreds.zip"
5542
msgstr ""
5543
5544
#: serverguide/C/virtualization.xml:1554(command)
5545
msgid "cd -"
5546
msgstr ""
5547
5548
#: serverguide/C/virtualization.xml:1561(title)
5549
msgid "Extracting and Using Your Credentials"
5550
msgstr ""
5551
5552
#: serverguide/C/virtualization.xml:1563(para)
5553
msgid ""
5554
"Now you will need to setup EC2 API and AMI tools on your server using X.509 "
5555
"certificates."
5556
msgstr ""
5557
5558
#: serverguide/C/virtualization.xml:1569(para)
5559
msgid ""
5560
"Source the included <emphasis>\"eucarc\"</emphasis> file to set up your "
5561
"Eucalyptus environment:"
5562
msgstr ""
5563
5564
#: serverguide/C/virtualization.xml:1573(command) serverguide/C/virtualization.xml:1600(command)
5565
msgid ". ~/.euca/eucarc"
5566
msgstr ""
5567
5568
#: serverguide/C/virtualization.xml:1577(para)
5569
msgid ""
5570
"You may additionally wish to add this command to your "
5571
"<filename>~/.bashrc</filename> file so that your Eucalyptus environment is "
5572
"set up automatically when you log in. Eucalyptus treats this set of "
5573
"credentials as <emphasis>'administrator'</emphasis> credentials that allow "
5574
"the holder global privileges across the cloud. As such, they should be "
5575
"protected in the same way that other elevated-priority access is protected "
5576
"(e.g. should not be made visible to the general user population)."
5577
msgstr ""
5578
5579
#: serverguide/C/virtualization.xml:1584(command)
5580
msgid ""
5581
"echo \"[ -r ~/.euca/eucarc ] && . ~/.euca/eucarc\" >> ~/.bashrc"
5582
msgstr ""
5583
5584
#: serverguide/C/virtualization.xml:1588(para)
5585
msgid "Install the required cloud user tools:"
5586
msgstr ""
5587
5588
#: serverguide/C/virtualization.xml:1592(command)
5589
msgid "sudo apt-get install euca2ools"
5590
msgstr ""
5591
5592
#: serverguide/C/virtualization.xml:1596(para)
5593
msgid ""
5594
"To validate that everything is working correctly, get the local cluster "
5595
"availability details:"
5596
msgstr ""
5597
5598
#: serverguide/C/virtualization.xml:1601(command)
5599
msgid "euca-describe-availability-zones verbose"
5600
msgstr ""
5601
5602
#: serverguide/C/virtualization.xml:1602(computeroutput)
5603
#, no-wrap
5604
msgid ""
5605
"AVAILABILITYZONE myowncloud 192.168.1.1\n"
5606
"AVAILABILITYZONE |- vm types free / max cpu ram disk\n"
5607
"AVAILABILITYZONE |- m1.small 0004 / 0004 1 128 2\n"
5608
"AVAILABILITYZONE |- c1.medium 0004 / 0004 1 256 5\n"
5609
"AVAILABILITYZONE |- m1.large 0002 / 0002 2 512 10\n"
5610
"AVAILABILITYZONE |- m1.xlarge 0002 / 0002 2 1024 20\n"
5611
"AVAILABILITYZONE |- c1.xlarge 0001 / 0001 4 2048 20"
5612
msgstr ""
5613
5614
#: serverguide/C/virtualization.xml:1612(para)
5615
msgid "Your output from the above command will vary."
5616
msgstr ""
5617
5618
#: serverguide/C/virtualization.xml:1622(title)
5619
msgid "Running an Image"
5620
msgstr ""
5621
5622
#: serverguide/C/virtualization.xml:1624(para)
5623
msgid "There are multiple ways to instantiate an image in UEC:"
5624
msgstr ""
5625
5626
#: serverguide/C/virtualization.xml:1629(para)
5627
msgid "Use the command line."
5628
msgstr ""
5629
5630
#: serverguide/C/virtualization.xml:1630(para)
5631
msgid ""
5632
"Use one of the UEC compatible management tools such as "
5633
"<emphasis>Landscape</emphasis>."
5634
msgstr ""
5635
5636
#: serverguide/C/virtualization.xml:1632(para)
5637
msgid ""
5638
"Use the <ulink "
5639
"url=\"https://help.ubuntu.com/community/UEC/ElasticFox\">ElasticFox</ulink> "
5640
"extension to Firefox."
5641
msgstr ""
5642
5643
#: serverguide/C/virtualization.xml:1638(para)
5644
msgid "Here we will describe the process from the command line:"
5645
msgstr ""
5646
5647
#: serverguide/C/virtualization.xml:1644(para)
5648
msgid ""
5649
"Before running an instance of your image, you should first create a "
5650
"<emphasis>keypair</emphasis> (ssh key) that you can use to log into your "
5651
"instance as root, once it boots. The key is stored, so you will only have to "
5652
"do this once."
5653
msgstr ""
5654
5655
#: serverguide/C/virtualization.xml:1648(para)
5656
msgid "Run the following command:"
5657
msgstr ""
5658
5659
#: serverguide/C/virtualization.xml:1651(programlisting)
5660
#, no-wrap
5661
msgid ""
5662
"\n"
5663
"if [ ! -e ~/.euca/mykey.priv ]; then\n"
5664
" touch ~/.euca/mykey.priv\n"
5665
" chmod 0600 ~/.euca/mykey.priv\n"
5666
" euca-add-keypair mykey > ~/.euca/mykey.priv\n"
5667
"fi\n"
5668
msgstr ""
5669
5670
#: serverguide/C/virtualization.xml:1659(para)
5671
msgid ""
5672
"You can call your key whatever you like (in this example, the key is called "
5673
"<emphasis>'mykey'</emphasis>), but remember what it is called. If you "
5674
"forget, you can always run <command>euca-describe-keypairs</command> to get "
5675
"a list of created keys stored in the system."
5676
msgstr ""
5677
5678
#: serverguide/C/virtualization.xml:1666(para)
5679
msgid "You must also allow access to port 22 in your instances:"
5680
msgstr ""
5681
5682
#: serverguide/C/virtualization.xml:1670(command)
5683
msgid "euca-describe-groups"
5684
msgstr ""
5685
5686
#: serverguide/C/virtualization.xml:1671(command)
5687
msgid "euca-authorize default -P tcp -p 22 -s 0.0.0.0/0"
5688
msgstr ""
5689
5690
#: serverguide/C/virtualization.xml:1675(para)
5691
msgid "Next, you can create instances of your registered image:"
5692
msgstr ""
5693
5694
#: serverguide/C/virtualization.xml:1679(command)
5695
msgid "euca-run-instances $EMI -k mykey -t c1.medium"
5696
msgstr ""
5697
5698
#: serverguide/C/virtualization.xml:1682(para)
5699
msgid ""
5700
"If you receive an error regarding <emphasis>image_id</emphasis>, you may "
5701
"find it by viewing Images page or click <emphasis>\"How to Run\"</emphasis> "
5702
"on the <emphasis>Store</emphasis> page to see the sample command."
5703
msgstr ""
5704
5705
#: serverguide/C/virtualization.xml:1689(para)
5706
msgid ""
5707
"The first time you run an instance, the system will be setting up caches for "
5708
"the image from which it will be created. This can often take some time the "
5709
"first time an instance is run given that VM images are usually quite large."
5710
msgstr ""
5711
5712
#: serverguide/C/virtualization.xml:1693(para)
5713
msgid "To monitor the state of your instance, run:"
5714
msgstr ""
5715
5716
#: serverguide/C/virtualization.xml:1697(command)
5717
msgid "watch -n5 euca-describe-instances"
5718
msgstr ""
5719
5720
#: serverguide/C/virtualization.xml:1699(para)
5721
msgid ""
5722
"In the output, you should see information about the instance, including its "
5723
"state. While first-time caching is being performed, the instance's state "
5724
"will be <emphasis>'pending'</emphasis>."
5725
msgstr ""
5726
5727
#: serverguide/C/virtualization.xml:1705(para)
5728
msgid ""
5729
"When the instance is fully started, the above state will become "
5730
"<emphasis>'running'</emphasis>. Look at the IP address assigned to your "
5731
"instance in the output, then connect to it:"
5732
msgstr ""
5733
5734
#: serverguide/C/virtualization.xml:1710(command)
5735
msgid ""
5736
"IPADDR=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | awk "
5737
"'{print $4}')"
5738
msgstr ""
5739
5740
#: serverguide/C/virtualization.xml:1711(command)
5741
msgid "ssh -i ~/.euca/mykey.priv ubuntu@$IPADDR"
5742
msgstr ""
5743
5744
#: serverguide/C/virtualization.xml:1715(para)
5745
msgid ""
5746
"And when you are done with this instance, exit your SSH connection, then "
5747
"terminate your instance:"
5748
msgstr ""
5749
5750
#: serverguide/C/virtualization.xml:1719(command)
5751
msgid ""
5752
"INSTANCEID=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | "
5753
"awk '{print $2}')"
5754
msgstr ""
5755
5756
#: serverguide/C/virtualization.xml:1720(command)
5757
msgid "euca-terminate-instances $INSTANCEID"
5758
msgstr ""
5759
5760
#: serverguide/C/virtualization.xml:1727(title)
5761
msgid "Install an Image from the Store"
5762
msgstr ""
5763
5764
#: serverguide/C/virtualization.xml:1729(para)
5765
msgid ""
5766
"The following is by far the simplest way to install an image. However, "
5767
"advanced users may be interested in learning how to <ulink "
5768
"url=\"https://help.ubuntu.com/community/UEC/BundlingImages\">Bundle their "
5769
"own image</ulink>."
5770
msgstr ""
5771
5772
#: serverguide/C/virtualization.xml:1734(para)
5773
msgid ""
5774
"The simplest way to add an image to <application>UEC</application> is to "
5775
"install it from the Image Store on the UEC web interface."
5776
msgstr ""
5777
5778
#: serverguide/C/virtualization.xml:1740(para)
5779
msgid ""
5780
"Access the web interface at the following URL (Make sure you specify https):"
5781
msgstr ""
5782
5783
#: serverguide/C/virtualization.xml:1748(para)
5784
msgid ""
5785
"Enter your login and password (if requested, as you may still be logged in "
5786
"from earlier)."
5787
msgstr ""
5788
5789
#: serverguide/C/virtualization.xml:1753(para)
5790
msgid "Click on the <emphasis>Store</emphasis> tab."
5791
msgstr ""
5792
5793
#: serverguide/C/virtualization.xml:1758(para)
5794
msgid "Browse available images."
5795
msgstr ""
5796
5797
#: serverguide/C/virtualization.xml:1763(para)
5798
msgid "Click on <emphasis>install</emphasis> for the image you want."
5799
msgstr ""
5800
5801
#: serverguide/C/virtualization.xml:1769(para)
5802
msgid ""
5803
"Once the image has been downloaded and installed, you can click on "
5804
"<emphasis>\"How to run?\"</emphasis> that will be displayed below the image "
5805
"button to view the command to execute to instantiate (start) this image. The "
5806
"image will also appear on the list given on the <emphasis>Image</emphasis> "
5807
"tab."
5808
msgstr ""
5809
5810
#: serverguide/C/virtualization.xml:1777(title) serverguide/C/dns.xml:619(title)
5811
msgid "More Information"
5812
msgstr ""
5813
5814
#: serverguide/C/virtualization.xml:1779(para)
5815
msgid ""
5816
"How to use the <ulink "
5817
"url=\"https://help.ubuntu.com/community/UEC/StorageController\">Storage "
5818
"Controller</ulink>"
5819
msgstr ""
5820
5821
#: serverguide/C/virtualization.xml:1783(para)
5822
msgid "Controlling eucalyptus services:"
5823
msgstr ""
5824
5825
#: serverguide/C/virtualization.xml:1788(para)
5826
msgid ""
5827
"sudo service eucalyptus [start|stop|restart] (on the CLC/CC/SC/Walrus side)"
5828
msgstr ""
5829
5830
#: serverguide/C/virtualization.xml:1789(para)
5831
msgid "sudo service eucalyptus-nc [start|stop|restart] (on the Node side)"
5832
msgstr ""
5833
5834
#: serverguide/C/virtualization.xml:1792(para)
5835
msgid "Locations of some important files:"
5836
msgstr ""
5837
5838
#: serverguide/C/virtualization.xml:1799(emphasis)
5839
msgid "Log files:"
5840
msgstr ""
5841
5842
#: serverguide/C/virtualization.xml:1802(para)
5843
msgid "/var/log/eucalyptus"
5844
msgstr ""
5845
5846
#: serverguide/C/virtualization.xml:1807(emphasis)
5847
msgid "Configuration files:"
5848
msgstr ""
5849
5850
#: serverguide/C/virtualization.xml:1810(para)
5851
msgid "/etc/eucalyptus"
5852
msgstr ""
5853
5854
#: serverguide/C/virtualization.xml:1815(emphasis)
5855
msgid "Database:"
5856
msgstr ""
5857
5858
#: serverguide/C/virtualization.xml:1818(para)
5859
msgid "/var/lib/eucalyptus/db"
5860
msgstr ""
5861
5862
#: serverguide/C/virtualization.xml:1823(emphasis)
5863
msgid "Keys:"
5864
msgstr ""
5865
5866
#: serverguide/C/virtualization.xml:1826(para)
5867
msgid "/var/lib/eucalyptus"
5868
msgstr ""
5869
5870
#: serverguide/C/virtualization.xml:1827(para)
5871
msgid "/var/lib/eucalyptus/.ssh"
5872
msgstr ""
5873
5874
#: serverguide/C/virtualization.xml:1833(para)
5875
msgid ""
5876
"Don't forget to source your <filename>~/.euca/eucarc</filename> before "
5877
"running the client tools."
5878
msgstr ""
5879
5880
#: serverguide/C/virtualization.xml:1844(para)
5881
msgid ""
5882
"For information on loading instances see the <ulink "
5883
"url=\"https://help.ubuntu.com/community/Eucalyptus\">Eucalyptus Wiki</ulink> "
5884
"page."
5885
msgstr ""
5886
5887
#: serverguide/C/virtualization.xml:1849(para)
5888
msgid ""
5889
"<ulink url=\"http://open.eucalyptus.com/\">Eucalyptus Project Site (forums, "
5890
"documentation, downloads)</ulink>."
5891
msgstr ""
5892
5893
#: serverguide/C/virtualization.xml:1854(para)
5894
msgid ""
5895
"<ulink url=\"https://launchpad.net/eucalyptus/\">Eucalyptus on Launchpad "
5896
"(bugs, code)</ulink>."
5897
msgstr ""
5898
5899
#: serverguide/C/virtualization.xml:1859(para)
5900
msgid ""
5901
"<ulink "
5902
"url=\"http://open.eucalyptus.com/wiki/EucalyptusTroubleshooting_v1.5\">Eucaly"
5903
"ptus Troubleshooting (1.5)</ulink>."
5904
msgstr ""
5905
5906
#: serverguide/C/virtualization.xml:1864(para)
5907
msgid ""
5908
"<ulink url=\"http://support.rightscale.com/2._References/02-"
5909
"Cloud_Infrastructures/Eucalyptus/03-"
5910
"Administration_Guide/Register_with_RightScale\"> Register your cloud with "
5911
"RightScale</ulink>."
5912
msgstr ""
5913
5914
#: serverguide/C/virtualization.xml:1870(para)
5915
msgid ""
5916
"You can also find help in the <emphasis>#ubuntu-virt</emphasis>, "
5917
"<emphasis>#eucalyptus</emphasis>, and <emphasis>#ubuntu-server</emphasis> "
5918
"IRC channels on <ulink url=\"http://freenode.net\">Freenode</ulink>."
5919
msgstr ""
5920
5921
#: serverguide/C/virtualization.xml:1879(title)
5922
msgid "Glossary"
5923
msgstr ""
5924
5925
#: serverguide/C/virtualization.xml:1881(para)
5926
msgid ""
5927
"The Ubuntu Enterprise Cloud documentation uses terminology that might be "
5928
"unfamiliar to some readers. This page is intended to provide a glossary of "
5929
"such terms and acronyms."
5930
msgstr ""
5931
5932
#: serverguide/C/virtualization.xml:1888(para)
5933
msgid ""
5934
"<emphasis>Cloud</emphasis> - A federated set of physical machines that offer "
5935
"computing resources through virtual machines, provisioned and recollected "
5936
"dynamically."
5937
msgstr ""
5938
5939
#: serverguide/C/virtualization.xml:1894(para)
5940
msgid ""
5941
"<emphasis>Cloud Controller (CLC)</emphasis> - Eucalyptus component that "
5942
"provides the web UI (an https server on port 8443), and implements the "
5943
"Amazon EC2 API. There should be only one Cloud Controller in an installation "
5944
"of UEC. This service is provided by the Ubuntu <application>eucalyptus-"
5945
"cloud</application> package."
5946
msgstr ""
5947
5948
#: serverguide/C/virtualization.xml:1901(para)
5949
msgid ""
5950
"<emphasis>Cluster</emphasis> - A collection of nodes, associated with a "
5951
"Cluster Controller. There can be more than one Cluster in an installation of "
5952
"UEC. Clusters are sometimes physically separate sets of nodes. (e.g. floor1, "
5953
"floor2, floor2)."
5954
msgstr ""
5955
5956
#: serverguide/C/virtualization.xml:1907(para)
5957
msgid ""
5958
"<emphasis>Cluster Controller (CC)</emphasis> - Eucalyptus component that "
5959
"manages collections of node resources. This service is provided by the "
5960
"Ubuntu <application>eucalyptus-cc</application> package."
5961
msgstr ""
5962
5963
#: serverguide/C/virtualization.xml:1913(para)
5964
msgid "<emphasis>EBS</emphasis> - Elastic Block Storage."
5965
msgstr ""
5966
5967
#: serverguide/C/virtualization.xml:1918(para)
5968
msgid ""
5969
"<emphasis>EC2</emphasis> - Elastic Compute Cloud. Amazon's pay-by-the-hour, "
5970
"pay-by-the-gigabyte public cloud computing offering."
5971
msgstr ""
5972
5973
#: serverguide/C/virtualization.xml:1923(para)
5974
msgid "<emphasis>EKI</emphasis> - Eucalyptus Kernel Image."
5975
msgstr ""
5976
5977
#: serverguide/C/virtualization.xml:1928(para)
5978
msgid "<emphasis>EMI</emphasis> - Eucalyptus Machine Image."
5979
msgstr ""
5980
5981
#: serverguide/C/virtualization.xml:1933(para)
5982
msgid "<emphasis>ERI</emphasis> - Eucalyptus Ramdisk Image."
5983
msgstr ""
5984
5985
#: serverguide/C/virtualization.xml:1938(para)
5986
msgid ""
5987
"<emphasis>Eucalyptus</emphasis> - Elastic Utility Computing Architecture for "
5988
"Linking Your Programs To Useful Systems. An open source project originally "
5989
"from the University of California at Santa Barbara, now supported by "
5990
"Eucalyptus Systems, a Canonical Partner."
5991
msgstr ""
5992
5993
#: serverguide/C/virtualization.xml:1945(para)
5994
msgid ""
5995
"<emphasis>Front-end</emphasis> - Physical machine hosting one (or more) of "
5996
"the high level Eucalyptus components (cloud, walrus, storage controller, "
5997
"cluster controller)."
5998
msgstr ""
5999
6000
#: serverguide/C/virtualization.xml:1951(para)
6001
msgid ""
6002
"<emphasis>Node</emphasis> - A node is a physical machine that's capable of "
6003
"running virtual machines, running a node controller. Within Ubuntu, this "
6004
"generally means that the CPU has VT extensions, and can run the KVM "
6005
"hypervisor."
6006
msgstr ""
6007
6008
#: serverguide/C/virtualization.xml:1957(para)
6009
msgid ""
6010
"<emphasis>Node Controller (NC)</emphasis> - Eucalyptus component that runs "
6011
"on nodes which host the virtual machines that comprise the cloud. This "
6012
"service is provided by the Ubuntu package <application>eucalyptus-"
6013
"nc</application>."
6014
msgstr ""
6015
6016
#: serverguide/C/virtualization.xml:1963(para)
6017
msgid ""
6018
"<emphasis>S3</emphasis> - Simple Storage Service. Amazon's pay-by-the-"
6019
"gigabyte persistent storage solution for EC2."
6020
msgstr ""
6021
6022
#: serverguide/C/virtualization.xml:1968(para)
6023
msgid ""
6024
"<emphasis>Storage Controller (SC)</emphasis> - Eucalyptus component that "
6025
"manages dynamic block storage services (EBS). Each 'cluster' in a Eucalyptus "
6026
"installation can have its own Storage Controller. This component is provided "
6027
"by the <application>eucalyptus-sc</application> package."
6028
msgstr ""
6029
6030
#: serverguide/C/virtualization.xml:1975(para)
6031
msgid ""
6032
"<emphasis>UEC</emphasis> - Ubuntu Enterprise Cloud. Ubuntu's cloud computing "
6033
"solution, based on Eucalyptus."
6034
msgstr ""
6035
6036
#: serverguide/C/virtualization.xml:1980(para)
6037
msgid "<emphasis>VM</emphasis> - Virtual Machine."
6038
msgstr ""
6039
6040
#: serverguide/C/virtualization.xml:1985(para)
6041
msgid ""
6042
"<emphasis>VT</emphasis> - Virtualization Technology. An optional feature of "
6043
"some modern CPUs, allowing for accelerated virtual machine hosting."
6044
msgstr ""
6045
6046
#: serverguide/C/virtualization.xml:1990(para)
6047
msgid ""
6048
"<emphasis>Walrus</emphasis> - Eucalyptus component that implements the "
6049
"Amazon S3 API, used for storing VM images and user storage using S3 bucket "
6050
"put/get abstractions."
6051
msgstr ""
6052
6053
#: serverguide/C/virtualization.xml:2000(title)
6054
msgid "OpenNebula"
6055
msgstr ""
6056
6057
#: serverguide/C/virtualization.xml:2002(para)
6058
msgid ""
6059
"<application>OpenNebula</application> allows virtual machines to be placed "
6060
"and re-placed dynamically on a pool of physical resources. This allows a "
6061
"virtual machine to be hosted from any location available."
6062
msgstr ""
6063
6064
#: serverguide/C/virtualization.xml:2007(para)
6065
msgid ""
6066
"This section will detail configuring an OpenNebula cluster using three "
6067
"machines: one <emphasis>Front-End</emphasis> host, and two <emphasis>Compute "
6068
"Nodes</emphasis> used to run the virtual machines. The Compute Nodes will "
6069
"also need a bridge configured to allow the virtual machines access to the "
6070
"local network. For details see <xref linkend=\"bridging\"/>."
6071
msgstr ""
6072
6073
#: serverguide/C/virtualization.xml:2016(para)
6074
msgid "First, from a terminal on the Front-End enter:"
6075
msgstr ""
6076
6077
#: serverguide/C/virtualization.xml:2021(command)
6078
msgid "sudo apt-get install opennebula"
6079
msgstr ""
6080
6081
#: serverguide/C/virtualization.xml:2024(para)
6082
msgid "On each Compute Node install:"
6083
msgstr ""
6084
6085
#: serverguide/C/virtualization.xml:2029(command)
6086
msgid "sudo apt-get install opennebula-node"
6087
msgstr ""
6088
6089
#: serverguide/C/virtualization.xml:2032(para)
6090
msgid ""
6091
"In order to copy SSH keys, the <emphasis>oneadmin</emphasis> user will need "
6092
"to have a password. On each machine execute:"
6093
msgstr ""
6094
6095
#: serverguide/C/virtualization.xml:2037(command)
6096
msgid "sudo passwd oneadmin"
6097
msgstr ""
6098
6099
#: serverguide/C/virtualization.xml:2040(para)
6100
msgid ""
6101
"Next, copy the <emphasis>oneadmin</emphasis> user's SSH key to the Compute "
6102
"Nodes, and to the Front-End's <filename>authorized_keys</filename> file:"
6103
msgstr ""
6104
6105
#: serverguide/C/virtualization.xml:2045(command)
6106
msgid ""
6107
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6108
"oneadmin@node01:/var/lib/one/.ssh/authorized_keys"
6109
msgstr ""
6110
6111
#: serverguide/C/virtualization.xml:2046(command)
6112
msgid ""
6113
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6114
"oneadmin@node02:/var/lib/one/.ssh/authorized_keys"
6115
msgstr ""
6116
6117
#: serverguide/C/virtualization.xml:2047(command)
6118
msgid ""
6119
"sudo sh -c \"cat /var/lib/one/.ssh/id_rsa.pub >> "
6120
"/var/lib/one/.ssh/authorized_keys\""
6121
msgstr ""
6122
6123
#: serverguide/C/virtualization.xml:2050(para)
6124
msgid ""
6125
"The SSH key for the Compute Nodes needs to be added to the "
6126
"<filename>/etc/ssh/ssh_known_hosts</filename> file on the Front-End host. To "
6127
"accomplish this <application>ssh</application> to each Compute Node as a "
6128
"user other than <emphasis>oneadmin</emphasis>. Then exit from the SSH "
6129
"session, and execute the following to copy the SSH key from "
6130
"<filename>~/.ssh/known_hosts</filename> to "
6131
"<filename>/etc/ssh/ssh_known_hosts</filename>:"
6132
msgstr ""
6133
6134
#: serverguide/C/virtualization.xml:2057(command)
6135
msgid ""
6136
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node01 1>> "
6137
"/etc/ssh/ssh_known_hosts\""
6138
msgstr ""
6139
6140
#: serverguide/C/virtualization.xml:2058(command)
6141
msgid ""
6142
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node02 1>> "
6143
"/etc/ssh/ssh_known_hosts\""
6144
msgstr ""
6145
6146
#: serverguide/C/virtualization.xml:2062(para)
6147
msgid ""
6148
"Replace <emphasis>node01</emphasis> and <emphasis>node02</emphasis> with the "
6149
"appropriate host names."
6150
msgstr ""
6151
6152
#: serverguide/C/virtualization.xml:2067(para)
6153
msgid ""
6154
"This allows the <emphasis>oneadmin</emphasis> to use "
6155
"<application>scp</application>, without a password or manual intervention, "
6156
"to deploy an image to the Compute Nodes."
6157
msgstr ""
6158
6159
#: serverguide/C/virtualization.xml:2072(para)
6160
msgid ""
6161
"On the Front-End create a directory to store the VM images, giving the "
6162
"<emphasis>oneadmin</emphasis> user access to the directory:"
6163
msgstr ""
6164
6165
#: serverguide/C/virtualization.xml:2077(command)
6166
msgid "sudo mkdir /var/lib/one/images"
6167
msgstr ""
6168
6169
#: serverguide/C/virtualization.xml:2078(command)
6170
msgid "sudo chown oneadmin /var/lib/one/images/"
6171
msgstr ""
6172
6173
#: serverguide/C/virtualization.xml:2081(para)
6174
msgid ""
6175
"Finally, copy a virtual machine disk file into "
6176
"<filename>/var/lib/one/images</filename>. You can create an Ubuntu virtual "
6177
"machine using <application>vmbuilder</application>, see <xref linkend=\"jeos-"
6178
"and-vmbuilder\"/> for details."
6179
msgstr ""
6180
6181
#: serverguide/C/virtualization.xml:2090(para)
6182
msgid ""
6183
"The <emphasis>OpenNebula Cluster</emphasis> is now ready to be configured, "
6184
"and virtual machines added to the cluster."
6185
msgstr ""
6186
6187
#: serverguide/C/virtualization.xml:2094(para)
6188
msgid "From a terminal prompt enter:"
6189
msgstr ""
6190
6191
#: serverguide/C/virtualization.xml:2099(command)
6192
msgid "onehost create node01 im_kvm vmm_kvm tm_ssh"
6193
msgstr ""
6194
6195
#: serverguide/C/virtualization.xml:2100(command)
6196
msgid "onehost create node02 im_kvm vmm_kvm tm_ssh"
6197
msgstr ""
6198
6199
#: serverguide/C/virtualization.xml:2103(para)
6200
msgid ""
6201
"Next, create a <emphasis>Virtual Network</emphasis> template file named "
6202
"<filename>vnet01.template</filename>:"
6203
msgstr ""
6204
6205
#: serverguide/C/virtualization.xml:2107(programlisting)
6206
#, no-wrap
6207
msgid ""
6208
"\n"
6209
"NAME = \"LAN\"\n"
6210
"TYPE = RANGED\n"
6211
"BRIDGE = br0\n"
6212
"NETWORK_SIZE = C\n"
6213
"NETWORK_ADDRESS = 192.168.0.0\n"
6214
msgstr ""
6215
6216
#: serverguide/C/virtualization.xml:2116(para)
6217
msgid ""
6218
"Be sure to change <emphasis>192.168.0.0</emphasis> to your local network."
6219
msgstr ""
6220
6221
#: serverguide/C/virtualization.xml:2121(para)
6222
msgid ""
6223
"Using the <application>onevnet</application> utility, add the virtual "
6224
"network to OpenNebula:"
6225
msgstr ""
6226
6227
#: serverguide/C/virtualization.xml:2126(command)
6228
msgid "onevnet create vnet01.template"
6229
msgstr ""
6230
6231
#: serverguide/C/virtualization.xml:2129(para)
6232
msgid ""
6233
"Now create a <emphasis>VM Template</emphasis> file named "
6234
"<filename>vm01.template</filename>:"
6235
msgstr ""
6236
6237
#: serverguide/C/virtualization.xml:2133(programlisting)
6238
#, no-wrap
6239
msgid ""
6240
"\n"
6241
"NAME = vm01\n"
6242
"CPU = 0.5\n"
6243
"MEMORY = 512\n"
6244
"\n"
6245
"OS = [ BOOT = hd ]\n"
6246
"\n"
6247
"DISK = [\n"
6248
" source = \"/var/lib/one/images/vm01.qcow2\",\n"
6249
" target = \"hda\",\n"
6250
" readonly = \"no\" ]\n"
6251
"\n"
6252
"NIC = [ NETWORK=\"LAN\" ]\n"
6253
"\n"
6254
"GRAPHICS = [type=\"vnc\",listen=\"127.0.0.1\",port=\"-1\"]\n"
6255
msgstr ""
6256
6257
#: serverguide/C/virtualization.xml:2150(para)
6258
msgid "Start the virtual machine using <application>onevm</application>:"
6259
msgstr ""
6260
6261
#: serverguide/C/virtualization.xml:2155(command)
6262
msgid "onevm submit vm01.template"
6263
msgstr ""
6264
6265
#: serverguide/C/virtualization.xml:2158(para)
6266
msgid ""
6267
"Use the <application>onevm list</application> option to view information "
6268
"about virtual machines. Also, the <application>onevm show vm01</application> "
6269
"option will display more details about a specific virtual machine."
6270
msgstr ""
6271
6272
#: serverguide/C/virtualization.xml:2169(para)
6273
msgid ""
6274
"See the <ulink "
6275
"url=\"http://www.opennebula.org/doku.php?id=start\">OpenNebula website</ulink"
6276
"> for more information."
6277
msgstr ""
6278
6279
#: serverguide/C/virtualization.xml:2174(para)
6280
msgid ""
6281
"You can also find help in the <emphasis>#ubuntu-virt</emphasis> and "
6282
"<emphasis>#ubuntu-server</emphasis> IRC channels on <ulink "
6283
"url=\"http://freenode.net\">Freenode</ulink>."
6284
msgstr ""
6285
6286
#: serverguide/C/virtualization.xml:2180(para)
6287
msgid ""
6288
"Also, the <ulink "
6289
"url=\"https://help.ubuntu.com/community/OpenNebula\">OpenNebula Ubuntu "
6290
"Wiki</ulink> page has more details."
6291
msgstr ""
6292
6293
#: serverguide/C/vcs.xml:13(title)
6294
msgid "Version Control System"
6295
msgstr ""
6296
6297
#: serverguide/C/vcs.xml:14(para)
6298
msgid ""
6299
"Version control is the art of managing changes to information. It has long "
6300
"been a critical tool for programmers, who typically spend their time making "
6301
"small changes to software and then undoing those changes the next day. But "
6302
"the usefulness of version control software extends far beyond the bounds of "
6303
"the software development world. Anywhere you can find people using computers "
6304
"to manage information that changes often, there is room for version control."
6305
msgstr ""
6306
6307
#: serverguide/C/vcs.xml:17(title)
6308
msgid "Bazaar"
6309
msgstr ""
6310
6311
#: serverguide/C/vcs.xml:18(para)
6312
msgid ""
6313
"Bazaar is a new version control system sponsored by Canonical, the "
6314
"commercial company behind Ubuntu. Unlike Subversion and CVS that only "
6315
"support a central repository model, Bazaar also supports "
6316
"<emphasis>distributed version control</emphasis>, giving people the ability "
6317
"to collaborate more efficiently. In particular, Bazaar is designed to "
6318
"maximize the level of community participation in open source projects."
6319
msgstr ""
6320
6321
#: serverguide/C/vcs.xml:29(para)
6322
msgid ""
6323
"At a terminal prompt, enter the following command to install "
6324
"<application>bzr</application>: <screen>\n"
6325
"<command>sudo apt-get install bzr</command>\n"
6326
"</screen>"
6327
msgstr ""
6328
6329
#: serverguide/C/vcs.xml:40(para)
6330
msgid ""
6331
"To introduce yourself to <application>bzr</application>, use the "
6332
"<emphasis>whoami</emphasis> command like this: <screen>\n"
6333
"<command>$ bzr whoami 'Joe Doe <joe.doe@gmail.com>'</command>\n"
6334
"</screen>"
6335
msgstr ""
6336
6337
#: serverguide/C/vcs.xml:49(title)
6338
msgid "Learning Bazaar"
6339
msgstr ""
6340
6341
#: serverguide/C/vcs.xml:50(para)
6342
msgid ""
6343
"Bazaar comes with bundled documentation installed into "
6344
"<application>/usr/share/doc/bzr/html</application> by default. The tutorial "
6345
"is a good place to start. The <application>bzr</application> command also "
6346
"comes with built-in help: <screen>\n"
6347
"<command>$ bzr help</command>\n"
6348
"</screen>"
6349
msgstr ""
6350
6351
#: serverguide/C/vcs.xml:60(para)
6352
msgid ""
6353
"To learn more about the <emphasis>foo</emphasis> command: <screen>\n"
6354
"<command>$ bzr help foo</command>\n"
6355
"</screen>"
6356
msgstr ""
6357
6358
#: serverguide/C/vcs.xml:68(title)
6359
msgid "Launchpad Integration"
6360
msgstr ""
6361
6362
#: serverguide/C/vcs.xml:69(para)
6363
msgid ""
6364
"While highly useful as a stand-alone system, Bazaar has good, optional "
6365
"integration with <ulink url=\"https://launchpad.net/\">Launchpad</ulink>, "
6366
"the collaborative development system used by Canonical and the broader open "
6367
"source community to manage and extend Ubuntu itself. For information on how "
6368
"Bazaar can be used with Launchpad to collaborate on open source projects, "
6369
"see <ulink url=\"http://bazaar-vcs.org/LaunchpadIntegration/\"> "
6370
"http://bazaar-vcs.org/LaunchpadIntegration</ulink>."
6371
msgstr ""
6372
6373
#: serverguide/C/vcs.xml:81(title)
6374
msgid "Subversion"
6375
msgstr ""
6376
6377
#: serverguide/C/vcs.xml:82(para)
6378
msgid ""
6379
"Subversion is an open source version control system. Using Subversion, you "
6380
"can record the history of source files and documents. It manages files and "
6381
"directories over time. A tree of files is placed into a central repository. "
6382
"The repository is much like an ordinary file server, except that it "
6383
"remembers every change ever made to files and directories."
6384
msgstr ""
6385
6386
#: serverguide/C/vcs.xml:87(para)
6387
msgid ""
6388
"To access Subversion repository using the HTTP protocol, you must install "
6389
"and configure a web server. Apache2 is proven to work with Subversion. "
6390
"Please refer to the HTTP subsection in the Apache2 section to install and "
6391
"configure Apache2. To access the Subversion repository using the HTTPS "
6392
"protocol, you must install and configure a digital certificate in your "
6393
"Apache 2 web server. Please refer to the HTTPS subsection in the Apache2 "
6394
"section to install and configure the digital certificate."
6395
msgstr ""
6396
6397
#: serverguide/C/vcs.xml:96(para)
6398
msgid ""
6399
"To install Subversion, run the following command from a terminal prompt:"
6400
msgstr ""
6401
6402
#: serverguide/C/vcs.xml:101(command)
6403
msgid "sudo apt-get install subversion libapache2-svn"
6404
msgstr ""
6405
6406
#: serverguide/C/vcs.xml:108(para)
6407
msgid ""
6408
"This step assumes you have installed above mentioned packages on your "
6409
"system. This section explains how to create a Subversion repository and "
6410
"access the project."
6411
msgstr ""
6412
6413
#: serverguide/C/vcs.xml:111(title)
6414
msgid "Create Subversion Repository"
6415
msgstr ""
6416
6417
#: serverguide/C/vcs.xml:112(para)
6418
msgid ""
6419
"The Subversion repository can be created using the following command from a "
6420
"terminal prompt:"
6421
msgstr ""
6422
6423
#: serverguide/C/vcs.xml:116(command)
6424
msgid "svnadmin create /path/to/repos/project"
6425
msgstr ""
6426
6427
#: serverguide/C/vcs.xml:121(title)
6428
msgid "Importing Files"
6429
msgstr ""
6430
6431
#: serverguide/C/vcs.xml:122(para)
6432
msgid ""
6433
"Once you create the repository you can <emphasis>import</emphasis> files "
6434
"into the repository. To import a directory, enter the following from a "
6435
"terminal prompt: <screen>\n"
6436
"<command>svn import /path/to/import/directory "
6437
"file:///path/to/repos/project</command>\n"
6438
"</screen>"
6439
msgstr ""
6440
6441
#: serverguide/C/vcs.xml:134(title) serverguide/C/vcs.xml:139(title)
6442
msgid "Access Methods"
6443
msgstr ""
6444
6445
#: serverguide/C/vcs.xml:135(para)
6446
msgid ""
6447
"Subversion repositories can be accessed (checked out) through many different "
6448
"methods --on local disk, or through various network protocols. A repository "
6449
"location, however, is always a URL. The table describes how different URL "
6450
"schemes map to the available access methods."
6451
msgstr ""
6452
6453
#: serverguide/C/vcs.xml:146(para)
6454
msgid "Schema"
6455
msgstr ""
6456
6457
#: serverguide/C/vcs.xml:147(para)
6458
msgid "Access Method"
6459
msgstr ""
6460
6461
#: serverguide/C/vcs.xml:152(para)
6462
msgid "file://"
6463
msgstr ""
6464
6465
#: serverguide/C/vcs.xml:153(para)
6466
msgid "direct repository access (on local disk)"
6467
msgstr ""
6468
6469
#: serverguide/C/vcs.xml:156(para)
6470
msgid "http://"
6471
msgstr ""
6472
6473
#: serverguide/C/vcs.xml:157(para)
6474
msgid "Access via WebDAV protocol to Subversion-aware Apache2 web server"
6475
msgstr ""
6476
6477
#: serverguide/C/vcs.xml:160(para)
6478
msgid "https://"
6479
msgstr ""
6480
6481
#: serverguide/C/vcs.xml:161(para)
6482
msgid "Same as http://, but with SSL encryption"
6483
msgstr ""
6484
6485
#: serverguide/C/vcs.xml:164(para)
6486
msgid "svn://"
6487
msgstr ""
6488
6489
#: serverguide/C/vcs.xml:165(para)
6490
msgid "Access via custom protocol to an svnserve server"
6491
msgstr ""
6492
6493
#: serverguide/C/vcs.xml:168(para)
6494
msgid "svn+ssh://"
6495
msgstr ""
6496
6497
#: serverguide/C/vcs.xml:169(para)
6498
msgid "Same as svn://, but through an SSH tunnel"
6499
msgstr ""
6500
6501
#: serverguide/C/vcs.xml:175(para)
6502
msgid ""
6503
"In this section, we will see how to configure Subversion for all these "
6504
"access methods. Here, we cover the basics. For more advanced usage details, "
6505
"refer to the <ulink url=\"http://svnbook.red-bean.com/\">svn book</ulink>."
6506
msgstr ""
6507
6508
#: serverguide/C/vcs.xml:182(title)
6509
msgid "Direct repository access (file://)"
6510
msgstr ""
6511
6512
#: serverguide/C/vcs.xml:183(para)
6513
msgid ""
6514
"This is the simplest of all access methods. It does not require any "
6515
"Subversion server process to be running. This access method is used to "
6516
"access Subversion from the same machine. The syntax of the command, entered "
6517
"at a terminal prompt, is as follows:"
6518
msgstr ""
6519
6520
#: serverguide/C/vcs.xml:190(command)
6521
msgid "svn co file:///path/to/repos/project"
6522
msgstr ""
6523
6524
#: serverguide/C/vcs.xml:193(para)
6525
msgid "or"
6526
msgstr ""
6527
6528
#: serverguide/C/vcs.xml:196(command)
6529
msgid "svn co file://localhost/path/to/repos/project"
6530
msgstr ""
6531
6532
#: serverguide/C/vcs.xml:200(para)
6533
msgid ""
6534
"If you do not specify the hostname, there are three forward slashes (///) -- "
6535
"two for the protocol (file, in this case) plus the leading slash in the "
6536
"path. If you specify the hostname, you must use two forward slashes (//)."
6537
msgstr ""
6538
6539
#: serverguide/C/vcs.xml:202(para)
6540
msgid ""
6541
"The repository permissions depend on filesystem permissions. If the user has "
6542
"read/write permission, he can checkout from and commit to the repository."
6543
msgstr ""
6544
6545
#: serverguide/C/vcs.xml:205(title)
6546
msgid "Access via WebDAV protocol (http://)"
6547
msgstr ""
6548
6549
#: serverguide/C/vcs.xml:206(para)
6550
msgid ""
6551
"To access the Subversion repository via WebDAV protocol, you must configure "
6552
"your Apache 2 web server. Add the following snippet between the "
6553
"<emphasis><VirtualHost></emphasis> and "
6554
"<emphasis></VirtualHost></emphasis> elements in "
6555
"<filename>/etc/apache2/sites-available/default</filename>, or another "
6556
"VirtualHost file:"
6557
msgstr ""
6558
6559
#: serverguide/C/vcs.xml:212(programlisting)
6560
#, no-wrap
6561
msgid ""
6562
"\n"
6563
" <Location /svn>\n"
6564
" DAV svn\n"
6565
" SVNPath /home/svn\n"
6566
" AuthType Basic\n"
6567
" AuthName \"Your repository name\"\n"
6568
" AuthUserFile /etc/subversion/passwd\n"
6569
" Require valid-user\n"
6570
" </Location> \n"
6571
msgstr ""
6572
6573
#: serverguide/C/vcs.xml:223(para)
6574
msgid ""
6575
"The above configuration snippet assumes that Subversion repositories are "
6576
"created under <filename>/home/svn/</filename> directory using "
6577
"<command>svnadmin</command> command. They can be accessible using "
6578
"<command>http://hostname/svn/repos_name</command> url."
6579
msgstr ""
6580
6581
#: serverguide/C/vcs.xml:229(para)
6582
msgid ""
6583
"To import or commit files to your Subversion repository over HTTP, the "
6584
"repository should be owned by the HTTP user. In Ubuntu systems, normally the "
6585
"HTTP user is <command>www-data</command>. To change the ownership of the "
6586
"repository files enter the following command from terminal prompt:"
6587
msgstr ""
6588
6589
#: serverguide/C/vcs.xml:238(command)
6590
msgid "sudo chown -R www-data:www-data /path/to/repos"
6591
msgstr ""
6592
6593
#: serverguide/C/vcs.xml:241(para)
6594
msgid ""
6595
"By changing the ownership of repository as <command>www-data</command> you "
6596
"will not be able to import or commit files into the repository by running "
6597
"<command>svn import file:///</command> command as any user other than "
6598
"<command>www-data</command>."
6599
msgstr ""
6600
6601
#: serverguide/C/vcs.xml:250(para)
6602
msgid ""
6603
"Next, you must create the <filename>/etc/subversion/passwd</filename> file "
6604
"that will contain user authentication details. To create a file issue the "
6605
"following command at a command prompt (which will create the file and add "
6606
"the first user):"
6607
msgstr ""
6608
6609
#: serverguide/C/vcs.xml:256(command)
6610
msgid "sudo htpasswd -c /etc/subversion/passwd user_name"
6611
msgstr ""
6612
6613
#: serverguide/C/vcs.xml:259(para)
6614
msgid ""
6615
"To add additional users omit the <emphasis>\"-c\"</emphasis> option as this "
6616
"option replaces the old file. Instead use this form:"
6617
msgstr ""
6618
6619
#: serverguide/C/vcs.xml:264(command)
6620
msgid "sudo htpasswd /etc/subversion/password user_name"
6621
msgstr ""
6622
6623
#: serverguide/C/vcs.xml:268(para)
6624
msgid ""
6625
"This command will prompt you to enter the password. Once you enter the "
6626
"password, the user is added. Now, to access the repository you can run the "
6627
"following command:"
6628
msgstr ""
6629
6630
#: serverguide/C/vcs.xml:269(command)
6631
msgid "svn co http://servername/svn"
6632
msgstr ""
6633
6634
#: serverguide/C/vcs.xml:271(para)
6635
msgid ""
6636
"The password is transmitted as plain text. If you are worried about password "
6637
"snooping, you are advised to use SSL encryption. For details, please refer "
6638
"next section."
6639
msgstr ""
6640
6641
#: serverguide/C/vcs.xml:277(title)
6642
msgid "Access via WebDAV protocol with SSL encryption (https://)"
6643
msgstr ""
6644
6645
#: serverguide/C/vcs.xml:278(para)
6646
msgid ""
6647
"Accessing Subversion repository via WebDAV protocol with SSL encryption "
6648
"(https://) is similar to http:// except that you must install and configure "
6649
"the digital certificate in your Apache2 web server. To use SSL with "
6650
"Subversion add the above Apache2 configuration to "
6651
"<filename>/etc/apache2/sites-available/default-ssl</filename>. For more "
6652
"information on setting up Apache2 with SSL see <xref linkend=\"https-"
6653
"configuration\"/>."
6654
msgstr ""
6655
6656
#: serverguide/C/vcs.xml:287(para)
6657
msgid ""
6658
"You can install a digital certificate issued by a signing authority. "
6659
"Alternatively, you can install your own self-signed certificate."
6660
msgstr ""
6661
6662
#: serverguide/C/vcs.xml:292(para)
6663
msgid ""
6664
"This step assumes you have installed and configured a digital certificate in "
6665
"your Apache 2 web server. Now, to access the Subversion repository, please "
6666
"refer to the above section! The access methods are exactly the same, except "
6667
"the protocol. You must use https:// to access the Subversion repository."
6668
msgstr ""
6669
6670
#: serverguide/C/vcs.xml:302(title)
6671
msgid "Access via custom protocol (svn://)"
6672
msgstr ""
6673
6674
#: serverguide/C/vcs.xml:303(para)
6675
msgid ""
6676
"Once the Subversion repository is created, you can configure the access "
6677
"control. You can edit the <filename> "
6678
"/path/to/repos/project/conf/svnserve.conf</filename> file to configure the "
6679
"access control. For example, to set up authentication, you can uncomment the "
6680
"following lines in the configuration file:"
6681
msgstr ""
6682
6683
#: serverguide/C/vcs.xml:310(programlisting)
6684
#, no-wrap
6685
msgid ""
6686
"# [general]\n"
6687
"# password-db = passwd"
6688
msgstr ""
6689
6690
#: serverguide/C/vcs.xml:313(para)
6691
msgid ""
6692
"After uncommenting the above lines, you can maintain the user list in the "
6693
"passwd file. So, edit the file <filename>passwd </filename> in the same "
6694
"directory and add the new user. The syntax is as follows:"
6695
msgstr ""
6696
6697
#: serverguide/C/vcs.xml:319(programlisting)
6698
#, no-wrap
6699
msgid "username = password"
6700
msgstr ""
6701
6702
#: serverguide/C/vcs.xml:320(para)
6703
msgid "For more details, please refer to the file."
6704
msgstr ""
6705
6706
#: serverguide/C/vcs.xml:324(para)
6707
msgid ""
6708
"Now, to access Subversion via the svn:// custom protocol, either from the "
6709
"same machine or a different machine, you can run svnserver using svnserve "
6710
"command. The syntax is as follows:"
6711
msgstr ""
6712
6713
#: serverguide/C/vcs.xml:329(programlisting)
6714
#, no-wrap
6715
msgid ""
6716
"$ svnserve -d --foreground -r /path/to/repos\n"
6717
"# -d -- daemon mode\n"
6718
"# --foreground -- run in foreground (useful for debugging)\n"
6719
"# -r -- root of directory to serve\n"
6720
"\n"
6721
"For more usage details, please refer to:\n"
6722
"$ svnserve --help"
6723
msgstr ""
6724
6725
#: serverguide/C/vcs.xml:337(para)
6726
msgid ""
6727
"Once you run this command, Subversion starts listening on default port "
6728
"(3690). To access the project repository, you must run the following command "
6729
"from a terminal prompt:"
6730
msgstr ""
6731
6732
#: serverguide/C/vcs.xml:340(command)
6733
msgid "svn co svn://hostname/project project --username user_name"
6734
msgstr ""
6735
6736
#: serverguide/C/vcs.xml:343(para)
6737
msgid ""
6738
"Based on server configuration, it prompts for password. Once you are "
6739
"authenticated, it checks out the code from Subversion repository. To "
6740
"synchronize the project repository with the local copy, you can run the "
6741
"<command>update</command> sub-command. The syntax of the command, entered at "
6742
"a terminal prompt, is as follows:"
6743
msgstr ""
6744
6745
#: serverguide/C/vcs.xml:351(command)
6746
msgid "cd project_dir ; svn update"
6747
msgstr ""
6748
6749
#: serverguide/C/vcs.xml:354(para)
6750
msgid ""
6751
"For more details about using each Subversion sub-command, you can refer to "
6752
"the manual. For example, to learn more about the co (checkout) command, "
6753
"please run the following command from a terminal prompt:"
6754
msgstr ""
6755
6756
#: serverguide/C/vcs.xml:358(command)
6757
msgid "svn co help"
6758
msgstr ""
6759
6760
#: serverguide/C/vcs.xml:362(title)
6761
msgid "Access via custom protocol with SSL encryption (svn+ssh://)"
6762
msgstr ""
6763
6764
#: serverguide/C/vcs.xml:363(para)
6765
msgid ""
6766
"The configuration and server process is same as in the svn:// method. For "
6767
"details, please refer to the above section. This step assumes you have "
6768
"followed the above step and started the Subversion server using "
6769
"<application>svnserve</application> command."
6770
msgstr ""
6771
6772
#: serverguide/C/vcs.xml:369(para)
6773
msgid ""
6774
"It is also assumed that the ssh server is running on that machine and that "
6775
"it is allowing incoming connections. To confirm, please try to login to that "
6776
"machine using ssh. If you can login, everything is perfect. If you cannot "
6777
"login, please address it before continuing further."
6778
msgstr ""
6779
6780
#: serverguide/C/vcs.xml:375(para)
6781
msgid ""
6782
"The svn+ssh:// protocol is used to access the Subversion repository using "
6783
"SSL encryption. The data transfer is encrypted using this method. To access "
6784
"the project repository (for example with a checkout), you must use the "
6785
"following command syntax:"
6786
msgstr ""
6787
6788
#: serverguide/C/vcs.xml:382(command)
6789
msgid "svn co svn+ssh://hostname/var/svn/repos/project"
6790
msgstr ""
6791
6792
#: serverguide/C/vcs.xml:386(para)
6793
msgid ""
6794
"You must use the full path (/path/to/repos/project) to access the Subversion "
6795
"repository using this access method."
6796
msgstr ""
6797
6798
#: serverguide/C/vcs.xml:389(para)
6799
msgid ""
6800
"Based on server configuration, it prompts for password. You must enter the "
6801
"password you use to login via ssh. Once you are authenticated, it checks out "
6802
"the code from the Subversion repository."
6803
msgstr ""
6804
6805
#: serverguide/C/vcs.xml:399(title)
6806
msgid "CVS Server"
6807
msgstr ""
6808
6809
#: serverguide/C/vcs.xml:400(para)
6810
msgid ""
6811
"CVS is a version control system. You can use it to record the history of "
6812
"source files."
6813
msgstr ""
6814
6815
#: serverguide/C/vcs.xml:406(para)
6816
msgid ""
6817
"To install <application>CVS</application>, run the following command from a "
6818
"terminal prompt: <screen>\n"
6819
"<command>sudo apt-get install cvs</command>\n"
6820
"</screen> After you install <application>cvs</application>, you should "
6821
"install <application>xinetd</application> to start/stop the cvs server. At "
6822
"the prompt, enter the following command to install "
6823
"<application>xinetd</application>: <screen>\n"
6824
"<command>sudo apt-get install xinetd</command>\n"
6825
"</screen>"
6826
msgstr ""
6827
6828
#: serverguide/C/vcs.xml:439(programlisting)
6829
#, no-wrap
6830
msgid ""
6831
"\n"
6832
"service cvspserver\n"
6833
"{\n"
6834
" port = 2401\n"
6835
" socket_type = stream\n"
6836
" protocol = tcp\n"
6837
" user = root\n"
6838
" wait = no\n"
6839
" type = UNLISTED\n"
6840
" server = /usr/bin/cvs\n"
6841
" server_args = -f --allow-root /var/lib/cvs pserver\n"
6842
" disable = no\n"
6843
"}\n"
6844
msgstr ""
6845
6846
#: serverguide/C/vcs.xml:455(para)
6847
msgid ""
6848
"Be sure to edit the repository if you have changed the default repository "
6849
"(<application>/var/lib/cvs</application>) directory."
6850
msgstr ""
6851
6852
#: serverguide/C/vcs.xml:424(para)
6853
msgid ""
6854
"Once you install cvs, the repository will be automatically initialized. By "
6855
"default, the repository resides under the "
6856
"<application>/var/lib/cvs</application> directory. You can change this path "
6857
"by running following command: <screen>\n"
6858
"<command>cvs -d /your/new/cvs/repo init</command>\n"
6859
"</screen> Once the initial repository is set up, you can configure "
6860
"<application>xinetd</application> to start the CVS server. You can copy the "
6861
"following lines to the <filename> /etc/xinetd.d/cvspserver</filename> file. "
6862
"<placeholder-1/><placeholder-2/> Once you have configured "
6863
"<application>xinetd</application> you can start the cvs server by running "
6864
"following command: <screen>\n"
6865
"<command>sudo /etc/init.d/xinetd restart</command>\n"
6866
"</screen>"
6867
msgstr ""
6868
6869
#: serverguide/C/vcs.xml:468(para)
6870
msgid ""
6871
"You can confirm that the CVS server is running by issuing the following "
6872
"command:"
6873
msgstr ""
6874
6875
#: serverguide/C/vcs.xml:475(command)
6876
msgid "sudo netstat -tap | grep cvs"
6877
msgstr ""
6878
6879
#: serverguide/C/vcs.xml:479(para) serverguide/C/databases.xml:65(para)
6880
msgid ""
6881
"When you run this command, you should see the following line or something "
6882
"similar:"
6883
msgstr ""
6884
6885
#: serverguide/C/vcs.xml:484(programlisting)
6886
#, no-wrap
6887
msgid ""
6888
"\n"
6889
"tcp 0 0 *:cvspserver *:* LISTEN \n"
6890
msgstr ""
6891
6892
#: serverguide/C/vcs.xml:488(para)
6893
msgid ""
6894
"From here you can continue to add users, add new projects, and manage the "
6895
"CVS server."
6896
msgstr ""
6897
6898
#: serverguide/C/vcs.xml:493(para)
6899
msgid ""
6900
"CVS allows the user to add users independently of the underlying OS "
6901
"installation. Probably the easiest way is to use the Linux Users for CVS, "
6902
"although it has potential security issues. Please refer to the CVS manual "
6903
"for details."
6904
msgstr ""
6905
6906
#: serverguide/C/vcs.xml:503(title)
6907
msgid "Add Projects"
6908
msgstr ""
6909
6910
#: serverguide/C/vcs.xml:515(para)
6911
msgid ""
6912
"You can use the CVSROOT environment variable to store the CVS root "
6913
"directory. Once you export the CVSROOT environment variable, you can avoid "
6914
"using -d option in the above cvs command."
6915
msgstr ""
6916
6917
#: serverguide/C/vcs.xml:527(para)
6918
msgid ""
6919
"When you add a new project, the CVS user you use must have write access to "
6920
"the CVS repository (<application>/var/lib/cvs</application>). By default, "
6921
"the <application>src</application> group has write access to the CVS "
6922
"repository. So, you can add the user to this group, and he can then add and "
6923
"manage projects in the CVS repository."
6924
msgstr ""
6925
6926
#: serverguide/C/vcs.xml:504(para)
6927
msgid ""
6928
"This section explains how to add new project to the CVS repository. Create "
6929
"the directory and add necessary document and source files to the directory. "
6930
"Now, run the following command to add this project to CVS repository: "
6931
"<screen>\n"
6932
"<command>cd your/project</command>\n"
6933
"<command>cvs -d :pserver:username@hostname.com:/var/lib/cvs import -m "
6934
"\"Importing my project to CVS repository\" . new_project start</command>\n"
6935
"</screen><placeholder-1/> The string <emphasis>new_project</emphasis> is a "
6936
"vendor tag, and <emphasis>start</emphasis> is a release tag. They serve no "
6937
"purpose in this context, but since CVS requires them, they must be present. "
6938
"<placeholder-2/>"
6939
msgstr ""
6940
6941
#: serverguide/C/vcs.xml:540(ulink)
6942
msgid "Bazaar Home Page"
6943
msgstr ""
6944
6945
#: serverguide/C/vcs.xml:541(ulink)
6946
msgid "Launchpad"
6947
msgstr ""
6948
6949
#: serverguide/C/vcs.xml:542(ulink)
6950
msgid "Subversion Home Page"
6951
msgstr ""
6952
6953
#: serverguide/C/vcs.xml:543(ulink)
6954
msgid "Subversion Book"
6955
msgstr ""
6956
6957
#: serverguide/C/vcs.xml:545(ulink)
6958
msgid "CVS Manual"
6959
msgstr ""
6960
6961
#: serverguide/C/vcs.xml:546(ulink)
6962
msgid "Easy Bazaar Ubuntu Wiki page"
6963
msgstr ""
6964
6965
#: serverguide/C/vcs.xml:547(ulink)
6966
msgid "Ubuntu Wiki Subversion page"
6967
msgstr ""
6968
6969
#: serverguide/C/serverguide.xml:3(title) serverguide/C/bookinfo.xml:3(title)
6970
msgid "Credits and License"
6971
msgstr ""
6972
6973
#: serverguide/C/serverguide.xml:4(para) serverguide/C/bookinfo.xml:4(para)
6974
msgid ""
6975
"This document is maintained by the Ubuntu documentation team "
6976
"(https://wiki.ubuntu.com/DocumentationTeam). For a list of contributors, see "
6977
"the <ulink url=\"../../libs/C/contributors.xml\">contributors page</ulink>"
6978
msgstr ""
6979
6980
#: serverguide/C/serverguide.xml:5(para) serverguide/C/bookinfo.xml:5(para)
6981
msgid ""
6982
"This document is made available under the Creative Commons ShareAlike 2.5 "
6983
"License (CC-BY-SA)."
6984
msgstr ""
6985
6986
#: serverguide/C/serverguide.xml:6(para) serverguide/C/bookinfo.xml:6(para)
6987
msgid ""
6988
"You are free to modify, extend, and improve the Ubuntu documentation source "
6989
"code under the terms of this license. All derivative works must be released "
6990
"under this license."
6991
msgstr ""
6992
6993
#: serverguide/C/serverguide.xml:8(para) serverguide/C/bookinfo.xml:8(para)
6994
msgid ""
6995
"This documentation is distributed in the hope that it will be useful, but "
6996
"WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY "
6997
"or FITNESS FOR A PARTICULAR PURPOSE AS DESCRIBED IN THE DISCLAIMER."
6998
msgstr ""
6999
7000
#: serverguide/C/serverguide.xml:11(para) serverguide/C/bookinfo.xml:11(para)
7001
msgid ""
7002
"A copy of the license is available here: <ulink url=\"/usr/share/ubuntu-"
7003
"docs/libs/C/ccbysa.xml\">Creative Commons ShareAlike License</ulink>."
7004
msgstr ""
7005
7006
#: serverguide/C/serverguide.xml:14(year) serverguide/C/bookinfo.xml:14(year)
7007
msgid "2008"
7008
msgstr ""
7009
7010
#: serverguide/C/serverguide.xml:15(ulink) serverguide/C/bookinfo.xml:15(ulink)
7011
msgid "Ubuntu Documentation Project"
7012
msgstr ""
7013
7014
#: serverguide/C/serverguide.xml:15(holder) serverguide/C/bookinfo.xml:15(holder)
7015
msgid "Canonical Ltd. and members of the <placeholder-1/>"
7016
msgstr ""
7017
7018
#: serverguide/C/serverguide.xml:18(publishername) serverguide/C/bookinfo.xml:18(publishername)
7019
msgid "The Ubuntu Documentation Project"
7020
msgstr ""
7021
7022
#: serverguide/C/serverguide.xml:17(para)
7023
msgid ""
7024
"Welcome to the <emphasis>Ubuntu Server Guide</emphasis>! It contains "
7025
"information on how to install and configure various server applications on "
7026
"your Ubuntu system to fit your needs. It is a step-by-step, task-oriented "
7027
"guide for configuring and customizing your system."
7028
msgstr ""
7029
7030
#: serverguide/C/security.xml:13(title)
7031
msgid "Security"
7032
msgstr ""
7033
7034
#: serverguide/C/security.xml:14(para)
7035
msgid ""
7036
"Security should always be considered when installing, deploying, and using "
7037
"any type of computer system. Although a fresh installation of Ubuntu is "
7038
"relatively safe for immediate use on the Internet, it is important to have a "
7039
"balanced understanding of your systems security posture based on how it will "
7040
"be used after deployment."
7041
msgstr ""
7042
7043
#: serverguide/C/security.xml:17(para)
7044
msgid ""
7045
"This chapter provides an overview of security related topics as they pertain "
7046
"to Ubuntu 10.04 LTS Server Edition, and outlines simple measures you may use "
7047
"to protect your server and network from any number of potential security "
7048
"threats."
7049
msgstr ""
7050
7051
#: serverguide/C/security.xml:21(title)
7052
msgid "User Management"
7053
msgstr ""
7054
7055
#: serverguide/C/security.xml:22(para)
7056
msgid ""
7057
"User management is a critical part of maintaining a secure system. "
7058
"Ineffective user and privilege management often lead many systems into being "
7059
"compromised. Therefore, it is important that you understand how you can "
7060
"protect your server through simple and effective user account management "
7061
"techniques."
7062
msgstr ""
7063
7064
#: serverguide/C/security.xml:26(title)
7065
msgid "Where is root?"
7066
msgstr ""
7067
7068
#: serverguide/C/security.xml:27(para)
7069
msgid ""
7070
"Ubuntu developers made a conscientious decision to disable the "
7071
"administrative root account by default in all Ubuntu installations. This "
7072
"does not mean that the root account has been deleted or that it may not be "
7073
"accessed. It merely has been given a password which matches no possible "
7074
"encrypted value, therefore may not log in directly by itself."
7075
msgstr ""
7076
7077
#: serverguide/C/security.xml:30(para)
7078
msgid ""
7079
"Instead, users are encouraged to make use of a tool by the name of "
7080
"<application>sudo</application> to carry out system administrative duties. "
7081
"<application>Sudo</application> allows an authorized user to temporarily "
7082
"elevate their privileges using their own password instead of having to know "
7083
"the password belonging to the root account. This simple yet effective "
7084
"methodology provides accountability for all user actions, and gives the "
7085
"administrator granular control over which actions a user can perform with "
7086
"said privileges."
7087
msgstr ""
7088
7089
#: serverguide/C/security.xml:35(para)
7090
msgid ""
7091
"If for some reason you wish to enable the root account, simply give it a "
7092
"password:"
7093
msgstr ""
7094
7095
#: serverguide/C/security.xml:39(command)
7096
msgid "sudo passwd"
7097
msgstr ""
7098
7099
#: serverguide/C/security.xml:41(para)
7100
msgid ""
7101
"Sudo will prompt you for your password, and then ask you to supply a new "
7102
"password for root as shown below:"
7103
msgstr ""
7104
7105
#: serverguide/C/security.xml:44(userinput)
7106
#, no-wrap
7107
msgid "(enter your own password)"
7108
msgstr ""
7109
7110
#: serverguide/C/security.xml:45(userinput)
7111
#, no-wrap
7112
msgid "(enter a new password for root)"
7113
msgstr ""
7114
7115
#: serverguide/C/security.xml:46(userinput)
7116
#, no-wrap
7117
msgid "(repeat new password for root)"
7118
msgstr ""
7119
7120
#: serverguide/C/security.xml:44(computeroutput)
7121
#, no-wrap
7122
msgid ""
7123
"[sudo] password for username: <placeholder-1/>\n"
7124
"Enter new UNIX password: <placeholder-2/>\n"
7125
"Retype new UNIX password: <placeholder-3/>\n"
7126
"passwd: password updated successfully"
7127
msgstr ""
7128
7129
#: serverguide/C/security.xml:51(para)
7130
msgid "To disable the root account, use the following passwd syntax:"
7131
msgstr ""
7132
7133
#: serverguide/C/security.xml:55(command)
7134
msgid "sudo passwd -l root"
7135
msgstr ""
7136
7137
#: serverguide/C/security.xml:59(para)
7138
msgid ""
7139
"You should read more on <application>Sudo</application> by checking out it's "
7140
"man page:"
7141
msgstr ""
7142
7143
#: serverguide/C/security.xml:63(command)
7144
msgid "man sudo"
7145
msgstr ""
7146
7147
#: serverguide/C/security.xml:67(para)
7148
msgid ""
7149
"By default, the initial user created by the Ubuntu installer is a member of "
7150
"the group \"admin\" which is added to the file "
7151
"<filename>/etc/sudoers</filename> as an authorized sudo user. If you wish to "
7152
"give any other account full root access through "
7153
"<application>sudo</application>, simply add them to the admin group."
7154
msgstr ""
7155
7156
#: serverguide/C/security.xml:73(title)
7157
msgid "Adding and Deleting Users"
7158
msgstr ""
7159
7160
#: serverguide/C/security.xml:74(para)
7161
msgid ""
7162
"The process for managing local users and groups is straight forward and "
7163
"differs very little from most other GNU/Linux operating systems. Ubuntu and "
7164
"other Debian based distributions, encourage the use of the \"adduser\" "
7165
"package for account management."
7166
msgstr ""
7167
7168
#: serverguide/C/security.xml:79(para)
7169
msgid ""
7170
"To add a user account, use the following syntax, and follow the prompts to "
7171
"give the account a password and identifiable characteristics such as a full "
7172
"name, phone number, etc."
7173
msgstr ""
7174
7175
#: serverguide/C/security.xml:83(command)
7176
msgid "sudo adduser username"
7177
msgstr ""
7178
7179
#: serverguide/C/security.xml:87(para)
7180
msgid ""
7181
"To delete a user account and its primary group, use the following syntax:"
7182
msgstr ""
7183
7184
#: serverguide/C/security.xml:91(command)
7185
msgid "sudo deluser username"
7186
msgstr ""
7187
7188
#: serverguide/C/security.xml:93(para)
7189
msgid ""
7190
"Deleting an account does not remove their respective home folder. It is up "
7191
"to you whether or not you wish to delete the folder manually or keep it "
7192
"according to your desired retention policies."
7193
msgstr ""
7194
7195
#: serverguide/C/security.xml:96(para)
7196
msgid ""
7197
"Remember, any user added later on with the same UID/GID as the previous "
7198
"owner will now have access to this folder if you have not taken the "
7199
"necessary precautions."
7200
msgstr ""
7201
7202
#: serverguide/C/security.xml:99(para)
7203
msgid ""
7204
"You may want to change these UID/GID values to something more appropriate, "
7205
"such as the root account, and perhaps even relocate the folder to avoid "
7206
"future conflicts:"
7207
msgstr ""
7208
7209
#: serverguide/C/security.xml:103(command)
7210
msgid "sudo chown -R root:root /home/username/"
7211
msgstr ""
7212
7213
#: serverguide/C/security.xml:104(command)
7214
msgid "sudo mkdir /home/archived_users/"
7215
msgstr ""
7216
7217
#: serverguide/C/security.xml:105(command)
7218
msgid "sudo mv /home/username /home/archived_users/"
7219
msgstr ""
7220
7221
#: serverguide/C/security.xml:109(para)
7222
msgid ""
7223
"To temporarily lock or unlock a user account, use the following syntax, "
7224
"respectively:"
7225
msgstr ""
7226
7227
#: serverguide/C/security.xml:113(command)
7228
msgid "sudo passwd -l username"
7229
msgstr ""
7230
7231
#: serverguide/C/security.xml:114(command)
7232
msgid "sudo passwd -u username"
7233
msgstr ""
7234
7235
#: serverguide/C/security.xml:118(para)
7236
msgid ""
7237
"To add or delete a personalized group, use the following syntax, "
7238
"respectively:"
7239
msgstr ""
7240
7241
#: serverguide/C/security.xml:122(command)
7242
msgid "sudo addgroup groupname"
7243
msgstr ""
7244
7245
#: serverguide/C/security.xml:123(command)
7246
msgid "sudo delgroup groupname"
7247
msgstr ""
7248
7249
#: serverguide/C/security.xml:127(para)
7250
msgid "To add a user to a group, use the following syntax:"
7251
msgstr ""
7252
7253
#: serverguide/C/security.xml:131(command)
7254
msgid "sudo adduser username groupname"
7255
msgstr ""
7256
7257
#: serverguide/C/security.xml:138(title)
7258
msgid "User Profile Security"
7259
msgstr ""
7260
7261
#: serverguide/C/security.xml:139(para)
7262
msgid ""
7263
"When a new user is created, the adduser utility creates a brand new home "
7264
"directory named <filename class=\"directory\">/home/username</filename>, "
7265
"respectively. The default profile is modeled after the contents found in the "
7266
"directory of <filename class=\"directory\">/etc/skel</filename>, which "
7267
"includes all profile basics."
7268
msgstr ""
7269
7270
#: serverguide/C/security.xml:142(para)
7271
msgid ""
7272
"If your server will be home to multiple users, you should pay close "
7273
"attention to the user home directory permissions to ensure confidentiality. "
7274
"By default, user home directories in Ubuntu are created with world "
7275
"read/execute permissions. This means that all users can browse and access "
7276
"the contents of other users home directories. This may not be suitable for "
7277
"your environment."
7278
msgstr ""
7279
7280
#: serverguide/C/security.xml:147(para)
7281
msgid ""
7282
"To verify your current users home directory permissions, use the following "
7283
"syntax:"
7284
msgstr ""
7285
7286
#: serverguide/C/security.xml:151(command) serverguide/C/security.xml:183(command)
7287
msgid "ls -ld /home/username"
7288
msgstr ""
7289
7290
#: serverguide/C/security.xml:153(para)
7291
msgid ""
7292
"The following output shows that the directory <filename "
7293
"class=\"directory\">/home/username</filename> has world readable permissions:"
7294
msgstr ""
7295
7296
#: serverguide/C/security.xml:156(computeroutput)
7297
#, no-wrap
7298
msgid "drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username"
7299
msgstr ""
7300
7301
#: serverguide/C/security.xml:160(para)
7302
msgid ""
7303
"You can remove the world readable permissions using the following syntax:"
7304
msgstr ""
7305
7306
#: serverguide/C/security.xml:164(command)
7307
msgid "sudo chmod 0750 /home/username"
7308
msgstr ""
7309
7310
#: serverguide/C/security.xml:167(para)
7311
msgid ""
7312
"Some people tend to use the recursive option (-R) indiscriminately which "
7313
"modifies all child folders and files, but this is not necessary, and may "
7314
"yield other undesirable results. The parent directory alone is sufficient "
7315
"for preventing unauthorized access to anything below the parent."
7316
msgstr ""
7317
7318
#: serverguide/C/security.xml:171(para)
7319
msgid ""
7320
"A much more efficient approach to the matter would be to modify the "
7321
"<application>adduser</application> global default permissions when creating "
7322
"user home folders. Simply edit the file "
7323
"<filename>/etc/adduser.conf</filename> and modify the "
7324
"<varname>DIR_MODE</varname> variable to something appropriate, so that all "
7325
"new home directories will receive the correct permissions."
7326
msgstr ""
7327
7328
#: serverguide/C/security.xml:174(programlisting)
7329
#, no-wrap
7330
msgid ""
7331
"\n"
7332
"DIR_MODE=0750\n"
7333
msgstr ""
7334
7335
#: serverguide/C/security.xml:179(para)
7336
msgid ""
7337
"After correcting the directory permissions using any of the previously "
7338
"mentioned techniques, verify the results using the following syntax:"
7339
msgstr ""
7340
7341
#: serverguide/C/security.xml:185(para)
7342
msgid ""
7343
"The results below show that world readable permissions have been removed:"
7344
msgstr ""
7345
7346
#: serverguide/C/security.xml:188(computeroutput)
7347
#, no-wrap
7348
msgid "drwxr-x--- 2 username username 4096 2007-10-02 20:03 username"
7349
msgstr ""
7350
7351
#: serverguide/C/security.xml:195(title)
7352
msgid "Password Policy"
7353
msgstr ""
7354
7355
#: serverguide/C/security.xml:196(para)
7356
msgid ""
7357
"A strong password policy is one of the most important aspects of your "
7358
"security posture. Many successful security breaches involve simple brute "
7359
"force and dictionary attacks against weak passwords. If you intend to offer "
7360
"any form of remote access involving your local password system, make sure "
7361
"you adequately address minimum password complexity requirements, maximum "
7362
"password lifetimes, and frequent audits of your authentication systems."
7363
msgstr ""
7364
7365
#: serverguide/C/security.xml:200(title)
7366
msgid "Minimum Password Length"
7367
msgstr ""
7368
7369
#: serverguide/C/security.xml:201(para)
7370
msgid ""
7371
"By default, Ubuntu requires a minimum password length of 4 characters, as "
7372
"well as some basic entropy checks. These values are controlled in the file "
7373
"<filename>/etc/pam.d/common-password</filename>, which is outlined below."
7374
msgstr ""
7375
7376
#: serverguide/C/security.xml:204(programlisting)
7377
#, no-wrap
7378
msgid ""
7379
"\n"
7380
"password required pam_unix.so nullok obscure min=4 max=8 md5\n"
7381
msgstr ""
7382
7383
#: serverguide/C/security.xml:207(para)
7384
msgid ""
7385
"If you would like to adjust the minimum length to 6 characters, change the "
7386
"appropriate variable to min=6. The modification is outlined below."
7387
msgstr ""
7388
7389
#: serverguide/C/security.xml:210(programlisting)
7390
#, no-wrap
7391
msgid ""
7392
"\n"
7393
"password required pam_unix.so nullok obscure min=6 max=8 md5\n"
7394
msgstr ""
7395
7396
#: serverguide/C/security.xml:214(para)
7397
msgid ""
7398
"The <varname>max=8</varname> variable does not represent the maximum length "
7399
"of a password. It only means that complexity requirements will not be "
7400
"checked on passwords over 8 characters. You may want to look at the "
7401
"<application>libpam-cracklib</application> package for additional password "
7402
"entropy assistance."
7403
msgstr ""
7404
7405
#: serverguide/C/security.xml:220(title)
7406
msgid "Password Expiration"
7407
msgstr ""
7408
7409
#: serverguide/C/security.xml:221(para)
7410
msgid ""
7411
"When creating user accounts, you should make it a policy to have a minimum "
7412
"and maximum password age forcing users to change their passwords when they "
7413
"expire."
7414
msgstr ""
7415
7416
#: serverguide/C/security.xml:226(para)
7417
msgid ""
7418
"To easily view the current status of a user account, use the following "
7419
"syntax:"
7420
msgstr ""
7421
7422
#: serverguide/C/security.xml:230(command) serverguide/C/security.xml:263(command)
7423
msgid "sudo chage -l username"
7424
msgstr ""
7425
7426
#: serverguide/C/security.xml:232(para)
7427
msgid ""
7428
"The output below shows interesting facts about the user account, namely that "
7429
"there are no policies applied:"
7430
msgstr ""
7431
7432
#: serverguide/C/security.xml:235(computeroutput)
7433
#, no-wrap
7434
msgid ""
7435
"Last password change : Jan 20, 2008\n"
7436
"Password expires : never\n"
7437
"Password inactive : never\n"
7438
"Account expires : never\n"
7439
"Minimum number of days between password change : 0\n"
7440
"Maximum number of days between password change : 99999\n"
7441
"Number of days of warning before password expires : 7"
7442
msgstr ""
7443
7444
#: serverguide/C/security.xml:245(para)
7445
msgid ""
7446
"To set any of these values, simply use the following syntax, and follow the "
7447
"interactive prompts:"
7448
msgstr ""
7449
7450
#: serverguide/C/security.xml:249(command)
7451
msgid "sudo chage username"
7452
msgstr ""
7453
7454
#: serverguide/C/security.xml:251(para)
7455
msgid ""
7456
"The following is also an example of how you can manually change the explicit "
7457
"expiration date (-E) to 01/31/2008, minimum password age (-m) of 5 days, "
7458
"maximum password age (-M) of 90 days, inactivity period (-I) of 5 days after "
7459
"password expiration, and a warning time period (-W) of 14 days before "
7460
"password expiration."
7461
msgstr ""
7462
7463
#: serverguide/C/security.xml:255(command)
7464
msgid "sudo chage -E 01/31/2008 -m 5 -M 90 -I 30 -W 14 username"
7465
msgstr ""
7466
7467
#: serverguide/C/security.xml:259(para)
7468
msgid "To verify changes, use the same syntax as mentioned previously:"
7469
msgstr ""
7470
7471
#: serverguide/C/security.xml:265(para)
7472
msgid ""
7473
"The output below shows the new policies that have been established for the "
7474
"account:"
7475
msgstr ""
7476
7477
#: serverguide/C/security.xml:268(computeroutput)
7478
#, no-wrap
7479
msgid ""
7480
"Last password change : Jan 20, 2008\n"
7481
"Password expires : Apr 19, 2008\n"
7482
"Password inactive : May 19, 2008\n"
7483
"Account expires : Jan 31, 2008\n"
7484
"Minimum number of days between password change : 5\n"
7485
"Maximum number of days between password change : 90\n"
7486
"Number of days of warning before password expires : 14"
7487
msgstr ""
7488
7489
#: serverguide/C/security.xml:284(title)
7490
msgid "Other Security Considerations"
7491
msgstr ""
7492
7493
#: serverguide/C/security.xml:285(para)
7494
msgid ""
7495
"Many applications use alternate authentication mechanisms that can be easily "
7496
"overlooked by even experienced system administrators. Therefore, it is "
7497
"important to understand and control how users authenticate and gain access "
7498
"to services and applications on your server."
7499
msgstr ""
7500
7501
#: serverguide/C/security.xml:290(title)
7502
msgid "SSH Access by Disabled Users"
7503
msgstr ""
7504
7505
#: serverguide/C/security.xml:291(para)
7506
msgid ""
7507
"Simply disabling/locking a user account will not prevent a user from logging "
7508
"into your server remotely if they have previously set up RSA public key "
7509
"authentication. They will still be able to gain shell access to the server, "
7510
"without the need for any password. Remember to check the users home "
7511
"directory for files that will allow for this type of authenticated SSH "
7512
"access. e.g. <filename>/home/username/.ssh/authorized_keys</filename>."
7513
msgstr ""
7514
7515
#: serverguide/C/security.xml:294(para)
7516
msgid ""
7517
"Remove or rename the directory <filename "
7518
"class=\"directory\">.ssh/</filename> in the user's home folder to prevent "
7519
"further SSH authentication capabilities."
7520
msgstr ""
7521
7522
#: serverguide/C/security.xml:297(para)
7523
msgid ""
7524
"Be sure to check for any established SSH connections by the disabled user, "
7525
"as it is possible they may have existing inbound or outbound connections. "
7526
"Kill any that are found."
7527
msgstr ""
7528
7529
#: serverguide/C/security.xml:300(para)
7530
msgid ""
7531
"Restrict SSH access to only user accounts that should have it. For example, "
7532
"you may create a group called \"sshlogin\" and add the group name as the "
7533
"value associated with the <varname>AllowGroups</varname> variable located in "
7534
"the file <filename>/etc/ssh/sshd_config</filename>."
7535
msgstr ""
7536
7537
#: serverguide/C/security.xml:303(programlisting)
7538
#, no-wrap
7539
msgid ""
7540
"\n"
7541
"AllowGroups sshlogin\n"
7542
msgstr ""
7543
7544
#: serverguide/C/security.xml:306(para)
7545
msgid ""
7546
"Then add your permitted SSH users to the group \"sshlogin\", and restart the "
7547
"SSH service."
7548
msgstr ""
7549
7550
#: serverguide/C/security.xml:310(command)
7551
msgid "sudo adduser username sshlogin"
7552
msgstr ""
7553
7554
#: serverguide/C/security.xml:311(command) serverguide/C/remote-administration.xml:150(command)
7555
msgid "sudo /etc/init.d/ssh restart"
7556
msgstr ""
7557
7558
#: serverguide/C/security.xml:315(title)
7559
msgid "External User Database Authentication"
7560
msgstr ""
7561
7562
#: serverguide/C/security.xml:316(para)
7563
msgid ""
7564
"Most enterprise networks require centralized authentication and access "
7565
"controls for all system resources. If you have configured your server to "
7566
"authenticate users against external databases, be sure to disable the user "
7567
"accounts both externally and locally, this way you ensure that local "
7568
"fallback authentication is not possible."
7569
msgstr ""
7570
7571
#: serverguide/C/security.xml:325(title)
7572
msgid "Console Security"
7573
msgstr ""
7574
7575
#: serverguide/C/security.xml:326(para)
7576
msgid ""
7577
"As with any other security barrier you put in place to protect your server, "
7578
"it is pretty tough to defend against untold damage caused by someone with "
7579
"physical access to your environment, for example, theft of hard drives, "
7580
"power or service disruption and so on. Therefore, console security should be "
7581
"addressed merely as one component of your overall physical security "
7582
"strategy. A locked \"screen door\" may deter a casual criminal, or at the "
7583
"very least slow down a determined one, so it is still advisable to perform "
7584
"basic precautions with regard to console security."
7585
msgstr ""
7586
7587
#: serverguide/C/security.xml:329(para)
7588
msgid ""
7589
"The following instructions will help defend your server against issues that "
7590
"could otherwise yield very serious consequences."
7591
msgstr ""
7592
7593
#: serverguide/C/security.xml:334(title)
7594
msgid "Disable Ctrl+Alt+Delete"
7595
msgstr ""
7596
7597
#: serverguide/C/security.xml:335(para)
7598
msgid ""
7599
"First and foremost, anyone that has physical access to the keyboard can "
7600
"simply use the "
7601
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7602
"eycombo> key combination to reboot the server without having to log on. "
7603
"Sure, someone could simply unplug the power source, but you should still "
7604
"prevent the use of this key combination on a production server. This forces "
7605
"an attacker to take more drastic measures to reboot the server, and will "
7606
"prevent accidental reboots at the same time."
7607
msgstr ""
7608
7609
#: serverguide/C/security.xml:340(para)
7610
msgid ""
7611
"To disable the reboot action taken by pressing the "
7612
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7613
"eycombo> key combination, comment out the following line in the file "
7614
"<filename>/etc/init/control-alt-delete.conf</filename>."
7615
msgstr ""
7616
7617
#: serverguide/C/security.xml:343(programlisting)
7618
#, no-wrap
7619
msgid ""
7620
"\n"
7621
"#exec shutdown -r now \"Control-Alt-Delete pressed\"\n"
7622
msgstr ""
7623
7624
#: serverguide/C/security.xml:352(title)
7625
msgid "Firewall"
7626
msgstr ""
7627
7628
#: serverguide/C/security.xml:355(para)
7629
msgid ""
7630
"The Linux kernel includes the <emphasis>Netfilter</emphasis> subsystem, "
7631
"which is used to manipulate or decide the fate of network traffic headed "
7632
"into or through your server. All modern Linux firewall solutions use this "
7633
"system for packet filtering."
7634
msgstr ""
7635
7636
#: serverguide/C/security.xml:360(para)
7637
msgid ""
7638
"The kernel's packet filtering system would be of little use to "
7639
"administrators without a userspace interface to manage it. This is the "
7640
"purpose of iptables. When a packet reaches your server, it will be handed "
7641
"off to the Netfilter subsystem for acceptance, manipulation, or rejection "
7642
"based on the rules supplied to it from userspace via iptables. Thus, "
7643
"iptables is all you need to manage your firewall if you're familiar with it, "
7644
"but many frontends are available to simplify the task."
7645
msgstr ""
7646
7647
#: serverguide/C/security.xml:370(title)
7648
msgid "ufw - Uncomplicated Firewall"
7649
msgstr ""
7650
7651
#: serverguide/C/security.xml:371(para)
7652
msgid ""
7653
"The default firewall configuration tool for Ubuntu is "
7654
"<application>ufw</application>. Developed to ease iptables firewall "
7655
"configuration, <application>ufw</application> provides a user friendly way "
7656
"to create an IPv4 or IPv6 host-based firewall."
7657
msgstr ""
7658
7659
#: serverguide/C/security.xml:375(para)
7660
msgid ""
7661
"<application>ufw</application> by default is initially disabled. From the "
7662
"<application>ufw</application> man page:"
7663
msgstr ""
7664
7665
#: serverguide/C/security.xml:379(quote)
7666
msgid ""
7667
"ufw is not intended to provide complete firewall functionality via its "
7668
"command interface, but instead provides an easy way to add or remove simple "
7669
"rules. It is currently mainly used for host-based firewalls."
7670
msgstr ""
7671
7672
#: serverguide/C/security.xml:383(para)
7673
msgid ""
7674
"The following are some examples of how to use <application>ufw</application>:"
7675
msgstr ""
7676
7677
#: serverguide/C/security.xml:388(para)
7678
msgid ""
7679
"First, <application>ufw</application> needs to be enabled. From a terminal "
7680
"prompt enter:"
7681
msgstr ""
7682
7683
#: serverguide/C/security.xml:392(command)
7684
msgid "sudo ufw enable"
7685
msgstr ""
7686
7687
#: serverguide/C/security.xml:396(para)
7688
msgid "To open a port (ssh in this example):"
7689
msgstr ""
7690
7691
#: serverguide/C/security.xml:400(command)
7692
msgid "sudo ufw allow 22"
7693
msgstr ""
7694
7695
#: serverguide/C/security.xml:404(para)
7696
msgid "Rules can also be added using a <emphasis>numbered</emphasis> format:"
7697
msgstr ""
7698
7699
#: serverguide/C/security.xml:408(command)
7700
msgid "sudo ufw insert 1 allow 80"
7701
msgstr ""
7702
7703
#: serverguide/C/security.xml:412(para)
7704
msgid "Similarly, to close an opened port:"
7705
msgstr ""
7706
7707
#: serverguide/C/security.xml:416(command)
7708
msgid "sudo ufw deny 22"
7709
msgstr ""
7710
7711
#: serverguide/C/security.xml:420(para)
7712
msgid "To remove a rule, use delete followed by the rule:"
7713
msgstr ""
7714
7715
#: serverguide/C/security.xml:424(command)
7716
msgid "sudo ufw delete deny 22"
7717
msgstr ""
7718
7719
#: serverguide/C/security.xml:428(para)
7720
msgid ""
7721
"It is also possible to allow access from specific hosts or networks to a "
7722
"port. The following example allows ssh access from host 192.168.0.2 to any "
7723
"ip address on this host:"
7724
msgstr ""
7725
7726
#: serverguide/C/security.xml:433(command)
7727
msgid "sudo ufw allow proto tcp from 192.168.0.2 to any port 22"
7728
msgstr ""
7729
7730
#: serverguide/C/security.xml:435(para)
7731
msgid ""
7732
"Replace 192.168.0.2 with 192.168.0.0/24 to allow ssh access from the entire "
7733
"subnet."
7734
msgstr ""
7735
7736
#: serverguide/C/security.xml:441(para)
7737
msgid ""
7738
"Adding the <emphasis>--dry-run</emphasis> option to a "
7739
"<emphasis>ufw</emphasis> command will output the resulting rules, but not "
7740
"apply them. For example, the following is what would be applied if opening "
7741
"the HTTP port:"
7742
msgstr ""
7743
7744
#: serverguide/C/security.xml:447(command)
7745
msgid "sudo ufw --dry-run allow http"
7746
msgstr ""
7747
7748
#: serverguide/C/security.xml:451(computeroutput)
7749
#, no-wrap
7750
msgid ""
7751
"*filter\n"
7752
":ufw-user-input - [0:0]\n"
7753
":ufw-user-output - [0:0]\n"
7754
":ufw-user-forward - [0:0]\n"
7755
":ufw-user-limit - [0:0]\n"
7756
":ufw-user-limit-accept - [0:0]\n"
7757
"### RULES ###\n"
7758
"\n"
7759
"### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0\n"
7760
"-A ufw-user-input -p tcp --dport 80 -j ACCEPT\n"
7761
"\n"
7762
"### END RULES ###\n"
7763
"-A ufw-user-input -j RETURN\n"
7764
"-A ufw-user-output -j RETURN\n"
7765
"-A ufw-user-forward -j RETURN\n"
7766
"-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix \"[UFW "
7767
"LIMIT]: \"\n"
7768
"-A ufw-user-limit -j REJECT\n"
7769
"-A ufw-user-limit-accept -j ACCEPT\n"
7770
"COMMIT\n"
7771
"Rules updated"
7772
msgstr ""
7773
7774
#: serverguide/C/security.xml:475(para)
7775
msgid "<application>ufw</application> can be disabled by:"
7776
msgstr ""
7777
7778
#: serverguide/C/security.xml:479(command)
7779
msgid "sudo ufw disable"
7780
msgstr ""
7781
7782
#: serverguide/C/security.xml:483(para)
7783
msgid "To see the firewall status, enter:"
7784
msgstr ""
7785
7786
#: serverguide/C/security.xml:487(command)
7787
msgid "sudo ufw status"
7788
msgstr ""
7789
7790
#: serverguide/C/security.xml:491(para)
7791
msgid "And for more verbose status information use:"
7792
msgstr ""
7793
7794
#: serverguide/C/security.xml:495(command)
7795
msgid "sudo ufw status verbose"
7796
msgstr ""
7797
7798
#: serverguide/C/security.xml:499(para)
7799
msgid "To view the <emphasis>numbered</emphasis> format:"
7800
msgstr ""
7801
7802
#: serverguide/C/security.xml:503(command)
7803
msgid "sudo ufw status numbered"
7804
msgstr ""
7805
7806
#: serverguide/C/security.xml:508(para)
7807
msgid ""
7808
"If the port you want to open or close is defined in "
7809
"<filename>/etc/services</filename>, you can use the port name instead of the "
7810
"number. In the above examples, replace <emphasis>22</emphasis> with "
7811
"<emphasis>ssh</emphasis>."
7812
msgstr ""
7813
7814
#: serverguide/C/security.xml:514(para)
7815
msgid ""
7816
"This is a quick introduction to using <application>ufw</application>. Please "
7817
"refer to the <application>ufw</application> man page for more information."
7818
msgstr ""
7819
7820
#: serverguide/C/security.xml:520(title)
7821
msgid "ufw Application Integration"
7822
msgstr ""
7823
7824
#: serverguide/C/security.xml:522(para)
7825
msgid ""
7826
"Applications that open ports can include an <application>ufw</application> "
7827
"profile, which details the ports needed for the application to function "
7828
"properly. The profiles are kept in <filename "
7829
"role=\"directory\">/etc/ufw/applications.d</filename>, and can be edited if "
7830
"the default ports have been changed."
7831
msgstr ""
7832
7833
#: serverguide/C/security.xml:531(para)
7834
msgid ""
7835
"To view which applications have installed a profile, enter the following in "
7836
"a terminal:"
7837
msgstr ""
7838
7839
#: serverguide/C/security.xml:536(command)
7840
msgid "sudo ufw app list"
7841
msgstr ""
7842
7843
#: serverguide/C/security.xml:542(para)
7844
msgid ""
7845
"Similar to allowing traffic to a port, using an application profile is "
7846
"accomplished by entering:"
7847
msgstr ""
7848
7849
#: serverguide/C/security.xml:547(command)
7850
msgid "sudo ufw allow Samba"
7851
msgstr ""
7852
7853
#: serverguide/C/security.xml:553(para)
7854
msgid "An extended syntax is available as well:"
7855
msgstr ""
7856
7857
#: serverguide/C/security.xml:558(command)
7858
msgid "ufw allow from 192.168.0.0/24 to any app Samba"
7859
msgstr ""
7860
7861
#: serverguide/C/security.xml:561(para)
7862
msgid ""
7863
"Replace <emphasis>Samba</emphasis> and <emphasis>192.168.0.0/24</emphasis> "
7864
"with the application profile you are using and the IP range for your network."
7865
msgstr ""
7866
7867
#: serverguide/C/security.xml:567(para)
7868
msgid ""
7869
"There is no need to specify the <emphasis>protocol</emphasis> for the "
7870
"application, because that information is detailed in the profile. Also, note "
7871
"that the <emphasis>app</emphasis> name replaces the "
7872
"<emphasis>port</emphasis> number."
7873
msgstr ""
7874
7875
#: serverguide/C/security.xml:576(para)
7876
msgid ""
7877
"To view details about which ports, protocols, etc are defined for an "
7878
"application, enter:"
7879
msgstr ""
7880
7881
#: serverguide/C/security.xml:581(command)
7882
msgid "sudo ufw app info Samba"
7883
msgstr ""
7884
7885
#: serverguide/C/security.xml:587(para)
7886
msgid ""
7887
"Not all applications that require opening a network port come with "
7888
"<application>ufw</application> profiles, but if you have profiled an "
7889
"application and want the file to be included with the package, please file a "
7890
"bug against the package in <ulink "
7891
"url=\"https://launchpad.net/\">Launchpad</ulink>."
7892
msgstr ""
7893
7894
#: serverguide/C/security.xml:596(title)
7895
msgid "IP Masquerading"
7896
msgstr ""
7897
7898
#: serverguide/C/security.xml:597(para)
7899
msgid ""
7900
"The purpose of IP Masquerading is to allow machines with private, non-"
7901
"routable IP addresses on your network to access the Internet through the "
7902
"machine doing the masquerading. Traffic from your private network destined "
7903
"for the Internet must be manipulated for replies to be routable back to the "
7904
"machine that made the request. To do this, the kernel must modify the "
7905
"<emphasis>source</emphasis> IP address of each packet so that replies will "
7906
"be routed back to it, rather than to the private IP address that made the "
7907
"request, which is impossible over the Internet. Linux uses "
7908
"<emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which "
7909
"connections belong to which machines and reroute each return packet "
7910
"accordingly. Traffic leaving your private network is thus \"masqueraded\" as "
7911
"having originated from your Ubuntu gateway machine. This process is referred "
7912
"to in Microsoft documentation as Internet Connection Sharing."
7913
msgstr ""
7914
7915
#: serverguide/C/security.xml:613(title)
7916
msgid "ufw Masquerading"
7917
msgstr ""
7918
7919
#: serverguide/C/security.xml:614(para)
7920
msgid ""
7921
"IP Masquerading can be achieved using custom <application>ufw</application> "
7922
"rules. This is possible because the current back-end for "
7923
"<application>ufw</application> is <application>iptables-"
7924
"restore</application> with the rules files located in "
7925
"<filename>/etc/ufw/*.rules</filename>. These files are a great place to add "
7926
"legacy iptables rules used without <application>ufw</application>, and rules "
7927
"that are more network gateway or bridge related."
7928
msgstr ""
7929
7930
#: serverguide/C/security.xml:620(para)
7931
msgid ""
7932
"The rules are split into two different files, rules that should be executed "
7933
"before <application>ufw</application> command line rules, and rules that are "
7934
"executed after <application>ufw</application> command line rules."
7935
msgstr ""
7936
7937
#: serverguide/C/security.xml:626(para)
7938
msgid ""
7939
"First, packet forwarding needs to be enabled in "
7940
"<application>ufw</application>. Two configuration files will need to be "
7941
"adjusted, in <filename>/etc/default/ufw</filename> change the "
7942
"<emphasis>DEFAULT_FORWARD_POLICY</emphasis> to <quote>ACCEPT</quote>:"
7943
msgstr ""
7944
7945
#: serverguide/C/security.xml:630(programlisting)
7946
#, no-wrap
7947
msgid ""
7948
"\n"
7949
"DEFAULT_FORWARD_POLICY=\"ACCEPT\"\n"
7950
msgstr ""
7951
7952
#: serverguide/C/security.xml:633(para)
7953
msgid "Then edit <filename>/etc/ufw/sysctl.conf</filename> and uncomment:"
7954
msgstr ""
7955
7956
#: serverguide/C/security.xml:636(programlisting)
7957
#, no-wrap
7958
msgid ""
7959
"\n"
7960
"net/ipv4/ip_forward=1\n"
7961
msgstr ""
7962
7963
#: serverguide/C/security.xml:639(para)
7964
msgid "Similarly, for IPv6 forwarding uncomment:"
7965
msgstr ""
7966
7967
#: serverguide/C/security.xml:642(programlisting)
7968
#, no-wrap
7969
msgid ""
7970
"\n"
7971
"net/ipv6/conf/default/forwarding=1\n"
7972
msgstr ""
7973
7974
#: serverguide/C/security.xml:647(para)
7975
msgid ""
7976
"Now we will add rules to the <filename>/etc/ufw/before.rules</filename> "
7977
"file. The default rules only configure the <emphasis>filter</emphasis> "
7978
"table, and to enable masquerading the <emphasis>nat</emphasis> table will "
7979
"need to be configured. Add the following to the top of the file just after "
7980
"the header comments:"
7981
msgstr ""
7982
7983
#: serverguide/C/security.xml:652(programlisting)
7984
#, no-wrap
7985
msgid ""
7986
"\n"
7987
"# nat Table rules\n"
7988
"*nat\n"
7989
":POSTROUTING ACCEPT [0:0]\n"
7990
"\n"
7991
"# Forward traffic from eth1 through eth0.\n"
7992
"-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE\n"
7993
"\n"
7994
"# don't delete the 'COMMIT' line or these nat table rules won't be "
7995
"processed\n"
7996
"COMMIT\n"
7997
msgstr ""
7998
7999
#: serverguide/C/security.xml:663(para)
8000
msgid ""
8001
"The comments are not strictly necessary, but it is considered good practice "
8002
"to document your configuration. Also, when modifying any of the "
8003
"<emphasis>rules</emphasis> files in <filename "
8004
"class=\"directory\">/etc/ufw</filename>, make sure these lines are the last "
8005
"line for each table modified:"
8006
msgstr ""
8007
8008
#: serverguide/C/security.xml:669(programlisting)
8009
#, no-wrap
8010
msgid ""
8011
"\n"
8012
"# don't delete the 'COMMIT' line or these rules won't be processed\n"
8013
"COMMIT\n"
8014
msgstr ""
8015
8016
#: serverguide/C/security.xml:674(para)
8017
msgid ""
8018
"For each <emphasis>Table</emphasis> a corresponding "
8019
"<emphasis>COMMIT</emphasis> statement is required. In these examples only "
8020
"the <emphasis>nat</emphasis> and <emphasis>filter</emphasis> tables are "
8021
"shown, but you can also add rules for the <emphasis>raw</emphasis> and "
8022
"<emphasis>mangle</emphasis> tables."
8023
msgstr ""
8024
8025
#: serverguide/C/security.xml:681(para)
8026
msgid ""
8027
"In the above example replace <emphasis>eth0</emphasis>, "
8028
"<emphasis>eth1</emphasis>, and <emphasis>192.168.0.0/24</emphasis> with the "
8029
"appropriate interfaces and IP range for your network."
8030
msgstr ""
8031
8032
#: serverguide/C/security.xml:689(para)
8033
msgid ""
8034
"Finally, disable and re-enable <application>ufw</application> to apply the "
8035
"changes:"
8036
msgstr ""
8037
8038
#: serverguide/C/security.xml:693(command)
8039
msgid "sudo ufw disable && sudo ufw enable"
8040
msgstr ""
8041
8042
#: serverguide/C/security.xml:697(para)
8043
msgid ""
8044
"IP Masquerading should now be enabled. You can also add any additional "
8045
"FORWARD rules to the <filename>/etc/ufw/before.rules</filename>. It is "
8046
"recommended that these additional rules be added to the <emphasis>ufw-before-"
8047
"forward</emphasis> chain."
8048
msgstr ""
8049
8050
#: serverguide/C/security.xml:704(title)
8051
msgid "iptables Masquerading"
8052
msgstr ""
8053
8054
#: serverguide/C/security.xml:705(para)
8055
msgid ""
8056
"<application>iptables</application> can also be used to enable masquerading."
8057
msgstr ""
8058
8059
#: serverguide/C/security.xml:710(para)
8060
msgid ""
8061
"Similar to <application>ufw</application>, the first step is to enable IPv4 "
8062
"packet forwarding by editing <filename>/etc/sysctl.conf</filename> and "
8063
"uncomment the following line"
8064
msgstr ""
8065
8066
#: serverguide/C/security.xml:714(programlisting)
8067
#, no-wrap
8068
msgid ""
8069
"\n"
8070
"net.ipv4.ip_forward=1\n"
8071
msgstr ""
8072
8073
#: serverguide/C/security.xml:717(para)
8074
msgid "If you wish to enable IPv6 forwarding also uncomment:"
8075
msgstr ""
8076
8077
#: serverguide/C/security.xml:720(programlisting)
8078
#, no-wrap
8079
msgid ""
8080
"\n"
8081
"net.ipv6.conf.default.forwarding=1\n"
8082
msgstr ""
8083
8084
#: serverguide/C/security.xml:725(para)
8085
msgid ""
8086
"Next, execute the <application>sysctl</application> command to enable the "
8087
"new settings in the configuration file:"
8088
msgstr ""
8089
8090
#: serverguide/C/security.xml:729(command)
8091
msgid "sudo sysctl -p"
8092
msgstr ""
8093
8094
#: serverguide/C/security.xml:733(para)
8095
msgid ""
8096
"IP Masquerading can now be accomplished with a single iptables rule, which "
8097
"may differ slightly based on your network configuration:"
8098
msgstr ""
8099
8100
#: serverguide/C/security.xml:736(screen)
8101
#, no-wrap
8102
msgid ""
8103
"\n"
8104
"sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8105
msgstr ""
8106
8107
#: serverguide/C/security.xml:739(para)
8108
msgid ""
8109
"The above command assumes that your private address space is 192.168.0.0/16 "
8110
"and that your Internet-facing device is ppp0. The syntax is broken down as "
8111
"follows:"
8112
msgstr ""
8113
8114
#: serverguide/C/security.xml:744(para)
8115
msgid "-t nat -- the rule is to go into the nat table"
8116
msgstr ""
8117
8118
#: serverguide/C/security.xml:745(para)
8119
msgid ""
8120
"-A POSTROUTING -- the rule is to be appended (-A) to the POSTROUTING chain"
8121
msgstr ""
8122
8123
#: serverguide/C/security.xml:746(para)
8124
msgid ""
8125
"-s 192.168.0.0/16 -- the rule applies to traffic originating from the "
8126
"specified address space"
8127
msgstr ""
8128
8129
#: serverguide/C/security.xml:747(para)
8130
msgid ""
8131
"-o ppp0 -- the rule applies to traffic scheduled to be routed through the "
8132
"specified network device"
8133
msgstr ""
8134
8135
#: serverguide/C/security.xml:749(para)
8136
msgid ""
8137
"-j MASQUERADE -- traffic matching this rule is to \"jump\" (-j) to the "
8138
"MASQUERADE target to be manipulated as described above"
8139
msgstr ""
8140
8141
#: serverguide/C/security.xml:757(para)
8142
msgid ""
8143
"Also, each chain in the filter table (the default table, and where most or "
8144
"all packet filtering occurs) has a default <emphasis>policy</emphasis> of "
8145
"ACCEPT, but if you are creating a firewall in addition to a gateway device, "
8146
"you may have set the policies to DROP or REJECT, in which case your "
8147
"masqueraded traffic needs to be allowed through the FORWARD chain for the "
8148
"above rule to work:"
8149
msgstr ""
8150
8151
#: serverguide/C/security.xml:764(screen)
8152
#, no-wrap
8153
msgid ""
8154
"\n"
8155
"sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT\n"
8156
"sudo iptables -A FORWARD -d 192.168.0.0/16 -m state --state "
8157
"ESTABLISHED,RELATED -i ppp0 -j ACCEPT\n"
8158
msgstr ""
8159
8160
#: serverguide/C/security.xml:768(para)
8161
msgid ""
8162
"The above commands will allow all connections from your local network to the "
8163
"Internet and all traffic related to those connections to return to the "
8164
"machine that initiated them."
8165
msgstr ""
8166
8167
#: serverguide/C/security.xml:775(para)
8168
msgid ""
8169
"If you want masquerading to be enabled on reboot, which you probably do, "
8170
"edit <filename>/etc/rc.local</filename> and add any commands used above. For "
8171
"example add the first command with no filtering:"
8172
msgstr ""
8173
8174
#: serverguide/C/security.xml:779(screen)
8175
#, no-wrap
8176
msgid ""
8177
"\n"
8178
"iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8179
msgstr ""
8180
8181
#: serverguide/C/security.xml:787(title)
8182
msgid "Logs"
8183
msgstr ""
8184
8185
#: serverguide/C/security.xml:788(para)
8186
msgid ""
8187
"Firewall logs are essential for recognizing attacks, troubleshooting your "
8188
"firewall rules, and noticing unusual activity on your network. You must "
8189
"include logging rules in your firewall for them to be generated, though, and "
8190
"logging rules must come before any applicable terminating rule (a rule with "
8191
"a target that decides the fate of the packet, such as ACCEPT, DROP, or "
8192
"REJECT)."
8193
msgstr ""
8194
8195
#: serverguide/C/security.xml:795(para)
8196
msgid ""
8197
"If you are using <application>ufw</application>, you can turn on logging by "
8198
"entering the following in a terminal:"
8199
msgstr ""
8200
8201
#: serverguide/C/security.xml:799(command)
8202
msgid "sudo ufw logging on"
8203
msgstr ""
8204
8205
#: serverguide/C/security.xml:801(para)
8206
msgid ""
8207
"To turn logging off in <application>ufw</application>, simply replace "
8208
"<emphasis role=\"italic\">on</emphasis> with <emphasis "
8209
"role=\"italic\">off</emphasis> in the above command."
8210
msgstr ""
8211
8212
#: serverguide/C/security.xml:804(para)
8213
msgid ""
8214
"If using <application>iptables</application> instead of "
8215
"<application>ufw</application>, enter:"
8216
msgstr ""
8217
8218
#: serverguide/C/security.xml:807(screen)
8219
#, no-wrap
8220
msgid ""
8221
"\n"
8222
"sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j LOG --log-"
8223
"prefix \"NEW_HTTP_CONN: \"\n"
8224
msgstr ""
8225
8226
#: serverguide/C/security.xml:810(para)
8227
msgid ""
8228
"A request on port 80 from the local machine, then, would generate a log in "
8229
"dmesg that looks like this:"
8230
msgstr ""
8231
8232
#: serverguide/C/security.xml:815(programlisting)
8233
#, no-wrap
8234
msgid ""
8235
"[4304885.870000] NEW_HTTP_CONN: IN=lo OUT= "
8236
"MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 "
8237
"LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=58288 DF PROTO=TCP SPT=53981 DPT=80 "
8238
"WINDOW=32767 RES=0x00 SYN URGP=0"
8239
msgstr ""
8240
8241
#: serverguide/C/security.xml:817(para)
8242
msgid ""
8243
"The above log will also appear in <filename>/var/log/messages</filename>, "
8244
"<filename>/var/log/syslog</filename>, and "
8245
"<filename>/var/log/kern.log</filename>. This behavior can be modified by "
8246
"editing <filename>/etc/syslog.conf</filename> appropriately or by installing "
8247
"and configuring <application>ulogd</application> and using the ULOG target "
8248
"instead of LOG. The <application>ulogd</application> daemon is a userspace "
8249
"server that listens for logging instructions from the kernel specifically "
8250
"for firewalls, and can log to any file you like, or even to a "
8251
"<application>PostgreSQL</application> or <application>MySQL</application> "
8252
"database. Making sense of your firewall logs can be simplified by using a "
8253
"log analyzing tool such as <application>fwanalog</application>, "
8254
"<application> fwlogwatch</application>, or <application>lire</application>."
8255
msgstr ""
8256
8257
#: serverguide/C/security.xml:832(title)
8258
msgid "Other Tools"
8259
msgstr ""
8260
8261
#: serverguide/C/security.xml:833(para)
8262
msgid ""
8263
"There are many tools available to help you construct a complete firewall "
8264
"without intimate knowledge of iptables. For the GUI-inclined:"
8265
msgstr ""
8266
8267
#: serverguide/C/security.xml:839(para)
8268
msgid ""
8269
"<ulink url=\"http://www.fs-security.com/\">Firestarter</ulink> is quite "
8270
"popular and easy to use."
8271
msgstr ""
8272
8273
#: serverguide/C/security.xml:844(para)
8274
msgid ""
8275
"<ulink url=\"http://www.fwbuilder.org/\">fwbuilder</ulink> is very powerful "
8276
"and will look familiar to an administrator who has used a commercial "
8277
"firewall utility such as <application>Checkpoint FireWall-1</application>."
8278
msgstr ""
8279
8280
#: serverguide/C/security.xml:850(para)
8281
msgid ""
8282
"If you prefer a command-line tool with plain-text configuration files:"
8283
msgstr ""
8284
8285
#: serverguide/C/security.xml:855(para)
8286
msgid ""
8287
"<ulink url=\"http://www.shorewall.net/\">Shorewall</ulink> is a very "
8288
"powerful solution to help you configure an advanced firewall for any network."
8289
msgstr ""
8290
8291
#: serverguide/C/security.xml:861(para)
8292
msgid ""
8293
"<ulink url=\"http://www.linuxkungfu.org/\">ipkungfu</ulink> should give you "
8294
"a working firewall \"out of the box\" with zero configuration, and will "
8295
"allow you to easily set up a more advanced firewall by editing simple, well-"
8296
"documented configuration files."
8297
msgstr ""
8298
8299
#: serverguide/C/security.xml:868(para)
8300
msgid ""
8301
"<ulink url=\"http://fireflier.sourceforge.net/\">fireflier</ulink> is "
8302
"designed to be a desktop firewall application. It is made up of a server "
8303
"(fireflier-server) and your choice of GUI clients (GTK or QT), and behaves "
8304
"like many popular interactive firewall applications for Windows."
8305
msgstr ""
8306
8307
#: serverguide/C/security.xml:880(para)
8308
msgid ""
8309
"The <ulink url=\"https://wiki.ubuntu.com/UbuntuFirewall\">Ubuntu "
8310
"Firewall</ulink> wiki page contains information on the development of "
8311
"<application>ufw</application>."
8312
msgstr ""
8313
8314
#: serverguide/C/security.xml:886(para)
8315
msgid ""
8316
"Also, the <application>ufw</application> manual page contains some very "
8317
"useful information: <command>man ufw</command>."
8318
msgstr ""
8319
8320
#: serverguide/C/security.xml:891(para)
8321
msgid ""
8322
"See the <ulink url=\"http://www.netfilter.org/documentation/HOWTO/packet-"
8323
"filtering-HOWTO.html\">packet-filtering-HOWTO</ulink> for more information "
8324
"on using <application>iptables</application>."
8325
msgstr ""
8326
8327
#: serverguide/C/security.xml:897(para)
8328
msgid ""
8329
"The <ulink url=\"http://www.netfilter.org/documentation/HOWTO/NAT-"
8330
"HOWTO.html\">nat-HOWTO</ulink> contains further details on masquerading."
8331
msgstr ""
8332
8333
#: serverguide/C/security.xml:903(para)
8334
msgid ""
8335
"The <ulink url=\"https://help.ubuntu.com/community/IptablesHowTo\">IPTables "
8336
"HowTo</ulink> in the Ubuntu wiki is a great resource."
8337
msgstr ""
8338
8339
#: serverguide/C/security.xml:911(title)
8340
msgid "AppArmor"
8341
msgstr ""
8342
8343
#: serverguide/C/security.xml:912(para)
8344
msgid ""
8345
"<application>AppArmor</application> is a Linux Security Module "
8346
"implementation of name-based mandatory access controls. AppArmor confines "
8347
"individual programs to a set of listed files and posix 1003.1e draft "
8348
"capabilities."
8349
msgstr ""
8350
8351
#: serverguide/C/security.xml:916(para)
8352
msgid ""
8353
"<application>AppArmor</application> is installed and loaded by default. It "
8354
"uses <emphasis>profiles</emphasis> of an application to determine what files "
8355
"and permissions the application requires. Some packages will install their "
8356
"own profiles, and additional profiles can be found in the "
8357
"<application>apparmor-profiles</application> package."
8358
msgstr ""
8359
8360
#: serverguide/C/security.xml:921(para)
8361
msgid ""
8362
"To install the <application>apparmor-profiles</application> package from a "
8363
"terminal prompt:"
8364
msgstr ""
8365
8366
#: serverguide/C/security.xml:927(para)
8367
msgid "AppArmor profiles have two modes of execution:"
8368
msgstr ""
8369
8370
#: serverguide/C/security.xml:932(para)
8371
msgid ""
8372
"Complaining/Learning: profile violations are permitted and logged. Useful "
8373
"for testing and developing new profiles."
8374
msgstr ""
8375
8376
#: serverguide/C/security.xml:937(para)
8377
msgid ""
8378
"Enforced/Confined: enforces profile policy as well as logging the violation."
8379
msgstr ""
8380
8381
#: serverguide/C/security.xml:943(title)
8382
msgid "Using AppArmor"
8383
msgstr ""
8384
8385
#: serverguide/C/security.xml:944(para)
8386
msgid ""
8387
"The <application>apparmor-utils</application> package contains command line "
8388
"utilities that you can use to change the <application>AppArmor</application> "
8389
"execution mode, find the status of a profile, create new profiles, etc."
8390
msgstr ""
8391
8392
#: serverguide/C/security.xml:950(para)
8393
msgid ""
8394
"<application>apparmor_status</application> is used to view the current "
8395
"status of AppArmor profiles."
8396
msgstr ""
8397
8398
#: serverguide/C/security.xml:954(command)
8399
msgid "sudo apparmor_status"
8400
msgstr ""
8401
8402
#: serverguide/C/security.xml:958(para)
8403
msgid ""
8404
"<application>aa-complain</application> places a profile into "
8405
"<emphasis>complain</emphasis> mode."
8406
msgstr ""
8407
8408
#: serverguide/C/security.xml:962(command)
8409
msgid "sudo aa-complain /path/to/bin"
8410
msgstr ""
8411
8412
#: serverguide/C/security.xml:966(para)
8413
msgid ""
8414
"<application>aa-enforce</application> places a profile into "
8415
"<emphasis>enforce</emphasis> mode."
8416
msgstr ""
8417
8418
#: serverguide/C/security.xml:970(command)
8419
msgid "sudo aa-enforce /path/to/bin"
8420
msgstr ""
8421
8422
#: serverguide/C/security.xml:974(para)
8423
msgid ""
8424
"The <filename>/etc/apparmor.d</filename> directory is where the AppArmor "
8425
"profiles are located. It can be used to manipulate the "
8426
"<emphasis>mode</emphasis> of all profiles."
8427
msgstr ""
8428
8429
#: serverguide/C/security.xml:978(para)
8430
msgid "Enter the following to place all profiles into complain mode:"
8431
msgstr ""
8432
8433
#: serverguide/C/security.xml:982(command)
8434
msgid "sudo aa-complain /etc/apparmor.d/*"
8435
msgstr ""
8436
8437
#: serverguide/C/security.xml:984(para)
8438
msgid "To place all profiles in enforce mode:"
8439
msgstr ""
8440
8441
#: serverguide/C/security.xml:988(command)
8442
msgid "sudo aa-enforce /etc/apparmor.d/*"
8443
msgstr ""
8444
8445
#: serverguide/C/security.xml:992(para)
8446
msgid ""
8447
"<application>apparmor_parser</application> is used to load a profile into "
8448
"the kernel. It can also be used to reload a currently loaded profile using "
8449
"the <emphasis>-r</emphasis> option. To load a profile:"
8450
msgstr ""
8451
8452
#: serverguide/C/security.xml:997(command) serverguide/C/security.xml:1029(command)
8453
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a"
8454
msgstr ""
8455
8456
#: serverguide/C/security.xml:999(para)
8457
msgid "To reload a profile:"
8458
msgstr ""
8459
8460
#: serverguide/C/security.xml:1003(command)
8461
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r"
8462
msgstr ""
8463
8464
#: serverguide/C/security.xml:1007(para)
8465
msgid ""
8466
"<filename>/etc/init.d/apparmor</filename> can be used to "
8467
"<emphasis>reload</emphasis> all profiles:"
8468
msgstr ""
8469
8470
#: serverguide/C/security.xml:1011(command) serverguide/C/network-auth.xml:632(command)
8471
msgid "sudo /etc/init.d/apparmor reload"
8472
msgstr ""
8473
8474
#: serverguide/C/security.xml:1015(para)
8475
msgid ""
8476
"The <filename>/etc/apparmor.d/disable</filename> directory can be used along "
8477
"with the <application>apparmor_parser -R</application> option to "
8478
"<emphasis>disable</emphasis> a profile."
8479
msgstr ""
8480
8481
#: serverguide/C/security.xml:1020(command)
8482
msgid "sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/"
8483
msgstr ""
8484
8485
#: serverguide/C/security.xml:1021(command)
8486
msgid "sudo apparmor_parser -R /etc/apparmor.d/profile.name"
8487
msgstr ""
8488
8489
#: serverguide/C/security.xml:1023(para)
8490
msgid ""
8491
"To <emphasis>re-enable</emphasis> a disabled profile remove the symbolic "
8492
"link to the profile in <filename>/etc/apparmor.d/disable/</filename>. Then "
8493
"load the profile using the <emphasis>-a</emphasis> option."
8494
msgstr ""
8495
8496
#: serverguide/C/security.xml:1028(command)
8497
msgid "sudo rm /etc/apparmor.d/disable/profile.name"
8498
msgstr ""
8499
8500
#: serverguide/C/security.xml:1033(para)
8501
msgid ""
8502
"<application>AppArmor</application> can be disabled, and the kernel module "
8503
"unloaded by entering the following:"
8504
msgstr ""
8505
8506
#: serverguide/C/security.xml:1037(command)
8507
msgid "sudo /etc/init.d/apparmor stop"
8508
msgstr ""
8509
8510
#: serverguide/C/security.xml:1038(command)
8511
msgid "sudo update-rc.d -f apparmor remove"
8512
msgstr ""
8513
8514
#: serverguide/C/security.xml:1042(para)
8515
msgid "To re-enable <application>AppArmor</application> enter:"
8516
msgstr ""
8517
8518
#: serverguide/C/security.xml:1046(command)
8519
msgid "sudo /etc/init.d/apparmor start"
8520
msgstr ""
8521
8522
#: serverguide/C/security.xml:1047(command)
8523
msgid "sudo update-rc.d apparmor defaults"
8524
msgstr ""
8525
8526
#: serverguide/C/security.xml:1052(para)
8527
msgid ""
8528
"Replace <emphasis>profile.name</emphasis> with the name of the profile you "
8529
"want to manipulate. Also, replace <filename>/path/to/bin/</filename> with "
8530
"the actual executable file path. For example for the "
8531
"<application>ping</application> command use <filename>/bin/ping</filename>"
8532
msgstr ""
8533
8534
#: serverguide/C/security.xml:1060(title)
8535
msgid "Profiles"
8536
msgstr ""
8537
8538
#: serverguide/C/security.xml:1061(para)
8539
msgid ""
8540
"<application>AppArmor</application> profiles are simple text files located "
8541
"in <filename>/etc/apparmor.d/</filename>. The files are named after the full "
8542
"path to the executable they profile replacing the \"/\" with \".\". For "
8543
"example <filename>/etc/apparmor.d/bin.ping</filename> is the AppArmor "
8544
"profile for the <filename>/bin/ping</filename> command."
8545
msgstr ""
8546
8547
#: serverguide/C/security.xml:1067(para)
8548
msgid "There are two main type of rules used in profiles:"
8549
msgstr ""
8550
8551
#: serverguide/C/security.xml:1072(para)
8552
msgid ""
8553
"<emphasis>Path entries:</emphasis> which detail which files an application "
8554
"can access in the file system."
8555
msgstr ""
8556
8557
#: serverguide/C/security.xml:1077(para)
8558
msgid ""
8559
"<emphasis>Capability entries:</emphasis> determine what privileges a "
8560
"confined process is allowed to use."
8561
msgstr ""
8562
8563
#: serverguide/C/security.xml:1082(para)
8564
msgid ""
8565
"As an example take a look at <filename>/etc/apparmor.d/bin.ping</filename>:"
8566
msgstr ""
8567
8568
#: serverguide/C/security.xml:1085(programlisting)
8569
#, no-wrap
8570
msgid ""
8571
"\n"
8572
"#include <tunables/global>\n"
8573
"/bin/ping flags=(complain) {\n"
8574
" #include <abstractions/base>\n"
8575
" #include <abstractions/consoles>\n"
8576
" #include <abstractions/nameservice>\n"
8577
"\n"
8578
" capability net_raw,\n"
8579
" capability setuid,\n"
8580
" network inet raw,\n"
8581
" \n"
8582
" /bin/ping mixr,\n"
8583
" /etc/modules.conf r,\n"
8584
"}\n"
8585
msgstr ""
8586
8587
#: serverguide/C/security.xml:1102(para)
8588
msgid ""
8589
"<emphasis>#include <tunables/global>:</emphasis> include statements "
8590
"from other files. This allows statements pertaining to multiple applications "
8591
"to be placed in a common file."
8592
msgstr ""
8593
8594
#: serverguide/C/security.xml:1108(para)
8595
msgid ""
8596
"<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled "
8597
"program, also setting the mode to <emphasis>complain</emphasis>."
8598
msgstr ""
8599
8600
#: serverguide/C/security.xml:1114(para)
8601
msgid ""
8602
"<emphasis>capability net_raw,:</emphasis> allows the application access to "
8603
"the CAP_NET_RAW Posix.1e capability."
8604
msgstr ""
8605
8606
#: serverguide/C/security.xml:1119(para)
8607
msgid ""
8608
"<emphasis>/bin/ping mixr,:</emphasis> allows the application read and "
8609
"execute access to the file."
8610
msgstr ""
8611
8612
#: serverguide/C/security.xml:1125(para)
8613
msgid ""
8614
"After editing a profile file the profile must be reloaded. See <xref "
8615
"linkend=\"apparmor-usage\"/> for details."
8616
msgstr ""
8617
8618
#: serverguide/C/security.xml:1130(title)
8619
msgid "Creating a Profile"
8620
msgstr ""
8621
8622
#: serverguide/C/security.xml:1133(para)
8623
msgid ""
8624
"<emphasis>Design a test plan:</emphasis> Try to think about how the "
8625
"application should be exercised. The test plan should be divided into small "
8626
"test cases. Each test case should have a small description and list the "
8627
"steps to follow."
8628
msgstr ""
8629
8630
#: serverguide/C/security.xml:1137(para)
8631
msgid "Some standard test cases are:"
8632
msgstr ""
8633
8634
#: serverguide/C/security.xml:1142(para)
8635
msgid "Starting the program."
8636
msgstr ""
8637
8638
#: serverguide/C/security.xml:1147(para)
8639
msgid "Stopping the program."
8640
msgstr ""
8641
8642
#: serverguide/C/security.xml:1152(para)
8643
msgid "Reloading the program."
8644
msgstr ""
8645
8646
#: serverguide/C/security.xml:1157(para)
8647
msgid "Testing all the commands supported by the init script."
8648
msgstr ""
8649
8650
#: serverguide/C/security.xml:1164(para)
8651
msgid ""
8652
"<emphasis>Generate the new profile:</emphasis> Use <application>aa-"
8653
"genprof</application> to generate a new profile. From a terminal:"
8654
msgstr ""
8655
8656
#: serverguide/C/security.xml:1169(command)
8657
msgid "sudo aa-genprof executable"
8658
msgstr ""
8659
8660
#: serverguide/C/security.xml:1171(para)
8661
msgid "For example:"
8662
msgstr ""
8663
8664
#: serverguide/C/security.xml:1175(command)
8665
msgid "sudo aa-genprof slapd"
8666
msgstr ""
8667
8668
#: serverguide/C/security.xml:1179(para)
8669
msgid ""
8670
"To get your new profile included in the <application>apparmor-"
8671
"profiles</application> package, file a bug in <emphasis>Launchpad</emphasis> "
8672
"against the <ulink "
8673
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug\">AppArmor<"
8674
"/ulink> package:"
8675
msgstr ""
8676
8677
#: serverguide/C/security.xml:1186(para)
8678
msgid "Include your test plan and test cases."
8679
msgstr ""
8680
8681
#: serverguide/C/security.xml:1191(para)
8682
msgid "Attach your new profile to the bug."
8683
msgstr ""
8684
8685
#: serverguide/C/security.xml:1200(title)
8686
msgid "Updating Profiles"
8687
msgstr ""
8688
8689
#: serverguide/C/security.xml:1201(para)
8690
msgid ""
8691
"When the program is misbehaving, audit messages are sent to the log files. "
8692
"The program <application>aa-logprof</application> can be used to scan log "
8693
"files for <application>AppArmor</application> audit messages, review them "
8694
"and update the profiles. From a terminal:"
8695
msgstr ""
8696
8697
#: serverguide/C/security.xml:1206(command)
8698
msgid "sudo aa-logprof"
8699
msgstr ""
8700
8701
#: serverguide/C/security.xml:1214(para)
8702
msgid ""
8703
"See the <ulink "
8704
"url=\"http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/ind"
8705
"ex.html?page=/documentation/apparmor/apparmor201_sp10_admin/data/book_apparmo"
8706
"r_admin.html\">AppArmor Administration Guide</ulink> for advanced "
8707
"configuration options."
8708
msgstr ""
8709
8710
#: serverguide/C/security.xml:1221(para)
8711
msgid ""
8712
"For details using AppArmor with other Ubuntu releases see the <ulink "
8713
"url=\"https://help.ubuntu.com/community/AppArmor\"> AppArmor Community "
8714
"Wiki</ulink> page."
8715
msgstr ""
8716
8717
#: serverguide/C/security.xml:1229(para)
8718
msgid ""
8719
"The <ulink url=\"http://en.opensuse.org/AppArmor\">OpenSUSE AppArmor</ulink> "
8720
"page is another introduction to AppArmor."
8721
msgstr ""
8722
8723
#: serverguide/C/security.xml:1236(para)
8724
msgid ""
8725
"A great place to ask for <application>AppArmor</application> assistance, and "
8726
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
8727
"server</emphasis> IRC channel on <ulink "
8728
"url=\"http://freenode.net\">freenode</ulink>."
8729
msgstr ""
8730
8731
#: serverguide/C/security.xml:1246(title)
8732
msgid "Certificates"
8733
msgstr ""
8734
8735
#: serverguide/C/security.xml:1247(para)
8736
msgid ""
8737
"One of the most common forms of cryptography today is <emphasis>public-"
8738
"key</emphasis> cryptography. Public-key cryptography utilizes a "
8739
"<emphasis>public key</emphasis> and a <emphasis>private key</emphasis>. The "
8740
"system works by <emphasis>encrypting</emphasis> information using the public "
8741
"key. The information can then only be <emphasis>decrypted</emphasis> using "
8742
"the private key."
8743
msgstr ""
8744
8745
#: serverguide/C/security.xml:1253(para)
8746
msgid ""
8747
"A common use for public-key cryptography is encrypting application traffic "
8748
"using a Secure Socket Layer (SSL) or Transport Layer Security (TLS) "
8749
"connection. For example, configuring Apache to provide "
8750
"<emphasis>HTTPS</emphasis>, the HTTP protocol over SSL. This allows a way to "
8751
"encrypt traffic using a protocol that does not itself provide encryption."
8752
msgstr ""
8753
8754
#: serverguide/C/security.xml:1258(para)
8755
msgid ""
8756
"A <emphasis>Certificate</emphasis> is a method used to distribute a "
8757
"<emphasis>public key</emphasis> and other information about a server and the "
8758
"organization who is responsible for it. Certificates can be digitally signed "
8759
"by a <emphasis>Certification Authority</emphasis> or CA. A CA is a trusted "
8760
"third party that has confirmed that the information contained in the "
8761
"certificate is accurate."
8762
msgstr ""
8763
8764
#: serverguide/C/security.xml:1265(title)
8765
msgid "Types of Certificates"
8766
msgstr ""
8767
8768
#: serverguide/C/security.xml:1266(para)
8769
msgid ""
8770
"To set up a secure server using public-key cryptography, in most cases, you "
8771
"send your certificate request (including your public key), proof of your "
8772
"company's identity, and payment to a CA. The CA verifies the certificate "
8773
"request and your identity, and then sends back a certificate for your secure "
8774
"server. Alternatively, you can create your own <emphasis>self-"
8775
"signed</emphasis> certificate."
8776
msgstr ""
8777
8778
#: serverguide/C/security.xml:1276(para)
8779
msgid ""
8780
"Note, that self-signed certificates should not be used in most production "
8781
"environments."
8782
msgstr ""
8783
8784
#: serverguide/C/security.xml:1280(para)
8785
msgid ""
8786
"Continuing the HTTPS example, a CA-signed certificate provides two important "
8787
"capabilities that a self-signed certificate does not:"
8788
msgstr ""
8789
8790
#: serverguide/C/security.xml:1287(para)
8791
msgid ""
8792
"Browsers (usually) automatically recognize the certificate and allow a "
8793
"secure connection to be made without prompting the user."
8794
msgstr ""
8795
8796
#: serverguide/C/security.xml:1294(para)
8797
msgid ""
8798
"When a CA issues a signed certificate, it is guaranteeing the identity of "
8799
"the organization that is providing the web pages to the browser."
8800
msgstr ""
8801
8802
#: serverguide/C/security.xml:1302(para)
8803
msgid ""
8804
"Most Web browsers, and computers, that support SSL have a list of CAs whose "
8805
"certificates they automatically accept. If a browser encounters a "
8806
"certificate whose authorizing CA is not in the list, the browser asks the "
8807
"user to either accept or decline the connection. Also, other applications "
8808
"may generate an error message when using a self-singed certificate."
8809
msgstr ""
8810
8811
#: serverguide/C/security.xml:1310(para)
8812
msgid ""
8813
"The process of getting a certificate from a CA is fairly easy. A quick "
8814
"overview is as follows:"
8815
msgstr ""
8816
8817
#: serverguide/C/security.xml:1317(para)
8818
msgid "Create a private and public encryption key pair."
8819
msgstr ""
8820
8821
#: serverguide/C/security.xml:1320(para)
8822
msgid ""
8823
"Create a certificate request based on the public key. The certificate "
8824
"request contains information about your server and the company hosting it."
8825
msgstr ""
8826
8827
#: serverguide/C/security.xml:1325(para)
8828
msgid ""
8829
"Send the certificate request, along with documents proving your identity, to "
8830
"a CA. We cannot tell you which certificate authority to choose. Your "
8831
"decision may be based on your past experiences, or on the experiences of "
8832
"your friends or colleagues, or purely on monetary factors."
8833
msgstr ""
8834
8835
#: serverguide/C/security.xml:1331(para)
8836
msgid ""
8837
"Once you have decided upon a CA, you need to follow the instructions they "
8838
"provide on how to obtain a certificate from them."
8839
msgstr ""
8840
8841
#: serverguide/C/security.xml:1336(para)
8842
msgid ""
8843
"When the CA is satisfied that you are indeed who you claim to be, they send "
8844
"you a digital certificate."
8845
msgstr ""
8846
8847
#: serverguide/C/security.xml:1340(para)
8848
msgid ""
8849
"Install this certificate on your secure server, and configure the "
8850
"appropriate applications to use the certificate."
8851
msgstr ""
8852
8853
#: serverguide/C/security.xml:1349(title)
8854
msgid "Generating a Certificate Signing Request (CSR)"
8855
msgstr ""
8856
8857
#: serverguide/C/security.xml:1351(para)
8858
msgid ""
8859
"Whether you are getting a certificate from a CA or generating your own self-"
8860
"signed certificate, the first step is to generate a key."
8861
msgstr ""
8862
8863
#: serverguide/C/security.xml:1356(para)
8864
msgid ""
8865
"If the certificate will be used by service daemons, such as Apache, Postfix, "
8866
"Dovecot, etc, a key without a passphrase is often appropriate. Not having a "
8867
"passphrase allows the services to start without manual intervention, usually "
8868
"the preferred way to start a daemon."
8869
msgstr ""
8870
8871
#: serverguide/C/security.xml:1362(para)
8872
msgid ""
8873
"This section will cover generating a key with a passphrase, and one without. "
8874
"The non-passphrase key will then be used to generate a certificate that can "
8875
"be used with various service daemons."
8876
msgstr ""
8877
8878
#: serverguide/C/security.xml:1368(para)
8879
msgid ""
8880
"Running your secure service without a passphrase is convenient because you "
8881
"will not need to enter the passphrase every time you start your secure "
8882
"service. But it is insecure and a compromise of the key means a compromise "
8883
"of the server as well."
8884
msgstr ""
8885
8886
#: serverguide/C/security.xml:1375(para)
8887
msgid ""
8888
"To generate the <emphasis>keys</emphasis> for the Certificate Signing "
8889
"Request (CSR) run the following command from a terminal prompt:"
8890
msgstr ""
8891
8892
#: serverguide/C/security.xml:1381(command)
8893
msgid "openssl genrsa -des3 -out server.key 1024"
8894
msgstr ""
8895
8896
#: serverguide/C/security.xml:1384(programlisting)
8897
#, no-wrap
8898
msgid ""
8899
"\n"
8900
"Generating RSA private key, 1024 bit long modulus\n"
8901
".....................++++++\n"
8902
".................++++++\n"
8903
"unable to write 'random state'\n"
8904
"e is 65537 (0x10001)\n"
8905
"Enter pass phrase for server.key:\n"
8906
msgstr ""
8907
8908
#: serverguide/C/security.xml:1393(para)
8909
msgid ""
8910
"You can now enter your passphrase. For best security, it should at least "
8911
"contain eight characters. The minimum length when specifying -des3 is four "
8912
"characters. It should include numbers and/or punctuation and not be a word "
8913
"in a dictionary. Also remember that your passphrase is case-sensitive."
8914
msgstr ""
8915
8916
#: serverguide/C/security.xml:1401(para)
8917
msgid ""
8918
"Re-type the passphrase to verify. Once you have re-typed it correctly, the "
8919
"server key is generated and stored in the <filename>server.key</filename> "
8920
"file."
8921
msgstr ""
8922
8923
#: serverguide/C/security.xml:1407(para)
8924
msgid ""
8925
"Now create the insecure key, the one without a passphrase, and shuffle the "
8926
"key names:"
8927
msgstr ""
8928
8929
#: serverguide/C/security.xml:1413(command)
8930
msgid "openssl rsa -in server.key -out server.key.insecure"
8931
msgstr ""
8932
8933
#: serverguide/C/security.xml:1414(command)
8934
msgid "mv server.key server.key.secure"
8935
msgstr ""
8936
8937
#: serverguide/C/security.xml:1415(command)
8938
msgid "mv server.key.insecure server.key"
8939
msgstr ""
8940
8941
#: serverguide/C/security.xml:1418(para)
8942
msgid ""
8943
"The insecure key is now named <filename>server.key</filename>, and you can "
8944
"use this file to generate the CSR without passphrase."
8945
msgstr ""
8946
8947
#: serverguide/C/security.xml:1423(para)
8948
msgid "To create the CSR, run the following command at a terminal prompt:"
8949
msgstr ""
8950
8951
#: serverguide/C/security.xml:1428(command)
8952
msgid "openssl req -new -key server.key -out server.csr"
8953
msgstr ""
8954
8955
#: serverguide/C/security.xml:1431(para)
8956
msgid ""
8957
"It will prompt you enter the passphrase. If you enter the correct "
8958
"passphrase, it will prompt you to enter Company Name, Site Name, Email Id, "
8959
"etc. Once you enter all these details, your CSR will be created and it will "
8960
"be stored in the <filename>server.csr</filename> file."
8961
msgstr ""
8962
8963
#: serverguide/C/security.xml:1439(para)
8964
msgid ""
8965
"You can now submit this CSR file to a CA for processing. The CA will use "
8966
"this CSR file and issue the certificate. On the other hand, you can create "
8967
"self-signed certificate using this CSR."
8968
msgstr ""
8969
8970
#: serverguide/C/security.xml:1447(title)
8971
msgid "Creating a Self-Signed Certificate"
8972
msgstr ""
8973
8974
#: serverguide/C/security.xml:1448(para)
8975
msgid ""
8976
"To create the self-signed certificate, run the following command at a "
8977
"terminal prompt:"
8978
msgstr ""
8979
8980
#: serverguide/C/security.xml:1453(command)
8981
msgid ""
8982
"openssl x509 -req -days 365 -in server.csr -signkey server.key -out "
8983
"server.crt"
8984
msgstr ""
8985
8986
#: serverguide/C/security.xml:1456(para)
8987
msgid ""
8988
"The above command will prompt you to enter the passphrase. Once you enter "
8989
"the correct passphrase, your certificate will be created and it will be "
8990
"stored in the <filename>server.crt</filename> file."
8991
msgstr ""
8992
8993
#: serverguide/C/security.xml:1461(para)
8994
msgid ""
8995
"If your secure server is to be used in a production environment, you "
8996
"probably need a CA-signed certificate. It is not recommended to use self-"
8997
"signed certificate."
8998
msgstr ""
8999
9000
#: serverguide/C/security.xml:1469(title)
9001
msgid "Installing the Certificate"
9002
msgstr ""
9003
9004
#: serverguide/C/security.xml:1471(para)
9005
msgid ""
9006
"You can install the key file <filename>server.key</filename> and certificate "
9007
"file <filename>server.crt</filename>, or the certificate file issued by your "
9008
"CA, by running following commands at a terminal prompt:"
9009
msgstr ""
9010
9011
#: serverguide/C/security.xml:1477(command)
9012
msgid "sudo cp server.crt /etc/ssl/certs"
9013
msgstr ""
9014
9015
#: serverguide/C/security.xml:1478(command)
9016
msgid "sudo cp server.key /etc/ssl/private"
9017
msgstr ""
9018
9019
#: serverguide/C/security.xml:1480(para)
9020
msgid ""
9021
"Now simply configure any applications, with the ability to use public-key "
9022
"cryptography, to use the <emphasis>certificate</emphasis> and "
9023
"<emphasis>key</emphasis> files. For example, "
9024
"<application>Apache</application> can provide HTTPS, "
9025
"<application>Dovecot</application> can provide IMAPS and POP3S, etc."
9026
msgstr ""
9027
9028
#: serverguide/C/security.xml:1487(title)
9029
msgid "Certification Authority"
9030
msgstr ""
9031
9032
#: serverguide/C/security.xml:1489(para)
9033
msgid ""
9034
"If the services on your network require more than a few self-signed "
9035
"certificates it may be worth the additional effort to setup your own "
9036
"internal <emphasis>Certification Authority (CA)</emphasis>. Using "
9037
"certificates signed by your own CA, allows the various services using the "
9038
"certificates to easily trust other services using certificates issued from "
9039
"the same CA."
9040
msgstr ""
9041
9042
#: serverguide/C/security.xml:1499(para)
9043
msgid ""
9044
"First, create the directories to hold the CA certificate and related files:"
9045
msgstr ""
9046
9047
#: serverguide/C/security.xml:1504(command)
9048
msgid "sudo mkdir /etc/ssl/CA"
9049
msgstr ""
9050
9051
#: serverguide/C/security.xml:1505(command)
9052
msgid "sudo mkdir /etc/ssl/newcerts"
9053
msgstr ""
9054
9055
#: serverguide/C/security.xml:1511(para)
9056
msgid ""
9057
"The CA needs a few additional files to operate, one to keep track of the "
9058
"last serial number used by the CA, each certificate must have a unique "
9059
"serial number, and another file to record which certificates have been "
9060
"issued:"
9061
msgstr ""
9062
9063
#: serverguide/C/security.xml:1518(command)
9064
msgid "sudo sh -c \"echo '01' > /etc/ssl/CA/serial\""
9065
msgstr ""
9066
9067
#: serverguide/C/security.xml:1519(command)
9068
msgid "sudo touch /etc/ssl/CA/index.txt"
9069
msgstr ""
9070
9071
#: serverguide/C/security.xml:1525(para)
9072
msgid ""
9073
"The third file is a CA configuration file. Though not strictly necessary, it "
9074
"is very convenient when issuing multiple certificates. Edit "
9075
"<filename>/etc/ssl/openssl.cnf</filename>, and in the <emphasis>[ CA_default "
9076
"]</emphasis> change:"
9077
msgstr ""
9078
9079
#: serverguide/C/security.xml:1531(programlisting)
9080
#, no-wrap
9081
msgid ""
9082
"\n"
9083
"dir = /etc/ssl/ # Where everything is kept\n"
9084
"database = $dir/CA/index.txt # database index file.\n"
9085
"certificate = $dir/certs/cacert.pem # The CA certificate\n"
9086
"serial = $dir/CA/serial # The current serial number\n"
9087
"private_key = $dir/private/cakey.pem# The private key\n"
9088
msgstr ""
9089
9090
#: serverguide/C/security.xml:1542(para)
9091
msgid "Next, create the self-singed root certificate:"
9092
msgstr ""
9093
9094
#: serverguide/C/security.xml:1547(command)
9095
msgid ""
9096
"openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -"
9097
"days 3650"
9098
msgstr ""
9099
9100
#: serverguide/C/security.xml:1550(para)
9101
msgid "You will then be asked to enter the details about the certificate."
9102
msgstr ""
9103
9104
#: serverguide/C/security.xml:1557(para)
9105
msgid "Now install the root certificate and key:"
9106
msgstr ""
9107
9108
#: serverguide/C/security.xml:1562(command)
9109
msgid "sudo mv cakey.pem /etc/ssl/private/"
9110
msgstr ""
9111
9112
#: serverguide/C/security.xml:1563(command)
9113
msgid "sudo mv cacert.pem /etc/ssl/certs/"
9114
msgstr ""
9115
9116
#: serverguide/C/security.xml:1569(para)
9117
msgid ""
9118
"You are now ready to start signing certificates. The first item needed is a "
9119
"Certificate Signing Request (CSR), see <xref linkend=\"generating-a-csr\"/> "
9120
"for details. Once you have a CSR, enter the following to generate a "
9121
"certificate signed by the CA:"
9122
msgstr ""
9123
9124
#: serverguide/C/security.xml:1576(command)
9125
msgid "sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf"
9126
msgstr ""
9127
9128
#: serverguide/C/security.xml:1579(para)
9129
msgid ""
9130
"After entering the password for the CA key, you will be prompted to sign the "
9131
"certificate, and again to commit the new certificate. You should then see a "
9132
"somewhat large amount of output related to the certificate creation."
9133
msgstr ""
9134
9135
#: serverguide/C/security.xml:1588(para)
9136
msgid ""
9137
"There should now be a new file, "
9138
"<filename>/etc/ssl/newcerts/01.pem</filename>, containing the same output. "
9139
"Copy and paste everything between the <emphasis>-----BEGIN CERTIFICATE-----"
9140
"</emphasis> and <emphasis>----END CERTIFICATE-----</emphasis> lines to a "
9141
"file named after the hostname of the server where the certificate will be "
9142
"installed. For example <filename>mail.example.com.crt</filename>, is a nice "
9143
"descriptive name."
9144
msgstr ""
9145
9146
#: serverguide/C/security.xml:1596(para)
9147
msgid ""
9148
"Subsequent certificates will be named <filename>02.pem</filename>, "
9149
"<filename>03.pem</filename>, etc."
9150
msgstr ""
9151
9152
#: serverguide/C/security.xml:1601(para)
9153
msgid ""
9154
"Replace <emphasis>mail.example.com.crt</emphasis> with your own descriptive "
9155
"name."
9156
msgstr ""
9157
9158
#: serverguide/C/security.xml:1609(para)
9159
msgid ""
9160
"Finally, copy the new certificate to the host that needs it, and configure "
9161
"the appropriate applications to use it. The default location to install "
9162
"certificates is <filename role=\"directory\">/etc/ssl/certs</filename>. This "
9163
"enables multiple services to use the same certificate without overly "
9164
"complicated file permissions."
9165
msgstr ""
9166
9167
#: serverguide/C/security.xml:1615(para)
9168
msgid ""
9169
"For applications that can be configured to use a CA certificate, you should "
9170
"also copy the <filename>/etc/ssl/certs/cacert.pem</filename> file to the "
9171
"<filename role=\"directory\">/etc/ssl/certs/</filename> directory on each "
9172
"server."
9173
msgstr ""
9174
9175
#: serverguide/C/security.xml:1629(para)
9176
msgid ""
9177
"For more detailed instructions on using cryptography see the <ulink "
9178
"url=\"http://tldp.org/HOWTO/SSL-Certificates-HOWTO/index.html\">SSL "
9179
"Certificates HOWTO</ulink> by tlpd.org"
9180
msgstr ""
9181
9182
#: serverguide/C/security.xml:1635(para)
9183
msgid ""
9184
"<ulink url=\"http://www.pki-page.org/\">The PKI Page</ulink> contains a list "
9185
"of Certificate Authorities."
9186
msgstr ""
9187
9188
#: serverguide/C/security.xml:1640(para)
9189
msgid ""
9190
"The Wikipedia <ulink "
9191
"url=\"http://en.wikipedia.org/wiki/Https\">HTTPS</ulink> page has more "
9192
"information regarding HTTPS."
9193
msgstr ""
9194
9195
#: serverguide/C/security.xml:1645(para)
9196
msgid ""
9197
"For more information on <emphasis>OpenSSL</emphasis> see the <ulink "
9198
"url=\"http://www.openssl.org/\">OpenSSL Home Page</ulink>."
9199
msgstr ""
9200
9201
#: serverguide/C/security.xml:1650(para)
9202
msgid ""
9203
"Also, O'Reilly's <ulink "
9204
"url=\"http://oreilly.com/catalog/9780596002701/\">Network Security with "
9205
"OpenSSL</ulink> is a good in depth reference."
9206
msgstr ""
9207
9208
#: serverguide/C/security.xml:1659(title)
9209
msgid "eCryptfs"
9210
msgstr ""
9211
9212
#: serverguide/C/security.xml:1661(para)
9213
msgid ""
9214
"<emphasis>eCryptfs</emphasis> is a POSIX-compliant enterprise-class stacked "
9215
"cryptographic filesystem for Linux. Layering on top of the filesystem layer "
9216
"<emphasis>eCryptfs</emphasis> protects files no matter the underlying "
9217
"filesystem, partition type, etc."
9218
msgstr ""
9219
9220
#: serverguide/C/security.xml:1667(para)
9221
msgid ""
9222
"During installation there is an option to encrypt the <filename "
9223
"role=\"directory\">/home</filename> partition. This will automatically "
9224
"configure everything needed to encrypt and mount the partition."
9225
msgstr ""
9226
9227
#: serverguide/C/security.xml:1672(para)
9228
msgid ""
9229
"As an example, this section will cover configuring <filename "
9230
"role=\"directory\">/srv</filename> to be encrypted using eCryptfs."
9231
msgstr ""
9232
9233
#: serverguide/C/security.xml:1677(title)
9234
msgid "Using eCryptfs"
9235
msgstr ""
9236
9237
#: serverguide/C/security.xml:1679(para)
9238
msgid "First, install the necessary packages. From a terminal prompt enter:"
9239
msgstr ""
9240
9241
#: serverguide/C/security.xml:1684(command)
9242
msgid "sudo apt-get install ecryptfs-utils"
9243
msgstr ""
9244
9245
#: serverguide/C/security.xml:1687(para)
9246
msgid "Now mount the partition to be encrypted:"
9247
msgstr ""
9248
9249
#: serverguide/C/security.xml:1692(command)
9250
msgid "sudo mount -t ecryptfs /srv /srv"
9251
msgstr ""
9252
9253
#: serverguide/C/security.xml:1695(para)
9254
msgid ""
9255
"You will then be prompted for some details on how "
9256
"<application>ecryptfs</application> should encrypt the data."
9257
msgstr ""
9258
9259
#: serverguide/C/security.xml:1699(para)
9260
msgid ""
9261
"To test that files placed in <filename>/srv</filename> are indeed encrypted "
9262
"copy the <filename>/etc/default</filename> folder to "
9263
"<filename>/srv</filename>:"
9264
msgstr ""
9265
9266
#: serverguide/C/security.xml:1705(command) serverguide/C/clustering.xml:192(command)
9267
msgid "sudo cp -r /etc/default /srv"
9268
msgstr ""
9269
9270
#: serverguide/C/security.xml:1708(para)
9271
msgid "Now unmount <filename>/srv</filename>, and try to view a file:"
9272
msgstr ""
9273
9274
#: serverguide/C/security.xml:1713(command) serverguide/C/installation.xml:1138(command) serverguide/C/clustering.xml:200(command)
9275
msgid "sudo umount /srv"
9276
msgstr ""
9277
9278
#: serverguide/C/security.xml:1714(command)
9279
msgid "cat /srv/default/cron"
9280
msgstr ""
9281
9282
#: serverguide/C/security.xml:1717(para)
9283
msgid ""
9284
"Remounting <filename>/srv</filename> using "
9285
"<application>ecryptfs</application> will make the data viewable once again."
9286
msgstr ""
9287
9288
#: serverguide/C/security.xml:1723(title)
9289
msgid "Automatically Mounting Encrypted Partitions"
9290
msgstr ""
9291
9292
#: serverguide/C/security.xml:1725(para)
9293
msgid ""
9294
"There are a couple of ways to automatically mount an "
9295
"<application>ecryptfs</application> encrypted filesystem at boot. This "
9296
"example will use a <filename>/root/.ecryptfsrc</filename> file containing "
9297
"mount options, along with a passphrase file residing on a USB key."
9298
msgstr ""
9299
9300
#: serverguide/C/security.xml:1731(para)
9301
msgid "First, create <filename>/root/.ecryptfsrc</filename> containing:"
9302
msgstr ""
9303
9304
#: serverguide/C/security.xml:1735(programlisting)
9305
#, no-wrap
9306
msgid ""
9307
"\n"
9308
"key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt\n"
9309
"ecryptfs_sig=5826dd62cf81c615\n"
9310
"ecryptfs_cipher=aes\n"
9311
"ecryptfs_key_bytes=16\n"
9312
"ecryptfs_passthrough=n\n"
9313
"ecryptfs_enable_filename_crypto=n\n"
9314
msgstr ""
9315
9316
#: serverguide/C/security.xml:1745(para)
9317
msgid ""
9318
"Adjust the <emphasis>ecryptfs_sig</emphasis> to the signature in "
9319
"<filename>/root/.ecryptfs/sig-cache.txt</filename>."
9320
msgstr ""
9321
9322
#: serverguide/C/security.xml:1750(para)
9323
msgid ""
9324
"Next, create the <filename>/mnt/usb/passwd_file.txt</filename> passphrase "
9325
"file:"
9326
msgstr ""
9327
9328
#: serverguide/C/security.xml:1754(programlisting)
9329
#, no-wrap
9330
msgid ""
9331
"\n"
9332
"passphrase_passwd=[secrets]\n"
9333
msgstr ""
9334
9335
#: serverguide/C/security.xml:1758(para)
9336
msgid "Now add the necessary lines to <filename>/etc/fstab</filename>:"
9337
msgstr ""
9338
9339
#: serverguide/C/security.xml:1762(programlisting)
9340
#, no-wrap
9341
msgid ""
9342
"\n"
9343
"/dev/sdb1 /mnt/usb ext3 ro 0 0\n"
9344
"/srv /srv ecryptfs defaults 0 0\n"
9345
msgstr ""
9346
9347
#: serverguide/C/security.xml:1767(para)
9348
msgid "Make sure the USB drive is mounted before the encrypted partition."
9349
msgstr ""
9350
9351
#: serverguide/C/security.xml:1771(para)
9352
msgid ""
9353
"Finally, reboot and the <filename>/srv</filename> should be mounted using "
9354
"ecryptfs."
9355
msgstr ""
9356
9357
#: serverguide/C/security.xml:1779(para)
9358
msgid ""
9359
"The <application>ecryptfs-utils</application> package includes several other "
9360
"useful utilities:"
9361
msgstr ""
9362
9363
#: serverguide/C/security.xml:1785(para)
9364
msgid ""
9365
"<emphasis>ecryptfs-setup-private:</emphasis> creates a "
9366
"<filename>~/Private</filename> directory to contain encrypted information. "
9367
"This utility can be run by unprivileged users to keep data private from "
9368
"other users on the system."
9369
msgstr ""
9370
9371
#: serverguide/C/security.xml:1792(para)
9372
msgid ""
9373
"<emphasis>ecryptfs-mount-private and ecryptfs-umount-private:</emphasis> "
9374
"will mount and unmount respectively, a users <filename>~/Private</filename> "
9375
"directory."
9376
msgstr ""
9377
9378
#: serverguide/C/security.xml:1798(para)
9379
msgid ""
9380
"<emphasis>ecryptfs-add-passphrase:</emphasis> adds a new passphrase to the "
9381
"kernel keyring."
9382
msgstr ""
9383
9384
#: serverguide/C/security.xml:1803(para)
9385
msgid ""
9386
"<emphasis>ecryptfs-manager:</emphasis> manages "
9387
"<application>eCryptfs</application> objects such as keys."
9388
msgstr ""
9389
9390
#: serverguide/C/security.xml:1808(para)
9391
msgid ""
9392
"<emphasis>ecryptfs-stat:</emphasis> allows you to view the "
9393
"<application>ecryptfs</application> meta information for a file."
9394
msgstr ""
9395
9396
#: serverguide/C/security.xml:1821(para)
9397
msgid ""
9398
"For more information on eCryptfs see the <ulink "
9399
"url=\"https://launchpad.net/ecryptfs\">Launchpad project page</ulink>."
9400
msgstr ""
9401
9402
#: serverguide/C/security.xml:1826(para)
9403
msgid ""
9404
"There is also a <ulink "
9405
"url=\"http://www.linuxjournal.com/article/9400\">Linux Journal</ulink> "
9406
"article covering eCryptfs."
9407
msgstr ""
9408
9409
#: serverguide/C/security.xml:1831(para)
9410
msgid ""
9411
"Also, for more <application>ecryptfs</application> options see the <ulink "
9412
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/ecryptfs.7.html\">ecr"
9413
"yptfs man page</ulink>."
9414
msgstr ""
9415
9416
#: serverguide/C/security.xml:1837(para)
9417
msgid ""
9418
"The <ulink url=\"https://help.ubuntu.com/community/eCryptfs\">eCryptfs "
9419
"Ubuntu Wiki</ulink> page also has more details."
9420
msgstr ""
9421
9422
#: serverguide/C/reporting-bugs.xml:13(title)
9423
msgid "Appendix"
9424
msgstr ""
9425
9426
#: serverguide/C/reporting-bugs.xml:16(title)
9427
msgid "Reporting Bugs in Ubuntu Server Edition"
9428
msgstr ""
9429
9430
#: serverguide/C/reporting-bugs.xml:18(para)
9431
msgid ""
9432
"While the Ubuntu Project attempts to release software with as few bugs as "
9433
"possible, they do occur. You can help fix these bugs by reporting ones that "
9434
"you find to the project. The Ubuntu Project uses <ulink "
9435
"url=\"https://launchpad.net/\">Launchpad</ulink> to track its bug reports. "
9436
"In order to file a bug about Ubuntu Server on Launchpad, you will need to "
9437
"<ulink url=\"https://help.launchpad.net/YourAccount/NewAccount\">create an "
9438
"account</ulink>."
9439
msgstr ""
9440
9441
#: serverguide/C/reporting-bugs.xml:30(title)
9442
msgid "Reporting Bugs With ubuntu-bug"
9443
msgstr ""
9444
9445
#: serverguide/C/reporting-bugs.xml:32(para)
9446
msgid ""
9447
"The preferred way to report a bug is with the <application>ubuntu-"
9448
"bug</application> command. The ubuntu-bug tool gathers information about the "
9449
"system useful to developers in diagnosing the reported problem that will "
9450
"then be included in the bug report filed on Launchpad. Bug reports in Ubuntu "
9451
"need to be filed against a specific software package, thus the name of the "
9452
"package that the bug occurs in needs to be given to ubuntu-bug:"
9453
msgstr ""
9454
9455
#: serverguide/C/reporting-bugs.xml:43(command)
9456
msgid "ubuntu-bug PACKAGENAME"
9457
msgstr ""
9458
9459
#: serverguide/C/reporting-bugs.xml:46(para)
9460
msgid ""
9461
"For example, to file a bug against the openssh-server package, you would do:"
9462
msgstr ""
9463
9464
#: serverguide/C/reporting-bugs.xml:51(command)
9465
msgid "ubuntu-bug openssh-server"
9466
msgstr ""
9467
9468
#: serverguide/C/reporting-bugs.xml:54(para)
9469
msgid ""
9470
"You can specify either a binary package or the source package for ubuntu-"
9471
"bug. Again using openssh-server as an example, you could also generate the "
9472
"report against the source package for openssh-server, openssh:"
9473
msgstr ""
9474
9475
#: serverguide/C/reporting-bugs.xml:62(command)
9476
msgid "ubuntu-bug openssh"
9477
msgstr ""
9478
9479
#: serverguide/C/reporting-bugs.xml:66(para)
9480
msgid ""
9481
"See <xref linkend=\"package-management\"/> for more information about "
9482
"packages in Ubuntu."
9483
msgstr ""
9484
9485
#: serverguide/C/reporting-bugs.xml:72(para)
9486
msgid ""
9487
"The ubuntu-bug command will gather information about the system in question, "
9488
"possibly including information specific to the specified package, and then "
9489
"ask you what you would like to do with collected information:"
9490
msgstr ""
9491
9492
#: serverguide/C/reporting-bugs.xml:80(command)
9493
msgid "ubuntu-bug postgresql"
9494
msgstr ""
9495
9496
#: serverguide/C/reporting-bugs.xml:79(screen)
9497
#, no-wrap
9498
msgid ""
9499
"\n"
9500
"<placeholder-1/>\n"
9501
"\n"
9502
"*** Collecting problem information\n"
9503
"\n"
9504
"The collected information can be sent to the developers to improve the\n"
9505
"application. This might take a few minutes.\n"
9506
"..........\n"
9507
"\n"
9508
"*** Send problem report to the developers?\n"
9509
"\n"
9510
"After the problem report has been sent, please fill out the form in the\n"
9511
"automatically opened web browser.\n"
9512
"\n"
9513
"What would you like to do? Your options are:\n"
9514
" S: Send report (1.7 KiB)\n"
9515
" V: View report\n"
9516
" K: Keep report file for sending later or copying to somewhere else\n"
9517
" C: Cancel\n"
9518
"Please choose (S/V/K/C):\n"
9519
msgstr ""
9520
9521
#: serverguide/C/reporting-bugs.xml:101(para)
9522
msgid "The options available are:"
9523
msgstr ""
9524
9525
#: serverguide/C/reporting-bugs.xml:108(para)
9526
msgid ""
9527
"<emphasis role=\"bold\">Send Report</emphasis> Selecting Send Report submits "
9528
"the collected information to Launchpad as part of the the process of filing "
9529
"a bug report. You will be given the opportunity to describe the situation "
9530
"that led up to the occurrance of the bug."
9531
msgstr ""
9532
9533
#: serverguide/C/reporting-bugs.xml:115(screen)
9534
#, no-wrap
9535
msgid ""
9536
"\n"
9537
"*** Uploading problem information\n"
9538
"\n"
9539
"The collected information is being sent to the bug tracking system.\n"
9540
"This might take a few minutes.\n"
9541
"91%\n"
9542
"\n"
9543
"*** To continue, you must visit the following URL:\n"
9544
"\n"
9545
" https://bugs.launchpad.net/ubuntu/+source/postgresql-"
9546
"8.4/+filebug/kc6eSnTLnLxF8u0t3e56EukFeqJ?\n"
9547
"\n"
9548
"You can launch a browser now, or copy this URL into a browser on another\n"
9549
"computer.\n"
9550
"\n"
9551
"Choices:\n"
9552
" 1: Launch a browser now\n"
9553
" C: Cancel\n"
9554
"Please choose (1/C):\n"
9555
msgstr ""
9556
9557
#: serverguide/C/reporting-bugs.xml:135(para)
9558
msgid ""
9559
"If you choose to start a browser, by default the text based web browser "
9560
"<application>w3m</application> will be used to finish filing the bug report. "
9561
"Alternately, you can copy the given URL to a currently running web browser."
9562
msgstr ""
9563
9564
#: serverguide/C/reporting-bugs.xml:144(para)
9565
msgid ""
9566
"<emphasis role=\"bold\">View Report</emphasis> Selecting View Report causes "
9567
"the collected information to be displayed to the terminal for review."
9568
msgstr ""
9569
9570
#: serverguide/C/reporting-bugs.xml:150(screen)
9571
#, no-wrap
9572
msgid ""
9573
"\n"
9574
"Package: postgresql 8.4.2-2\n"
9575
"PackageArchitecture: all\n"
9576
"Tags: lucid\n"
9577
"ProblemType: Bug\n"
9578
"ProcEnviron:\n"
9579
" LANG=en_US.UTF-8\n"
9580
" SHELL=/bin/bash\n"
9581
"Uname: Linux 2.6.32-16-server x86_64\n"
9582
"Dependencies:\n"
9583
" adduser 3.112ubuntu1\n"
9584
" base-files 5.0.0ubuntu10\n"
9585
" base-passwd 3.5.22\n"
9586
" coreutils 7.4-2ubuntu2\n"
9587
"...\n"
9588
msgstr ""
9589
9590
#: serverguide/C/reporting-bugs.xml:167(para)
9591
msgid ""
9592
"After viewing the report, you will be brought back to the same menu asking "
9593
"what you would like to do with the report."
9594
msgstr ""
9595
9596
#: serverguide/C/reporting-bugs.xml:174(para)
9597
msgid ""
9598
"<emphasis role=\"bold\">Keep Report File</emphasis> Selecting Keep Report "
9599
"File causes the gathered information to be written to a file. This file can "
9600
"then be used to later file a bug report or transferred to a different Ubuntu "
9601
"system for reporting. To submit the report file, simply give it as an "
9602
"argument to the ubuntu-bug command:"
9603
msgstr ""
9604
9605
#: serverguide/C/reporting-bugs.xml:189(userinput)
9606
#, no-wrap
9607
msgid "k"
9608
msgstr ""
9609
9610
#: serverguide/C/reporting-bugs.xml:192(command)
9611
msgid "ubuntu-bug /tmp/apport.postgresql.v4MQas.apport"
9612
msgstr ""
9613
9614
#: serverguide/C/reporting-bugs.xml:183(screen)
9615
#, no-wrap
9616
msgid ""
9617
"\n"
9618
"What would you like to do? Your options are:\n"
9619
" S: Send report (1.7 KiB)\n"
9620
" V: View report\n"
9621
" K: Keep report file for sending later or copying to somewhere else\n"
9622
" C: Cancel\n"
9623
"Please choose (S/V/K/C): <placeholder-1/>\n"
9624
"Problem report file: /tmp/apport.postgresql.v4MQas.apport\n"
9625
"\n"
9626
"<placeholder-2/>\n"
9627
"\n"
9628
"*** Send problem report to the developers?\n"
9629
"...\n"
9630
msgstr ""
9631
9632
#: serverguide/C/reporting-bugs.xml:200(para)
9633
msgid ""
9634
"<emphasis role=\"bold\">Cancel</emphasis> Selecting Cancel causes the "
9635
"collected information to be discarded."
9636
msgstr ""
9637
9638
#: serverguide/C/reporting-bugs.xml:210(title)
9639
msgid "Reporting Application Crashes"
9640
msgstr ""
9641
9642
#: serverguide/C/reporting-bugs.xml:212(para)
9643
msgid ""
9644
"The software package that provides the ubuntu-bug utility, "
9645
"<application>apport</application>, can be configured to trigger when "
9646
"applications crash. This is disabled by default, as capturing a crash can be "
9647
"resource intensive depending on how much memory the application that crashed "
9648
"was using as apport captures and processes the core dump."
9649
msgstr ""
9650
9651
#: serverguide/C/reporting-bugs.xml:221(para)
9652
msgid ""
9653
"Configuring apport to capture information about crashing applications "
9654
"requires a couple of steps. First, <application>gdb</application> needs to "
9655
"be installed; it is not installed by default in Ubuntu Server Edition."
9656
msgstr ""
9657
9658
#: serverguide/C/reporting-bugs.xml:229(command)
9659
msgid "sudo apt-get install gdb"
9660
msgstr ""
9661
9662
#: serverguide/C/reporting-bugs.xml:232(para)
9663
msgid ""
9664
"See <xref linkend=\"package-management\"/> for more information about "
9665
"managing packages in Ubuntu."
9666
msgstr ""
9667
9668
#: serverguide/C/reporting-bugs.xml:237(para)
9669
msgid ""
9670
"Once you have ensured that gdb is installed, open the file "
9671
"<filename>/etc/default/apport</filename> in your text editor, and change the "
9672
"<emphasis>enabled</emphasis> setting to be <emphasis "
9673
"role=\"bold\">1</emphasis> like so:"
9674
msgstr ""
9675
9676
#: serverguide/C/reporting-bugs.xml:244(programlisting)
9677
#, no-wrap
9678
msgid ""
9679
"\n"
9680
"# set this to 0 to disable apport, or to 1 to enable it\n"
9681
"# you can temporarily override this with\n"
9682
"# sudo service apport start force_start=1\n"
9683
"enabled=<userinput>1</userinput>\n"
9684
"\n"
9685
"# set maximum core dump file size (default: 209715200 bytes == 200 MB)\n"
9686
"maxsize=209715200\n"
9687
msgstr ""
9688
9689
#: serverguide/C/reporting-bugs.xml:254(para)
9690
msgid ""
9691
"Once you have completed editing <filename>/etc/default/apport</filename>, "
9692
"start the apport service:"
9693
msgstr ""
9694
9695
#: serverguide/C/reporting-bugs.xml:261(command)
9696
msgid "sudo start apport"
9697
msgstr ""
9698
9699
#: serverguide/C/reporting-bugs.xml:264(para)
9700
msgid ""
9701
"After an application crashes, use the <application>apport-cli</application> "
9702
"command to search for the existing saved crash report information:"
9703
msgstr ""
9704
9705
#: serverguide/C/reporting-bugs.xml:271(command)
9706
msgid "apport-cli"
9707
msgstr ""
9708
9709
#: serverguide/C/reporting-bugs.xml:270(screen)
9710
#, no-wrap
9711
msgid ""
9712
"\n"
9713
"<placeholder-1/>\n"
9714
"\n"
9715
"*** dash closed unexpectedly on 2010-03-11 at 21:40:59.\n"
9716
"\n"
9717
"If you were not doing anything confidential (entering passwords or other\n"
9718
"private information), you can help to improve the application by\n"
9719
"reporting\n"
9720
"the problem.\n"
9721
"\n"
9722
"What would you like to do? Your options are:\n"
9723
" R: Report Problem...\n"
9724
" I: Cancel and ignore future crashes of this program version\n"
9725
" C: Cancel\n"
9726
"Please choose (R/I/C):\n"
9727
msgstr ""
9728
9729
#: serverguide/C/reporting-bugs.xml:287(para)
9730
msgid ""
9731
"Selecting <emphasis>Report Problem</emphasis> will walk you through similar "
9732
"steps as when using ubuntu-bug. One important difference is that a crash "
9733
"report will be marked as private when filed on Launchpad, meaning that it "
9734
"will be visible to only a limited set of bug triagers. These triagers will "
9735
"review the gathered data for private information before making the bug "
9736
"report publicly visible."
9737
msgstr ""
9738
9739
#: serverguide/C/reporting-bugs.xml:307(para)
9740
msgid ""
9741
"See the <ulink "
9742
"url=\"https://help.ubuntu.com/community/ReportingBugs\">Reporting "
9743
"Bugs</ulink> Ubuntu wiki page."
9744
msgstr ""
9745
9746
#: serverguide/C/reporting-bugs.xml:313(para)
9747
msgid ""
9748
"Also, the <ulink url=\"https://wiki.ubuntu.com/Apport\">Apport</ulink> page "
9749
"has some useful information. Though some of it pertains to using a GUI."
9750
msgstr ""
9751
9752
#: serverguide/C/remote-administration.xml:13(title)
9753
msgid "Remote Administration"
9754
msgstr ""
9755
9756
#: serverguide/C/remote-administration.xml:14(para)
9757
msgid ""
9758
"There are many ways to remotely administer a Linux server. This chapter will "
9759
"cover one of the most popular <application>SSH</application> as well as "
9760
"<application>eBox</application>, a web based administration framework."
9761
msgstr ""
9762
9763
#: serverguide/C/remote-administration.xml:23(para)
9764
msgid ""
9765
"This section of the Ubuntu Server Guide introduces a powerful collection of "
9766
"tools for the remote control of networked computers and transfer of data "
9767
"between networked computers, called <emphasis>OpenSSH</emphasis>. You will "
9768
"also learn about some of the configuration settings possible with the "
9769
"OpenSSH server application and how to change them on your Ubuntu system."
9770
msgstr ""
9771
9772
#: serverguide/C/remote-administration.xml:30(para)
9773
msgid ""
9774
"OpenSSH is a freely available version of the Secure Shell (SSH) protocol "
9775
"family of tools for remotely controlling a computer or transferring files "
9776
"between computers. Traditional tools used to accomplish these functions, "
9777
"such as <application>telnet</application> or <application>rcp</application>, "
9778
"are insecure and transmit the user's password in cleartext when used. "
9779
"OpenSSH provides a server daemon and client tools to facilitate secure, "
9780
"encrypted remote control and file transfer operations, effectively replacing "
9781
"the legacy tools."
9782
msgstr ""
9783
9784
#: serverguide/C/remote-administration.xml:39(para)
9785
msgid ""
9786
"The OpenSSH server component, <application>sshd</application>, listens "
9787
"continuously for client connections from any of the client tools. When a "
9788
"connection request occurs, <application>sshd</application> sets up the "
9789
"correct connection depending on the type of client tool connecting. For "
9790
"example, if the remote computer is connecting with the "
9791
"<application>ssh</application> client application, the OpenSSH server sets "
9792
"up a remote control session after authentication. If a remote user connects "
9793
"to an OpenSSH server with <application>scp</application>, the OpenSSH server "
9794
"daemon initiates a secure copy of files between the server and client after "
9795
"authentication. OpenSSH can use many authentication methods, including plain "
9796
"password, public key, and <application>Kerberos</application> tickets."
9797
msgstr ""
9798
9799
#: serverguide/C/remote-administration.xml:53(para)
9800
msgid ""
9801
"Installation of the OpenSSH client and server applications is simple. To "
9802
"install the OpenSSH client applications on your Ubuntu system, use this "
9803
"command at a terminal prompt:"
9804
msgstr ""
9805
9806
#: serverguide/C/remote-administration.xml:59(command)
9807
msgid "sudo apt-get install openssh-client"
9808
msgstr ""
9809
9810
#: serverguide/C/remote-administration.xml:61(para)
9811
msgid ""
9812
"To install the OpenSSH server application, and related support files, use "
9813
"this command at a terminal prompt:"
9814
msgstr ""
9815
9816
#: serverguide/C/remote-administration.xml:66(command)
9817
msgid "sudo apt-get install openssh-server"
9818
msgstr ""
9819
9820
#: serverguide/C/remote-administration.xml:68(para)
9821
msgid ""
9822
"The <application>openssh-server</application> package can also be selected "
9823
"to install during the Server Edition installation process."
9824
msgstr ""
9825
9826
#: serverguide/C/remote-administration.xml:75(para)
9827
msgid ""
9828
"You may configure the default behavior of the OpenSSH server application, "
9829
"<application>sshd</application>, by editing the file "
9830
"<filename>/etc/ssh/sshd_config</filename>. For information about the "
9831
"configuration directives used in this file, you may view the appropriate "
9832
"manual page with the following command, issued at a terminal prompt:"
9833
msgstr ""
9834
9835
#: serverguide/C/remote-administration.xml:83(command)
9836
msgid "man sshd_config"
9837
msgstr ""
9838
9839
#: serverguide/C/remote-administration.xml:85(para)
9840
msgid ""
9841
"There are many directives in the <application>sshd</application> "
9842
"configuration file controlling such things as communication settings and "
9843
"authentication modes. The following are examples of configuration directives "
9844
"that can be changed by editing the <filename>/etc/ssh/sshd_config</filename> "
9845
"file."
9846
msgstr ""
9847
9848
#: serverguide/C/remote-administration.xml:92(para)
9849
msgid ""
9850
"Prior to editing the configuration file, you should make a copy of the "
9851
"original file and protect it from writing so you will have the original "
9852
"settings as a reference and to reuse as necessary."
9853
msgstr ""
9854
9855
#: serverguide/C/remote-administration.xml:96(para)
9856
msgid ""
9857
"Copy the <filename>/etc/ssh/sshd_config</filename> file and protect it from "
9858
"writing with the following commands, issued at a terminal prompt:"
9859
msgstr ""
9860
9861
#: serverguide/C/remote-administration.xml:101(command)
9862
msgid "sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original"
9863
msgstr ""
9864
9865
#: serverguide/C/remote-administration.xml:102(command)
9866
msgid "sudo chmod a-w /etc/ssh/sshd_config.original"
9867
msgstr ""
9868
9869
#: serverguide/C/remote-administration.xml:104(para)
9870
msgid ""
9871
"The following are examples of configuration directives you may change:"
9872
msgstr ""
9873
9874
#: serverguide/C/remote-administration.xml:109(para)
9875
msgid ""
9876
"To set your OpenSSH to listen on TCP port 2222 instead of the default TCP "
9877
"port 22, change the Port directive as such:"
9878
msgstr ""
9879
9880
#: serverguide/C/remote-administration.xml:113(para)
9881
msgid "Port 2222"
9882
msgstr ""
9883
9884
#: serverguide/C/remote-administration.xml:118(para)
9885
msgid ""
9886
"To have <application>sshd</application> allow public key-based login "
9887
"credentials, simply add or modify the line:"
9888
msgstr ""
9889
9890
#: serverguide/C/remote-administration.xml:122(para)
9891
msgid "PubkeyAuthentication yes"
9892
msgstr ""
9893
9894
#: serverguide/C/remote-administration.xml:125(para)
9895
msgid ""
9896
"In the <filename>/etc/ssh/sshd_config</filename> file, or if already "
9897
"present, ensure the line is not commented out."
9898
msgstr ""
9899
9900
#: serverguide/C/remote-administration.xml:131(para)
9901
msgid ""
9902
"To make your OpenSSH server display the contents of the "
9903
"<filename>/etc/issue.net</filename> file as a pre-login banner, simply add "
9904
"or modify the line:"
9905
msgstr ""
9906
9907
#: serverguide/C/remote-administration.xml:136(para)
9908
msgid "Banner /etc/issue.net"
9909
msgstr ""
9910
9911
#: serverguide/C/remote-administration.xml:139(para)
9912
msgid "In the <filename>/etc/ssh/sshd_config</filename> file."
9913
msgstr ""
9914
9915
#: serverguide/C/remote-administration.xml:144(para)
9916
msgid ""
9917
"After making changes to the <filename>/etc/ssh/sshd_config</filename> file, "
9918
"save the file, and restart the <application>sshd</application> server "
9919
"application to effect the changes using the following command at a terminal "
9920
"prompt:"
9921
msgstr ""
9922
9923
#: serverguide/C/remote-administration.xml:153(para)
9924
msgid ""
9925
"Many other configuration directives for <application>sshd</application> are "
9926
"available for changing the server application's behavior to fit your needs. "
9927
"Be advised, however, if your only method of access to a server is "
9928
"<application>ssh</application>, and you make a mistake in configuring "
9929
"<application>sshd</application> via the "
9930
"<filename>/etc/ssh/sshd_config</filename> file, you may find you are locked "
9931
"out of the server upon restarting it, or that the "
9932
"<application>sshd</application> server refuses to start due to an incorrect "
9933
"configuration directive, so be extra careful when editing this file on a "
9934
"remote server."
9935
msgstr ""
9936
9937
#: serverguide/C/remote-administration.xml:168(title)
9938
msgid "SSH Keys"
9939
msgstr ""
9940
9941
#: serverguide/C/remote-administration.xml:169(para)
9942
msgid ""
9943
"SSH <emphasis>keys</emphasis> allow authentication between two hosts without "
9944
"the need of a password. SSH key authentication uses two keys a "
9945
"<emphasis>private</emphasis> key and a <emphasis>public</emphasis> key."
9946
msgstr ""
9947
9948
#: serverguide/C/remote-administration.xml:173(para)
9949
msgid "To generate the keys, from a terminal prompt enter:"
9950
msgstr ""
9951
9952
#: serverguide/C/remote-administration.xml:177(command)
9953
msgid "ssh-keygen -t dsa"
9954
msgstr ""
9955
9956
#: serverguide/C/remote-administration.xml:179(para)
9957
msgid ""
9958
"This will generate the keys using a <emphasis>DSA</emphasis> authentication "
9959
"identity of the user. During the process you will be prompted for a "
9960
"password. Simply hit <emphasis>Enter</emphasis> when prompted to create the "
9961
"key."
9962
msgstr ""
9963
9964
#: serverguide/C/remote-administration.xml:183(para)
9965
msgid ""
9966
"By default the <emphasis>public</emphasis> key is saved in the file "
9967
"<filename>~/.ssh/id_dsa.pub</filename>, while "
9968
"<filename>~/.ssh/id_dsa</filename> is the <emphasis>private</emphasis> key. "
9969
"Now copy the <filename>id_dsa.pub</filename> file to the remote host and "
9970
"append it to <filename>~/.ssh/authorized_keys</filename> by entering:"
9971
msgstr ""
9972
9973
#: serverguide/C/remote-administration.xml:189(command)
9974
msgid "ssh-copy-id username@remotehost"
9975
msgstr ""
9976
9977
#: serverguide/C/remote-administration.xml:191(para)
9978
msgid ""
9979
"Finally, double check the permissions on the "
9980
"<filename>authorized_keys</filename> file, only the authenticated user "
9981
"should have read and write permissions. If the permissions are not correct "
9982
"change them by:"
9983
msgstr ""
9984
9985
#: serverguide/C/remote-administration.xml:196(command)
9986
msgid "chmod 600 .ssh/authorized_keys"
9987
msgstr ""
9988
9989
#: serverguide/C/remote-administration.xml:198(para)
9990
msgid ""
9991
"You should now be able to SSH to the host without being prompted for a "
9992
"password."
9993
msgstr ""
9994
9995
#: serverguide/C/remote-administration.xml:207(para)
9996
msgid ""
9997
"<ulink url=\"https://help.ubuntu.com/community/SSH\">Ubuntu Wiki SSH</ulink> "
9998
"page."
9999
msgstr ""
10000
10001
#: serverguide/C/remote-administration.xml:213(ulink)
10002
msgid "OpenSSH Website"
10003
msgstr ""
10004
10005
#: serverguide/C/remote-administration.xml:218(ulink)
10006
msgid "Advanced OpenSSH Wiki Page"
10007
msgstr ""
10008
10009
#: serverguide/C/remote-administration.xml:226(title)
10010
msgid "eBox"
10011
msgstr ""
10012
10013
#: serverguide/C/remote-administration.xml:227(para)
10014
msgid ""
10015
"<application>eBox</application> is a web framework used to manage server "
10016
"application configuration. The modular design of eBox allows you to pick and "
10017
"choose which services you want to configure using eBox."
10018
msgstr ""
10019
10020
#: serverguide/C/remote-administration.xml:234(para)
10021
msgid ""
10022
"The different <application>eBox</application> modules are split into "
10023
"different packages, allowing you to only install those necessary. One way to "
10024
"view the available packages is to enter the following from a terminal:"
10025
msgstr ""
10026
10027
#: serverguide/C/remote-administration.xml:240(command)
10028
msgid "apt-cache rdepends ebox | uniq"
10029
msgstr ""
10030
10031
#: serverguide/C/remote-administration.xml:242(para)
10032
msgid ""
10033
"To install the <application>ebox</application> package, which contains the "
10034
"default modules, enter the following:"
10035
msgstr ""
10036
10037
#: serverguide/C/remote-administration.xml:247(command)
10038
msgid "sudo apt-get install ebox"
10039
msgstr ""
10040
10041
#: serverguide/C/remote-administration.xml:250(para)
10042
msgid ""
10043
"During the installation you will be asked to supply a password for the ebox "
10044
"user. After installing eBox the web interface can be accessed from: "
10045
"<emphasis>https://yourserver/ebox</emphasis>."
10046
msgstr ""
10047
10048
#: serverguide/C/remote-administration.xml:259(para)
10049
msgid ""
10050
"An important thing to remember when using <application>eBox</application> is "
10051
"that when configuring most modules there is a <emphasis>Change</emphasis> "
10052
"button that implements the new configuration. After clicking the Change "
10053
"button most, but not all, modules will then need to be "
10054
"<emphasis>Saved</emphasis>. To save the new configuration click on the "
10055
"<quote>Save changes</quote> link in the top right hand corner."
10056
msgstr ""
10057
10058
#: serverguide/C/remote-administration.xml:267(para)
10059
msgid ""
10060
"Once you make a change that requires a Save, the link will change from green "
10061
"to red."
10062
msgstr ""
10063
10064
#: serverguide/C/remote-administration.xml:273(title)
10065
msgid "eBox Modules"
10066
msgstr ""
10067
10068
#: serverguide/C/remote-administration.xml:274(para)
10069
msgid ""
10070
"By default all eBox <emphasis>Modules</emphasis> are not enabled, and when a "
10071
"new module is installed it will not be automatically enabled."
10072
msgstr ""
10073
10074
#: serverguide/C/remote-administration.xml:278(para)
10075
msgid ""
10076
"To enable a disabled module click on the <emphasis>Module status</emphasis> "
10077
"link in the left hand menu. Then <emphasis role=\"italic\">check</emphasis> "
10078
"which modules you would like to enable and click the <quote>Save</quote> "
10079
"link."
10080
msgstr ""
10081
10082
#: serverguide/C/remote-administration.xml:284(title)
10083
msgid "Default Modules"
10084
msgstr ""
10085
10086
#: serverguide/C/remote-administration.xml:285(para)
10087
msgid ""
10088
"This section provides a quick summary of the default "
10089
"<application>eBox</application> modules."
10090
msgstr ""
10091
10092
#: serverguide/C/remote-administration.xml:291(para)
10093
msgid ""
10094
"<emphasis>System:</emphasis> contains options allowing configuration of "
10095
"general eBox items."
10096
msgstr ""
10097
10098
#: serverguide/C/remote-administration.xml:297(para)
10099
msgid ""
10100
"<emphasis>General:</emphasis> allows you to set the language, port number, "
10101
"and contains a change password form."
10102
msgstr ""
10103
10104
#: serverguide/C/remote-administration.xml:303(para)
10105
msgid ""
10106
"<emphasis>Disk Usage:</emphasis> displays a graph detailing information "
10107
"about disk usage."
10108
msgstr ""
10109
10110
#: serverguide/C/remote-administration.xml:309(para)
10111
msgid ""
10112
"<emphasis>Backup:</emphasis> is used to backup "
10113
"<application>eBox</application> configuration information, and the "
10114
"<emphasis>Full Backup</emphasis> option allows you to save all eBox "
10115
"information not included in the <emphasis>Configuration</emphasis> option "
10116
"such as log files."
10117
msgstr ""
10118
10119
#: serverguide/C/remote-administration.xml:317(para)
10120
msgid ""
10121
"<emphasis>Halt/Reboot:</emphasis> will shutdown the system or reboot it."
10122
msgstr ""
10123
10124
#: serverguide/C/remote-administration.xml:322(para)
10125
msgid ""
10126
"<emphasis>Bug Report:</emphasis> creates a file containing details helpful "
10127
"when reporting bugs to the eBox developers."
10128
msgstr ""
10129
10130
#: serverguide/C/remote-administration.xml:330(para)
10131
msgid ""
10132
"<emphasis>Logs:</emphasis> allows <application>eBox</application> logs to be "
10133
"queried depending on the purge time configured."
10134
msgstr ""
10135
10136
#: serverguide/C/remote-administration.xml:336(para)
10137
msgid ""
10138
"<emphasis>Events:</emphasis> this module has the ability to send alerts "
10139
"through rss, jabber, and log file."
10140
msgstr ""
10141
10142
#: serverguide/C/remote-administration.xml:343(emphasis)
10143
msgid "Available Events:"
10144
msgstr ""
10145
10146
#: serverguide/C/remote-administration.xml:347(para)
10147
msgid ""
10148
"<emphasis>Free Storage Space:</emphasis> will send alert if free disk space "
10149
"drops below a configured percentage, 10% by default."
10150
msgstr ""
10151
10152
#: serverguide/C/remote-administration.xml:353(para)
10153
msgid ""
10154
"<emphasis>Log Observer:</emphasis> sends an alert when a configured logger "
10155
"has logged something."
10156
msgstr ""
10157
10158
#: serverguide/C/remote-administration.xml:359(para)
10159
msgid ""
10160
"<emphasis>RAID:</emphasis> will monitor the RAID system and send alerts if "
10161
"any issues arise."
10162
msgstr ""
10163
10164
#: serverguide/C/remote-administration.xml:365(para)
10165
msgid ""
10166
"<emphasis>Service:</emphasis> sends alerts if a service restarts multiple "
10167
"times in a short time period."
10168
msgstr ""
10169
10170
#: serverguide/C/remote-administration.xml:371(para)
10171
msgid ""
10172
"<emphasis>State:</emphasis> alerts on the state of "
10173
"<application>eBox</application>, either up or down."
10174
msgstr ""
10175
10176
#: serverguide/C/remote-administration.xml:380(emphasis)
10177
msgid "Dispatchers:"
10178
msgstr ""
10179
10180
#: serverguide/C/remote-administration.xml:384(para)
10181
msgid ""
10182
"<emphasis>Log:</emphasis> this dispatcher will send event messages to the "
10183
"<application>eBox</application> log file "
10184
"<filename>/var/log/ebox/ebox.log</filename>."
10185
msgstr ""
10186
10187
#: serverguide/C/remote-administration.xml:391(para)
10188
msgid ""
10189
"<emphasis>Jabber:</emphasis> before enabling this dispatcher you must first "
10190
"configure it by clicking on the <quote>Configure</quote> icon."
10191
msgstr ""
10192
10193
#: serverguide/C/remote-administration.xml:397(para)
10194
msgid ""
10195
"<emphasis>RSS:</emphasis> once this dispatcher is configured you can "
10196
"subscribe to the link in order to view event alerts."
10197
msgstr ""
10198
10199
#: serverguide/C/remote-administration.xml:410(title)
10200
msgid "Additional Modules"
10201
msgstr ""
10202
10203
#: serverguide/C/remote-administration.xml:411(para)
10204
msgid ""
10205
"Here is a quick description of other available "
10206
"<application>eBox</application> modules:"
10207
msgstr ""
10208
10209
#: serverguide/C/remote-administration.xml:416(para)
10210
msgid ""
10211
"<emphasis>Network:</emphasis> allows configuration of the server's network "
10212
"options through eBox."
10213
msgstr ""
10214
10215
#: serverguide/C/remote-administration.xml:422(para)
10216
msgid ""
10217
"<emphasis>Firewall:</emphasis> configures firewall options for the eBox host."
10218
msgstr ""
10219
10220
#: serverguide/C/remote-administration.xml:427(para)
10221
msgid ""
10222
"<emphasis>UsersandGroups:</emphasis> this module will manage users and "
10223
"groups contained in an <application>OpenLDAP</application> LDAP directory."
10224
msgstr ""
10225
10226
#: serverguide/C/remote-administration.xml:433(para)
10227
msgid ""
10228
"<emphasis>DHCP:</emphasis> provides an interface for configuring a DHCP "
10229
"server."
10230
msgstr ""
10231
10232
#: serverguide/C/remote-administration.xml:438(para)
10233
msgid ""
10234
"<emphasis>DNS:</emphasis> provides <application>BIND9</application> DNS "
10235
"server configuration options."
10236
msgstr ""
10237
10238
#: serverguide/C/remote-administration.xml:444(para)
10239
msgid ""
10240
"<emphasis>Objects:</emphasis> allow configuration of eBox <emphasis>Network "
10241
"Objects</emphasis>, which allow you to assign a name to an IP address or "
10242
"group of IPs."
10243
msgstr ""
10244
10245
#: serverguide/C/remote-administration.xml:451(para)
10246
msgid ""
10247
"<emphasis>Services:</emphasis> displays configuration information for "
10248
"services that are available to the network."
10249
msgstr ""
10250
10251
#: serverguide/C/remote-administration.xml:457(para)
10252
msgid ""
10253
"<emphasis>Squid:</emphasis> configuration options for the "
10254
"<application>Squid</application> proxy server."
10255
msgstr ""
10256
10257
#: serverguide/C/remote-administration.xml:463(para)
10258
msgid ""
10259
"<emphasis>CA:</emphasis> configures a Certificate Authority for the server."
10260
msgstr ""
10261
10262
#: serverguide/C/remote-administration.xml:468(para)
10263
msgid "<emphasis>NTP:</emphasis> set Network Time Protocol options."
10264
msgstr ""
10265
10266
#: serverguide/C/remote-administration.xml:473(para)
10267
msgid "<emphasis>Printers:</emphasis> allows the configuration of printers."
10268
msgstr ""
10269
10270
#: serverguide/C/remote-administration.xml:478(para)
10271
msgid "<emphasis>Samba:</emphasis> configuration options for Samba."
10272
msgstr ""
10273
10274
#: serverguide/C/remote-administration.xml:483(para)
10275
msgid ""
10276
"<emphasis>OpenVPN:</emphasis> setup options for OpenVPN Virtual Private "
10277
"Network application."
10278
msgstr ""
10279
10280
#: serverguide/C/remote-administration.xml:494(para)
10281
msgid ""
10282
"The <ulink url=\"https://help.ubuntu.com/community/eBox\">eBox Ubuntu "
10283
"Wiki</ulink> page has more details."
10284
msgstr ""
10285
10286
#: serverguide/C/remote-administration.xml:499(para)
10287
msgid ""
10288
"For more information also see the <ulink url=\"http://ebox-"
10289
"platform.com/\">eBox Home Page</ulink>."
10290
msgstr ""
10291
10292
#: serverguide/C/package-management.xml:13(title)
10293
msgid "Package Management"
10294
msgstr ""
10295
10296
#: serverguide/C/package-management.xml:14(para)
10297
msgid ""
10298
"Ubuntu features a comprehensive package management system for the "
10299
"installation, upgrade, configuration, and removal of software. In addition "
10300
"to providing access to an organized base of over 24,000 software packages "
10301
"for your Ubuntu computer, the package management facilities also feature "
10302
"dependency resolution capabilities and software update checking."
10303
msgstr ""
10304
10305
#: serverguide/C/package-management.xml:16(para)
10306
msgid ""
10307
"Several tools are available for interacting with Ubuntu's package management "
10308
"system, from simple command-line utilities which may be easily automated by "
10309
"system administrators, to a simple graphical interface which is easy to use "
10310
"by those new to Ubuntu."
10311
msgstr ""
10312
10313
#: serverguide/C/package-management.xml:21(para)
10314
msgid ""
10315
"Ubuntu's package management system is derived from the same system used by "
10316
"the Debian GNU/Linux distribution. The package files contain all of the "
10317
"necessary files, meta-data, and instructions to implement a particular "
10318
"functionality or software application on your Ubuntu computer."
10319
msgstr ""
10320
10321
#: serverguide/C/package-management.xml:24(para)
10322
msgid ""
10323
"Debian package files typically have the extension '.deb', and typically "
10324
"exist in <emphasis role=\"italics\">repositories</emphasis> which are "
10325
"collections of packages found on various media, such as CD-ROM discs, or "
10326
"online. Packages are normally of the pre-compiled binary format; thus "
10327
"installation is quick and requires no compiling of software."
10328
msgstr ""
10329
10330
#: serverguide/C/package-management.xml:27(para)
10331
msgid ""
10332
"Many complex packages use the concept of <emphasis "
10333
"role=\"italics\">dependencies</emphasis>. Dependencies are additional "
10334
"packages required by the principal package in order to function properly. "
10335
"For example, the speech synthesis package "
10336
"<application>Festival</application> depends upon the package "
10337
"<application>libasound2</application>, which is a package supplying the "
10338
"<application>ALSA</application> sound library needed for audio playback. In "
10339
"order for <application>Festival</application> to function, it and all of its "
10340
"dependencies must be installed. The software management tools in Ubuntu will "
10341
"do this automatically."
10342
msgstr ""
10343
10344
#: serverguide/C/package-management.xml:32(title)
10345
msgid "dpkg"
10346
msgstr ""
10347
10348
#: serverguide/C/package-management.xml:34(para)
10349
msgid ""
10350
"<application>dpkg</application> is a package manager for "
10351
"<emphasis>Debian</emphasis> based systems. It can install, remove, and build "
10352
"packages, but unlike other package management system's it can not "
10353
"automatically download and install packages and their dependencies. This "
10354
"section covers using <application>dpkg</application> to manage locally "
10355
"installed packages:"
10356
msgstr ""
10357
10358
#: serverguide/C/package-management.xml:43(para)
10359
msgid ""
10360
"To list all packages installed on the system, from a terminal prompt enter:"
10361
msgstr ""
10362
10363
#: serverguide/C/package-management.xml:48(command)
10364
msgid "dpkg -l"
10365
msgstr ""
10366
10367
#: serverguide/C/package-management.xml:54(para)
10368
msgid ""
10369
"Depending on the amount of packages on your system, this can generate a "
10370
"large amount of output. Pipe the output through "
10371
"<application>grep</application> to see if a specific package is installed:"
10372
msgstr ""
10373
10374
#: serverguide/C/package-management.xml:60(command)
10375
msgid "dpkg -l | grep apache2"
10376
msgstr ""
10377
10378
#: serverguide/C/package-management.xml:63(para)
10379
msgid ""
10380
"Replace <emphasis>apache2</emphasis> with any package name, part of a "
10381
"package name, or other regular expression."
10382
msgstr ""
10383
10384
#: serverguide/C/package-management.xml:70(para)
10385
msgid ""
10386
"To list the files installed by a package, in this case the "
10387
"<application>ufw</application> package, enter:"
10388
msgstr ""
10389
10390
#: serverguide/C/package-management.xml:75(command)
10391
msgid "dpkg -L ufw"
10392
msgstr ""
10393
10394
#: serverguide/C/package-management.xml:81(para)
10395
msgid ""
10396
"If you are not sure which package installed a file, <application>dpkg -"
10397
"S</application> may be able to tell you. For example:"
10398
msgstr ""
10399
10400
#: serverguide/C/package-management.xml:87(command)
10401
msgid "dpkg -S /etc/host.conf"
10402
msgstr ""
10403
10404
#: serverguide/C/package-management.xml:88(computeroutput)
10405
#, no-wrap
10406
msgid "base-files: /etc/host.conf"
10407
msgstr ""
10408
10409
#: serverguide/C/package-management.xml:91(para)
10410
msgid ""
10411
"The output shows that the <filename>/etc/host.conf</filename> belongs to the "
10412
"<application>base-files</application> package."
10413
msgstr ""
10414
10415
#: serverguide/C/package-management.xml:96(para)
10416
msgid ""
10417
"Many files are automatically generated during the package install process, "
10418
"and even though they are on the filesystem <command>dpkg -S</command> may "
10419
"not know which package they belong to."
10420
msgstr ""
10421
10422
#: serverguide/C/package-management.xml:105(para)
10423
msgid "You can install a local <emphasis>.deb</emphasis> file by entering:"
10424
msgstr ""
10425
10426
#: serverguide/C/package-management.xml:110(command)
10427
msgid "sudo dpkg -i zip_2.32-1_i386.deb"
10428
msgstr ""
10429
10430
#: serverguide/C/package-management.xml:113(para)
10431
msgid ""
10432
"Change <filename>zip_2.32-1_i386.deb</filename> to the actual file name of "
10433
"the local .deb file."
10434
msgstr ""
10435
10436
#: serverguide/C/package-management.xml:120(para)
10437
msgid "Uninstalling a package can be accomplished by:"
10438
msgstr ""
10439
10440
#: serverguide/C/package-management.xml:125(command)
10441
msgid "sudo dpkg -r zip"
10442
msgstr ""
10443
10444
#: serverguide/C/package-management.xml:129(para)
10445
msgid ""
10446
"Uninstalling packages using <application>dpkg</application>, in most cases, "
10447
"is <emphasis>NOT</emphasis> recommended. It is better to use a package "
10448
"manager that handles dependencies, to ensure that the system is in a "
10449
"consistent state. For example using <command>dpkg -r</command> you can "
10450
"remove the <application>zip</application> package, but any packages that "
10451
"depend on it will still be installed and may no longer function correctly."
10452
msgstr ""
10453
10454
#: serverguide/C/package-management.xml:140(para)
10455
msgid ""
10456
"For more <application>dpkg</application> options see the man page: "
10457
"<command>man dpkg</command>."
10458
msgstr ""
10459
10460
#: serverguide/C/package-management.xml:146(title)
10461
msgid "Apt-Get"
10462
msgstr ""
10463
10464
#: serverguide/C/package-management.xml:147(para)
10465
msgid ""
10466
"The <application>apt-get</application> command is a powerful command-line "
10467
"tool used to work with Ubuntu's <emphasis>Advanced Packaging Tool</emphasis> "
10468
"(APT) performing such functions as installation of new software packages, "
10469
"upgrade of existing software packages, updating of the package list index, "
10470
"and even upgrading the entire Ubuntu system."
10471
msgstr ""
10472
10473
#: serverguide/C/package-management.xml:150(para)
10474
msgid ""
10475
"Being a simple command-line tool, <application>apt-get</application> has "
10476
"numerous advantages over other package management tools available in Ubuntu "
10477
"for server administrators. Some of these advantages include ease of use over "
10478
"simple terminal connections (SSH) and the ability to be used in system "
10479
"administration scripts, which can in turn be automated by the "
10480
"<application>cron</application> scheduling utility."
10481
msgstr ""
10482
10483
#: serverguide/C/package-management.xml:157(para)
10484
msgid ""
10485
"<emphasis role=\"bold\">Install a Package</emphasis>: Installation of "
10486
"packages using the <application>apt-get</application> tool is quite simple. "
10487
"For example, to install the network scanner <emphasis "
10488
"role=\"italics\">nmap</emphasis>, type the following: <screen>\n"
10489
"<command>sudo apt-get install nmap</command>\n"
10490
"</screen>"
10491
msgstr ""
10492
10493
#: serverguide/C/package-management.xml:165(para)
10494
msgid ""
10495
"<emphasis role=\"bold\">Remove a Package</emphasis>: Removal of a package or "
10496
"packages is also a straightforward and simple process. To remove the nmap "
10497
"package installed in the previous example, type the following: <screen>\n"
10498
"<command>sudo apt-get remove nmap</command>\n"
10499
"</screen>"
10500
msgstr ""
10501
10502
#: serverguide/C/package-management.xml:172(para)
10503
msgid ""
10504
"<emphasis role=\"bold\">Multiple Packages</emphasis>: You may specify "
10505
"multiple packages to be installed or removed, separated by spaces."
10506
msgstr ""
10507
10508
#: serverguide/C/package-management.xml:175(para)
10509
msgid ""
10510
"Also, adding the <emphasis>--purge</emphasis> options to <command>apt-get "
10511
"remove</command> will remove the package configuration files as well. This "
10512
"may or may not be the desired effect so use with caution."
10513
msgstr ""
10514
10515
#: serverguide/C/package-management.xml:181(para)
10516
msgid ""
10517
"<emphasis role=\"bold\">Update the Package Index</emphasis>: The APT package "
10518
"index is essentially a database of available packages from the repositories "
10519
"defined in the <filename>/etc/apt/sources.list</filename> file. To update "
10520
"the local package index with the latest changes made in repositories, type "
10521
"the following: <screen>\n"
10522
"<command>sudo apt-get update</command>\n"
10523
"</screen>"
10524
msgstr ""
10525
10526
#: serverguide/C/package-management.xml:189(para)
10527
msgid ""
10528
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: Over time, updated "
10529
"versions of packages currently installed on your computer may become "
10530
"available from the package repositories (for example security updates). To "
10531
"upgrade your system, first update your package index as outlined above, and "
10532
"then type: <screen>\n"
10533
"<command>sudo apt-get upgrade</command>\n"
10534
"</screen>"
10535
msgstr ""
10536
10537
#: serverguide/C/package-management.xml:195(para)
10538
msgid ""
10539
"For information on upgrading to a new Ubuntu release see <xref "
10540
"linkend=\"installing-upgrading\"/>."
10541
msgstr ""
10542
10543
#: serverguide/C/package-management.xml:153(para)
10544
msgid ""
10545
"Some examples of popular uses for the <application>apt-get</application> "
10546
"utility: <placeholder-1/>"
10547
msgstr ""
10548
10549
#: serverguide/C/package-management.xml:201(para)
10550
msgid ""
10551
"Actions of the <application>apt-get</application> command, such as "
10552
"installation and removal of packages, are logged in the /var/log/dpkg.log "
10553
"log file."
10554
msgstr ""
10555
10556
#: serverguide/C/package-management.xml:204(para)
10557
msgid ""
10558
"For further information about the use of <application>APT</application>, "
10559
"read the comprehensive <ulink url=\"http://www.debian.org/doc/user-"
10560
"manuals#apt-howto\">Debian APT User Manual</ulink> or type: <screen>apt-get "
10561
"help</screen>"
10562
msgstr ""
10563
10564
#: serverguide/C/package-management.xml:208(title)
10565
msgid "Aptitude"
10566
msgstr ""
10567
10568
#: serverguide/C/package-management.xml:209(para)
10569
msgid ""
10570
"<application>Aptitude</application> is a menu-driven, text-based front-end "
10571
"to the <emphasis>Advanced Packaging Tool</emphasis> (APT) system. Many of "
10572
"the common package management functions, such as installation, removal, and "
10573
"upgrade, are performed in <application>Aptitude</application> with single-"
10574
"key commands, which are typically lowercase letters."
10575
msgstr ""
10576
10577
#: serverguide/C/package-management.xml:212(para)
10578
msgid ""
10579
"<application>Aptitude</application> is best suited for use in a non-"
10580
"graphical terminal environment to ensure proper functioning of the command "
10581
"keys. You may start <application>Aptitude</application> as a normal user "
10582
"with the following command at a terminal prompt: <screen>\n"
10583
"<command>sudo aptitude</command>\n"
10584
"</screen>"
10585
msgstr ""
10586
10587
#: serverguide/C/package-management.xml:219(para)
10588
msgid ""
10589
"When <application>Aptitude</application> starts, you will see a menu bar at "
10590
"the top of the screen and two panes below the menu bar. The top pane "
10591
"contains package categories, such as <emphasis role=\"italics\">New "
10592
"Packages</emphasis> and <emphasis role=\"italics\">Not Installed "
10593
"Packages</emphasis>. The bottom pane contains information related to the "
10594
"packages and package categories."
10595
msgstr ""
10596
10597
#: serverguide/C/package-management.xml:222(para)
10598
msgid ""
10599
"Using <application>Aptitude</application> for package management is "
10600
"relatively straightforward, and the user interface makes common tasks simple "
10601
"to perform. The following are examples of common package management "
10602
"functions as performed in <application>Aptitude</application>:"
10603
msgstr ""
10604
10605
#: serverguide/C/package-management.xml:226(para)
10606
msgid ""
10607
"<emphasis role=\"bold\">Install Packages</emphasis>: To install a package, "
10608
"locate the package via the Not Installed Packages package category, for "
10609
"example, by using the keyboard arrow keys and the <keycap>ENTER</keycap> "
10610
"key, and highlight the package you wish to install. After highlighting the "
10611
"package you wish to install, press the <keycap>+</keycap> key, and the "
10612
"package entry should turn <emphasis role=\"italics\">green</emphasis>, "
10613
"indicating it has been marked for installation. Now press <keycap>g</keycap> "
10614
"to be presented with a summary of package actions. Press <keycap>g</keycap> "
10615
"again, and you will be prompted to become root to complete the installation. "
10616
"Press <keycap>ENTER</keycap> which will result in a Password: prompt. Enter "
10617
"your user password to become root. Finally, press <keycap>g</keycap> once "
10618
"more and you'll be prompted to download the package. Press "
10619
"<keycap>ENTER</keycap> on the <emphasis role=\"italics\">Continue</emphasis> "
10620
"prompt, and downloading and installation of the package will commence."
10621
msgstr ""
10622
10623
#: serverguide/C/package-management.xml:230(para)
10624
msgid ""
10625
"<emphasis role=\"bold\">Remove Packages</emphasis>: To remove a package, "
10626
"locate the package via the Installed Packages package category, for example, "
10627
"by using the keyboard arrow keys and the <keycap>ENTER</keycap> key, and "
10628
"highlight the package you wish to remove. After highlighting the package you "
10629
"wish to install, press the <keycap>-</keycap> key, and the package entry "
10630
"should turn <emphasis role=\"italics\">pink</emphasis>, indicating it has "
10631
"been marked for removal. Now press <keycap>g</keycap> to be presented with a "
10632
"summary of package actions. Press <keycap>g</keycap> again, and you will be "
10633
"prompted to become root to complete the installation. Press "
10634
"<keycap>ENTER</keycap> which will result in a Password: prompt. Enter your "
10635
"user password to become root. Finally, press <keycap>g</keycap> once more, "
10636
"and you'll be prompted to download the package. Press <keycap>ENTER</keycap> "
10637
"on the <emphasis role=\"italics\">Continue</emphasis> prompt, and removal of "
10638
"the package will commence."
10639
msgstr ""
10640
10641
#: serverguide/C/package-management.xml:234(para)
10642
msgid ""
10643
"<emphasis role=\"bold\">Update Package Index</emphasis>: To update the "
10644
"package index, simply press the <keycap>u</keycap> key and you will be "
10645
"prompted to become root to complete the update. Press <keycap>ENTER</keycap> "
10646
"which will result in a Password: prompt. Enter your user password to become "
10647
"root. Updating of the package index will commence. Press "
10648
"<keycap>ENTER</keycap> on the OK prompt when the download dialog is "
10649
"presented to complete the process."
10650
msgstr ""
10651
10652
#: serverguide/C/package-management.xml:238(para)
10653
msgid ""
10654
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: To upgrade packages, "
10655
"perform the update of the package index as detailed above, and then press "
10656
"the <keycap>U</keycap> key to mark all packages with updates. Now press "
10657
"<keycap>g</keycap> whereby you'll be presented with a summary of package "
10658
"actions. Press <keycap>g</keycap> again, and you will be prompted to become "
10659
"root to complete the installation. Press <keycap>ENTER</keycap> which will "
10660
"result in a Password: prompt. Enter your user password to become root. "
10661
"Finally, press <keycap>g</keycap> once more, and you'll be prompted to "
10662
"download the packages. Press <keycap>ENTER</keycap> on the <emphasis "
10663
"role=\"italics\">Continue</emphasis> prompt, and upgrade of the packages "
10664
"will commence."
10665
msgstr ""
10666
10667
#: serverguide/C/package-management.xml:245(para)
10668
msgid "<emphasis role=\"bold\">i</emphasis>: Installed package"
10669
msgstr ""
10670
10671
#: serverguide/C/package-management.xml:250(para)
10672
msgid ""
10673
"<emphasis role=\"bold\">c</emphasis>: Package not installed, but package "
10674
"configuration remains on system"
10675
msgstr ""
10676
10677
#: serverguide/C/package-management.xml:254(para)
10678
msgid "<emphasis role=\"bold\">p</emphasis>: Purged from system"
10679
msgstr ""
10680
10681
#: serverguide/C/package-management.xml:258(para)
10682
msgid "<emphasis role=\"bold\">v</emphasis>: Virtual package"
10683
msgstr ""
10684
10685
#: serverguide/C/package-management.xml:262(para)
10686
msgid "<emphasis role=\"bold\">B</emphasis>: Broken package"
10687
msgstr ""
10688
10689
#: serverguide/C/package-management.xml:266(para)
10690
msgid ""
10691
"<emphasis role=\"bold\">u</emphasis>: Unpacked files, but package not yet "
10692
"configured"
10693
msgstr ""
10694
10695
#: serverguide/C/package-management.xml:270(para)
10696
msgid ""
10697
"<emphasis role=\"bold\">C</emphasis>: Half-configured - Configuration failed "
10698
"and requires fix"
10699
msgstr ""
10700
10701
#: serverguide/C/package-management.xml:274(para)
10702
msgid ""
10703
"<emphasis role=\"bold\">H</emphasis>: Half-installed - Removal failed and "
10704
"requires fix"
10705
msgstr ""
10706
10707
#: serverguide/C/package-management.xml:242(para)
10708
msgid ""
10709
"The first column of information displayed in the package list in the top "
10710
"pane, when actually viewing packages lists the current state of the package, "
10711
"and uses the following key to describe the state of the package: "
10712
"<placeholder-1/>"
10713
msgstr ""
10714
10715
#: serverguide/C/package-management.xml:280(para)
10716
msgid ""
10717
"To exit Aptitude, simply press the <keycap>q</keycap> key and confirm you "
10718
"wish to exit. Many other functions are available from the Aptitude menu by "
10719
"pressing the <keycap>F10</keycap> key."
10720
msgstr ""
10721
10722
#: serverguide/C/package-management.xml:285(title)
10723
msgid "Automatic Updates"
10724
msgstr ""
10725
10726
#: serverguide/C/package-management.xml:287(para)
10727
msgid ""
10728
"The <application>unattended-upgrades</application> package can be used to "
10729
"automatically install updated packages, and can be configured to update all "
10730
"packages or just install security updates. First, install the package by "
10731
"entering the following in a terminal:"
10732
msgstr ""
10733
10734
#: serverguide/C/package-management.xml:293(command)
10735
msgid "sudo apt-get install unattended-upgrades"
10736
msgstr ""
10737
10738
#: serverguide/C/package-management.xml:296(para)
10739
msgid ""
10740
"To configure <application>unattended-upgrades</application>, edit "
10741
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> and adjust "
10742
"the following to fit your needs:"
10743
msgstr ""
10744
10745
#: serverguide/C/package-management.xml:301(programlisting)
10746
#, no-wrap
10747
msgid ""
10748
"\n"
10749
"Unattended-Upgrade::Allowed-Origins {\n"
10750
" \"Ubuntu lucid-security\";\n"
10751
"// \"Ubuntu lucid-updates\";\n"
10752
"};\n"
10753
msgstr ""
10754
10755
#: serverguide/C/package-management.xml:308(para)
10756
msgid ""
10757
"Certain packages can also be <emphasis>blacklisted</emphasis> and therefore "
10758
"will not be automatically updated. To blacklist a package, add it to the "
10759
"list:"
10760
msgstr ""
10761
10762
#: serverguide/C/package-management.xml:313(programlisting)
10763
#, no-wrap
10764
msgid ""
10765
"\n"
10766
"Unattended-Upgrade::Package-Blacklist {\n"
10767
"// \"vim\";\n"
10768
"// \"libc6\";\n"
10769
"// \"libc6-dev\";\n"
10770
"// \"libc6-i686\";\n"
10771
"};\n"
10772
msgstr ""
10773
10774
#: serverguide/C/package-management.xml:323(para)
10775
msgid ""
10776
"The double <emphasis><quote>//</quote></emphasis> serve as comments, so "
10777
"whatever follows \"//\" will not be evaluated."
10778
msgstr ""
10779
10780
#: serverguide/C/package-management.xml:328(para)
10781
msgid ""
10782
"To enable automatic updates, edit "
10783
"<filename>/etc/apt/apt.conf.d/10periodic</filename> and set the appropriate "
10784
"<application>apt</application> configuration options:"
10785
msgstr ""
10786
10787
#: serverguide/C/package-management.xml:332(programlisting)
10788
#, no-wrap
10789
msgid ""
10790
"\n"
10791
"APT::Periodic::Update-Package-Lists \"1\";\n"
10792
"APT::Periodic::Download-Upgradeable-Packages \"1\";\n"
10793
"APT::Periodic::AutocleanInterval \"7\";\n"
10794
"APT::Periodic::Unattended-Upgrade \"1\";\n"
10795
msgstr ""
10796
10797
#: serverguide/C/package-management.xml:339(para)
10798
msgid ""
10799
"The above configuration updates the package list, downloads, and installs "
10800
"available upgrades every day. The local download archive is cleaned every "
10801
"week."
10802
msgstr ""
10803
10804
#: serverguide/C/package-management.xml:345(para)
10805
msgid ""
10806
"You can read more about <application>apt</application> Periodic "
10807
"configuration options in the <filename>/etc/cron.daily/apt</filename> script "
10808
"header."
10809
msgstr ""
10810
10811
#: serverguide/C/package-management.xml:350(para)
10812
msgid ""
10813
"The results of <application>unattended-upgrades</application> will be logged "
10814
"to <filename>/var/log/unattended-upgrades</filename>."
10815
msgstr ""
10816
10817
#: serverguide/C/package-management.xml:355(title)
10818
msgid "Notifications"
10819
msgstr ""
10820
10821
#: serverguide/C/package-management.xml:357(para)
10822
msgid ""
10823
"Configuring <emphasis>Unattended-Upgrade::Mail</emphasis> in "
10824
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> will enable "
10825
"<application>unattended-upgrades</application> to email an administrator "
10826
"detailing any packages that need upgrading or have problems."
10827
msgstr ""
10828
10829
#: serverguide/C/package-management.xml:362(para)
10830
msgid ""
10831
"Another useful package is <application>apticron</application>. "
10832
"<application>apticron</application> will configure a "
10833
"<application>cron</application> job to email an administrator information "
10834
"about any packages on the system that have updates available, as well as a "
10835
"summary of changes in each package."
10836
msgstr ""
10837
10838
#: serverguide/C/package-management.xml:368(para)
10839
msgid ""
10840
"To install the <application>apticron</application> package, in a terminal "
10841
"enter:"
10842
msgstr ""
10843
10844
#: serverguide/C/package-management.xml:373(command)
10845
msgid "sudo apt-get install apticron"
10846
msgstr ""
10847
10848
#: serverguide/C/package-management.xml:376(para)
10849
msgid ""
10850
"Once the package is installed edit "
10851
"<filename>/etc/apticron/apticron.conf</filename>, to set the email address "
10852
"and other options:"
10853
msgstr ""
10854
10855
#: serverguide/C/package-management.xml:380(programlisting)
10856
#, no-wrap
10857
msgid ""
10858
"\n"
10859
"EMAIL=\"root@example.com\"\n"
10860
msgstr ""
10861
10862
#: serverguide/C/package-management.xml:389(para)
10863
msgid ""
10864
"Configuration of the <emphasis>Advanced Packaging Tool</emphasis> (APT) "
10865
"system repositories is stored in the /etc/apt/sources.list configuration "
10866
"file. An example of this file is referenced here, along with information on "
10867
"adding or removing repository references from the file."
10868
msgstr ""
10869
10870
#: serverguide/C/package-management.xml:395(para)
10871
msgid ""
10872
"<ulink url=\"../sample/sources.list\">Here</ulink> is a simple example of a "
10873
"typical <filename>/etc/apt/sources.list</filename> file."
10874
msgstr ""
10875
10876
#: serverguide/C/package-management.xml:399(para)
10877
msgid ""
10878
"You may edit the file to enable repositories or disable them. For example, "
10879
"to disable the requirement of inserting the Ubuntu CD-ROM whenever package "
10880
"operations occur, simply comment out the appropriate line for the CD-ROM, "
10881
"which appears at the top of the file:"
10882
msgstr ""
10883
10884
#: serverguide/C/package-management.xml:404(screen)
10885
#, no-wrap
10886
msgid ""
10887
"\n"
10888
"# no more prompting for CD-ROM please\n"
10889
"# deb cdrom:[Ubuntu 10.04_Lucid_Lynx - Release i386 (20070419.1)]/ lucid "
10890
"main restricted\n"
10891
msgstr ""
10892
10893
#: serverguide/C/package-management.xml:410(title)
10894
msgid "Extra Repositories"
10895
msgstr ""
10896
10897
#: serverguide/C/package-management.xml:411(para)
10898
msgid ""
10899
"In addition to the officially supported package repositories available for "
10900
"Ubuntu, there exist additional community-maintained repositories which add "
10901
"thousands more potential packages for installation. Two of the most popular "
10902
"are the <emphasis>Universe</emphasis> and <emphasis>Multiverse</emphasis> "
10903
"repositories. These repositories are not officially supported by Ubuntu, but "
10904
"because they are maintained by the community they generally provide packages "
10905
"which are safe for use with your Ubuntu computer."
10906
msgstr ""
10907
10908
#: serverguide/C/package-management.xml:414(para)
10909
msgid ""
10910
"Packages in the <emphasis>Multiverse</emphasis> repository often have "
10911
"licensing issues that prevent them from being distributed with a free "
10912
"operating system, and they may be illegal in your locality."
10913
msgstr ""
10914
10915
#: serverguide/C/package-management.xml:416(para)
10916
msgid ""
10917
"Be advised that neither the <emphasis>Universe</emphasis> or "
10918
"<emphasis>Multiverse</emphasis> repositories contain officially supported "
10919
"packages. In particular, there may not be security updates for these "
10920
"packages."
10921
msgstr ""
10922
10923
#: serverguide/C/package-management.xml:420(para)
10924
msgid ""
10925
"Many other package sources are available, sometimes even offering only one "
10926
"package, as in the case of package sources provided by the developer of a "
10927
"single application. You should always be very careful and cautious when "
10928
"using non-standard package sources, however. Research the source and "
10929
"packages carefully before performing any installation, as some package "
10930
"sources and their packages could render your system unstable or non-"
10931
"functional in some respects."
10932
msgstr ""
10933
10934
#: serverguide/C/package-management.xml:423(para)
10935
msgid ""
10936
"By default, the <emphasis>Universe</emphasis> and "
10937
"<emphasis>Multiverse</emphasis> repositories are enabled but if you would "
10938
"like to disable them edit <filename>/etc/apt/sources.list</filename> and "
10939
"comment the following lines:"
10940
msgstr ""
10941
10942
#: serverguide/C/package-management.xml:430(programlisting)
10943
#, no-wrap
10944
msgid ""
10945
"\n"
10946
"deb http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
10947
"deb-src http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
10948
"\n"
10949
"deb http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
10950
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
10951
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
10952
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
10953
"\n"
10954
"deb http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
10955
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
10956
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
10957
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
10958
"\n"
10959
"deb http://security.ubuntu.com/ubuntu lucid-security universe\n"
10960
"deb-src http://security.ubuntu.com/ubuntu lucid-security universe\n"
10961
"deb http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
10962
"deb-src http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
10963
msgstr ""
10964
10965
#: serverguide/C/package-management.xml:456(para)
10966
msgid ""
10967
"Most of the material covered in this chapter is available in "
10968
"<application>man</application> pages, many of which are available online."
10969
msgstr ""
10970
10971
#: serverguide/C/package-management.xml:463(para)
10972
msgid ""
10973
"The <ulink "
10974
"url=\"https://help.ubuntu.com/community/InstallingSoftware\">InstallingSoftwa"
10975
"re</ulink> Ubuntu wiki page has more information."
10976
msgstr ""
10977
10978
#: serverguide/C/package-management.xml:468(para)
10979
msgid ""
10980
"For more <application>dpkg</application> details see the <ulink "
10981
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/dpkg.1.html\">dpkg "
10982
"man page</ulink>."
10983
msgstr ""
10984
10985
#: serverguide/C/package-management.xml:474(para)
10986
msgid ""
10987
"The <ulink url=\"http://www.debian.org/doc/manuals/apt-howto/\">APT "
10988
"HOWTO</ulink> and <ulink "
10989
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/apt-get.8.html\">apt-"
10990
"get man page</ulink> contain useful information regarding <application>apt-"
10991
"get</application> usage."
10992
msgstr ""
10993
10994
#: serverguide/C/package-management.xml:481(para)
10995
msgid ""
10996
"See the <ulink "
10997
"url=\"http://manpages.ubuntu.com/manpages/lucid/man8/aptitude.8.html\">aptitu"
10998
"de man page</ulink> for more <application>aptitude</application> options."
10999
msgstr ""
11000
11001
#: serverguide/C/package-management.xml:487(para)
11002
msgid ""
11003
"The <ulink "
11004
"url=\"https://help.ubuntu.com/community/Repositories/Ubuntu\">Adding "
11005
"Repositories HOWTO (Ubuntu Wiki)</ulink> page contains more details on "
11006
"adding repositories."
11007
msgstr ""
11008
11009
#: serverguide/C/other-apps.xml:13(title)
11010
msgid "Other Useful Applications"
11011
msgstr ""
11012
11013
#: serverguide/C/other-apps.xml:15(para)
11014
msgid ""
11015
"There are many very useful applications developed by the Ubuntu Server Team, "
11016
"and others that are well integrated with Ubuntu Server Edition, that might "
11017
"not be well known. This chapter will showcase some useful applications that "
11018
"can make administering an Ubuntu server, or many Ubuntu servers, that much "
11019
"easier."
11020
msgstr ""
11021
11022
#: serverguide/C/other-apps.xml:23(title)
11023
msgid "pam_motd"
11024
msgstr ""
11025
11026
#: serverguide/C/other-apps.xml:25(para)
11027
msgid ""
11028
"When logging into an Ubuntu server you may have noticed the informative "
11029
"Message Of The Day (MOTD). This information is obtained and displayed using "
11030
"a couple of packages:"
11031
msgstr ""
11032
11033
#: serverguide/C/other-apps.xml:32(para)
11034
msgid ""
11035
"<emphasis>landscape-common:</emphasis> provides the core libraries of "
11036
"<application>landscape-client</application>, which can be used to manage "
11037
"systems using the web based <emphasis>Landscape</emphasis> application. The "
11038
"package includes the <application>/usr/bin/landscape-sysinfo</application> "
11039
"utility which is used to gather the information displayed in the MOTD."
11040
msgstr ""
11041
11042
#: serverguide/C/other-apps.xml:40(para)
11043
msgid ""
11044
"<emphasis>update-notifier-common:</emphasis> is used to automatically update "
11045
"the MOTD via <application>pam_motd</application> module."
11046
msgstr ""
11047
11048
#: serverguide/C/other-apps.xml:46(para)
11049
msgid ""
11050
"<application>pam_motd</application> executes the scripts in "
11051
"<filename>/etc/update-motd.d</filename> in order based on the number "
11052
"prepended to the script. The output of the scripts is written to "
11053
"<filename>/var/run/motd</filename>, keeping the numerical order, then "
11054
"concatenated with <filename>/etc/motd.tail</filename>."
11055
msgstr ""
11056
11057
#: serverguide/C/other-apps.xml:52(para)
11058
msgid ""
11059
"You can add your own dynamic information to the MOTD. For example, to add "
11060
"local weather information:"
11061
msgstr ""
11062
11063
#: serverguide/C/other-apps.xml:58(para)
11064
msgid "First, install the <application>weather-util</application> package:"
11065
msgstr ""
11066
11067
#: serverguide/C/other-apps.xml:63(command)
11068
msgid "sudo apt-get install weather-util"
11069
msgstr ""
11070
11071
#: serverguide/C/other-apps.xml:68(para)
11072
msgid ""
11073
"The <application>weather</application> utility uses METAR data from the "
11074
"National Oceanic and Atmospheric Administration and forecasts from the "
11075
"National Weather Service. In order to find local information you will need "
11076
"the 4-character ICAO location indicator. This can be determined by browsing "
11077
"to the <ulink url=\"http://www.weather.gov/tg/siteloc.shtml\">National "
11078
"Weather Service</ulink> site."
11079
msgstr ""
11080
11081
#: serverguide/C/other-apps.xml:75(para)
11082
msgid ""
11083
"Although the National Weather Service is a United States government agency "
11084
"there are weather stations available world wide. However, local weather "
11085
"information for all locations outside the U.S. may not be available."
11086
msgstr ""
11087
11088
#: serverguide/C/other-apps.xml:81(para)
11089
msgid ""
11090
"Create <filename>/usr/local/bin/local-weather</filename>, a simple shell "
11091
"script to use <application>weather</application> with your local ICAO "
11092
"indicator:"
11093
msgstr ""
11094
11095
#: serverguide/C/other-apps.xml:86(programlisting)
11096
#, no-wrap
11097
msgid ""
11098
"\n"
11099
"#!/bin/sh\n"
11100
"#\n"
11101
"#\n"
11102
"# Prints the local weather information for the MOTD.\n"
11103
"#\n"
11104
"#\n"
11105
"\n"
11106
"# Replace KINT with your local weather station.\n"
11107
"# Local stations can be found here: http://www.weather.gov/tg/siteloc.shtml\n"
11108
"\n"
11109
"echo\n"
11110
"weather -i KINT\n"
11111
"echo\n"
11112
"\n"
11113
msgstr ""
11114
11115
#: serverguide/C/other-apps.xml:104(para)
11116
msgid "Make the script executable:"
11117
msgstr ""
11118
11119
#: serverguide/C/other-apps.xml:109(command)
11120
msgid "sudo chmod 755 /usr/local/bin/local-weather"
11121
msgstr ""
11122
11123
#: serverguide/C/other-apps.xml:113(para)
11124
msgid ""
11125
"Next, create a symlink to <filename>/etc/update-motd.d/98-local-"
11126
"weather</filename>:"
11127
msgstr ""
11128
11129
#: serverguide/C/other-apps.xml:118(command)
11130
msgid ""
11131
"sudo ln -s /usr/local/bin/local-weather /etc/update-motd.d/98-local-weather"
11132
msgstr ""
11133
11134
#: serverguide/C/other-apps.xml:122(para)
11135
msgid "Finally, exit the server and re-login to view the new MOTD."
11136
msgstr ""
11137
11138
#: serverguide/C/other-apps.xml:128(para)
11139
msgid ""
11140
"You should now be greeted with some useful information, and some information "
11141
"about the local weather that may not be quite so useful. Hopefully the "
11142
"<application>local-weather</application> example demonstrates the "
11143
"flexibility of <application>pam_motd</application>."
11144
msgstr ""
11145
11146
#: serverguide/C/other-apps.xml:136(title)
11147
msgid "etckeeper"
11148
msgstr ""
11149
11150
#: serverguide/C/other-apps.xml:138(para)
11151
msgid ""
11152
"<application>etckeeper</application> allows the contents of <filename "
11153
"role=\"directory\">/etc</filename> be easily stored in Version Control "
11154
"System (VCS) repository. It hooks into <application>apt</application> to "
11155
"automatically commit changes to <filename>/etc</filename> when packages are "
11156
"installed or upgraded. Placing <filename>/etc</filename> under version "
11157
"control is considered an industry best practice, and the goal of "
11158
"<application>etckeeper</application> is to make this process as painless as "
11159
"possible."
11160
msgstr ""
11161
11162
#: serverguide/C/other-apps.xml:146(para)
11163
msgid ""
11164
"Install <application>etckeeper</application> by entering the following in a "
11165
"terminal:"
11166
msgstr ""
11167
11168
#: serverguide/C/other-apps.xml:151(command)
11169
msgid "sudo apt-get install etckeeper"
11170
msgstr ""
11171
11172
#: serverguide/C/other-apps.xml:154(para)
11173
msgid ""
11174
"The main configuration file, "
11175
"<filename>/etc/etckeeper/etckeeper.conf</filename>, is fairly simple. The "
11176
"main option is which VCS to use. By default "
11177
"<application>etckeeper</application> is configured to use "
11178
"<application>bzr</application> for version control. The repository is "
11179
"automatically initialized (and committed for the first time) during package "
11180
"installation. It is possible to undo this by entering the following command:"
11181
msgstr ""
11182
11183
#: serverguide/C/other-apps.xml:164(command)
11184
msgid "sudo etckeeper uninit"
11185
msgstr ""
11186
11187
#: serverguide/C/other-apps.xml:167(para)
11188
msgid ""
11189
"By default, etckeeper will commit uncommitted changes made to /etc daily. "
11190
"This can be disabled using the AVOID_DAILY_AUTOCOMMITS configuration option. "
11191
"It will also automatically commit changes before and after package "
11192
"installation. For a more precise tracking of changes, it is recommended to "
11193
"commit your changes manually, together with a commit message, using:"
11194
msgstr ""
11195
11196
#: serverguide/C/other-apps.xml:176(command)
11197
msgid "sudo etckeeper commit \"..Reason for configuration change..\""
11198
msgstr ""
11199
11200
#: serverguide/C/other-apps.xml:179(para)
11201
msgid ""
11202
"Using the VCS commands you can view log information about files in "
11203
"<filename>/etc</filename>:"
11204
msgstr ""
11205
11206
#: serverguide/C/other-apps.xml:184(command)
11207
msgid "sudo bzr log /etc/passwd"
11208
msgstr ""
11209
11210
#: serverguide/C/other-apps.xml:187(para)
11211
msgid ""
11212
"To demonstrate the integration with the package management system, install "
11213
"<application>postfix</application>:"
11214
msgstr ""
11215
11216
#: serverguide/C/other-apps.xml:192(command) serverguide/C/mail.xml:45(command)
11217
msgid "sudo apt-get install postfix"
11218
msgstr ""
11219
11220
#: serverguide/C/other-apps.xml:195(para)
11221
msgid ""
11222
"When the installation is finished, all the "
11223
"<application>postfix</application> configuration files should be committed "
11224
"to the repository:"
11225
msgstr ""
11226
11227
#: serverguide/C/other-apps.xml:201(computeroutput)
11228
#, no-wrap
11229
msgid ""
11230
"Committing to: /etc/\n"
11231
"added aliases.db\n"
11232
"modified group\n"
11233
"modified group-\n"
11234
"modified gshadow\n"
11235
"modified gshadow-\n"
11236
"modified passwd\n"
11237
"modified passwd-\n"
11238
"added postfix\n"
11239
"added resolvconf\n"
11240
"added rsyslog.d\n"
11241
"modified shadow\n"
11242
"modified shadow-\n"
11243
"added init.d/postfix\n"
11244
"added network/if-down.d/postfix\n"
11245
"added network/if-up.d/postfix\n"
11246
"added postfix/dynamicmaps.cf\n"
11247
"added postfix/main.cf\n"
11248
"added postfix/master.cf\n"
11249
"added postfix/post-install\n"
11250
"added postfix/postfix-files\n"
11251
"added postfix/postfix-script\n"
11252
"added postfix/sasl\n"
11253
"added ppp/ip-down.d\n"
11254
"added ppp/ip-down.d/postfix\n"
11255
"added ppp/ip-up.d/postfix\n"
11256
"added rc0.d/K20postfix\n"
11257
"added rc1.d/K20postfix\n"
11258
"added rc2.d/S20postfix\n"
11259
"added rc3.d/S20postfix\n"
11260
"added rc4.d/S20postfix\n"
11261
"added rc5.d/S20postfix\n"
11262
"added rc6.d/K20postfix\n"
11263
"added resolvconf/update-libc.d\n"
11264
"added resolvconf/update-libc.d/postfix\n"
11265
"added rsyslog.d/postfix.conf\n"
11266
"added ufw/applications.d/postfix\n"
11267
"Committed revision 2."
11268
msgstr ""
11269
11270
#: serverguide/C/other-apps.xml:241(para)
11271
msgid ""
11272
"For an example of how <application>etckeeper</application> tracks manual "
11273
"changes, add new a host to <filename>/etc/hosts</filename>. Using "
11274
"<application>bzr</application> you can see which files have been modified:"
11275
msgstr ""
11276
11277
#: serverguide/C/other-apps.xml:247(command)
11278
msgid "sudo bzr status /etc/"
11279
msgstr ""
11280
11281
#: serverguide/C/other-apps.xml:248(computeroutput)
11282
#, no-wrap
11283
msgid ""
11284
"modified:\n"
11285
" hosts"
11286
msgstr ""
11287
11288
#: serverguide/C/other-apps.xml:252(para)
11289
msgid "Now commit the changes:"
11290
msgstr ""
11291
11292
#: serverguide/C/other-apps.xml:257(command)
11293
msgid "sudo etckeeper commit \"new host\""
11294
msgstr ""
11295
11296
#: serverguide/C/other-apps.xml:260(para)
11297
msgid ""
11298
"For more information on <application>bzr</application> see <xref "
11299
"linkend=\"bazaar\"/>."
11300
msgstr ""
11301
11302
#: serverguide/C/other-apps.xml:266(title)
11303
msgid "Byobu"
11304
msgstr ""
11305
11306
#: serverguide/C/other-apps.xml:268(para)
11307
msgid ""
11308
"One of the most useful applications for any system administrator is "
11309
"<application>screen</application>. It allows the execution of multiple "
11310
"shells in one terminal. To make some of the advanced "
11311
"<application>screen</application> features more user friendly, and provide "
11312
"some useful information about the system, the "
11313
"<application>byobu</application> package was created."
11314
msgstr ""
11315
11316
#: serverguide/C/other-apps.xml:275(para)
11317
msgid ""
11318
"When executing <application>byobu</application> pressing the "
11319
"<emphasis>F9</emphasis> key will bring up the "
11320
"<application>Configuration</application> menu. This menu will allow you to:"
11321
msgstr ""
11322
11323
#: serverguide/C/other-apps.xml:281(para)
11324
msgid "View the Help menu"
11325
msgstr ""
11326
11327
#: serverguide/C/other-apps.xml:282(para)
11328
msgid "Change Byobu's background color"
11329
msgstr ""
11330
11331
#: serverguide/C/other-apps.xml:283(para)
11332
msgid "Change Byobu's foreground color"
11333
msgstr ""
11334
11335
#: serverguide/C/other-apps.xml:284(para)
11336
msgid "Toggle status notifications"
11337
msgstr ""
11338
11339
#: serverguide/C/other-apps.xml:285(para)
11340
msgid "Change the key binding set"
11341
msgstr ""
11342
11343
#: serverguide/C/other-apps.xml:286(para)
11344
msgid "Change the escape sequence"
11345
msgstr ""
11346
11347
#: serverguide/C/other-apps.xml:287(para)
11348
msgid "Create new windows"
11349
msgstr ""
11350
11351
#: serverguide/C/other-apps.xml:288(para)
11352
msgid "Manage the default windows"
11353
msgstr ""
11354
11355
#: serverguide/C/other-apps.xml:289(para)
11356
msgid "Byobu currently does not launch at login (toggle on)"
11357
msgstr ""
11358
11359
#: serverguide/C/other-apps.xml:292(para)
11360
msgid ""
11361
"The <emphasis>key bindings</emphasis> determine such things as the escape "
11362
"sequence, new window, change window, etc. There are two key binding sets to "
11363
"choose from <emphasis>f-keys</emphasis> and <emphasis>screen-escape-"
11364
"keys</emphasis>. If you wish to use the original key bindings choose the "
11365
"<emphasis>none</emphasis> set."
11366
msgstr ""
11367
11368
#: serverguide/C/other-apps.xml:298(para)
11369
msgid ""
11370
"<application>byobu</application> provides a menu which displays the Ubuntu "
11371
"release, processor information, memory information, and the time and date. "
11372
"The effect is similar to a desktop menu."
11373
msgstr ""
11374
11375
#: serverguide/C/other-apps.xml:303(para)
11376
msgid ""
11377
"Using the <emphasis>\"Byobu currently does not launch at login (toggle "
11378
"on)\"</emphasis> option will cause <application>byobu</application> to be "
11379
"executed any time a terminal is opened. Changes made to "
11380
"<application>byobu</application> are on a per user basis, and will not "
11381
"affect other users on the system."
11382
msgstr ""
11383
11384
#: serverguide/C/other-apps.xml:309(para)
11385
msgid ""
11386
"One difference when using byobu is the <emphasis>scrollback</emphasis> mode. "
11387
"Press the <emphasis>F7</emphasis> key to enter scrollback mode. Scrollback "
11388
"mode allows you to navigate past output using <emphasis>vi</emphasis> like "
11389
"commands. Here is a quick list of movement commands:"
11390
msgstr ""
11391
11392
#: serverguide/C/other-apps.xml:316(para)
11393
msgid "<emphasis>h</emphasis> - Move the cursor left by one character"
11394
msgstr ""
11395
11396
#: serverguide/C/other-apps.xml:317(para)
11397
msgid "<emphasis>j</emphasis> - Move the cursor down by one line"
11398
msgstr ""
11399
11400
#: serverguide/C/other-apps.xml:318(para)
11401
msgid "<emphasis>k</emphasis> - Move the cursor up by one line"
11402
msgstr ""
11403
11404
#: serverguide/C/other-apps.xml:319(para)
11405
msgid "<emphasis>l</emphasis> - Move the cursor right by one character"
11406
msgstr ""
11407
11408
#: serverguide/C/other-apps.xml:320(para)
11409
msgid "<emphasis>0</emphasis> - Move to the beginning of the current line"
11410
msgstr ""
11411
11412
#: serverguide/C/other-apps.xml:321(para)
11413
msgid "<emphasis>$</emphasis> - Move to the end of the current line"
11414
msgstr ""
11415
11416
#: serverguide/C/other-apps.xml:322(para)
11417
msgid ""
11418
"<emphasis>G</emphasis> - Moves to the specified line (defaults to the end of "
11419
"the buffer)"
11420
msgstr ""
11421
11422
#: serverguide/C/other-apps.xml:323(para)
11423
msgid "<emphasis>/</emphasis> - Search forward"
11424
msgstr ""
11425
11426
#: serverguide/C/other-apps.xml:324(para)
11427
msgid "<emphasis>?</emphasis> - Search backward"
11428
msgstr ""
11429
11430
#: serverguide/C/other-apps.xml:325(para)
11431
msgid ""
11432
"<emphasis>n</emphasis> - Moves to the next match, either forward or backword"
11433
msgstr ""
11434
11435
#: serverguide/C/other-apps.xml:334(para)
11436
msgid ""
11437
"See the <ulink "
11438
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/update-motd.1.html\">"
11439
"update-motd man page</ulink> for more options available to "
11440
"<application>update-motd</application>."
11441
msgstr ""
11442
11443
#: serverguide/C/other-apps.xml:340(para)
11444
msgid ""
11445
"The Debian Package of the Day <ulink "
11446
"url=\"http://debaday.debian.net/2007/10/04/weather-check-weather-conditions-"
11447
"and-forecasts-on-the-command-line/\">weather</ulink> article has more "
11448
"details about using the <application>weather</application>utility."
11449
msgstr ""
11450
11451
#: serverguide/C/other-apps.xml:347(para)
11452
msgid ""
11453
"See the <ulink "
11454
"url=\"http://kitenet.net/~joey/code/etckeeper/\">etckeeper</ulink> site for "
11455
"more details on using <application>etckeeper</application>."
11456
msgstr ""
11457
11458
#: serverguide/C/other-apps.xml:353(para)
11459
msgid ""
11460
"The <ulink url=\"https://help.ubuntu.com/community/etckeeper\">etckeeper "
11461
"Ubuntu Wiki</ulink> page."
11462
msgstr ""
11463
11464
#: serverguide/C/other-apps.xml:358(para)
11465
msgid ""
11466
"For the latest news and information about <application>bzr</application> see "
11467
"the <ulink url=\"http://bazaar-vcs.org/\">bzr</ulink> web site."
11468
msgstr ""
11469
11470
#: serverguide/C/other-apps.xml:363(para)
11471
msgid ""
11472
"For more information on <application>screen</application> see the <ulink "
11473
"url=\"http://www.gnu.org/software/screen/\">screen web site</ulink>."
11474
msgstr ""
11475
11476
#: serverguide/C/other-apps.xml:368(para)
11477
msgid ""
11478
"And the <ulink url=\"https://help.ubuntu.com/community/Screen\">Ubuntu Wiki "
11479
"screen</ulink> page."
11480
msgstr ""
11481
11482
#: serverguide/C/other-apps.xml:373(para)
11483
msgid ""
11484
"Also, see the <application>byobu</application><ulink "
11485
"url=\"https://launchpad.net/byobu\">project page</ulink> for more "
11486
"information."
11487
msgstr ""
11488
11489
#: serverguide/C/network-config.xml:14(para)
11490
msgid ""
11491
"Networks consist of two or more devices, such as computer systems, printers, "
11492
"and related equipment which are connected by either physical cabling or "
11493
"wireless links for the purpose of sharing and distributing information among "
11494
"the connected devices."
11495
msgstr ""
11496
11497
#: serverguide/C/network-config.xml:20(para)
11498
msgid ""
11499
"This section provides general and specific information pertaining to "
11500
"networking, including an overview of network concepts and detailed "
11501
"discussion of popular network protocols."
11502
msgstr ""
11503
11504
#: serverguide/C/network-config.xml:27(title)
11505
msgid "Network Configuration"
11506
msgstr ""
11507
11508
#: serverguide/C/network-config.xml:28(para)
11509
msgid ""
11510
"Ubuntu ships with a number of graphical utilities to configure your network "
11511
"devices. This document is geared toward server administrators and will focus "
11512
"on managing your network on the command line."
11513
msgstr ""
11514
11515
#: serverguide/C/network-config.xml:35(title)
11516
msgid "Ethernet Interfaces"
11517
msgstr ""
11518
11519
#: serverguide/C/network-config.xml:36(para)
11520
msgid ""
11521
"Ethernet interfaces are identified by the system using the naming convention "
11522
"of <emphasis role=\"italix\">ethX</emphasis>, where <emphasis "
11523
"role=\"italic\">X</emphasis> represents a numeric value. The first Ethernet "
11524
"interface is typically identified as <emphasis "
11525
"role=\"italic\">eth0</emphasis>, the second as <emphasis "
11526
"role=\"italic\">eth1</emphasis>, and all others should move up in numerical "
11527
"order."
11528
msgstr ""
11529
11530
#: serverguide/C/network-config.xml:46(title)
11531
msgid "Identify Ethernet Interfaces"
11532
msgstr ""
11533
11534
#: serverguide/C/network-config.xml:47(para)
11535
msgid ""
11536
"To quickly identify all available Ethernet interfaces, you can use the "
11537
"<application>ifconfig</application> command as shown below."
11538
msgstr ""
11539
11540
#: serverguide/C/network-config.xml:52(userinput)
11541
#, no-wrap
11542
msgid "ifconfig -a | grep eth"
11543
msgstr ""
11544
11545
#: serverguide/C/network-config.xml:51(screen)
11546
#, no-wrap
11547
msgid ""
11548
"\n"
11549
"<placeholder-1/>\n"
11550
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a\n"
11551
msgstr ""
11552
11553
#: serverguide/C/network-config.xml:55(para)
11554
msgid ""
11555
"Another application that can help identify all network interfaces available "
11556
"to your system is the <application>lshw</application> command. In the "
11557
"example below, <application>lshw</application> shows a single Ethernet "
11558
"interface with the logical name of <emphasis role=\"italic\">eth0</emphasis> "
11559
"along with bus information, driver details and all supported capabilities."
11560
msgstr ""
11561
11562
#: serverguide/C/network-config.xml:62(userinput)
11563
#, no-wrap
11564
msgid "sudo lshw -class network"
11565
msgstr ""
11566
11567
#: serverguide/C/network-config.xml:61(screen)
11568
#, no-wrap
11569
msgid ""
11570
"\n"
11571
"<placeholder-1/>\n"
11572
" *-network\n"
11573
" description: Ethernet interface\n"
11574
" product: BCM4401-B0 100Base-TX\n"
11575
" vendor: Broadcom Corporation\n"
11576
" physical id: 0\n"
11577
" bus info: pci@0000:03:00.0\n"
11578
" logical name: eth0\n"
11579
" version: 02\n"
11580
" serial: 00:15:c5:4a:16:5a\n"
11581
" size: 10MB/s\n"
11582
" capacity: 100MB/s\n"
11583
" width: 32 bits\n"
11584
" clock: 33MHz\n"
11585
" capabilities: (snipped for brevity)\n"
11586
" configuration: (snipped for brevity)\n"
11587
" resources: irq:17 memory:ef9fe000-ef9fffff\n"
11588
msgstr ""
11589
11590
#: serverguide/C/network-config.xml:83(title)
11591
msgid "Ethernet Interface Logical Names"
11592
msgstr ""
11593
11594
#: serverguide/C/network-config.xml:84(para)
11595
msgid ""
11596
"Interface logical names are configured in the file "
11597
"<filename>/etc/udev/rules.d/70-persistent-net.rules.</filename> If you would "
11598
"like control which interface receives a particular logical name, find the "
11599
"line matching the interfaces physical MAC address and modify the value of "
11600
"<emphasis role=\"italic\">NAME=ethX</emphasis> to the desired logical name. "
11601
"Reboot the system to commit your changes."
11602
msgstr ""
11603
11604
#: serverguide/C/network-config.xml:92(programlisting)
11605
#, no-wrap
11606
msgid ""
11607
"\n"
11608
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11609
"ATTR{address}==\"00:15:c5:4a:16:5a\", ATTR{dev_id}==\"0x0\", "
11610
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth0\"\n"
11611
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11612
"ATTR{address}==\"00:15:c5:4a:16:5b\", ATTR{dev_id}==\"0x0\", "
11613
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth1\"\n"
11614
msgstr ""
11615
11616
#: serverguide/C/network-config.xml:99(title)
11617
msgid "Ethernet Interface Settings"
11618
msgstr ""
11619
11620
#: serverguide/C/network-config.xml:100(para)
11621
msgid ""
11622
"<application>ethtool</application> is a program that displays and changes "
11623
"Ethernet card settings such as auto-negotiation, port speed, duplex mode, "
11624
"and Wake-on-LAN. It is not installed by default, but is available for "
11625
"installation in the repositories."
11626
msgstr ""
11627
11628
#: serverguide/C/network-config.xml:106(userinput)
11629
#, no-wrap
11630
msgid "sudo apt-get install ethtool"
11631
msgstr ""
11632
11633
#: serverguide/C/network-config.xml:108(para)
11634
msgid ""
11635
"The following is an example of how to view supported features and configured "
11636
"settings of an Ethernet interface."
11637
msgstr ""
11638
11639
#: serverguide/C/network-config.xml:113(userinput)
11640
#, no-wrap
11641
msgid "sudo ethtool eth0"
11642
msgstr ""
11643
11644
#: serverguide/C/network-config.xml:112(screen)
11645
#, no-wrap
11646
msgid ""
11647
"\n"
11648
"<placeholder-1/>\n"
11649
"Settings for eth0:\n"
11650
" Supported ports: [ TP ]\n"
11651
" Supported link modes: 10baseT/Half 10baseT/Full \n"
11652
" 100baseT/Half 100baseT/Full \n"
11653
" 1000baseT/Half 1000baseT/Full \n"
11654
" Supports auto-negotiation: Yes\n"
11655
" Advertised link modes: 10baseT/Half 10baseT/Full \n"
11656
" 100baseT/Half 100baseT/Full \n"
11657
" 1000baseT/Half 1000baseT/Full \n"
11658
" Advertised auto-negotiation: Yes\n"
11659
" Speed: 1000Mb/s\n"
11660
" Duplex: Full\n"
11661
" Port: Twisted Pair\n"
11662
" PHYAD: 1\n"
11663
" Transceiver: internal\n"
11664
" Auto-negotiation: on\n"
11665
" Supports Wake-on: g\n"
11666
" Wake-on: d\n"
11667
" Current message level: 0x000000ff (255)\n"
11668
" Link detected: yes\n"
11669
msgstr ""
11670
11671
#: serverguide/C/network-config.xml:135(para)
11672
msgid ""
11673
"Changes made with the <application>ethtool</application> command are "
11674
"temporary and will be lost after a reboot. If you would like to retain "
11675
"settings, simply add the desired <application>ethtool</application> command "
11676
"to a <emphasis role=\"italic\">pre-up</emphasis> statement in the interface "
11677
"configuration file <filename>/etc/network/interfaces</filename>."
11678
msgstr ""
11679
11680
#: serverguide/C/network-config.xml:141(para)
11681
msgid ""
11682
"The following is an example of how the interface identified as <emphasis "
11683
"role=\"italic\">eth0</emphasis> could be permanently configured with a port "
11684
"speed of 1000Mb/s running in full duplex mode."
11685
msgstr ""
11686
11687
#: serverguide/C/network-config.xml:145(programlisting)
11688
#, no-wrap
11689
msgid ""
11690
"\n"
11691
"auto eth0\n"
11692
"iface eth0 inet static\n"
11693
"pre-up /usr/sbin/ethtool -s eth0 speed 1000 duplex full\n"
11694
msgstr ""
11695
11696
#: serverguide/C/network-config.xml:151(para)
11697
msgid ""
11698
"Although the example above shows the interface configured to use the "
11699
"<emphasis role=\"italic\">static</emphasis> method, it actually works with "
11700
"other methods as well, such as DHCP. The example is meant to demonstrate "
11701
"only proper placement of the <emphasis role=\"italic\">pre-up</emphasis> "
11702
"statement in relation to the rest of the interface configuration."
11703
msgstr ""
11704
11705
#: serverguide/C/network-config.xml:163(title)
11706
msgid "IP Addressing"
11707
msgstr ""
11708
11709
#: serverguide/C/network-config.xml:164(para)
11710
msgid ""
11711
"The following section describes the process of configuring your systems IP "
11712
"address and default gateway needed for communicating on a local area network "
11713
"and the Internet."
11714
msgstr ""
11715
11716
#: serverguide/C/network-config.xml:171(title)
11717
msgid "Temporary IP Address Assignment"
11718
msgstr ""
11719
11720
#: serverguide/C/network-config.xml:172(para)
11721
msgid ""
11722
"For temporary network configurations, you can use standard commands such as "
11723
"<application>ip</application>, <application>ifconfig</application> and "
11724
"<application>route</application>, which are also found on most other "
11725
"GNU/Linux operating systems. These commands allow you to configure settings "
11726
"which take effect immediately, however they are not persistent and will be "
11727
"lost after a reboot."
11728
msgstr ""
11729
11730
#: serverguide/C/network-config.xml:180(para)
11731
msgid ""
11732
"To temporarily configure an IP address, you can use the "
11733
"<application>ifconfig</application> command in the following manner. Just "
11734
"modify the IP address and subnet mask to match your network requirements."
11735
msgstr ""
11736
11737
#: serverguide/C/network-config.xml:186(userinput)
11738
#, no-wrap
11739
msgid "sudo ifconfig eth0 10.0.0.100 netmask 255.255.255.0"
11740
msgstr ""
11741
11742
#: serverguide/C/network-config.xml:188(para)
11743
msgid ""
11744
"To verify the IP address configuration of <application>eth0</application>, "
11745
"you can use the <application>ifconfig</application> command in the following "
11746
"manner."
11747
msgstr ""
11748
11749
#: serverguide/C/network-config.xml:193(userinput)
11750
#, no-wrap
11751
msgid "ifconfig eth0"
11752
msgstr ""
11753
11754
#: serverguide/C/network-config.xml:192(screen)
11755
#, no-wrap
11756
msgid ""
11757
"\n"
11758
"<placeholder-1/>\n"
11759
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a \n"
11760
" inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0\n"
11761
" inet6 addr: fe80::215:c5ff:fe4a:165a/64 Scope:Link\n"
11762
" UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1\n"
11763
" RX packets:466475604 errors:0 dropped:0 overruns:0 frame:0\n"
11764
" TX packets:403172654 errors:0 dropped:0 overruns:0 carrier:0\n"
11765
" collisions:0 txqueuelen:1000 \n"
11766
" RX bytes:2574778386 (2.5 GB) TX bytes:1618367329 (1.6 GB)\n"
11767
" Interrupt:16 \n"
11768
msgstr ""
11769
11770
#: serverguide/C/network-config.xml:204(para)
11771
msgid ""
11772
"To configure a default gateway, you can use the "
11773
"<application>route</application> command in the following manner. Modify the "
11774
"default gateway address to match your network requirements."
11775
msgstr ""
11776
11777
#: serverguide/C/network-config.xml:210(userinput)
11778
#, no-wrap
11779
msgid "sudo route add default gw 10.0.0.1 eth0"
11780
msgstr ""
11781
11782
#: serverguide/C/network-config.xml:212(para)
11783
msgid ""
11784
"To verify your default gateway configuration, you can use the "
11785
"<application>route</application> command in the following manner."
11786
msgstr ""
11787
11788
#: serverguide/C/network-config.xml:217(userinput)
11789
#, no-wrap
11790
msgid "route -n"
11791
msgstr ""
11792
11793
#: serverguide/C/network-config.xml:216(screen)
11794
#, no-wrap
11795
msgid ""
11796
"\n"
11797
"<placeholder-1/>\n"
11798
"Kernel IP routing table\n"
11799
"Destination Gateway Genmask Flags Metric Ref Use "
11800
"Iface\n"
11801
"10.0.0.0 0.0.0.0 255.255.255.0 U 1 0 0 "
11802
"eth0\n"
11803
"0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 "
11804
"eth0\n"
11805
msgstr ""
11806
11807
#: serverguide/C/network-config.xml:223(para)
11808
msgid ""
11809
"If you require DNS for your temporary network configuration, you can add DNS "
11810
"server IP addresses in the file <filename>/etc/resolv.conf</filename>. The "
11811
"example below shows how to enter two DNS servers to "
11812
"<filename>/etc/resolv.conf</filename>, which should be changed to servers "
11813
"appropriate for your network. A more lengthy description of DNS client "
11814
"configuration is in a following section."
11815
msgstr ""
11816
11817
#: serverguide/C/network-config.xml:230(programlisting)
11818
#, no-wrap
11819
msgid ""
11820
"\n"
11821
"nameserver 8.8.8.8\n"
11822
"nameserver 8.8.4.4\n"
11823
msgstr ""
11824
11825
#: serverguide/C/network-config.xml:234(para)
11826
msgid ""
11827
"If you no longer need this configuration and wish to purge all IP "
11828
"configuration from an interface, you can use the "
11829
"<application>ip</application> command with the flush option as shown below."
11830
msgstr ""
11831
11832
#: serverguide/C/network-config.xml:240(userinput)
11833
#, no-wrap
11834
msgid "ip addr flush eth0"
11835
msgstr ""
11836
11837
#: serverguide/C/network-config.xml:243(para)
11838
msgid ""
11839
"Flushing the IP configuration using the <application>ip</application> "
11840
"command does not clear the contents of "
11841
"<filename>/etc/resolv.conf</filename>. You must remove or modify those "
11842
"entries manually."
11843
msgstr ""
11844
11845
#: serverguide/C/network-config.xml:251(title)
11846
msgid "Dynamic IP Address Assignment (DHCP Client)"
11847
msgstr ""
11848
11849
#: serverguide/C/network-config.xml:252(para)
11850
msgid ""
11851
"To configure your server to use DHCP for dynamic address assignment, add the "
11852
"<emphasis role=\"italic\">dhcp</emphasis> method to the inet address family "
11853
"statement for the appropriate interface in the file "
11854
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
11855
"are configuring your first Ethernet interface identified as <emphasis "
11856
"role=\"italic\">eth0</emphasis>."
11857
msgstr ""
11858
11859
#: serverguide/C/network-config.xml:259(programlisting)
11860
#, no-wrap
11861
msgid ""
11862
"\n"
11863
"auto eth0\n"
11864
"iface eth0 inet dhcp\n"
11865
msgstr ""
11866
11867
#: serverguide/C/network-config.xml:263(para)
11868
msgid ""
11869
"By adding an interface configuration as shown above, you can manually enable "
11870
"the interface through the <application>ifup</application> command which "
11871
"initiates the DHCP process via <application>dhclient</application>."
11872
msgstr ""
11873
11874
#: serverguide/C/network-config.xml:269(userinput) serverguide/C/network-config.xml:304(userinput)
11875
#, no-wrap
11876
msgid "sudo ifup eth0"
11877
msgstr ""
11878
11879
#: serverguide/C/network-config.xml:271(para)
11880
msgid ""
11881
"To manually disable the interface, you can use the "
11882
"<application>ifdown</application> command, which in turn will initiate the "
11883
"DHCP release process and shut down the interface."
11884
msgstr ""
11885
11886
#: serverguide/C/network-config.xml:277(userinput) serverguide/C/network-config.xml:311(userinput)
11887
#, no-wrap
11888
msgid "sudo ifdown eth0"
11889
msgstr ""
11890
11891
#: serverguide/C/network-config.xml:282(title)
11892
msgid "Static IP Address Assignment"
11893
msgstr ""
11894
11895
#: serverguide/C/network-config.xml:283(para)
11896
msgid ""
11897
"To configure your system to use a static IP address assignment, add the "
11898
"<emphasis role=\"italic\">static</emphasis> method to the inet address "
11899
"family statement for the appropriate interface in the file "
11900
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
11901
"are configuring your first Ethernet interface identified as <emphasis "
11902
"role=\"italic\">eth0</emphasis>. Change the <emphasis "
11903
"role=\"italic\">address</emphasis>, <emphasis "
11904
"role=\"italic\">netmask</emphasis>, and <emphasis "
11905
"role=\"italic\">gateway</emphasis> values to meet the requirements of your "
11906
"network."
11907
msgstr ""
11908
11909
#: serverguide/C/network-config.xml:292(programlisting)
11910
#, no-wrap
11911
msgid ""
11912
"\n"
11913
"auto eth0\n"
11914
"iface eth0 inet static\n"
11915
"address 10.0.0.100\n"
11916
"netmask 255.255.255.0\n"
11917
"gateway 10.0.0.1\n"
11918
msgstr ""
11919
11920
#: serverguide/C/network-config.xml:299(para)
11921
msgid ""
11922
"By adding an interface configuration as shown above, you can manually enable "
11923
"the interface through the <application>ifup</application> command."
11924
msgstr ""
11925
11926
#: serverguide/C/network-config.xml:306(para)
11927
msgid ""
11928
"To manually disable the interface, you can use the "
11929
"<application>ifdown</application> command."
11930
msgstr ""
11931
11932
#: serverguide/C/network-config.xml:316(title)
11933
msgid "Loopback Interface"
11934
msgstr ""
11935
11936
#: serverguide/C/network-config.xml:317(para)
11937
msgid ""
11938
"The loopback interface is identified by the system as <emphasis "
11939
"role=\"italic\">lo</emphasis> and has a default IP address of 127.0.0.1. It "
11940
"can be viewed using the ifconfig command."
11941
msgstr ""
11942
11943
#: serverguide/C/network-config.xml:322(userinput)
11944
#, no-wrap
11945
msgid "ifconfig lo"
11946
msgstr ""
11947
11948
#: serverguide/C/network-config.xml:321(screen)
11949
#, no-wrap
11950
msgid ""
11951
"\n"
11952
"<placeholder-1/>\n"
11953
"lo Link encap:Local Loopback \n"
11954
" inet addr:127.0.0.1 Mask:255.0.0.0\n"
11955
" inet6 addr: ::1/128 Scope:Host\n"
11956
" UP LOOPBACK RUNNING MTU:16436 Metric:1\n"
11957
" RX packets:2718 errors:0 dropped:0 overruns:0 frame:0\n"
11958
" TX packets:2718 errors:0 dropped:0 overruns:0 carrier:0\n"
11959
" collisions:0 txqueuelen:0 \n"
11960
" RX bytes:183308 (183.3 KB) TX bytes:183308 (183.3 KB)\n"
11961
msgstr ""
11962
11963
#: serverguide/C/network-config.xml:332(para)
11964
msgid ""
11965
"By default, there should be two lines in "
11966
"<filename>/etc/network/interfaces</filename> responsible for automatically "
11967
"configuring your loopback interface. It is recommended that you keep the "
11968
"default settings unless you have a specific purpose for changing them. An "
11969
"example of the two default lines are shown below."
11970
msgstr ""
11971
11972
#: serverguide/C/network-config.xml:338(programlisting)
11973
#, no-wrap
11974
msgid ""
11975
"\n"
11976
"auto lo\n"
11977
"iface lo inet loopback\n"
11978
msgstr ""
11979
11980
#: serverguide/C/network-config.xml:347(title)
11981
msgid "Name Resolution"
11982
msgstr ""
11983
11984
#: serverguide/C/network-config.xml:348(para)
11985
msgid ""
11986
"Name resolution as it relates to IP networking is the process of mapping IP "
11987
"addresses to hostnames, making it easier to identify resources on a network. "
11988
"The following section will explain how to properly configure your system for "
11989
"name resolution using DNS and static hostname records."
11990
msgstr ""
11991
11992
#: serverguide/C/network-config.xml:356(title)
11993
msgid "DNS Client Configuration"
11994
msgstr ""
11995
11996
#: serverguide/C/network-config.xml:357(para)
11997
msgid ""
11998
"To configure your system to use DNS for name resolution, add the IP "
11999
"addresses of the DNS servers that are appropriate for your network in the "
12000
"file <filename>/etc/resolv.conf</filename>. You can also add an optional DNS "
12001
"suffix search-lists to match your network domain names."
12002
msgstr ""
12003
12004
#: serverguide/C/network-config.xml:362(para)
12005
msgid ""
12006
"Below is an example of a typical configuration of "
12007
"<filename>/etc/resolv.conf</filename> for a server on the domain \"<emphasis "
12008
"role=\"italic\">example.com</emphasis>\" and using two public DNS servers."
12009
msgstr ""
12010
12011
#: serverguide/C/network-config.xml:367(programlisting)
12012
#, no-wrap
12013
msgid ""
12014
"\n"
12015
"search example.com\n"
12016
"nameserver 8.8.8.8\n"
12017
"nameserver 8.8.4.4\n"
12018
msgstr ""
12019
12020
#: serverguide/C/network-config.xml:372(para)
12021
msgid ""
12022
"The <emphasis role=\"italic\">search</emphasis> option can also be used with "
12023
"multiple domain names so that DNS queries will be appended in the order in "
12024
"which they are entered. For example, your network may have multiple sub-"
12025
"domains to search; a parent domain of <emphasis "
12026
"role=\"italic\">example.com</emphasis>, and two sub-domains, <emphasis "
12027
"role=\"italic\">sales.example.com</emphasis> and <emphasis "
12028
"role=\"italic\">dev.example.com</emphasis>."
12029
msgstr ""
12030
12031
#: serverguide/C/network-config.xml:380(para)
12032
msgid ""
12033
"If you have multiple domains you wish to search, your configuration might "
12034
"look like the following."
12035
msgstr ""
12036
12037
#: serverguide/C/network-config.xml:383(programlisting)
12038
#, no-wrap
12039
msgid ""
12040
"\n"
12041
"search example.com sales.example.com dev.example.com\n"
12042
"nameserver 8.8.8.8\n"
12043
"nameserver 8.8.4.4\n"
12044
msgstr ""
12045
12046
#: serverguide/C/network-config.xml:388(para)
12047
msgid ""
12048
"If you try to ping a host with the name of <emphasis "
12049
"role=\"italic\">server1</emphasis>, your system will automatically query DNS "
12050
"for its Fully Qualified Domain Name (FQDN) in the following order:"
12051
msgstr ""
12052
12053
#: serverguide/C/network-config.xml:394(para)
12054
msgid "server1<emphasis role=\"bold\">.example.com</emphasis>"
12055
msgstr ""
12056
12057
#: serverguide/C/network-config.xml:399(para)
12058
msgid "server1<emphasis role=\"bold\">.sales.example.com</emphasis>"
12059
msgstr ""
12060
12061
#: serverguide/C/network-config.xml:404(para)
12062
msgid "server1<emphasis role=\"bold\">.dev.example.com</emphasis>"
12063
msgstr ""
12064
12065
#: serverguide/C/network-config.xml:409(para)
12066
msgid ""
12067
"If no matches are found, the DNS server will provide a result of <emphasis "
12068
"role=\"italic\">notfound</emphasis> and the DNS query will fail."
12069
msgstr ""
12070
12071
#: serverguide/C/network-config.xml:416(title)
12072
msgid "Static Hostnames"
12073
msgstr ""
12074
12075
#: serverguide/C/network-config.xml:417(para)
12076
msgid ""
12077
"Static hostnames are locally defined hostname-to-IP mappings located in the "
12078
"file <filename>/etc/hosts</filename>. Entries in the "
12079
"<filename>hosts</filename> file will have precedence over DNS by default. "
12080
"This means that if your system tries to resolve a hostname and it matches an "
12081
"entry in /etc/hosts, it will not attempt to look up the record in DNS. In "
12082
"some configurations, especially when Internet access is not required, "
12083
"servers that communicate with a limited number of resources can be "
12084
"conveniently set to use static hostnames instead of DNS."
12085
msgstr ""
12086
12087
#: serverguide/C/network-config.xml:424(para)
12088
msgid ""
12089
"The following is an example of a <filename>hosts</filename> file where a "
12090
"number of local servers have been identified by simple hostnames, aliases "
12091
"and their equivalent Fully Qualified Domain Names (FQDN's)."
12092
msgstr ""
12093
12094
#: serverguide/C/network-config.xml:428(programlisting)
12095
#, no-wrap
12096
msgid ""
12097
"\n"
12098
"127.0.0.1\tlocalhost\n"
12099
"127.0.1.1\tubuntu-server\n"
12100
"10.0.0.11\tserver1 vpn server1.example.com\n"
12101
"10.0.0.12\tserver2 mail server2.example.com\n"
12102
"10.0.0.13\tserver3 www server3.example.com\n"
12103
"10.0.0.14\tserver4 file server4.example.com\n"
12104
msgstr ""
12105
12106
#: serverguide/C/network-config.xml:437(para)
12107
msgid ""
12108
"In the above example, notice that each of the servers have been given "
12109
"aliases in addition to their proper names and FQDN's. <emphasis "
12110
"role=\"italic\">Server1</emphasis> has been mapped to the name <emphasis "
12111
"role=\"italic\">vpn</emphasis>, <emphasis role=\"italic\">server2</emphasis> "
12112
"is referred to as <emphasis role=\"italic\">mail</emphasis>, <emphasis "
12113
"role=\"italic\">server3</emphasis> as <emphasis "
12114
"role=\"italic\">www</emphasis>, and <emphasis "
12115
"role=\"italic\">server4</emphasis> as <emphasis "
12116
"role=\"italic\">file</emphasis>."
12117
msgstr ""
12118
12119
#: serverguide/C/network-config.xml:449(title)
12120
msgid "Name Service Switch Configuration"
12121
msgstr ""
12122
12123
#: serverguide/C/network-config.xml:450(para)
12124
msgid ""
12125
"The order in which your system selects a method of resolving hostnames to IP "
12126
"addresses is controlled by the Name Service Switch (NSS) configuration file "
12127
"<filename>/etc/nsswitch.conf</filename>. As mentioned in the previous "
12128
"section, typically static hostnames defined in the systems "
12129
"<filename>/etc/hosts</filename> file have precedence over names resolved "
12130
"from DNS. The following is an example of the line responsible for this order "
12131
"of hostname lookups in the file <filename>/etc/nsswitch.conf</filename>."
12132
msgstr ""
12133
12134
#: serverguide/C/network-config.xml:458(programlisting)
12135
#, no-wrap
12136
msgid ""
12137
"\n"
12138
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
12139
msgstr ""
12140
12141
#: serverguide/C/network-config.xml:464(para)
12142
msgid ""
12143
"<emphasis role=\"bold\">files</emphasis> first tries to resolve static "
12144
"hostnames located in <filename>/etc/hosts</filename>."
12145
msgstr ""
12146
12147
#: serverguide/C/network-config.xml:470(para)
12148
msgid ""
12149
"<emphasis role=\"bold\">mdns4_minimal</emphasis> attempts to resolve the "
12150
"name using Multicast DNS."
12151
msgstr ""
12152
12153
#: serverguide/C/network-config.xml:475(para)
12154
msgid ""
12155
"<emphasis role=\"bold\">[NOTFOUND=return]</emphasis> means that any response "
12156
"of <emphasis role=\"italic\">notfound</emphasis> by the preceeding <emphasis "
12157
"role=\"italic\">mdns4_minimal</emphasis> process should be treated as "
12158
"authoritative and that the system should not try to continue hunting for an "
12159
"answer."
12160
msgstr ""
12161
12162
#: serverguide/C/network-config.xml:483(para)
12163
msgid ""
12164
"<emphasis role=\"bold\">dns</emphasis> represents a legacy unicast DNS query."
12165
msgstr ""
12166
12167
#: serverguide/C/network-config.xml:488(para)
12168
msgid ""
12169
"<emphasis role=\"bold\">mdns4</emphasis> represents a Multicast DNS query."
12170
msgstr ""
12171
12172
#: serverguide/C/network-config.xml:494(para)
12173
msgid ""
12174
"To modify the order of the above mentioned name resolution methods, you can "
12175
"simply change the <emphasis role=\"italic\">hosts:</emphasis> string to the "
12176
"value of your choosing. For example, if you prefer to use legacy Unicast DNS "
12177
"versus Multicast DNS, you can change the string in "
12178
"<filename>/etc/nsswitch.conf</filename> as shown below."
12179
msgstr ""
12180
12181
#: serverguide/C/network-config.xml:501(programlisting)
12182
#, no-wrap
12183
msgid ""
12184
"\n"
12185
"hosts: files dns [NOTFOUND=return] mdns4_minimal mdns4\n"
12186
msgstr ""
12187
12188
#: serverguide/C/network-config.xml:508(title)
12189
msgid "Bridging"
12190
msgstr ""
12191
12192
#: serverguide/C/network-config.xml:510(para)
12193
msgid ""
12194
"Bridging multiple interfaces is a more advanced configuration, but is very "
12195
"useful in multiple scenarios. One scenario is setting up a bridge with "
12196
"multiple network interfaces, then using a firewall to filter traffic between "
12197
"two network segments. Another scenario is using bridge on a system with one "
12198
"interface to allow virtual machines direct access to the outside network. "
12199
"The following example covers the latter scenario."
12200
msgstr ""
12201
12202
#: serverguide/C/network-config.xml:517(para)
12203
msgid ""
12204
"Before configuring a bridge you will need to install the <application>bridge-"
12205
"utils</application> package. To install the package, in a terminal enter:"
12206
msgstr ""
12207
12208
#: serverguide/C/network-config.xml:523(command)
12209
msgid "sudo apt-get install bridge-utils"
12210
msgstr ""
12211
12212
#: serverguide/C/network-config.xml:526(para)
12213
msgid ""
12214
"Next, configure the bridge by editing "
12215
"<filename>/etc/network/interfaces</filename>:"
12216
msgstr ""
12217
12218
#: serverguide/C/network-config.xml:530(programlisting)
12219
#, no-wrap
12220
msgid ""
12221
"\n"
12222
"auto lo\n"
12223
"iface lo inet loopback\n"
12224
"\n"
12225
"auto br0\n"
12226
"iface br0 inet static\n"
12227
" address 192.168.0.10\n"
12228
" network 192.168.0.0\n"
12229
" netmask 255.255.255.0\n"
12230
" broadcast 192.168.0.255\n"
12231
" gateway 192.168.0.1\n"
12232
" bridge_ports eth0\n"
12233
" bridge_fd 9\n"
12234
" bridge_hello 2\n"
12235
" bridge_maxage 12\n"
12236
" bridge_stp off\n"
12237
msgstr ""
12238
12239
#: serverguide/C/network-config.xml:549(para)
12240
msgid "Enter the appropriate values for your physical interface and network."
12241
msgstr ""
12242
12243
#: serverguide/C/network-config.xml:554(para)
12244
msgid "Now restart networking to enable the bridge interface:"
12245
msgstr ""
12246
12247
#: serverguide/C/network-config.xml:561(para)
12248
msgid ""
12249
"The new bridge interface should now be up and running. The "
12250
"<application>brctl</application> provides useful information about the state "
12251
"of the bridge, controls which interfaces are part of the bridge, etc. See "
12252
"<command>man brctl</command> for more information."
12253
msgstr ""
12254
12255
#: serverguide/C/network-config.xml:577(para)
12256
msgid ""
12257
"The <ulink url=\"https://help.ubuntu.com/community/Network\">Ubuntu Wiki "
12258
"Network page</ulink> has links to articles covering more advanced network "
12259
"configuration."
12260
msgstr ""
12261
12262
#: serverguide/C/network-config.xml:583(para)
12263
msgid ""
12264
"The <ulink "
12265
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/interfaces.5.html\">i"
12266
"nterfaces man page</ulink> has details on more options for "
12267
"<filename>/etc/network/interfaces</filename>."
12268
msgstr ""
12269
12270
#: serverguide/C/network-config.xml:589(para)
12271
msgid ""
12272
"The <ulink "
12273
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/dhclient.8.html\">dhc"
12274
"lient man page</ulink> has details on more options for configuring DHCP "
12275
"client settings."
12276
msgstr ""
12277
12278
#: serverguide/C/network-config.xml:595(para)
12279
msgid ""
12280
"For more information on DNS client configuration see the <ulink "
12281
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/resolver.5.html\">res"
12282
"olver man page</ulink>. Also, Chapter 6 of O'Reilly's <ulink "
12283
"url=\"http://oreilly.com/catalog/linag2/book/ch06.html\">Linux Network "
12284
"Administrator's Guide</ulink> is a good source of resolver and name service "
12285
"configuration information."
12286
msgstr ""
12287
12288
#: serverguide/C/network-config.xml:603(para)
12289
msgid ""
12290
"For more information on <emphasis>bridging</emphasis> see the <ulink "
12291
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/brctl.8.html\">brctl "
12292
"man page</ulink> and the Linux Foundation's <ulink "
12293
"url=\"http://www.linuxfoundation.org/en/Net:Bridge\">Net:Bridge</ulink> page."
12294
msgstr ""
12295
12296
#: serverguide/C/network-config.xml:614(title)
12297
msgid "TCP/IP"
12298
msgstr ""
12299
12300
#: serverguide/C/network-config.xml:615(para)
12301
msgid ""
12302
"The Transmission Control Protocol and Internet Protocol (TCP/IP) is a "
12303
"standard set of protocols developed in the late 1970s by the Defense "
12304
"Advanced Research Projects Agency (DARPA) as a means of communication "
12305
"between different types of computers and computer networks. TCP/IP is the "
12306
"driving force of the Internet, and thus it is the most popular set of "
12307
"network protocols on Earth."
12308
msgstr ""
12309
12310
#: serverguide/C/network-config.xml:623(title)
12311
msgid "TCP/IP Introduction"
12312
msgstr ""
12313
12314
#: serverguide/C/network-config.xml:624(para)
12315
msgid ""
12316
"The two protocol components of TCP/IP deal with different aspects of "
12317
"computer networking. <emphasis>Internet Protocol</emphasis>, the \"IP\" of "
12318
"TCP/IP is a connectionless protocol which deals only with network packet "
12319
"routing using the <emphasis role=\"italics\">IP Datagram</emphasis> as the "
12320
"basic unit of networking information. The IP Datagram consists of a header "
12321
"followed by a message. The <emphasis> Transmission Control "
12322
"Protocol</emphasis> is the \"TCP\" of TCP/IP and enables network hosts to "
12323
"establish connections which may be used to exchange data streams. TCP also "
12324
"guarantees that the data between connections is delivered and that it "
12325
"arrives at one network host in the same order as sent from another network "
12326
"host."
12327
msgstr ""
12328
12329
#: serverguide/C/network-config.xml:637(title)
12330
msgid "TCP/IP Configuration"
12331
msgstr ""
12332
12333
#: serverguide/C/network-config.xml:638(para)
12334
msgid ""
12335
"The TCP/IP protocol configuration consists of several elements which must be "
12336
"set by editing the appropriate configuration files, or deploying solutions "
12337
"such as the Dynamic Host Configuration Protocol (DHCP) server which in turn, "
12338
"can be configured to provide the proper TCP/IP configuration settings to "
12339
"network clients automatically. These configuration values must be set "
12340
"correctly in order to facilitate the proper network operation of your Ubuntu "
12341
"system."
12342
msgstr ""
12343
12344
#: serverguide/C/network-config.xml:650(para)
12345
msgid ""
12346
"<emphasis role=\"bold\">IP address</emphasis> The IP address is a unique "
12347
"identifying string expressed as four decimal numbers ranging from zero (0) "
12348
"to two-hundred and fifty-five (255), separated by periods, with each of the "
12349
"four numbers representing eight (8) bits of the address for a total length "
12350
"of thirty-two (32) bits for the whole address. This format is called "
12351
"<emphasis>dotted quad notation</emphasis>."
12352
msgstr ""
12353
12354
#: serverguide/C/network-config.xml:660(para)
12355
msgid ""
12356
"<emphasis role=\"bold\">Netmask</emphasis> The Subnet Mask (or simply, "
12357
"<emphasis>netmask</emphasis>) is a local bit mask, or set of flags which "
12358
"separate the portions of an IP address significant to the network from the "
12359
"bits significant to the <emphasis>subnetwork</emphasis>. For example, in a "
12360
"Class C network, the standard netmask is 255.255.255.0 which masks the first "
12361
"three bytes of the IP address and allows the last byte of the IP address to "
12362
"remain available for specifying hosts on the subnetwork."
12363
msgstr ""
12364
12365
#: serverguide/C/network-config.xml:671(para)
12366
msgid ""
12367
"<emphasis role=\"bold\">Network Address</emphasis> The Network Address "
12368
"represents the bytes comprising the network portion of an IP address. For "
12369
"example, the host 12.128.1.2 in a Class A network would use 12.0.0.0 as the "
12370
"network address, where twelve (12) represents the first byte of the IP "
12371
"address, (the network part) and zeroes (0) in all of the remaining three "
12372
"bytes to represent the potential host values. A network host using the "
12373
"private IP address 192.168.1.100 would in turn use a Network Address of "
12374
"192.168.1.0, which specifies the first three bytes of the Class C 192.168.1 "
12375
"network and a zero (0) for all the possible hosts on the network."
12376
msgstr ""
12377
12378
#: serverguide/C/network-config.xml:684(para)
12379
msgid ""
12380
"<emphasis role=\"bold\">Broadcast Address</emphasis> The Broadcast Address "
12381
"is an IP address which allows network data to be sent simultaneously to all "
12382
"hosts on a given subnetwork rather than specifying a particular host. The "
12383
"standard general broadcast address for IP networks is 255.255.255.255, but "
12384
"this broadcast address cannot be used to send a broadcast message to every "
12385
"host on the Internet because routers block it. A more appropriate broadcast "
12386
"address is set to match a specific subnetwork. For example, on the private "
12387
"Class C IP network, 192.168.1.0, the broadcast address is 192.168.1.255. "
12388
"Broadcast messages are typically produced by network protocols such as the "
12389
"Address Resolution Protocol (ARP) and the Routing Information Protocol (RIP)."
12390
msgstr ""
12391
12392
#: serverguide/C/network-config.xml:697(para)
12393
msgid ""
12394
"<emphasis role=\"bold\">Gateway Address</emphasis> A Gateway Address is the "
12395
"IP address through which a particular network, or host on a network, may be "
12396
"reached. If one network host wishes to communicate with another network "
12397
"host, and that host is not located on the same network, then a "
12398
"<emphasis>gateway</emphasis> must be used. In many cases, the Gateway "
12399
"Address will be that of a router on the same network, which will in turn "
12400
"pass traffic on to other networks or hosts, such as Internet hosts. The "
12401
"value of the Gateway Address setting must be correct, or your system will "
12402
"not be able to reach any hosts beyond those on the same network."
12403
msgstr ""
12404
12405
#: serverguide/C/network-config.xml:708(para)
12406
msgid ""
12407
"<emphasis role=\"bold\">Nameserver Address</emphasis> Nameserver Addresses "
12408
"represent the IP addresses of Domain Name Service (DNS) systems, which "
12409
"resolve network hostnames into IP addresses. There are three levels of "
12410
"Nameserver Addresses, which may be specified in order of precedence: The "
12411
"<emphasis>Primary</emphasis> Nameserver, the <emphasis>Secondary</emphasis> "
12412
"Nameserver, and the <emphasis>Tertiary</emphasis> Nameserver. In order for "
12413
"your system to be able to resolve network hostnames into their corresponding "
12414
"IP addresses, you must specify valid Nameserver Addresses which you are "
12415
"authorized to use in your system's TCP/IP configuration. In many cases these "
12416
"addresses can and will be provided by your network service provider, but "
12417
"many free and publicly accessible nameservers are available for use, such as "
12418
"the Level3 (Verizon) servers with IP addresses from 4.2.2.1 to 4.2.2.6."
12419
msgstr ""
12420
12421
#: serverguide/C/network-config.xml:722(para)
12422
msgid ""
12423
"The IP address, Netmask, Network Address, Broadcast Address, and Gateway "
12424
"Address are typically specified via the appropriate directives in the file "
12425
"<filename>/etc/network/interfaces</filename>. The Nameserver Addresses are "
12426
"typically specified via <emphasis>nameserver</emphasis> directives in the "
12427
"file <filename>/etc/resolv.conf</filename>. For more information, view the "
12428
"system manual page for <filename>interfaces</filename> or "
12429
"<filename>resolv.conf</filename> respectively, with the following commands "
12430
"typed at a terminal prompt:"
12431
msgstr ""
12432
12433
#: serverguide/C/network-config.xml:729(para)
12434
msgid ""
12435
"Access the system manual page for <filename>interfaces</filename> with the "
12436
"following command:"
12437
msgstr ""
12438
12439
#: serverguide/C/network-config.xml:734(command)
12440
msgid "man interfaces"
12441
msgstr ""
12442
12443
#: serverguide/C/network-config.xml:737(para)
12444
msgid ""
12445
"Access the system manual page for <filename>resolv.conf</filename> with the "
12446
"following command:"
12447
msgstr ""
12448
12449
#: serverguide/C/network-config.xml:741(command)
12450
msgid "man resolv.conf"
12451
msgstr ""
12452
12453
#: serverguide/C/network-config.xml:646(para)
12454
msgid ""
12455
"The common configuration elements of TCP/IP and their purposes are as "
12456
"follows: <placeholder-1/>"
12457
msgstr ""
12458
12459
#: serverguide/C/network-config.xml:748(title)
12460
msgid "IP Routing"
12461
msgstr ""
12462
12463
#: serverguide/C/network-config.xml:749(para)
12464
msgid ""
12465
"IP routing is a means of specifying and discovering paths in a TCP/IP "
12466
"network along which network data may be sent. Routing uses a set of "
12467
"<emphasis>routing tables</emphasis> to direct the forwarding of network data "
12468
"packets from their source to the destination, often via many intermediary "
12469
"network nodes known as <emphasis>routers</emphasis>. There are two primary "
12470
"forms of IP routing: <emphasis>Static Routing</emphasis> and "
12471
"<emphasis>Dynamic Routing.</emphasis>"
12472
msgstr ""
12473
12474
#: serverguide/C/network-config.xml:758(para)
12475
msgid ""
12476
"Static routing involves manually adding IP routes to the system's routing "
12477
"table, and this is usually done by manipulating the routing table with the "
12478
"<application>route</application> command. Static routing enjoys many "
12479
"advantages over dynamic routing, such as simplicity of implementation on "
12480
"smaller networks, predictability (the routing table is always computed in "
12481
"advance, and thus the route is precisely the same each time it is used), and "
12482
"low overhead on other routers and network links due to the lack of a dynamic "
12483
"routing protocol. However, static routing does present some disadvantages as "
12484
"well. For example, static routing is limited to small networks and does not "
12485
"scale well. Static routing also fails completely to adapt to network outages "
12486
"and failures along the route due to the fixed nature of the route."
12487
msgstr ""
12488
12489
#: serverguide/C/network-config.xml:768(para)
12490
msgid ""
12491
"Dynamic routing depends on large networks with multiple possible IP routes "
12492
"from a source to a destination and makes use of special routing protocols, "
12493
"such as the Router Information Protocol (RIP), which handle the automatic "
12494
"adjustments in routing tables that make dynamic routing possible. Dynamic "
12495
"routing has several advantages over static routing, such as superior "
12496
"scalability and the ability to adapt to failures and outages along network "
12497
"routes. Additionally, there is less manual configuration of the routing "
12498
"tables, since routers learn from one another about their existence and "
12499
"available routes. This trait also eliminates the possibility of introducing "
12500
"mistakes in the routing tables via human error. Dynamic routing is not "
12501
"perfect, however, and presents disadvantages such as heightened complexity "
12502
"and additional network overhead from router communications, which does not "
12503
"immediately benefit the end users, but still consumes network bandwidth."
12504
msgstr ""
12505
12506
#: serverguide/C/network-config.xml:782(title)
12507
msgid "TCP and UDP"
12508
msgstr ""
12509
12510
#: serverguide/C/network-config.xml:783(para)
12511
msgid ""
12512
"TCP is a connection-based protocol, offering error correction and guaranteed "
12513
"delivery of data via what is known as <emphasis>flow control</emphasis>. "
12514
"Flow control determines when the flow of a data stream needs to be stopped, "
12515
"and previously sent data packets should to be re-sent due to problems such "
12516
"as <emphasis>collisions</emphasis>, for example, thus ensuring complete and "
12517
"accurate delivery of the data. TCP is typically used in the exchange of "
12518
"important information such as database transactions."
12519
msgstr ""
12520
12521
#: serverguide/C/network-config.xml:791(para)
12522
msgid ""
12523
"The User Datagram Protocol (UDP), on the other hand, is a "
12524
"<emphasis>connectionless</emphasis> protocol which seldom deals with the "
12525
"transmission of important data because it lacks flow control or any other "
12526
"method to ensure reliable delivery of the data. UDP is commonly used in such "
12527
"applications as audio and video streaming, where it is considerably faster "
12528
"than TCP due to the lack of error correction and flow control, and where the "
12529
"loss of a few packets is not generally catastrophic."
12530
msgstr ""
12531
12532
#: serverguide/C/network-config.xml:801(title)
12533
msgid "ICMP"
12534
msgstr ""
12535
12536
#: serverguide/C/network-config.xml:802(para)
12537
msgid ""
12538
"The Internet Control Messaging Protocol (ICMP) is an extension to the "
12539
"Internet Protocol (IP) as defined in the Request For Comments (RFC) #792 and "
12540
"supports network packets containing control, error, and informational "
12541
"messages. ICMP is used by such network applications as the "
12542
"<application>ping</application> utility, which can determine the "
12543
"availability of a network host or device. Examples of some error messages "
12544
"returned by ICMP which are useful to both network hosts and devices such as "
12545
"routers, include <emphasis>Destination Unreachable</emphasis> and "
12546
"<emphasis>Time Exceeded</emphasis>."
12547
msgstr ""
12548
12549
#: serverguide/C/network-config.xml:812(title)
12550
msgid "Daemons"
12551
msgstr ""
12552
12553
#: serverguide/C/network-config.xml:813(para)
12554
msgid ""
12555
"Daemons are special system applications which typically execute continuously "
12556
"in the background and await requests for the functions they provide from "
12557
"other applications. Many daemons are network-centric; that is, a large "
12558
"number of daemons executing in the background on an Ubuntu system may "
12559
"provide network-related functionality. Some examples of such network daemons "
12560
"include the <emphasis>Hyper Text Transport Protocol Daemon</emphasis> "
12561
"(httpd), which provides web server functionality; the <emphasis>Secure SHell "
12562
"Daemon</emphasis> (sshd), which provides secure remote login shell and file "
12563
"transfer capabilities; and the <emphasis>Internet Message Access Protocol "
12564
"Daemon</emphasis> (imapd), which provides E-Mail services."
12565
msgstr ""
12566
12567
#: serverguide/C/network-config.xml:828(para)
12568
msgid ""
12569
"There are man pages for <ulink "
12570
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/tcp.7.html\">TCP</uli"
12571
"nk> and <ulink "
12572
"url=\"http://manpages.ubuntu.com/manpages/lucid/man7/ip.7.html\">IP</ulink> "
12573
"that contain more useful information."
12574
msgstr ""
12575
12576
#: serverguide/C/network-config.xml:834(para)
12577
msgid ""
12578
"Also, see the <ulink "
12579
"url=\"http://www.redbooks.ibm.com/abstracts/gg243376.html\">TCP/IP Tutorial "
12580
"and Technical Overview</ulink> IBM Redbook."
12581
msgstr ""
12582
12583
#: serverguide/C/network-config.xml:840(para)
12584
msgid ""
12585
"Another resource is O'Reilly's <ulink "
12586
"url=\"http://oreilly.com/catalog/9780596002978/\">TCP/IP Network "
12587
"Administration</ulink>."
12588
msgstr ""
12589
12590
#: serverguide/C/network-config.xml:849(title)
12591
msgid "Dynamic Host Configuration Protocol (DHCP)"
12592
msgstr ""
12593
12594
#: serverguide/C/network-config.xml:850(para)
12595
msgid ""
12596
"The Dynamic Host Configuration Protocol (DHCP) is a network service that "
12597
"enables host computers to be automatically assigned settings from a server "
12598
"as opposed to manually configuring each network host. Computers configured "
12599
"to be DHCP clients have no control over the settings they receive from the "
12600
"DHCP server, and the configuration is transparent to the computer's user."
12601
msgstr ""
12602
12603
#: serverguide/C/network-config.xml:857(para)
12604
msgid ""
12605
"The most common settings provided by a DHCP server to DHCP clients include:"
12606
msgstr ""
12607
12608
#: serverguide/C/network-config.xml:862(para)
12609
msgid "IP-Address and Netmask"
12610
msgstr ""
12611
12612
#: serverguide/C/network-config.xml:865(para)
12613
msgid "DNS"
12614
msgstr ""
12615
12616
#: serverguide/C/network-config.xml:868(para)
12617
msgid "WINS"
12618
msgstr ""
12619
12620
#: serverguide/C/network-config.xml:871(para)
12621
msgid ""
12622
"However, a DHCP server can also supply configuration properties such as:"
12623
msgstr ""
12624
12625
#: serverguide/C/network-config.xml:876(para)
12626
msgid "Host Name"
12627
msgstr ""
12628
12629
#: serverguide/C/network-config.xml:879(para)
12630
msgid "Domain Name"
12631
msgstr ""
12632
12633
#: serverguide/C/network-config.xml:882(para)
12634
msgid "Default Gateway"
12635
msgstr ""
12636
12637
#: serverguide/C/network-config.xml:885(para)
12638
msgid "Time Server"
12639
msgstr ""
12640
12641
#: serverguide/C/network-config.xml:888(para)
12642
msgid "Print Server"
12643
msgstr ""
12644
12645
#: serverguide/C/network-config.xml:891(para)
12646
msgid ""
12647
"The advantage of using DHCP is that changes to the network, for example a "
12648
"change in the address of the DNS server, need only be changed at the DHCP "
12649
"server, and all network hosts will be reconfigured the next time their DHCP "
12650
"clients poll the DHCP server. As an added advantage, it is also easier to "
12651
"integrate new computers into the network, as there is no need to check for "
12652
"the availability of an IP address. Conflicts in IP address allocation are "
12653
"also reduced."
12654
msgstr ""
12655
12656
#: serverguide/C/network-config.xml:899(para)
12657
msgid "A DHCP server can provide configuration settings using two methods:"
12658
msgstr ""
12659
12660
#: serverguide/C/network-config.xml:904(term)
12661
msgid "MAC Address"
12662
msgstr ""
12663
12664
#: serverguide/C/network-config.xml:906(para)
12665
msgid ""
12666
"This method entails using DHCP to identify the unique hardware address of "
12667
"each network card connected to the network and then continually supplying a "
12668
"constant configuration each time the DHCP client makes a request to the DHCP "
12669
"server using that network device."
12670
msgstr ""
12671
12672
#: serverguide/C/network-config.xml:915(term)
12673
msgid "Address Pool"
12674
msgstr ""
12675
12676
#: serverguide/C/network-config.xml:917(para)
12677
msgid ""
12678
"This method entails defining a pool (sometimes also called a range or scope) "
12679
"of IP addresses from which DHCP clients are supplied their configuration "
12680
"properties dynamically and on a \"first come, first served\" basis. When a "
12681
"DHCP client is no longer on the network for a specified period, the "
12682
"configuration is expired and released back to the address pool for use by "
12683
"other DHCP Clients."
12684
msgstr ""
12685
12686
#: serverguide/C/network-config.xml:928(para)
12687
msgid ""
12688
"Ubuntu is shipped with both DHCP server and client. The server is "
12689
"<application>dhcpd</application> (dynamic host configuration protocol "
12690
"daemon). The client provided with Ubuntu is "
12691
"<application>dhclient</application> and should be installed on all computers "
12692
"required to be automatically configured. Both programs are easy to install "
12693
"and configure and will be automatically started at system boot."
12694
msgstr ""
12695
12696
#: serverguide/C/network-config.xml:938(para)
12697
msgid ""
12698
"At a terminal prompt, enter the following command to install "
12699
"<application>dhcpd</application>:"
12700
msgstr ""
12701
12702
#: serverguide/C/network-config.xml:943(command)
12703
msgid "sudo apt-get install dhcp3-server"
12704
msgstr ""
12705
12706
#: serverguide/C/network-config.xml:945(para)
12707
msgid ""
12708
"You will probably need to change the default configuration by editing "
12709
"/etc/dhcp3/dhcpd.conf to suit your needs and particular configuration."
12710
msgstr ""
12711
12712
#: serverguide/C/network-config.xml:949(para)
12713
msgid ""
12714
"You also need to edit /etc/default/dhcp3-server to specify the interfaces "
12715
"dhcpd should listen to. By default it listens to eth0."
12716
msgstr ""
12717
12718
#: serverguide/C/network-config.xml:953(para)
12719
msgid ""
12720
"NOTE: dhcpd's messages are being sent to syslog. Look there for diagnostics "
12721
"messages."
12722
msgstr ""
12723
12724
#: serverguide/C/network-config.xml:960(para)
12725
msgid ""
12726
"The error message the installation ends with might be a little confusing, "
12727
"but the following steps will help you configure the service:"
12728
msgstr ""
12729
12730
#: serverguide/C/network-config.xml:964(para)
12731
msgid ""
12732
"Most commonly, what you want to do is assign an IP address randomly. This "
12733
"can be done with settings as follows:"
12734
msgstr ""
12735
12736
#: serverguide/C/network-config.xml:968(programlisting)
12737
#, no-wrap
12738
msgid ""
12739
"\n"
12740
"# Sample /etc/dhcpd.conf\n"
12741
"# (add your comments here) \n"
12742
"default-lease-time 600;\n"
12743
"max-lease-time 7200;\n"
12744
"option subnet-mask 255.255.255.0;\n"
12745
"option broadcast-address 192.168.1.255;\n"
12746
"option routers 192.168.1.254;\n"
12747
"option domain-name-servers 192.168.1.1, 192.168.1.2;\n"
12748
"option domain-name \"mydomain.example\";\n"
12749
"\n"
12750
"subnet 192.168.1.0 netmask 255.255.255.0 {\n"
12751
"range 192.168.1.10 192.168.1.100;\n"
12752
"range 192.168.1.150 192.168.1.200;\n"
12753
"} \n"
12754
msgstr ""
12755
12756
#: serverguide/C/network-config.xml:984(para)
12757
msgid ""
12758
"This will result in the DHCP server giving a client an IP address from the "
12759
"range 192.168.1.10-192.168.1.100 or 192.168.1.150-192.168.1.200. It will "
12760
"lease an IP address for 600 seconds if the client doesn't ask for a specific "
12761
"time frame. Otherwise the maximum (allowed) lease will be 7200 seconds. The "
12762
"server will also \"advise\" the client that it should use 255.255.255.0 as "
12763
"its subnet mask, 192.168.1.255 as its broadcast address, 192.168.1.254 as "
12764
"the router/gateway and 192.168.1.1 and 192.168.1.2 as its DNS servers."
12765
msgstr ""
12766
12767
#: serverguide/C/network-config.xml:993(para)
12768
msgid ""
12769
"If you need to specify a WINS server for your Windows clients, you will need "
12770
"to include the netbios-name-servers option, e.g."
12771
msgstr ""
12772
12773
#: serverguide/C/network-config.xml:997(programlisting)
12774
#, no-wrap
12775
msgid ""
12776
"\n"
12777
"option netbios-name-servers 192.168.1.1; \n"
12778
msgstr ""
12779
12780
#: serverguide/C/network-config.xml:1000(para)
12781
msgid ""
12782
"Dhcpd configuration settings are taken from the DHCP mini-HOWTO, which can "
12783
"be found <ulink "
12784
"url=\"http://www.tldp.org/HOWTO/DHCP/index.html\">here</ulink>."
12785
msgstr ""
12786
12787
#: serverguide/C/network-config.xml:1010(para)
12788
msgid ""
12789
"The <ulink url=\"https://help.ubuntu.com/community/dhcp3-server\">dhcp3-"
12790
"server Ubuntu Wiki</ulink> page has more information."
12791
msgstr ""
12792
12793
#: serverguide/C/network-config.xml:1015(para)
12794
msgid ""
12795
"For more <filename>/etc/dhcp3/dchpd.conf</filename> options see the <ulink "
12796
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/dhcpd.conf.5.html\">d"
12797
"hcpd.conf man page</ulink>."
12798
msgstr ""
12799
12800
#: serverguide/C/network-config.xml:1021(para)
12801
msgid ""
12802
"Also see the <ulink url=\"http://www.dhcp-handbook.com/dhcp_faq.html\">DHCP "
12803
"FAQ</ulink>"
12804
msgstr ""
12805
12806
#: serverguide/C/network-config.xml:1031(title)
12807
msgid "Time Synchronisation with NTP"
12808
msgstr ""
12809
12810
#: serverguide/C/network-config.xml:1032(para)
12811
msgid ""
12812
"This page describes methods for keeping your computer's time accurate. This "
12813
"is useful for servers, but is not necessary (or desirable) for desktop "
12814
"machines."
12815
msgstr ""
12816
12817
#: serverguide/C/network-config.xml:1035(para)
12818
msgid ""
12819
"NTP is a TCP/IP protocol for synchronising time over a network. Basically a "
12820
"client requests the current time from a server, and uses it to set its own "
12821
"clock."
12822
msgstr ""
12823
12824
#: serverguide/C/network-config.xml:1038(para)
12825
msgid ""
12826
"Behind this simple description, there is a lot of complexity - there are "
12827
"tiers of NTP servers, with the tier one NTP servers connected to atomic "
12828
"clocks (often via GPS), and tier two and three servers spreading the load of "
12829
"actually handling requests across the Internet. Also the client software is "
12830
"a lot more complex than you might think - it has to factor out communication "
12831
"delays, and adjust the time in a way that does not upset all the other "
12832
"processes that run on the server. But luckily all that complexity is hidden "
12833
"from you!"
12834
msgstr ""
12835
12836
#: serverguide/C/network-config.xml:1041(para)
12837
msgid ""
12838
"Ubuntu has two ways of automatically setting your time: ntpdate and ntpd."
12839
msgstr ""
12840
12841
#: serverguide/C/network-config.xml:1046(title)
12842
msgid "ntpdate"
12843
msgstr ""
12844
12845
#: serverguide/C/network-config.xml:1047(para)
12846
msgid ""
12847
"Ubuntu comes with ntpdate as standard, and will run it once at boot time to "
12848
"set up your time according to Ubuntu's NTP server. However, a server's clock "
12849
"is likely to drift considerably between reboots, so it makes sense to "
12850
"correct the time occasionally. The easiest way to do this is to get cron to "
12851
"run ntpdate every day. With your favorite editor, as root, create a file "
12852
"<code>/etc/cron.daily/ntpdate</code> containing:"
12853
msgstr ""
12854
12855
#: serverguide/C/network-config.xml:1052(screen)
12856
#, no-wrap
12857
msgid "ntpdate ntp.ubuntu.com\n"
12858
msgstr ""
12859
12860
#: serverguide/C/network-config.xml:1054(para)
12861
msgid ""
12862
"The file <code>/etc/cron.daily/ntpdate</code> must also be executable."
12863
msgstr ""
12864
12865
#: serverguide/C/network-config.xml:1057(screen)
12866
#, no-wrap
12867
msgid "sudo chmod 755 /etc/cron.daily/ntpdate\n"
12868
msgstr ""
12869
12870
#: serverguide/C/network-config.xml:1061(title)
12871
msgid "ntpd"
12872
msgstr ""
12873
12874
#: serverguide/C/network-config.xml:1062(para)
12875
msgid ""
12876
"ntpdate is a bit of a blunt instrument - it can only adjust the time once a "
12877
"day, in one big correction. The ntp daemon ntpd is far more subtle. It "
12878
"calculates the drift of your system clock and continuously adjusts it, so "
12879
"there are no large corrections that could lead to inconsistent logs for "
12880
"instance. The cost is a little processing power and memory, but for a modern "
12881
"server this is negligible."
12882
msgstr ""
12883
12884
#: serverguide/C/network-config.xml:1065(para)
12885
msgid "To set up ntpd:"
12886
msgstr ""
12887
12888
#: serverguide/C/network-config.xml:1066(screen)
12889
#, no-wrap
12890
msgid "sudo apt-get install ntp\n"
12891
msgstr ""
12892
12893
#: serverguide/C/network-config.xml:1071(title)
12894
msgid "Changing Time Servers"
12895
msgstr ""
12896
12897
#: serverguide/C/network-config.xml:1072(para)
12898
msgid ""
12899
"In both cases above, your system will use Ubuntu's NTP server at "
12900
"<code>ntp.ubuntu.com</code> by default. This is OK, but you might want to "
12901
"use several servers to increase accuracy and resilience, and you may want to "
12902
"use time servers that are geographically closer to you. to do this for "
12903
"ntpdate, change the contents of <code>/etc/cron.daily/ntpdate</code> to:"
12904
msgstr ""
12905
12906
#: serverguide/C/network-config.xml:1079(screen)
12907
#, no-wrap
12908
msgid "ntpdate ntp.ubuntu.com pool.ntp.org \n"
12909
msgstr ""
12910
12911
#: serverguide/C/network-config.xml:1081(para)
12912
msgid ""
12913
"And for ntpd edit <code>/etc/ntp.conf</code> to include additional server "
12914
"lines:"
12915
msgstr ""
12916
12917
#: serverguide/C/network-config.xml:1086(screen)
12918
#, no-wrap
12919
msgid ""
12920
"server ntp.ubuntu.com\n"
12921
"server pool.ntp.org\n"
12922
msgstr ""
12923
12924
#: serverguide/C/network-config.xml:1089(para)
12925
msgid ""
12926
"You may notice <code>pool.ntp.org</code> in the examples above. This is a "
12927
"really good idea which uses round-robin DNS to return an NTP server from a "
12928
"pool, spreading the load between several different servers. Even better, "
12929
"they have pools for different regions - for instance, if you are in New "
12930
"Zealand, so you could use <code>nz.pool.ntp.org</code> instead of "
12931
"<code>pool.ntp.org</code> . Look at <ulink "
12932
"url=\"http://www.pool.ntp.org/\">http://www.pool.ntp.org/</ulink> for more "
12933
"details."
12934
msgstr ""
12935
12936
#: serverguide/C/network-config.xml:1100(para)
12937
msgid ""
12938
"You can also Google for NTP servers in your region, and add these to your "
12939
"configuration. To test that a server works, just type <code>sudo ntpdate "
12940
"ntp.server.name</code> and see what happens."
12941
msgstr ""
12942
12943
#: serverguide/C/network-config.xml:1111(para)
12944
msgid ""
12945
"See the <ulink url=\"https://help.ubuntu.com/community/UbuntuTime\">Ubuntu "
12946
"Time</ulink> wiki page for more information."
12947
msgstr ""
12948
12949
#: serverguide/C/network-config.xml:1117(ulink)
12950
msgid "NTP Support"
12951
msgstr ""
12952
12953
#: serverguide/C/network-config.xml:1122(ulink)
12954
msgid "The NTP FAQ and HOWTO"
12955
msgstr ""
12956
12957
#: serverguide/C/network-auth.xml:13(title)
12958
msgid "Network Authentication"
12959
msgstr ""
12960
12961
#: serverguide/C/network-auth.xml:15(para)
12962
msgid "This section explains various Network Authentication protocols."
12963
msgstr ""
12964
12965
#: serverguide/C/network-auth.xml:19(title)
12966
msgid "OpenLDAP Server"
12967
msgstr ""
12968
12969
#: serverguide/C/network-auth.xml:20(para)
12970
msgid ""
12971
"LDAP is an acronym for Lightweight Directory Access Protocol, it is a "
12972
"simplified version of the X.500 protocol. The directory setup in this "
12973
"section will be used for authentication. Nevertheless, LDAP can be used in "
12974
"numerous ways: authentication, shared directory (for mail clients), address "
12975
"book, etc."
12976
msgstr ""
12977
12978
#: serverguide/C/network-auth.xml:28(para)
12979
msgid ""
12980
"To describe LDAP quickly, all information is stored in a tree structure. "
12981
"With <application>OpenLDAP</application> you have freedom to determine the "
12982
"directory arborescence (the Directory Information Tree: the DIT) yourself. "
12983
"We will begin with a basic tree containing two nodes below the root:"
12984
msgstr ""
12985
12986
#: serverguide/C/network-auth.xml:37(para)
12987
msgid "\"People\" node where your users will be stored"
12988
msgstr ""
12989
12990
#: serverguide/C/network-auth.xml:40(para)
12991
msgid "\"Groups\" node where your groups will be stored"
12992
msgstr ""
12993
12994
#: serverguide/C/network-auth.xml:44(para)
12995
msgid ""
12996
"Before beginning, you should determine what the root of your LDAP directory "
12997
"will be. By default, your tree will be determined by your Fully Qualified "
12998
"Domain Name (FQDN). If your domain is example.com (which we will use in this "
12999
"example), your root node will be dc=example,dc=com."
13000
msgstr ""
13001
13002
#: serverguide/C/network-auth.xml:54(para)
13003
msgid ""
13004
"First, install the <application>OpenLDAP</application> server daemon "
13005
"<application>slapd</application> and <application>ldap-utils</application>, "
13006
"a package containing LDAP management utilities:"
13007
msgstr ""
13008
13009
#: serverguide/C/network-auth.xml:60(command)
13010
msgid "sudo apt-get install slapd ldap-utils"
13011
msgstr ""
13012
13013
#: serverguide/C/network-auth.xml:63(para)
13014
msgid ""
13015
"By default <application>slapd</application> is configured with minimal "
13016
"options needed to run the <application>slapd</application> daemon."
13017
msgstr ""
13018
13019
#: serverguide/C/network-auth.xml:68(para)
13020
msgid ""
13021
"The configuration example in the following sections will match the domain "
13022
"name of the server. For example, if the machine's Fully Qualified Domain "
13023
"Name (FQDN) is ldap.example.com, the default suffix will be "
13024
"<emphasis>dc=example,dc=com</emphasis>."
13025
msgstr ""
13026
13027
#: serverguide/C/network-auth.xml:76(title)
13028
msgid "Populating LDAP"
13029
msgstr ""
13030
13031
#: serverguide/C/network-auth.xml:78(para)
13032
msgid ""
13033
"<application>OpenLDAP</application> uses a separate directory which contains "
13034
"the <emphasis>cn=config</emphasis> Directory Information Tree (DIT). The "
13035
"<emphasis>cn=config</emphasis> DIT is used to dynamically configure the "
13036
"<application>slapd</application> daemon, allowing the modification of schema "
13037
"definitions, indexes, ACLs, etc without stopping the service."
13038
msgstr ""
13039
13040
#: serverguide/C/network-auth.xml:86(para)
13041
msgid ""
13042
"The backend <emphasis>cn=config</emphasis> directory has only a minimal "
13043
"configuration and will need additional configuration options in order to "
13044
"populate the frontend directory. The frontend will be populated with a "
13045
"\"classical\" scheme that will be compatible with address book applications "
13046
"and with Unix Posix accounts. Posix accounts will allow authentication to "
13047
"various applications, such as web applications, email Mail Transfer Agent "
13048
"(MTA) applications, etc."
13049
msgstr ""
13050
13051
#: serverguide/C/network-auth.xml:95(para)
13052
msgid ""
13053
"For external applications to authenticate using LDAP they will each need to "
13054
"be specifically configured to do so. Refer to the individual application "
13055
"documentation for details."
13056
msgstr ""
13057
13058
#: serverguide/C/network-auth.xml:103(para)
13059
msgid ""
13060
"Remember to change <emphasis>dc=example,dc=com</emphasis> in the following "
13061
"examples to match your LDAP configuration."
13062
msgstr ""
13063
13064
#: serverguide/C/network-auth.xml:108(para)
13065
msgid ""
13066
"First, some additional schema files need to be loaded. In a terminal enter:"
13067
msgstr ""
13068
13069
#: serverguide/C/network-auth.xml:113(command) serverguide/C/network-auth.xml:702(command)
13070
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif"
13071
msgstr ""
13072
13073
#: serverguide/C/network-auth.xml:114(command) serverguide/C/network-auth.xml:703(command)
13074
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif"
13075
msgstr ""
13076
13077
#: serverguide/C/network-auth.xml:115(command) serverguide/C/network-auth.xml:704(command)
13078
msgid ""
13079
"sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif"
13080
msgstr ""
13081
13082
#: serverguide/C/network-auth.xml:118(para)
13083
msgid ""
13084
"Next, copy the following example LDIF file, naming it "
13085
"<filename>backend.example.com.ldif</filename>, somewhere on your system:"
13086
msgstr ""
13087
13088
#: serverguide/C/network-auth.xml:123(programlisting)
13089
#, no-wrap
13090
msgid ""
13091
"\n"
13092
"# Load dynamic backend modules\n"
13093
"dn: cn=module,cn=config\n"
13094
"objectClass: olcModuleList\n"
13095
"cn: module\n"
13096
"olcModulepath: /usr/lib/ldap\n"
13097
"olcModuleload: back_hdb\n"
13098
"\n"
13099
"# Database settings\n"
13100
"dn: olcDatabase=hdb,cn=config\n"
13101
"objectClass: olcDatabaseConfig\n"
13102
"objectClass: olcHdbConfig\n"
13103
"olcDatabase: {1}hdb\n"
13104
"olcSuffix: dc=example,dc=com\n"
13105
"olcDbDirectory: /var/lib/ldap\n"
13106
"olcRootDN: cn=admin,dc=example,dc=com\n"
13107
"olcRootPW: secret\n"
13108
"olcDbConfig: set_cachesize 0 2097152 0\n"
13109
"olcDbConfig: set_lk_max_objects 1500\n"
13110
"olcDbConfig: set_lk_max_locks 1500\n"
13111
"olcDbConfig: set_lk_max_lockers 1500\n"
13112
"olcDbIndex: objectClass eq\n"
13113
"olcLastMod: TRUE\n"
13114
"olcDbCheckpoint: 512 30\n"
13115
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13116
"by anonymous auth by self write by * none\n"
13117
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13118
"olcAccess: to dn.base=\"\" by * read\n"
13119
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13120
"\n"
13121
msgstr ""
13122
13123
#: serverguide/C/network-auth.xml:155(para)
13124
msgid ""
13125
"Change <emphasis>olcRootPW: secret</emphasis> to a password of your choosing."
13126
msgstr ""
13127
13128
#: serverguide/C/network-auth.xml:160(para)
13129
msgid "Now add the LDIF to the directory:"
13130
msgstr ""
13131
13132
#: serverguide/C/network-auth.xml:165(command) serverguide/C/network-auth.xml:746(command)
13133
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.example.com.ldif"
13134
msgstr ""
13135
13136
#: serverguide/C/network-auth.xml:168(para)
13137
msgid ""
13138
"The frontend directory is now ready to be populated. Create a "
13139
"<filename>frontend.example.com.ldif</filename> with the following contents:"
13140
msgstr ""
13141
13142
#: serverguide/C/network-auth.xml:173(programlisting)
13143
#, no-wrap
13144
msgid ""
13145
"\n"
13146
"# Create top-level object in domain\n"
13147
"dn: dc=example,dc=com\n"
13148
"objectClass: top\n"
13149
"objectClass: dcObject\n"
13150
"objectclass: organization\n"
13151
"o: Example Organization\n"
13152
"dc: Example\n"
13153
"description: LDAP Example \n"
13154
"\n"
13155
"# Admin user.\n"
13156
"dn: cn=admin,dc=example,dc=com\n"
13157
"objectClass: simpleSecurityObject\n"
13158
"objectClass: organizationalRole\n"
13159
"cn: admin\n"
13160
"description: LDAP administrator\n"
13161
"userPassword: secret\n"
13162
"\n"
13163
"dn: ou=people,dc=example,dc=com\n"
13164
"objectClass: organizationalUnit\n"
13165
"ou: people\n"
13166
"\n"
13167
"dn: ou=groups,dc=example,dc=com\n"
13168
"objectClass: organizationalUnit\n"
13169
"ou: groups\n"
13170
"\n"
13171
"dn: uid=john,ou=people,dc=example,dc=com\n"
13172
"objectClass: inetOrgPerson\n"
13173
"objectClass: posixAccount\n"
13174
"objectClass: shadowAccount\n"
13175
"uid: john\n"
13176
"sn: Doe\n"
13177
"givenName: John\n"
13178
"cn: John Doe\n"
13179
"displayName: John Doe\n"
13180
"uidNumber: 1000\n"
13181
"gidNumber: 10000\n"
13182
"userPassword: password\n"
13183
"gecos: John Doe\n"
13184
"loginShell: /bin/bash\n"
13185
"homeDirectory: /home/john\n"
13186
"shadowExpire: -1\n"
13187
"shadowFlag: 0\n"
13188
"shadowWarning: 7\n"
13189
"shadowMin: 8\n"
13190
"shadowMax: 999999\n"
13191
"shadowLastChange: 10877\n"
13192
"mail: john.doe@example.com\n"
13193
"postalCode: 31000\n"
13194
"l: Toulouse\n"
13195
"o: Example\n"
13196
"mobile: +33 (0)6 xx xx xx xx\n"
13197
"homePhone: +33 (0)5 xx xx xx xx\n"
13198
"title: System Administrator\n"
13199
"postalAddress: \n"
13200
"initials: JD\n"
13201
"\n"
13202
"dn: cn=example,ou=groups,dc=example,dc=com\n"
13203
"objectClass: posixGroup\n"
13204
"cn: example\n"
13205
"gidNumber: 10000\n"
13206
msgstr ""
13207
13208
#: serverguide/C/network-auth.xml:236(para)
13209
msgid ""
13210
"In this example the directory structure, a user, and a group have been "
13211
"setup. In other examples you might see the <emphasis>objectClass: "
13212
"top</emphasis> added in every entry, but that is the default behaviour so "
13213
"you do not have to add it explicitly."
13214
msgstr ""
13215
13216
#: serverguide/C/network-auth.xml:243(para)
13217
msgid "Add the entries to the LDAP directory:"
13218
msgstr ""
13219
13220
#: serverguide/C/network-auth.xml:249(command) serverguide/C/network-auth.xml:757(command)
13221
msgid ""
13222
"sudo ldapadd -x -D cn=admin,dc=example,dc=com -W -f frontend.example.com.ldif"
13223
msgstr ""
13224
13225
#: serverguide/C/network-auth.xml:252(para)
13226
msgid ""
13227
"We can check that the content has been correctly added with the "
13228
"<application>ldapsearch</application> utility. Execute a search of the LDAP "
13229
"directory:"
13230
msgstr ""
13231
13232
#: serverguide/C/network-auth.xml:258(command)
13233
msgid "ldapsearch -xLLL -b \"dc=example,dc=com\" uid=john sn givenName cn"
13234
msgstr ""
13235
13236
#: serverguide/C/network-auth.xml:259(computeroutput)
13237
#, no-wrap
13238
msgid ""
13239
"\n"
13240
"dn: uid=john,ou=people,dc=example,dc=com\n"
13241
"cn: John Doe\n"
13242
"sn: Doe\n"
13243
"givenName: John\n"
13244
msgstr ""
13245
13246
#: serverguide/C/network-auth.xml:267(para)
13247
msgid "Just a quick explanation:"
13248
msgstr ""
13249
13250
#: serverguide/C/network-auth.xml:273(para)
13251
msgid ""
13252
"<emphasis>-x:</emphasis> will not use SASL authentication method, which is "
13253
"the default."
13254
msgstr ""
13255
13256
#: serverguide/C/network-auth.xml:279(para)
13257
msgid "<emphasis>-LLL:</emphasis> disable printing LDIF schema information."
13258
msgstr ""
13259
13260
#: serverguide/C/network-auth.xml:287(title)
13261
msgid "Further Configuration"
13262
msgstr ""
13263
13264
#: serverguide/C/network-auth.xml:290(para)
13265
msgid ""
13266
"The <emphasis>cn=config</emphasis> tree can be manipulated using the "
13267
"utilities in the <application>ldap-utils</application> package. For example:"
13268
msgstr ""
13269
13270
#: serverguide/C/network-auth.xml:298(para)
13271
msgid ""
13272
"Use <application>ldapsearch</application> to view the tree, entering the "
13273
"admin password set during installation or reconfiguration:"
13274
msgstr ""
13275
13276
#: serverguide/C/network-auth.xml:304(command)
13277
msgid "sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn"
13278
msgstr ""
13279
13280
#: serverguide/C/network-auth.xml:308(computeroutput)
13281
#, no-wrap
13282
msgid ""
13283
"\n"
13284
"SASL/EXTERNAL authentication started\n"
13285
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13286
"SASL SSF: 0\n"
13287
"dn: cn=config\n"
13288
"\n"
13289
"dn: cn=module{0},cn=config\n"
13290
"\n"
13291
"dn: cn=schema,cn=config\n"
13292
"\n"
13293
"dn: cn={0}core,cn=schema,cn=config\n"
13294
"\n"
13295
"dn: cn={1}cosine,cn=schema,cn=config\n"
13296
"\n"
13297
"dn: cn={2}nis,cn=schema,cn=config\n"
13298
"\n"
13299
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
13300
"\n"
13301
"dn: olcDatabase={-1}frontend,cn=config\n"
13302
"\n"
13303
"dn: olcDatabase={0}config,cn=config\n"
13304
"\n"
13305
"dn: olcDatabase={1}hdb,cn=config\n"
13306
msgstr ""
13307
13308
#: serverguide/C/network-auth.xml:334(para)
13309
msgid ""
13310
"The output above is the current configuration options for the "
13311
"<emphasis>cn=config</emphasis> backend database. Your output may be vary."
13312
msgstr ""
13313
13314
#: serverguide/C/network-auth.xml:342(para)
13315
msgid ""
13316
"As an example of modifying the <emphasis>cn=config</emphasis> tree, add "
13317
"another attribute to the index list using "
13318
"<application>ldapmodify</application>:"
13319
msgstr ""
13320
13321
#: serverguide/C/network-auth.xml:348(command) serverguide/C/network-auth.xml:984(command) serverguide/C/network-auth.xml:1155(command) serverguide/C/network-auth.xml:1191(command)
13322
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:///"
13323
msgstr ""
13324
13325
#: serverguide/C/network-auth.xml:356(userinput)
13326
#, no-wrap
13327
msgid ""
13328
"dn: olcDatabase={1}hdb,cn=config\n"
13329
"add: olcDbIndex\n"
13330
"olcDbIndex: uidNumber eq"
13331
msgstr ""
13332
13333
#: serverguide/C/network-auth.xml:352(computeroutput)
13334
#, no-wrap
13335
msgid ""
13336
"\n"
13337
"SASL/EXTERNAL authentication started\n"
13338
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13339
"SASL SSF: 0\n"
13340
"<placeholder-1/>\n"
13341
"\n"
13342
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13343
msgstr ""
13344
13345
#: serverguide/C/network-auth.xml:364(para)
13346
msgid ""
13347
"Once the modification has completed, press <emphasis>Ctrl+D</emphasis> to "
13348
"exit the utility."
13349
msgstr ""
13350
13351
#: serverguide/C/network-auth.xml:371(para)
13352
msgid ""
13353
"<application>ldapmodify</application> can also read the changes from a file. "
13354
"Copy and paste the following into a file named "
13355
"<filename>uid_index.ldif</filename>:"
13356
msgstr ""
13357
13358
#: serverguide/C/network-auth.xml:376(programlisting)
13359
#, no-wrap
13360
msgid ""
13361
"\n"
13362
"dn: olcDatabase={1}hdb,cn=config\n"
13363
"add: olcDbIndex\n"
13364
"olcDbIndex: uid eq,pres,sub\n"
13365
msgstr ""
13366
13367
#: serverguide/C/network-auth.xml:382(para)
13368
msgid "Then execute <application>ldapmodify</application>:"
13369
msgstr ""
13370
13371
#: serverguide/C/network-auth.xml:387(command)
13372
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f uid_index.ldif"
13373
msgstr ""
13374
13375
#: serverguide/C/network-auth.xml:391(computeroutput)
13376
#, no-wrap
13377
msgid ""
13378
"\n"
13379
"SASL/EXTERNAL authentication started\n"
13380
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13381
"SASL SSF: 0\n"
13382
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13383
msgstr ""
13384
13385
#: serverguide/C/network-auth.xml:399(para)
13386
msgid "The file method is very useful for large changes."
13387
msgstr ""
13388
13389
#: serverguide/C/network-auth.xml:406(para)
13390
msgid ""
13391
"Adding additional <emphasis>schemas</emphasis> to "
13392
"<application>slapd</application> requires the schema to be converted to LDIF "
13393
"format. The <filename role=\"directory\">/etc/ldap/schema</filename> "
13394
"directory contains some schema files already converted to LDIF format as "
13395
"demonstrated in the previous section. Fortunately, the "
13396
"<application>slapd</application> program can be used to automate the "
13397
"conversion. The following example will add the "
13398
"<emphasis>dyngoup.schema</emphasis>:"
13399
msgstr ""
13400
13401
#: serverguide/C/network-auth.xml:416(para)
13402
msgid ""
13403
"First, create a conversion <filename>schema_convert.conf</filename> file "
13404
"containing the following lines:"
13405
msgstr ""
13406
13407
#: serverguide/C/network-auth.xml:421(programlisting)
13408
#, no-wrap
13409
msgid ""
13410
"\n"
13411
"include /etc/ldap/schema/core.schema\n"
13412
"include /etc/ldap/schema/collective.schema\n"
13413
"include /etc/ldap/schema/corba.schema\n"
13414
"include /etc/ldap/schema/cosine.schema\n"
13415
"include /etc/ldap/schema/duaconf.schema\n"
13416
"include /etc/ldap/schema/dyngroup.schema\n"
13417
"include /etc/ldap/schema/inetorgperson.schema\n"
13418
"include /etc/ldap/schema/java.schema\n"
13419
"include /etc/ldap/schema/misc.schema\n"
13420
"include /etc/ldap/schema/nis.schema\n"
13421
"include /etc/ldap/schema/openldap.schema\n"
13422
"include /etc/ldap/schema/ppolicy.schema\n"
13423
msgstr ""
13424
13425
#: serverguide/C/network-auth.xml:439(para) serverguide/C/network-auth.xml:1655(para)
13426
msgid "Next, create a temporary directory to hold the output:"
13427
msgstr ""
13428
13429
#: serverguide/C/network-auth.xml:444(command) serverguide/C/network-auth.xml:1660(command) serverguide/C/network-auth.xml:2695(command)
13430
msgid "mkdir /tmp/ldif_output"
13431
msgstr ""
13432
13433
#: serverguide/C/network-auth.xml:450(para)
13434
msgid ""
13435
"Now using <application>slapcat</application> convert the schema files to "
13436
"LDIF:"
13437
msgstr ""
13438
13439
#: serverguide/C/network-auth.xml:455(command)
13440
msgid ""
13441
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
13442
"\"cn={5}dyngroup,cn=schema,cn=config\" > /tmp/cn=dyngroup.ldif"
13443
msgstr ""
13444
13445
#: serverguide/C/network-auth.xml:458(para)
13446
msgid ""
13447
"Adjust the configuration file name and temporary directory names if yours "
13448
"are different. Also, it may be worthwhile to keep the "
13449
"<filename>ldif_output</filename> directory around in case you want to add "
13450
"additional schemas in the future."
13451
msgstr ""
13452
13453
#: serverguide/C/network-auth.xml:467(para)
13454
msgid ""
13455
"Edit the <filename>/tmp/cn\\=dyngroup.ldif</filename> file, changing the "
13456
"following attributes:"
13457
msgstr ""
13458
13459
#: serverguide/C/network-auth.xml:471(programlisting)
13460
#, no-wrap
13461
msgid ""
13462
"\n"
13463
"dn: cn=dyngroup,cn=schema,cn=config\n"
13464
"...\n"
13465
"cn: dyngroup\n"
13466
msgstr ""
13467
13468
#: serverguide/C/network-auth.xml:477(para) serverguide/C/network-auth.xml:1691(para)
13469
msgid "And remove the following lines from the bottom of the file:"
13470
msgstr ""
13471
13472
#: serverguide/C/network-auth.xml:481(programlisting)
13473
#, no-wrap
13474
msgid ""
13475
"\n"
13476
"structuralObjectClass: olcSchemaConfig\n"
13477
"entryUUID: 10dae0ea-0760-102d-80d3-f9366b7f7757\n"
13478
"creatorsName: cn=config\n"
13479
"createTimestamp: 20080826021140Z\n"
13480
"entryCSN: 20080826021140.791425Z#000000#000#000000\n"
13481
"modifiersName: cn=config\n"
13482
"modifyTimestamp: 20080826021140Z\n"
13483
msgstr ""
13484
13485
#: serverguide/C/network-auth.xml:492(para) serverguide/C/network-auth.xml:1706(para) serverguide/C/network-auth.xml:2741(para)
13486
msgid ""
13487
"The attribute values will vary, just be sure the attributes are removed."
13488
msgstr ""
13489
13490
#: serverguide/C/network-auth.xml:500(para) serverguide/C/network-auth.xml:1714(para)
13491
msgid ""
13492
"Finally, using the <application>ldapadd</application> utility, add the new "
13493
"schema to the directory:"
13494
msgstr ""
13495
13496
#: serverguide/C/network-auth.xml:506(command)
13497
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/cn\\=dyngroup.ldif"
13498
msgstr ""
13499
13500
#: serverguide/C/network-auth.xml:512(para)
13501
msgid ""
13502
"There should now be a <emphasis>dn: "
13503
"cn={4}dyngroup,cn=schema,cn=config</emphasis> entry in the cn=config tree."
13504
msgstr ""
13505
13506
#: serverguide/C/network-auth.xml:522(title)
13507
msgid "LDAP Replication"
13508
msgstr ""
13509
13510
#: serverguide/C/network-auth.xml:524(para)
13511
msgid ""
13512
"LDAP often quickly becomes a highly critical service to the network. "
13513
"Multiple systems will come to depend on LDAP for authentication, "
13514
"authorization, configuration, etc. It is a good idea to setup a redundant "
13515
"system through replication."
13516
msgstr ""
13517
13518
#: serverguide/C/network-auth.xml:530(para)
13519
msgid ""
13520
"Replication is achieved using the <emphasis>Syncrepl</emphasis> engine. "
13521
"Syncrepl allows the changes to be synced using a "
13522
"<emphasis>consumer</emphasis>, <emphasis>provider</emphasis> model. A "
13523
"provider sends directory changes to consumers."
13524
msgstr ""
13525
13526
#: serverguide/C/network-auth.xml:537(title)
13527
msgid "Provider Configuration"
13528
msgstr ""
13529
13530
#: serverguide/C/network-auth.xml:539(para)
13531
msgid ""
13532
"The following is an example of a <emphasis>Single-Master</emphasis> "
13533
"configuration. In this configuration one OpenLDAP server is configured as a "
13534
"<emphasis>provider</emphasis> and another as a <emphasis>consumer</emphasis>."
13535
msgstr ""
13536
13537
#: serverguide/C/network-auth.xml:547(para)
13538
msgid ""
13539
"First, configure the provider server. Copy the following to a file named "
13540
"<filename>provider_sync.ldif</filename>:"
13541
msgstr ""
13542
13543
#: serverguide/C/network-auth.xml:552(programlisting)
13544
#, no-wrap
13545
msgid ""
13546
"\n"
13547
"# Add indexes to the frontend db.\n"
13548
"dn: olcDatabase={1}hdb,cn=config\n"
13549
"changetype: modify\n"
13550
"add: olcDbIndex\n"
13551
"olcDbIndex: entryCSN eq\n"
13552
"-\n"
13553
"add: olcDbIndex\n"
13554
"olcDbIndex: entryUUID eq\n"
13555
"\n"
13556
"#Load the syncprov and accesslog modules.\n"
13557
"dn: cn=module{0},cn=config\n"
13558
"changetype: modify\n"
13559
"add: olcModuleLoad\n"
13560
"olcModuleLoad: syncprov\n"
13561
"-\n"
13562
"add: olcModuleLoad\n"
13563
"olcModuleLoad: accesslog\n"
13564
"\n"
13565
"# Accesslog database definitions\n"
13566
"dn: olcDatabase={2}hdb,cn=config\n"
13567
"objectClass: olcDatabaseConfig\n"
13568
"objectClass: olcHdbConfig\n"
13569
"olcDatabase: {2}hdb\n"
13570
"olcDbDirectory: /var/lib/ldap/accesslog\n"
13571
"olcSuffix: cn=accesslog\n"
13572
"olcRootDN: cn=admin,dc=example,dc=com\n"
13573
"olcDbIndex: default eq\n"
13574
"olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart\n"
13575
"\n"
13576
"# Accesslog db syncprov.\n"
13577
"dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config\n"
13578
"changetype: add\n"
13579
"objectClass: olcOverlayConfig\n"
13580
"objectClass: olcSyncProvConfig\n"
13581
"olcOverlay: syncprov\n"
13582
"olcSpNoPresent: TRUE\n"
13583
"olcSpReloadHint: TRUE\n"
13584
"\n"
13585
"# syncrepl Provider for primary db\n"
13586
"dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config\n"
13587
"changetype: add\n"
13588
"objectClass: olcOverlayConfig\n"
13589
"objectClass: olcSyncProvConfig\n"
13590
"olcOverlay: syncprov\n"
13591
"olcSpNoPresent: TRUE\n"
13592
"\n"
13593
"# accesslog overlay definitions for primary db\n"
13594
"dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config\n"
13595
"objectClass: olcOverlayConfig\n"
13596
"objectClass: olcAccessLogConfig\n"
13597
"olcOverlay: accesslog\n"
13598
"olcAccessLogDB: cn=accesslog\n"
13599
"olcAccessLogOps: writes\n"
13600
"olcAccessLogSuccess: TRUE\n"
13601
"# scan the accesslog DB every day, and purge entries older than 7 days\n"
13602
"olcAccessLogPurge: 07+00:00 01+00:00\n"
13603
msgstr ""
13604
13605
#: serverguide/C/network-auth.xml:614(para)
13606
msgid ""
13607
"The <application>AppArmor</application> profile for "
13608
"<application>slapd</application> will need to be adjusted for the accesslog "
13609
"database location. Edit <filename>/etc/apparmor.d/usr.sbin.slapd</filename> "
13610
"adding:"
13611
msgstr ""
13612
13613
#: serverguide/C/network-auth.xml:619(programlisting)
13614
#, no-wrap
13615
msgid ""
13616
"\n"
13617
" /var/lib/ldap/accesslog/ r,\n"
13618
" /var/lib/ldap/accesslog/** rwk,\n"
13619
msgstr ""
13620
13621
#: serverguide/C/network-auth.xml:624(para)
13622
msgid ""
13623
"Then create the directory, reload the <application>apparmor</application> "
13624
"profile, and copy the <filename>DB_CONFIG</filename> file:"
13625
msgstr ""
13626
13627
#: serverguide/C/network-auth.xml:630(command)
13628
msgid "sudo -u openldap mkdir /var/lib/ldap/accesslog"
13629
msgstr ""
13630
13631
#: serverguide/C/network-auth.xml:631(command)
13632
msgid "sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog/"
13633
msgstr ""
13634
13635
#: serverguide/C/network-auth.xml:636(para)
13636
msgid ""
13637
"Using the <emphasis>-u openldap</emphasis> option with the "
13638
"<application>sudo</application> commands above removes the need to adjust "
13639
"permissions for the new directory later."
13640
msgstr ""
13641
13642
#: serverguide/C/network-auth.xml:645(para)
13643
msgid ""
13644
"Edit the file and change the <emphasis>olcRootDN</emphasis> to match your "
13645
"directory:"
13646
msgstr ""
13647
13648
#: serverguide/C/network-auth.xml:649(programlisting)
13649
#, no-wrap
13650
msgid ""
13651
"\n"
13652
"olcRootDN: cn=admin,dc=example,dc=com\n"
13653
msgstr ""
13654
13655
#: serverguide/C/network-auth.xml:657(para)
13656
msgid ""
13657
"Next, add the LDIF file using the <application>ldapadd</application> utility:"
13658
msgstr ""
13659
13660
#: serverguide/C/network-auth.xml:662(command)
13661
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif"
13662
msgstr ""
13663
13664
#: serverguide/C/network-auth.xml:669(para)
13665
msgid "Restart <application>slapd</application>:"
13666
msgstr ""
13667
13668
#: serverguide/C/network-auth.xml:674(command) serverguide/C/network-auth.xml:1040(command) serverguide/C/network-auth.xml:1227(command)
13669
msgid "sudo /etc/init.d/slapd restart"
13670
msgstr ""
13671
13672
#: serverguide/C/network-auth.xml:680(para)
13673
msgid ""
13674
"The <emphasis>Provider</emphasis> server is now configured, and it is time "
13675
"to configure a <emphasis>Consumer</emphasis> server."
13676
msgstr ""
13677
13678
#: serverguide/C/network-auth.xml:687(title)
13679
msgid "Consumer Configuration"
13680
msgstr ""
13681
13682
#: serverguide/C/network-auth.xml:692(para)
13683
msgid ""
13684
"On the <emphasis>Consumer</emphasis> server configure it the same as the "
13685
"<emphasis>Provider</emphasis> except for the <emphasis>Syncrepl</emphasis> "
13686
"configuration steps."
13687
msgstr ""
13688
13689
#: serverguide/C/network-auth.xml:697(para)
13690
msgid "Add the additional schema files:"
13691
msgstr ""
13692
13693
#: serverguide/C/network-auth.xml:707(para)
13694
msgid ""
13695
"Also, create, or copy from the provider server, the "
13696
"<filename>backend.example.com.ldif</filename>"
13697
msgstr ""
13698
13699
#: serverguide/C/network-auth.xml:711(programlisting)
13700
#, no-wrap
13701
msgid ""
13702
"\n"
13703
"# Load dynamic backend modules\n"
13704
"dn: cn=module,cn=config\n"
13705
"objectClass: olcModuleList\n"
13706
"cn: module\n"
13707
"olcModulepath: /usr/lib/ldap\n"
13708
"olcModuleload: back_hdb\n"
13709
"\n"
13710
"# Database settings\n"
13711
"dn: olcDatabase=hdb,cn=config\n"
13712
"objectClass: olcDatabaseConfig\n"
13713
"objectClass: olcHdbConfig\n"
13714
"olcDatabase: {1}hdb\n"
13715
"olcSuffix: dc=example,dc=com\n"
13716
"olcDbDirectory: /var/lib/ldap\n"
13717
"olcRootDN: cn=admin,dc=example,dc=com\n"
13718
"olcRootPW: secret\n"
13719
"olcDbConfig: set_cachesize 0 2097152 0\n"
13720
"olcDbConfig: set_lk_max_objects 1500\n"
13721
"olcDbConfig: set_lk_max_locks 1500\n"
13722
"olcDbConfig: set_lk_max_lockers 1500\n"
13723
"olcDbIndex: objectClass eq\n"
13724
"olcLastMod: TRUE\n"
13725
"olcDbCheckpoint: 512 30\n"
13726
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13727
"by anonymous auth by self write by * none\n"
13728
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13729
"olcAccess: to dn.base=\"\" by * read\n"
13730
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13731
msgstr ""
13732
13733
#: serverguide/C/network-auth.xml:741(para)
13734
msgid "And add the LDIF by entering:"
13735
msgstr ""
13736
13737
#: serverguide/C/network-auth.xml:752(para)
13738
msgid ""
13739
"Do the same with the <filename>frontend.example.com.ldif</filename> file "
13740
"listed above, and add it:"
13741
msgstr ""
13742
13743
#: serverguide/C/network-auth.xml:760(para)
13744
msgid ""
13745
"The two severs should now have the same configuration except for the "
13746
"<emphasis>Syncrepl</emphasis> options."
13747
msgstr ""
13748
13749
#: serverguide/C/network-auth.xml:768(para)
13750
msgid ""
13751
"Now create a file named <filename>consumer_sync.ldif</filename> containing:"
13752
msgstr ""
13753
13754
#: serverguide/C/network-auth.xml:772(programlisting)
13755
#, no-wrap
13756
msgid ""
13757
"\n"
13758
"#Load the syncprov module.\n"
13759
"dn: cn=module{0},cn=config\n"
13760
"changetype: modify\n"
13761
"add: olcModuleLoad\n"
13762
"olcModuleLoad: syncprov\n"
13763
"\n"
13764
"# syncrepl specific indices\n"
13765
"dn: olcDatabase={1}hdb,cn=config\n"
13766
"changetype: modify\n"
13767
"add: olcDbIndex\n"
13768
"olcDbIndex: entryUUID eq\n"
13769
"-\n"
13770
"add: olcSyncRepl\n"
13771
"olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
13772
"binddn=\"cn=admin,dc=example,dc=com\" \n"
13773
" credentials=secret searchbase=\"dc=example,dc=com\" "
13774
"logbase=\"cn=accesslog\" \n"
13775
" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" "
13776
"schemachecking=on \n"
13777
" type=refreshAndPersist retry=\"60 +\" syncdata=accesslog\n"
13778
"-\n"
13779
"add: olcUpdateRef\n"
13780
"olcUpdateRef: ldap://ldap01.example.com\n"
13781
msgstr ""
13782
13783
#: serverguide/C/network-auth.xml:795(para)
13784
msgid "You will probably want to change the following attributes:"
13785
msgstr ""
13786
13787
#: serverguide/C/network-auth.xml:800(para)
13788
msgid "<emphasis>ldap01.example.com</emphasis> to your server's hostname."
13789
msgstr ""
13790
13791
#: serverguide/C/network-auth.xml:801(emphasis)
13792
msgid "binddn"
13793
msgstr ""
13794
13795
#: serverguide/C/network-auth.xml:802(emphasis)
13796
msgid "credentials"
13797
msgstr ""
13798
13799
#: serverguide/C/network-auth.xml:803(emphasis)
13800
msgid "searchbase"
13801
msgstr ""
13802
13803
#: serverguide/C/network-auth.xml:804(emphasis)
13804
msgid "olcUpdateRef:"
13805
msgstr ""
13806
13807
#: serverguide/C/network-auth.xml:810(para)
13808
msgid "Add the LDIF file to the configuration tree:"
13809
msgstr ""
13810
13811
#: serverguide/C/network-auth.xml:815(command)
13812
msgid "sudo ldapadd -c -Y EXTERNAL -H ldapi:/// -f consumer_sync.ldif"
13813
msgstr ""
13814
13815
#: serverguide/C/network-auth.xml:821(para)
13816
msgid ""
13817
"The frontend database should now sync between servers. You can add "
13818
"additional servers using the steps above as the need arises."
13819
msgstr ""
13820
13821
#: serverguide/C/network-auth.xml:831(programlisting)
13822
#, no-wrap
13823
msgid "127.0.0.1\tldap01.example.com ldap01"
13824
msgstr ""
13825
13826
#: serverguide/C/network-auth.xml:827(para)
13827
msgid ""
13828
"The <application>slapd</application> daemon will send log information to "
13829
"<filename>/var/log/syslog</filename> by default. So if all does "
13830
"<emphasis>not</emphasis> go well check there for errors and other "
13831
"troubleshooting information. Also, be sure that each server knows it's Fully "
13832
"Qualified Domain Name (FQDN). This is configured in "
13833
"<filename>/etc/hosts</filename> with a line similar to: <placeholder-1/>."
13834
msgstr ""
13835
13836
#: serverguide/C/network-auth.xml:839(title)
13837
msgid "Setting up ACL"
13838
msgstr ""
13839
13840
#: serverguide/C/network-auth.xml:841(para)
13841
msgid ""
13842
"Authentication requires access to the password field, that should be not "
13843
"accessible by default. Also, in order for users to change their own "
13844
"password, using <command>passwd</command> or other utilities, "
13845
"<emphasis>shadowLastChange</emphasis> needs to be accessible once a user has "
13846
"authenticated."
13847
msgstr ""
13848
13849
#: serverguide/C/network-auth.xml:848(para)
13850
msgid ""
13851
"To view the Access Control List (ACL), use the "
13852
"<application>ldapsearch</application> utility:"
13853
msgstr ""
13854
13855
#: serverguide/C/network-auth.xml:853(command)
13856
msgid ""
13857
"ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb "
13858
"olcAccess"
13859
msgstr ""
13860
13861
#: serverguide/C/network-auth.xml:857(computeroutput)
13862
#, no-wrap
13863
msgid ""
13864
"Enter LDAP Password: \n"
13865
"dn: olcDatabase={1}hdb,cn=config\n"
13866
"olcAccess: {0}to attrs=userPassword,shadowLastChange by "
13867
"dn=\"cn=admin,dc=exampl\n"
13868
" e,dc=com\" write by anonymous auth by self write by * none\n"
13869
"olcAccess: {1}to dn.base=\"\" by * read\n"
13870
"olcAccess: {2}to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13871
msgstr ""
13872
13873
#: serverguide/C/network-auth.xml:869(title)
13874
msgid "TLS and SSL"
13875
msgstr ""
13876
13877
#: serverguide/C/network-auth.xml:871(para)
13878
msgid ""
13879
"When authenticating to an OpenLDAP server it is best to do so using an "
13880
"encrypted session. This can be accomplished using Transport Layer Security "
13881
"(TLS) and/or Secure Sockets Layer (SSL)."
13882
msgstr ""
13883
13884
#: serverguide/C/network-auth.xml:876(para)
13885
msgid ""
13886
"The first step in the process is to obtain or create a "
13887
"<emphasis>certificate</emphasis>. Because <application>slapd</application> "
13888
"is compiled using the <application>gnutls</application> library, the "
13889
"<application>certtool</application> utility will be used to create "
13890
"certificates."
13891
msgstr ""
13892
13893
#: serverguide/C/network-auth.xml:885(para)
13894
msgid ""
13895
"First, install <application>gnutls-bin</application> by entering the "
13896
"following in a terminal:"
13897
msgstr ""
13898
13899
#: serverguide/C/network-auth.xml:890(command)
13900
msgid "sudo apt-get install gnutls-bin"
13901
msgstr ""
13902
13903
#: serverguide/C/network-auth.xml:896(para)
13904
msgid ""
13905
"Next, create a private key for the <emphasis>Certificate "
13906
"Authority</emphasis> (CA):"
13907
msgstr ""
13908
13909
#: serverguide/C/network-auth.xml:901(command)
13910
msgid ""
13911
"sudo sh -c \"certtool --generate-privkey > /etc/ssl/private/cakey.pem\""
13912
msgstr ""
13913
13914
#: serverguide/C/network-auth.xml:907(para)
13915
msgid ""
13916
"Create a <filename>/etc/ssl/ca.info</filename> details file to self-sign the "
13917
"CA certificate containing:"
13918
msgstr ""
13919
13920
#: serverguide/C/network-auth.xml:911(programlisting)
13921
#, no-wrap
13922
msgid ""
13923
"\n"
13924
"cn = Example Company\n"
13925
"ca\n"
13926
"cert_signing_key\n"
13927
msgstr ""
13928
13929
#: serverguide/C/network-auth.xml:920(para)
13930
msgid "Now create the self-signed CA certificate:"
13931
msgstr ""
13932
13933
#: serverguide/C/network-auth.xml:925(command)
13934
msgid ""
13935
"sudo certtool --generate-self-signed --load-privkey "
13936
"/etc/ssl/private/cakey.pem \\ --template /etc/ssl/ca.info --outfile "
13937
"/etc/ssl/certs/cacert.pem"
13938
msgstr ""
13939
13940
#: serverguide/C/network-auth.xml:932(para)
13941
msgid "Make a private key for the server:"
13942
msgstr ""
13943
13944
#: serverguide/C/network-auth.xml:937(command)
13945
msgid ""
13946
"sudo sh -c \"certtool --generate-privkey > "
13947
"/etc/ssl/private/ldap01_slapd_key.pem\""
13948
msgstr ""
13949
13950
#: serverguide/C/network-auth.xml:941(para)
13951
msgid ""
13952
"Replace <emphasis>ldap01</emphasis> in the filename with your server's "
13953
"hostname. Naming the certificate and key for the host and service that will "
13954
"be using them will help keep filenames and paths straight."
13955
msgstr ""
13956
13957
#: serverguide/C/network-auth.xml:950(para)
13958
msgid ""
13959
"To sign the server's certificate with the CA, create the "
13960
"<filename>/etc/ssl/ldap01.info</filename> info file containing:"
13961
msgstr ""
13962
13963
#: serverguide/C/network-auth.xml:954(programlisting)
13964
#, no-wrap
13965
msgid ""
13966
"\n"
13967
"organization = Example Company\n"
13968
"cn = ldap01.example.com\n"
13969
"tls_www_server\n"
13970
"encryption_key\n"
13971
"signing_key\n"
13972
msgstr ""
13973
13974
#: serverguide/C/network-auth.xml:965(para)
13975
msgid "Create the server's certificate:"
13976
msgstr ""
13977
13978
#: serverguide/C/network-auth.xml:970(command)
13979
msgid ""
13980
"sudo certtool --generate-certificate --load-privkey /etc/ssl/private/x01-"
13981
"test_slapd_key.pem \\ --load-ca-certificate /etc/ssl/certs/cacert.pem --load-"
13982
"ca-privkey /etc/ssl/private/cakey.pem \\ --template /etc/ssl/x01-test.info --"
13983
"outfile /etc/ssl/certs/x01-test_slapd_cert.pem"
13984
msgstr ""
13985
13986
#: serverguide/C/network-auth.xml:978(para)
13987
msgid ""
13988
"Once you have a certificate, key, and CA cert installed, use "
13989
"<application>ldapmodify</application> to add the new configuration options:"
13990
msgstr ""
13991
13992
#: serverguide/C/network-auth.xml:989(userinput)
13993
#, no-wrap
13994
msgid ""
13995
"dn: cn=config\n"
13996
"add: olcTLSCACertificateFile\n"
13997
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
13998
"-\n"
13999
"add: olcTLSCertificateFile\n"
14000
"olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem\n"
14001
"-\n"
14002
"add: olcTLSCertificateKeyFile\n"
14003
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem"
14004
msgstr ""
14005
14006
#: serverguide/C/network-auth.xml:988(computeroutput) serverguide/C/network-auth.xml:1159(computeroutput)
14007
#, no-wrap
14008
msgid ""
14009
"Enter LDAP Password:\n"
14010
"<placeholder-1/>\n"
14011
"\n"
14012
"modifying entry \"cn=config\"\n"
14013
msgstr ""
14014
14015
#: serverguide/C/network-auth.xml:1004(para)
14016
msgid ""
14017
"Adjust the <filename>ldap01_slapd_cert.pem</filename>, "
14018
"<filename>ldap01_slapd_key.pem</filename>, and "
14019
"<filename>cacert.pem</filename> names if yours are different."
14020
msgstr ""
14021
14022
#: serverguide/C/network-auth.xml:1010(para)
14023
msgid ""
14024
"Next, edit <filename>/etc/default/slapd</filename> uncomment the "
14025
"<emphasis>SLAPD_SERVICES</emphasis> option:"
14026
msgstr ""
14027
14028
#: serverguide/C/network-auth.xml:1014(programlisting)
14029
#, no-wrap
14030
msgid ""
14031
"\n"
14032
"SLAPD_SERVICES=\"ldap:/// ldapi:/// ldaps:///\"\n"
14033
msgstr ""
14034
14035
#: serverguide/C/network-auth.xml:1018(para)
14036
msgid ""
14037
"Now the <emphasis>openldap</emphasis> user needs access to the certificate:"
14038
msgstr ""
14039
14040
#: serverguide/C/network-auth.xml:1023(command)
14041
msgid "sudo adduser openldap ssl-cert"
14042
msgstr ""
14043
14044
#: serverguide/C/network-auth.xml:1024(command)
14045
msgid "sudo chgrp ssl-cert /etc/ssl/private/ldap01_slapd_key.pem"
14046
msgstr ""
14047
14048
#: serverguide/C/network-auth.xml:1025(command)
14049
msgid "sudo chmod g+r /etc/ssl/private/ldap01_slapd_key.pem"
14050
msgstr ""
14051
14052
#: serverguide/C/network-auth.xml:1029(para)
14053
msgid ""
14054
"If the <filename role=\"directory\">/etc/ssl/private</filename> and "
14055
"<filename>/etc/ssl/private/server.key</filename> have different permissions, "
14056
"adjust the commands appropriately."
14057
msgstr ""
14058
14059
#: serverguide/C/network-auth.xml:1035(para)
14060
msgid "Finally, restart <application>slapd</application>:"
14061
msgstr ""
14062
14063
#: serverguide/C/network-auth.xml:1043(para)
14064
msgid ""
14065
"The <application>slapd</application> daemon should now be listening for "
14066
"LDAPS connections and be able to use STARTTLS during authentication."
14067
msgstr ""
14068
14069
#: serverguide/C/network-auth.xml:1049(para)
14070
msgid ""
14071
"If you run into troubles with the server not starting, check the "
14072
"/var/log/syslog. If you see errors like main: TLS init def ctx failed: -1, "
14073
"it is likely there is a configuration problem. Check that the certificate is "
14074
"signed by the authority from in the files configured, and that the ssl-cert "
14075
"group has read permissions on the private key."
14076
msgstr ""
14077
14078
#: serverguide/C/network-auth.xml:1061(title)
14079
msgid "TLS Replication"
14080
msgstr ""
14081
14082
#: serverguide/C/network-auth.xml:1063(para)
14083
msgid ""
14084
"If you have setup <application>Syncrepl</application> between servers, it is "
14085
"prudent to encrypt the replication traffic using <emphasis>Transport Layer "
14086
"Security (TLS)</emphasis>. For details on setting up replication see <xref "
14087
"linkend=\"openldap-server-replication\"/>."
14088
msgstr ""
14089
14090
#: serverguide/C/network-auth.xml:1069(para)
14091
msgid ""
14092
"Assuming you have followed the above instructions and created a CA "
14093
"certificate and server certificate on the <emphasis>Provider</emphasis> "
14094
"server. Follow the following instructions to create a certificate and key "
14095
"for the <emphasis>Consumer</emphasis> server."
14096
msgstr ""
14097
14098
#: serverguide/C/network-auth.xml:1078(para)
14099
msgid "Create a new key for the Consumer server:"
14100
msgstr ""
14101
14102
#: serverguide/C/network-auth.xml:1083(command)
14103
msgid "mkdir ldap02-ssl"
14104
msgstr ""
14105
14106
#: serverguide/C/network-auth.xml:1084(command)
14107
msgid "cd ldap02-ssl"
14108
msgstr ""
14109
14110
#: serverguide/C/network-auth.xml:1085(command)
14111
msgid "certtool --generate-privkey > ldap02_slapd_key.pem"
14112
msgstr ""
14113
14114
#: serverguide/C/network-auth.xml:1089(para)
14115
msgid ""
14116
"Creating a new directory is not strictly necessary, but it will help keep "
14117
"things organized and make it easier to copy the files to the Consumer server."
14118
msgstr ""
14119
14120
#: serverguide/C/network-auth.xml:1098(para)
14121
msgid ""
14122
"Next, create an info file, <filename>ldap02.info</filename> for the Consumer "
14123
"server, changing the attributes to match your locality and server:"
14124
msgstr ""
14125
14126
#: serverguide/C/network-auth.xml:1103(programlisting)
14127
#, no-wrap
14128
msgid ""
14129
"\n"
14130
"country = US\n"
14131
"state = North Carolina\n"
14132
"locality = Winston-Salem\n"
14133
"organization = Example Company\n"
14134
"cn = ldap02.salem.edu\n"
14135
"tls_www_client\n"
14136
"encryption_key\n"
14137
"signing_key\n"
14138
msgstr ""
14139
14140
#: serverguide/C/network-auth.xml:1117(para)
14141
msgid "Create the certificate:"
14142
msgstr ""
14143
14144
#: serverguide/C/network-auth.xml:1122(command)
14145
msgid ""
14146
"sudo certtool --generate-certificate --load-privkey ldap02_slapd_key.pem \\ -"
14147
"-load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey "
14148
"/etc/ssl/private/cakey.pem \\ --template ldap02.info --outfile "
14149
"ldap02_slapd_cert.pem"
14150
msgstr ""
14151
14152
#: serverguide/C/network-auth.xml:1130(para)
14153
msgid "Copy the <filename>cacert.pem</filename> to the dicretory:"
14154
msgstr ""
14155
14156
#: serverguide/C/network-auth.xml:1135(command)
14157
msgid "cp /etc/ssl/certs/cacert.pem ."
14158
msgstr ""
14159
14160
#: serverguide/C/network-auth.xml:1141(para)
14161
msgid ""
14162
"The only thing left is to copy the <filename>ldap02-ssl</filename> directory "
14163
"to the Consumer server, then copy <filename>ldap02_slapd_cert.pem</filename> "
14164
"and <filename>cacert.pem</filename> to <filename>/etc/ssl/certs</filename>, "
14165
"and copy <filename>ldap02_slapd_key.pem</filename> to "
14166
"<filename>/etc/ssl/private</filename>."
14167
msgstr ""
14168
14169
#: serverguide/C/network-auth.xml:1150(para)
14170
msgid ""
14171
"Once the files are in place adjust the <emphasis>cn=config</emphasis> tree "
14172
"by entering:"
14173
msgstr ""
14174
14175
#: serverguide/C/network-auth.xml:1160(userinput)
14176
#, no-wrap
14177
msgid ""
14178
"dn: cn=config\n"
14179
"add: olcTLSCACertificateFile\n"
14180
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
14181
"-\n"
14182
"add: olcTLSCertificateFile\n"
14183
"olcTLSCertificateFile: /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14184
"-\n"
14185
"add: olcTLSCertificateKeyFile\n"
14186
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap02_slapd_key.pem"
14187
msgstr ""
14188
14189
#: serverguide/C/network-auth.xml:1177(para)
14190
msgid ""
14191
"As with the Provider you can now edit "
14192
"<filename>/etc/default/slapd</filename> and add the "
14193
"<emphasis>ldaps:///</emphasis> parameter to the "
14194
"<emphasis>SLAPD_SERVICES</emphasis> option."
14195
msgstr ""
14196
14197
#: serverguide/C/network-auth.xml:1185(para)
14198
msgid ""
14199
"Now that <emphasis>TLS</emphasis> has been setup on each server, once again "
14200
"modify the <emphasis>Consumer</emphasis> server's "
14201
"<emphasis>cn=config</emphasis> tree by entering the following in a terminal:"
14202
msgstr ""
14203
14204
#: serverguide/C/network-auth.xml:1198(userinput)
14205
#, no-wrap
14206
msgid ""
14207
"\n"
14208
"dn: olcDatabase={1}hdb,cn=config\n"
14209
"replace: olcSyncrepl\n"
14210
"olcSyncrepl: {0}rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
14211
"binddn=\"cn=ad\n"
14212
" min,dc=example,dc=com\" credentials=secret searchbase=\"dc=example,dc=com\" "
14213
"logbas\n"
14214
" e=\"cn=accesslog\" "
14215
"logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" s\n"
14216
" chemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog "
14217
"starttls=yes"
14218
msgstr ""
14219
14220
#: serverguide/C/network-auth.xml:1195(computeroutput)
14221
#, no-wrap
14222
msgid ""
14223
"SASL/EXTERNAL authentication started\n"
14224
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
14225
"SASL SSF: 0\n"
14226
"<placeholder-1/>\n"
14227
"\n"
14228
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
14229
msgstr ""
14230
14231
#: serverguide/C/network-auth.xml:1210(para)
14232
msgid ""
14233
"If the LDAP server hostname does not match the Fully Qualified Domain Name "
14234
"(FQDN) in the certificate, you may have to edit "
14235
"<filename>/etc/ldap/ldap.conf</filename> and add the following TLS options:"
14236
msgstr ""
14237
14238
#: serverguide/C/network-auth.xml:1215(programlisting)
14239
#, no-wrap
14240
msgid ""
14241
"\n"
14242
"TLS_CERT /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14243
"TLS_KEY /etc/ssl/private/ldap02_slapd_key.pem\n"
14244
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
14245
msgstr ""
14246
14247
#: serverguide/C/network-auth.xml:1222(para)
14248
msgid ""
14249
"Finally, restart <application>slapd</application> on each of the servers:"
14250
msgstr ""
14251
14252
#: serverguide/C/network-auth.xml:1235(title)
14253
msgid "LDAP Authentication"
14254
msgstr ""
14255
14256
#: serverguide/C/network-auth.xml:1237(para)
14257
msgid ""
14258
"Once you have a working LDAP server, the <application>auth-client-"
14259
"config</application> and <application>libnss-ldap</application> packages "
14260
"take the pain out of configuring an Ubuntu client to authenticate using "
14261
"LDAP. To install the packages from, a terminal prompt enter:"
14262
msgstr ""
14263
14264
#: serverguide/C/network-auth.xml:1244(command)
14265
msgid "sudo apt-get install libnss-ldap"
14266
msgstr ""
14267
14268
#: serverguide/C/network-auth.xml:1247(para)
14269
msgid ""
14270
"During the install a menu dialog will ask you connection details about your "
14271
"LDAP server."
14272
msgstr ""
14273
14274
#: serverguide/C/network-auth.xml:1251(para)
14275
msgid ""
14276
"If you make a mistake when entering your information you can execute the "
14277
"dialog again using:"
14278
msgstr ""
14279
14280
#: serverguide/C/network-auth.xml:1256(command)
14281
msgid "sudo dpkg-reconfigure ldap-auth-config"
14282
msgstr ""
14283
14284
#: serverguide/C/network-auth.xml:1259(para)
14285
msgid ""
14286
"The results of the dialog can be seen in "
14287
"<filename>/etc/ldap.conf</filename>. If your server requires options not "
14288
"covered in the menu edit this file accordingly."
14289
msgstr ""
14290
14291
#: serverguide/C/network-auth.xml:1264(para)
14292
msgid ""
14293
"Now that <application>libnss-ldap</application> is configured enable the "
14294
"<application>auth-client-config</application> LDAP profile by entering:"
14295
msgstr ""
14296
14297
#: serverguide/C/network-auth.xml:1270(command)
14298
msgid "sudo auth-client-config -t nss -p lac_ldap"
14299
msgstr ""
14300
14301
#: serverguide/C/network-auth.xml:1275(para)
14302
msgid ""
14303
"<emphasis>-t:</emphasis> only modifies "
14304
"<filename>/etc/nsswitch.conf</filename>."
14305
msgstr ""
14306
14307
#: serverguide/C/network-auth.xml:1280(para)
14308
msgid "<emphasis>-p:</emphasis> name of the profile to enable, disable, etc."
14309
msgstr ""
14310
14311
#: serverguide/C/network-auth.xml:1285(para)
14312
msgid ""
14313
"<emphasis>lac_ldap:</emphasis> the <application>auth-client-"
14314
"config</application> profile that is part of the <application>ldap-auth-"
14315
"config</application> package."
14316
msgstr ""
14317
14318
#: serverguide/C/network-auth.xml:1292(para)
14319
msgid ""
14320
"Using the <application>pam-auth-update</application> utility, configure the "
14321
"system to use LDAP for authentication:"
14322
msgstr ""
14323
14324
#: serverguide/C/network-auth.xml:1297(command)
14325
msgid "sudo pam-auth-update"
14326
msgstr ""
14327
14328
#: serverguide/C/network-auth.xml:1300(para)
14329
msgid ""
14330
"From the <application>pam-auth-update</application> menu, choose LDAP and "
14331
"any other authentication mechanisms you need."
14332
msgstr ""
14333
14334
#: serverguide/C/network-auth.xml:1304(para)
14335
msgid ""
14336
"You should now be able to login using user credentials stored in the LDAP "
14337
"directory."
14338
msgstr ""
14339
14340
#: serverguide/C/network-auth.xml:1309(para)
14341
msgid ""
14342
"If you are going to use LDAP to store Samba users you will need to configure "
14343
"the server to authenticate using LDAP. See <xref linkend=\"samba-ldap\"/> "
14344
"for details."
14345
msgstr ""
14346
14347
#: serverguide/C/network-auth.xml:1317(title)
14348
msgid "User and Group Management"
14349
msgstr ""
14350
14351
#: serverguide/C/network-auth.xml:1319(para)
14352
msgid ""
14353
"The <application>ldap-utils</application> package comes with multiple "
14354
"utilities to manage the directory, but the long string of options needed, "
14355
"can make them a burden to use. The <application>ldapscripts</application> "
14356
"package contains configurable scripts to easily manage LDAP users and groups."
14357
msgstr ""
14358
14359
#: serverguide/C/network-auth.xml:1325(para)
14360
msgid "To install the package, from a terminal enter:"
14361
msgstr ""
14362
14363
#: serverguide/C/network-auth.xml:1330(command)
14364
msgid "sudo apt-get install ldapscripts"
14365
msgstr ""
14366
14367
#: serverguide/C/network-auth.xml:1333(para)
14368
msgid ""
14369
"Next, edit the config file "
14370
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> uncommenting and "
14371
"changing the following to match your environment:"
14372
msgstr ""
14373
14374
#: serverguide/C/network-auth.xml:1338(programlisting)
14375
#, no-wrap
14376
msgid ""
14377
"\n"
14378
"SERVER=localhost\n"
14379
"BINDDN='cn=admin,dc=example,dc=com'\n"
14380
"BINDPWDFILE=\"/etc/ldapscripts/ldapscripts.passwd\"\n"
14381
"SUFFIX='dc=example,dc=com'\n"
14382
"GSUFFIX='ou=Groups'\n"
14383
"USUFFIX='ou=People'\n"
14384
"MSUFFIX='ou=Computers'\n"
14385
"GIDSTART=10000\n"
14386
"UIDSTART=10000\n"
14387
"MIDSTART=10000\n"
14388
msgstr ""
14389
14390
#: serverguide/C/network-auth.xml:1351(para)
14391
msgid ""
14392
"Now, create the <filename>ldapscripts.passwd</filename> file to allow "
14393
"authenticated access to the directory:"
14394
msgstr ""
14395
14396
#: serverguide/C/network-auth.xml:1356(command)
14397
msgid ""
14398
"sudo sh -c \"echo -n 'secret' > /etc/ldapscripts/ldapscripts.passwd\""
14399
msgstr ""
14400
14401
#: serverguide/C/network-auth.xml:1357(command)
14402
msgid "sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd"
14403
msgstr ""
14404
14405
#: serverguide/C/network-auth.xml:1361(para)
14406
msgid ""
14407
"Replace <quote>secret</quote> with the actual password for your LDAP admin "
14408
"user."
14409
msgstr ""
14410
14411
#: serverguide/C/network-auth.xml:1366(para)
14412
msgid ""
14413
"The <application>ldapscripts</application> are now ready to help manage your "
14414
"directory. The following are some examples of how to use the scripts:"
14415
msgstr ""
14416
14417
#: serverguide/C/network-auth.xml:1373(para)
14418
msgid "Create a new user:"
14419
msgstr ""
14420
14421
#: serverguide/C/network-auth.xml:1377(command)
14422
msgid "sudo ldapadduser george example"
14423
msgstr ""
14424
14425
#: serverguide/C/network-auth.xml:1379(para)
14426
msgid ""
14427
"This will create a user with uid <emphasis role=\"italic\">george</emphasis> "
14428
"and set the user's primary group (gid) to <emphasis "
14429
"role=\"italic\">example</emphasis>"
14430
msgstr ""
14431
14432
#: serverguide/C/network-auth.xml:1385(para)
14433
msgid "Change a user's password:"
14434
msgstr ""
14435
14436
#: serverguide/C/network-auth.xml:1389(command)
14437
msgid "sudo ldapsetpasswd george"
14438
msgstr ""
14439
14440
#: serverguide/C/network-auth.xml:1390(computeroutput)
14441
#, no-wrap
14442
msgid "Changing password for user uid=george,ou=People,dc=example,dc=com"
14443
msgstr ""
14444
14445
#: serverguide/C/network-auth.xml:1391(userinput)
14446
#, no-wrap
14447
msgid "New Password: "
14448
msgstr ""
14449
14450
#: serverguide/C/network-auth.xml:1392(userinput)
14451
#, no-wrap
14452
msgid "New Password (verify): "
14453
msgstr ""
14454
14455
#: serverguide/C/network-auth.xml:1396(para)
14456
msgid "Delete a user:"
14457
msgstr ""
14458
14459
#: serverguide/C/network-auth.xml:1400(command)
14460
msgid "sudo ldapdeleteuser george"
14461
msgstr ""
14462
14463
#: serverguide/C/network-auth.xml:1405(para)
14464
msgid "Add a group:"
14465
msgstr ""
14466
14467
#: serverguide/C/network-auth.xml:1409(command)
14468
msgid "sudo ldapaddgroup qa"
14469
msgstr ""
14470
14471
#: serverguide/C/network-auth.xml:1413(para)
14472
msgid "Delete a group:"
14473
msgstr ""
14474
14475
#: serverguide/C/network-auth.xml:1417(command)
14476
msgid "sudo ldapdeletegroup qa"
14477
msgstr ""
14478
14479
#: serverguide/C/network-auth.xml:1421(para)
14480
msgid "Add a user to a group:"
14481
msgstr ""
14482
14483
#: serverguide/C/network-auth.xml:1425(command)
14484
msgid "sudo ldapaddusertogroup george qa"
14485
msgstr ""
14486
14487
#: serverguide/C/network-auth.xml:1427(para)
14488
msgid ""
14489
"You should now see a <emphasis>memberUid</emphasis> attribute for the "
14490
"<emphasis role=\"italic\">qa</emphasis> group with a value of <emphasis "
14491
"role=\"italic\">george</emphasis>."
14492
msgstr ""
14493
14494
#: serverguide/C/network-auth.xml:1433(para)
14495
msgid "Remove a user from a group:"
14496
msgstr ""
14497
14498
#: serverguide/C/network-auth.xml:1437(command)
14499
msgid "sudo ldapdeleteuserfromgroup george qa"
14500
msgstr ""
14501
14502
#: serverguide/C/network-auth.xml:1439(para)
14503
msgid ""
14504
"The <emphasis>memberUid</emphasis> attribute should now be removed from the "
14505
"<emphasis role=\"italic\">qa</emphasis> group."
14506
msgstr ""
14507
14508
#: serverguide/C/network-auth.xml:1445(para)
14509
msgid ""
14510
"The <application>ldapmodifyuser</application> script allows you to add, "
14511
"remove, or replace a user's attributes. The script uses the same syntax as "
14512
"the <application>ldapmodify</application> utility. For example:"
14513
msgstr ""
14514
14515
#: serverguide/C/network-auth.xml:1450(command)
14516
msgid "sudo ldapmodifyuser george"
14517
msgstr ""
14518
14519
#: serverguide/C/network-auth.xml:1451(computeroutput)
14520
#, no-wrap
14521
msgid ""
14522
"# About to modify the following entry :\n"
14523
"dn: uid=george,ou=People,dc=example,dc=com\n"
14524
"objectClass: account\n"
14525
"objectClass: posixAccount\n"
14526
"cn: george\n"
14527
"uid: george\n"
14528
"uidNumber: 1001\n"
14529
"gidNumber: 1001\n"
14530
"homeDirectory: /home/george\n"
14531
"loginShell: /bin/bash\n"
14532
"gecos: george\n"
14533
"description: User account\n"
14534
"userPassword:: e1NTSEF9eXFsTFcyWlhwWkF1eGUybVdFWHZKRzJVMjFTSG9vcHk=\n"
14535
"\n"
14536
"# Enter your modifications here, end with CTRL-D.\n"
14537
"dn: uid=george,ou=People,dc=example,dc=com"
14538
msgstr ""
14539
14540
#: serverguide/C/network-auth.xml:1467(userinput)
14541
#, no-wrap
14542
msgid ""
14543
"replace: gecos\n"
14544
"gecos: George Carlin"
14545
msgstr ""
14546
14547
#: serverguide/C/network-auth.xml:1470(para)
14548
msgid ""
14549
"The user's <emphasis>gecos</emphasis> should now be <quote>George "
14550
"Carlin</quote>."
14551
msgstr ""
14552
14553
#: serverguide/C/network-auth.xml:1475(para)
14554
msgid ""
14555
"Another great feature of <application>ldapscripts</application>, is the "
14556
"template system. Templates allow you to customize the attributes of user, "
14557
"group, and machine objectes. For example, to enable the "
14558
"<emphasis>user</emphasis> template edit "
14559
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> changing:"
14560
msgstr ""
14561
14562
#: serverguide/C/network-auth.xml:1482(programlisting)
14563
#, no-wrap
14564
msgid ""
14565
"\n"
14566
"UTEMPLATE=\"/etc/ldapscripts/ldapadduser.template\"\n"
14567
msgstr ""
14568
14569
#: serverguide/C/network-auth.xml:1486(para)
14570
msgid ""
14571
"There are <emphasis role=\"italic\">sample</emphasis> templates in the "
14572
"<filename>/etc/ldapscripts</filename> directory. Copy or rename the "
14573
"<filename>ldapadduser.template.sample</filename> file to "
14574
"<filename>/etc/ldapscripts/ldapadduser.template</filename>:"
14575
msgstr ""
14576
14577
#: serverguide/C/network-auth.xml:1493(command)
14578
msgid ""
14579
"sudo cp /etc/ldapscripts/ldapadduser.template.sample "
14580
"/etc/ldapscripts/ldapadduser.template"
14581
msgstr ""
14582
14583
#: serverguide/C/network-auth.xml:1496(para)
14584
msgid ""
14585
"Edit the new template to add the desired attributes. The following will "
14586
"create new user's as with an <emphasis>objectClass</emphasis> of "
14587
"<emphasis>inetOrgPerson</emphasis>:"
14588
msgstr ""
14589
14590
#: serverguide/C/network-auth.xml:1501(programlisting)
14591
#, no-wrap
14592
msgid ""
14593
"\n"
14594
"dn: uid=<user>,<usuffix>,<suffix>\n"
14595
"objectClass: inetOrgPerson\n"
14596
"objectClass: posixAccount\n"
14597
"cn: <user>\n"
14598
"sn: <ask>\n"
14599
"uid: <user>\n"
14600
"uidNumber: <uid>\n"
14601
"gidNumber: <gid>\n"
14602
"homeDirectory: <home>\n"
14603
"loginShell: <shell>\n"
14604
"gecos: <user>\n"
14605
"description: User account\n"
14606
"title: Employee\n"
14607
msgstr ""
14608
14609
#: serverguide/C/network-auth.xml:1517(para)
14610
msgid ""
14611
"Notice the <emphasis><ask></emphasis> option used for the "
14612
"<emphasis>cn</emphasis> value. Using <ask> will configure "
14613
"<application>ldapadduser</application> to prompt you for the attribute value "
14614
"during user creation."
14615
msgstr ""
14616
14617
#: serverguide/C/network-auth.xml:1525(para)
14618
msgid ""
14619
"There are more useful scripts in the package, to see a full list enter: "
14620
"<command>dpkg -L ldapscripts | grep bin</command>"
14621
msgstr ""
14622
14623
#: serverguide/C/network-auth.xml:1534(para)
14624
msgid ""
14625
"The <ulink url=\"https://help.ubuntu.com/community/OpenLDAPServer\">OpenLDAP "
14626
"Ubuntu Wiki</ulink> page has more details."
14627
msgstr ""
14628
14629
#: serverguide/C/network-auth.xml:1539(para)
14630
msgid ""
14631
"For more information see <ulink url=\"http://www.openldap.org/\">OpenLDAP "
14632
"Home Page</ulink>"
14633
msgstr ""
14634
14635
#: serverguide/C/network-auth.xml:1544(para)
14636
msgid ""
14637
"Though starting to show it's age, a great source for in depth LDAP "
14638
"information is O'Reilly's <ulink "
14639
"url=\"http://www.oreilly.com/catalog/ldapsa/\">LDAP System "
14640
"Administration</ulink>"
14641
msgstr ""
14642
14643
#: serverguide/C/network-auth.xml:1550(para)
14644
msgid ""
14645
"Packt's <ulink url=\"http://www.packtpub.com/OpenLDAP-Developers-Server-Open-"
14646
"Source-Linux/book\">Mastering OpenLDAP</ulink> is a great reference covering "
14647
"newer versions of OpenLDAP."
14648
msgstr ""
14649
14650
#: serverguide/C/network-auth.xml:1556(para)
14651
msgid ""
14652
"For more information on <application>auth-client-config</application> see "
14653
"the man page: <command>man auth-client-config</command>."
14654
msgstr ""
14655
14656
#: serverguide/C/network-auth.xml:1561(para)
14657
msgid ""
14658
"For more details regarding the <application>ldapscripts</application> "
14659
"package see the man pages: <command>man ldapscripts</command>, <command>man "
14660
"ldapadduser</command>, <command>man ldapaddgroup</command>, etc."
14661
msgstr ""
14662
14663
#: serverguide/C/network-auth.xml:1571(title)
14664
msgid "Samba and LDAP"
14665
msgstr ""
14666
14667
#: serverguide/C/network-auth.xml:1573(para)
14668
msgid ""
14669
"This section covers configuring Samba to use LDAP for user, group, and "
14670
"machine account information and authentication. The assumption is, you "
14671
"already have a working OpenLDAP directory installed and the server is "
14672
"configured to use it for authentication. See <xref linkend=\"openldap-"
14673
"server\"/> and <xref linkend=\"openldap-auth-config\"/> for details on "
14674
"setting up OpenLDAP. For more information on installing and configuring "
14675
"Samba see <xref linkend=\"windows-networking\"/>."
14676
msgstr ""
14677
14678
#: serverguide/C/network-auth.xml:1583(para)
14679
msgid ""
14680
"There are three packages needed when integrating Samba with LDAP. "
14681
"<application>samba</application>, <application>samba-doc</application>, and "
14682
"<application>smbldap-tools</application> packages . To install the packages, "
14683
"from a terminal enter:"
14684
msgstr ""
14685
14686
#: serverguide/C/network-auth.xml:1589(command)
14687
msgid "sudo apt-get install samba samba-doc smbldap-tools"
14688
msgstr ""
14689
14690
#: serverguide/C/network-auth.xml:1592(para)
14691
msgid ""
14692
"Strictly speaking the <application>smbldap-tools</application> package isn't "
14693
"needed, but unless you have another package or custom scripts, a method of "
14694
"managing users, groups, and computer accounts is needed."
14695
msgstr ""
14696
14697
#: serverguide/C/network-auth.xml:1599(title)
14698
msgid "OpenLDAP Configuration"
14699
msgstr ""
14700
14701
#: serverguide/C/network-auth.xml:1601(para)
14702
msgid ""
14703
"In order for Samba to use OpenLDAP as a <emphasis>passdb backend</emphasis>, "
14704
"the user objects in the directory will need additional attributes. This "
14705
"section assumes you want Samba to be configured as a Windows NT domain "
14706
"controller, and will add the necessary LDAP objects and attributes."
14707
msgstr ""
14708
14709
#: serverguide/C/network-auth.xml:1609(para)
14710
msgid ""
14711
"The Samba attributes are defined in the <filename>samba.schema</filename> "
14712
"file which is part of the <application>samba-doc</application> package. The "
14713
"schema file needs to be unzipped and copied to "
14714
"<filename>/etc/ldap/schema</filename>. From a terminal prompt enter:"
14715
msgstr ""
14716
14717
#: serverguide/C/network-auth.xml:1616(command)
14718
msgid ""
14719
"sudo cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz "
14720
"/etc/ldap/schema/"
14721
msgstr ""
14722
14723
#: serverguide/C/network-auth.xml:1617(command)
14724
msgid "sudo gzip -d /etc/ldap/schema/samba.schema.gz"
14725
msgstr ""
14726
14727
#: serverguide/C/network-auth.xml:1623(para)
14728
msgid ""
14729
"The <emphasis>samba</emphasis> schema needs to be added to the "
14730
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
14731
"<application>slapd</application> is also detailed in <xref "
14732
"linkend=\"openldap-configuration\"/>."
14733
msgstr ""
14734
14735
#: serverguide/C/network-auth.xml:1631(para) serverguide/C/network-auth.xml:2666(para)
14736
msgid ""
14737
"First, create a configuration file named "
14738
"<filename>schema_convert.conf</filename>, or a similar descriptive name, "
14739
"containing the following lines:"
14740
msgstr ""
14741
14742
#: serverguide/C/network-auth.xml:1636(programlisting)
14743
#, no-wrap
14744
msgid ""
14745
"\n"
14746
"include /etc/ldap/schema/core.schema\n"
14747
"include /etc/ldap/schema/collective.schema\n"
14748
"include /etc/ldap/schema/corba.schema\n"
14749
"include /etc/ldap/schema/cosine.schema\n"
14750
"include /etc/ldap/schema/duaconf.schema\n"
14751
"include /etc/ldap/schema/dyngroup.schema\n"
14752
"include /etc/ldap/schema/inetorgperson.schema\n"
14753
"include /etc/ldap/schema/java.schema\n"
14754
"include /etc/ldap/schema/misc.schema\n"
14755
"include /etc/ldap/schema/nis.schema\n"
14756
"include /etc/ldap/schema/openldap.schema\n"
14757
"include /etc/ldap/schema/ppolicy.schema\n"
14758
"include /etc/ldap/schema/samba.schema\n"
14759
msgstr ""
14760
14761
#: serverguide/C/network-auth.xml:1666(para) serverguide/C/network-auth.xml:2701(para)
14762
msgid ""
14763
"Now use <application>slapcat</application> to convert the schema files:"
14764
msgstr ""
14765
14766
#: serverguide/C/network-auth.xml:1671(command)
14767
msgid ""
14768
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
14769
"\"cn={12}samba,cn=schema,cn=config\" > /tmp/cn=samba.ldif"
14770
msgstr ""
14771
14772
#: serverguide/C/network-auth.xml:1674(para) serverguide/C/network-auth.xml:2709(para)
14773
msgid ""
14774
"Change the above file and path names to match your own if they are different."
14775
msgstr ""
14776
14777
#: serverguide/C/network-auth.xml:1681(para)
14778
msgid ""
14779
"Edit the generated <filename>/tmp/cn\\=samba.ldif</filename> file, changing "
14780
"the following attributes:"
14781
msgstr ""
14782
14783
#: serverguide/C/network-auth.xml:1685(programlisting)
14784
#, no-wrap
14785
msgid ""
14786
"\n"
14787
"dn: cn=samba,cn=schema,cn=config\n"
14788
"...\n"
14789
"cn: samba\n"
14790
msgstr ""
14791
14792
#: serverguide/C/network-auth.xml:1695(programlisting)
14793
#, no-wrap
14794
msgid ""
14795
"\n"
14796
"structuralObjectClass: olcSchemaConfig\n"
14797
"entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95\n"
14798
"creatorsName: cn=config\n"
14799
"createTimestamp: 20080827045234Z\n"
14800
"entryCSN: 20080827045234.341425Z#000000#000#000000\n"
14801
"modifiersName: cn=config\n"
14802
"modifyTimestamp: 20080827045234Z\n"
14803
msgstr ""
14804
14805
#: serverguide/C/network-auth.xml:1720(command)
14806
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=samba.ldif"
14807
msgstr ""
14808
14809
#: serverguide/C/network-auth.xml:1726(para)
14810
msgid ""
14811
"There should now be a <emphasis>dn: "
14812
"cn={X}misc,cn=schema,cn=config</emphasis>, where \"X\" is the next "
14813
"sequential schema, entry in the cn=config tree."
14814
msgstr ""
14815
14816
#: serverguide/C/network-auth.xml:1734(para)
14817
msgid ""
14818
"Copy and paste the following into a file named "
14819
"<filename>samba_indexes.ldif</filename>:"
14820
msgstr ""
14821
14822
#: serverguide/C/network-auth.xml:1738(programlisting)
14823
#, no-wrap
14824
msgid ""
14825
"\n"
14826
"dn: olcDatabase={1}hdb,cn=config\n"
14827
"changetype: modify\n"
14828
"add: olcDbIndex\n"
14829
"olcDbIndex: uidNumber eq\n"
14830
"olcDbIndex: gidNumber eq\n"
14831
"olcDbIndex: loginShell eq\n"
14832
"olcDbIndex: uid eq,pres,sub\n"
14833
"olcDbIndex: memberUid eq,pres,sub\n"
14834
"olcDbIndex: uniqueMember eq,pres\n"
14835
"olcDbIndex: sambaSID eq\n"
14836
"olcDbIndex: sambaPrimaryGroupSID eq\n"
14837
"olcDbIndex: sambaGroupType eq\n"
14838
"olcDbIndex: sambaSIDList eq\n"
14839
"olcDbIndex: sambaDomainName eq\n"
14840
"olcDbIndex: default sub\n"
14841
msgstr ""
14842
14843
#: serverguide/C/network-auth.xml:1756(para)
14844
msgid ""
14845
"Using the <application>ldapmodify</application> utility load the new indexes:"
14846
msgstr ""
14847
14848
#: serverguide/C/network-auth.xml:1761(command)
14849
msgid "ldapmodify -x -D cn=admin,cn=config -W -f samba_indexes.ldif"
14850
msgstr ""
14851
14852
#: serverguide/C/network-auth.xml:1763(para)
14853
msgid ""
14854
"If all went well you should see the new indexes using "
14855
"<application>ldapsearch</application>:"
14856
msgstr ""
14857
14858
#: serverguide/C/network-auth.xml:1768(command)
14859
msgid ""
14860
"ldapsearch -xLLL -D cn=admin,cn=config -x -b cn=config -W olcDatabase={1}hdb"
14861
msgstr ""
14862
14863
#: serverguide/C/network-auth.xml:1774(para)
14864
msgid ""
14865
"Next, configure the <application>smbldap-tools</application> package to "
14866
"match your environment. The package comes with a configuration script that "
14867
"will ask questions about the needed options. To run the script enter:"
14868
msgstr ""
14869
14870
#: serverguide/C/network-auth.xml:1780(command)
14871
msgid "sudo gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz"
14872
msgstr ""
14873
14874
#: serverguide/C/network-auth.xml:1781(command)
14875
msgid "sudo perl /usr/share/doc/smbldap-tools/configure.pl"
14876
msgstr ""
14877
14878
#: serverguide/C/network-auth.xml:1784(para)
14879
msgid ""
14880
"Once you have answered the questions, there should be <filename>/etc/smbldap-"
14881
"tools/smbldap.conf</filename> and <filename>/etc/smbldap-"
14882
"tools/smbldap_bind.conf</filename> files. These files are generated by the "
14883
"configure script, so if you made any mistakes while executing the script it "
14884
"may be simpler to edit the file appropriately."
14885
msgstr ""
14886
14887
#: serverguide/C/network-auth.xml:1794(para)
14888
msgid ""
14889
"The <application>smbldap-populate</application> script will add the "
14890
"necessary users, groups, and LDAP objects required for Samba. It is a good "
14891
"idea to make a backup LDAP Data Interchange Format (LDIF) file with "
14892
"<application>slapcat</application> before executing the command:"
14893
msgstr ""
14894
14895
#: serverguide/C/network-auth.xml:1801(command)
14896
msgid "sudo slapcat -l backup.ldif"
14897
msgstr ""
14898
14899
#: serverguide/C/network-auth.xml:1807(para)
14900
msgid ""
14901
"Once you have a current backup execute <application>smbldap-"
14902
"populate</application> by entering:"
14903
msgstr ""
14904
14905
#: serverguide/C/network-auth.xml:1812(command)
14906
msgid "sudo smbldap-populate"
14907
msgstr ""
14908
14909
#: serverguide/C/network-auth.xml:1816(para)
14910
msgid ""
14911
"You can create an LDIF file containing the new Samba objects by executing "
14912
"<command>sudo smbldap-populate -e samba.ldif</command>. This allows you to "
14913
"look over the changes making sure everything is correct."
14914
msgstr ""
14915
14916
#: serverguide/C/network-auth.xml:1824(para)
14917
msgid ""
14918
"Your LDAP directory now has the necessary domain information to authenticate "
14919
"Samba users."
14920
msgstr ""
14921
14922
#: serverguide/C/network-auth.xml:1830(title)
14923
msgid "Samba Configuration"
14924
msgstr ""
14925
14926
#: serverguide/C/network-auth.xml:1832(para)
14927
msgid ""
14928
"There a multiple ways to configure Samba for details on some common "
14929
"configurations see <xref linkend=\"windows-networking\"/>. To configure "
14930
"Samba to use LDAP, edit the main Samba configuration file "
14931
"<filename>/etc/samba/smb.conf</filename> commenting the <emphasis>passdb "
14932
"backend</emphasis> option and adding the following:"
14933
msgstr ""
14934
14935
#: serverguide/C/network-auth.xml:1838(programlisting)
14936
#, no-wrap
14937
msgid ""
14938
"\n"
14939
"# passdb backend = tdbsam\n"
14940
"\n"
14941
"# LDAP Settings\n"
14942
" passdb backend = ldapsam:ldap://hostname\n"
14943
" ldap suffix = dc=example,dc=com\n"
14944
" ldap user suffix = ou=People\n"
14945
" ldap group suffix = ou=Groups\n"
14946
" ldap machine suffix = ou=Computers\n"
14947
" ldap idmap suffix = ou=Idmap\n"
14948
" ldap admin dn = cn=admin,dc=example,dc=com\n"
14949
" ldap ssl = start tls\n"
14950
" ldap passwd sync = yes\n"
14951
"...\n"
14952
" add machine script = sudo /usr/sbin/smbldap-useradd -t 0 -w \"%u\"\n"
14953
msgstr ""
14954
14955
#: serverguide/C/network-auth.xml:1855(para)
14956
msgid "Restart <application>samba</application> to enable the new settings:"
14957
msgstr ""
14958
14959
#: serverguide/C/network-auth.xml:1863(para)
14960
msgid ""
14961
"Now Samba needs to know the LDAP admin password. From a terminal prompt "
14962
"enter:"
14963
msgstr ""
14964
14965
#: serverguide/C/network-auth.xml:1868(command)
14966
msgid "sudo smbpasswd -w secret"
14967
msgstr ""
14968
14969
#: serverguide/C/network-auth.xml:1872(para)
14970
msgid ""
14971
"Replacing <emphasis role=\"italic\">secret</emphasis> with your LDAP admin "
14972
"password."
14973
msgstr ""
14974
14975
#: serverguide/C/network-auth.xml:1877(para)
14976
msgid ""
14977
"If you currently have users in LDAP, and you want them to authenticate using "
14978
"Samba, they will need some Samba attributes defined in the "
14979
"<filename>samba.schema</filename> file. Add the Samba attributes to existing "
14980
"users using the <application>smbpasswd</application> utility, replacing "
14981
"<emphasis role=\"italic\">username</emphasis> with an actual user:"
14982
msgstr ""
14983
14984
#: serverguide/C/network-auth.xml:1885(command)
14985
msgid "sudo smbpasswd -a username"
14986
msgstr ""
14987
14988
#: serverguide/C/network-auth.xml:1888(para)
14989
msgid "You will then be asked to enter the user's password."
14990
msgstr ""
14991
14992
#: serverguide/C/network-auth.xml:1892(para)
14993
msgid ""
14994
"To add new user, group, and machine accounts use the utilities from the "
14995
"<application>smbldap-tools</application> package. Here are some examples:"
14996
msgstr ""
14997
14998
#: serverguide/C/network-auth.xml:1899(para)
14999
msgid ""
15000
"To add a new user to LDAP with Samba attributes enter the following, "
15001
"replacing username with an actual username:"
15002
msgstr ""
15003
15004
#: serverguide/C/network-auth.xml:1903(command)
15005
msgid "sudo smbldap-useradd -a -P username"
15006
msgstr ""
15007
15008
#: serverguide/C/network-auth.xml:1905(para)
15009
msgid ""
15010
"The <emphasis>-a</emphasis> option adds the Samba attributes, and the "
15011
"<emphasis>-P</emphasis> options calls the <application>smbldap-"
15012
"passwd</application> utility after the user is created allowing you to enter "
15013
"a password for the user."
15014
msgstr ""
15015
15016
#: serverguide/C/network-auth.xml:1911(para)
15017
msgid "To remove a user from the directory enter:"
15018
msgstr ""
15019
15020
#: serverguide/C/network-auth.xml:1915(command)
15021
msgid "sudo smbldap-userdel username"
15022
msgstr ""
15023
15024
#: serverguide/C/network-auth.xml:1917(para)
15025
msgid ""
15026
"The <application>smbldap-userdel</application> utility also has a <emphasis>-"
15027
"r</emphasis> option to remove the user's home directory."
15028
msgstr ""
15029
15030
#: serverguide/C/network-auth.xml:1922(para)
15031
msgid ""
15032
"Use <application>smbldap-groupadd</application> to add a group, replacing "
15033
"groupname with an appropriate group:"
15034
msgstr ""
15035
15036
#: serverguide/C/network-auth.xml:1926(command)
15037
msgid "sudo smbldap-groupadd -a groupname"
15038
msgstr ""
15039
15040
#: serverguide/C/network-auth.xml:1928(para)
15041
msgid ""
15042
"Similar to <application>smbldap-useradd</application>, the <emphasis>-"
15043
"a</emphasis> adds the Samba attributes."
15044
msgstr ""
15045
15046
#: serverguide/C/network-auth.xml:1933(para)
15047
msgid ""
15048
"To add a user to a group use <application>smbldap-groupmod</application>:"
15049
msgstr ""
15050
15051
#: serverguide/C/network-auth.xml:1937(command)
15052
msgid "sudo smbldap-groupmod -m username groupname"
15053
msgstr ""
15054
15055
#: serverguide/C/network-auth.xml:1939(para)
15056
msgid ""
15057
"Be sure to replace <emphasis>username</emphasis> with a real user. Also, the "
15058
"<emphasis>-m</emphasis> option can add more than one user at a time by "
15059
"listing them in <emphasis>comma separated</emphasis> format."
15060
msgstr ""
15061
15062
#: serverguide/C/network-auth.xml:1945(para)
15063
msgid ""
15064
"<application>smbldap-groupmod</application> can also be used to remove a "
15065
"user from a group:"
15066
msgstr ""
15067
15068
#: serverguide/C/network-auth.xml:1949(command)
15069
msgid "sudo smbldap-groupmod -x username groupname"
15070
msgstr ""
15071
15072
#: serverguide/C/network-auth.xml:1953(para)
15073
msgid ""
15074
"Additionally, the <application>smbldap-useradd</application> utility can add "
15075
"Samba machine accounts:"
15076
msgstr ""
15077
15078
#: serverguide/C/network-auth.xml:1957(command)
15079
msgid "sudo smbldap-useradd -t 0 -w username"
15080
msgstr ""
15081
15082
#: serverguide/C/network-auth.xml:1959(para)
15083
msgid ""
15084
"Replace <emphasis>username</emphasis> with the name of the workstation. The "
15085
"<emphasis>-t 0</emphasis> option creates the machine account without a "
15086
"delay, while the <emphasis>-w</emphasis> option specifies the user as a "
15087
"machine account. Also, note the <emphasis>add machine script</emphasis> "
15088
"option in <filename>/etc/samba/smb.conf</filename> was changed to use "
15089
"<application>smbldap-useradd</application>."
15090
msgstr ""
15091
15092
#: serverguide/C/network-auth.xml:1968(para)
15093
msgid ""
15094
"There are more useful utilities and options in the <application>smbldap-"
15095
"tools</application> package. The man page for each utility provides more "
15096
"details."
15097
msgstr ""
15098
15099
#: serverguide/C/network-auth.xml:1979(para)
15100
msgid ""
15101
"There are multiple places where LDAP and Samba is documented in the <ulink "
15102
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
15103
"Collection</ulink>."
15104
msgstr ""
15105
15106
#: serverguide/C/network-auth.xml:1985(para)
15107
msgid ""
15108
"Specifically see the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
15109
"HOWTO-Collection/passdb.html\">passdb section</ulink>."
15110
msgstr ""
15111
15112
#: serverguide/C/network-auth.xml:1991(para)
15113
msgid ""
15114
"Another good site is <ulink url=\"http://www.iallanis.info/smbldap-"
15115
"tools/docs/samba-ldap-howto/\">Samba OpenLDAP HOWTO</ulink>."
15116
msgstr ""
15117
15118
#: serverguide/C/network-auth.xml:1997(para)
15119
msgid ""
15120
"Again, for more information on <application>smbldap-tools</application> see "
15121
"the man pages: <command>man smbldap-useradd</command>, <command>man smbldap-"
15122
"groupadd</command>, <command>man smbldap-populate</command>, etc."
15123
msgstr ""
15124
15125
#: serverguide/C/network-auth.xml:2004(para)
15126
msgid ""
15127
"Also, there is a list of <ulink "
15128
"url=\"https://help.ubuntu.com/community/Samba#samba-ldap\">Ubuntu "
15129
"wiki</ulink> articles with more information."
15130
msgstr ""
15131
15132
#: serverguide/C/network-auth.xml:2013(title)
15133
msgid "Kerberos"
15134
msgstr ""
15135
15136
#: serverguide/C/network-auth.xml:2015(para)
15137
msgid ""
15138
"<application>Kerberos</application> is a network authentication system based "
15139
"on the principal of a trusted third party. The other two parties being the "
15140
"user and the service the user wishes to authenticate to. Not all services "
15141
"and applications can use Kerberos, but for those that can, it brings the "
15142
"network environment one step closer to being Single Sign On (SSO)."
15143
msgstr ""
15144
15145
#: serverguide/C/network-auth.xml:2021(para)
15146
msgid ""
15147
"This section covers installation and configuration of a Kerberos server, and "
15148
"some example client configurations."
15149
msgstr ""
15150
15151
#: serverguide/C/network-auth.xml:2028(para)
15152
msgid ""
15153
"If you are new to Kerberos there are a few terms that are good to understand "
15154
"before setting up a Kerberos server. Most of the terms will relate to things "
15155
"you may be familiar with in other environments:"
15156
msgstr ""
15157
15158
#: serverguide/C/network-auth.xml:2035(para)
15159
msgid ""
15160
"<emphasis>Principal:</emphasis> any users, computers, and services provided "
15161
"by servers need to be defined as Kerberos Principals."
15162
msgstr ""
15163
15164
#: serverguide/C/network-auth.xml:2040(para)
15165
msgid ""
15166
"<emphasis>Instances:</emphasis> are used for service principals and special "
15167
"administrative principals."
15168
msgstr ""
15169
15170
#: serverguide/C/network-auth.xml:2045(para)
15171
msgid ""
15172
"<emphasis>Realms:</emphasis> the unique realm of control provided by the "
15173
"Kerberos installation. Usually the DNS domain converted to uppercase "
15174
"(EXAMPLE.COM)."
15175
msgstr ""
15176
15177
#: serverguide/C/network-auth.xml:2051(para)
15178
msgid ""
15179
"<emphasis>Key Distribution Center:</emphasis> (KDC) consist of three parts, "
15180
"a database of all principals, the authentication server, and the ticket "
15181
"granting server. For each realm there must be at least one KDC."
15182
msgstr ""
15183
15184
#: serverguide/C/network-auth.xml:2057(para)
15185
msgid ""
15186
"<emphasis>Ticket Granting Ticket:</emphasis> issued by the Authentication "
15187
"Server (AS), the Ticket Granting Ticket (TGT) is encrypted in the user's "
15188
"password which is known only to the user and the KDC."
15189
msgstr ""
15190
15191
#: serverguide/C/network-auth.xml:2063(para)
15192
msgid ""
15193
"<emphasis>Ticket Granting Server:</emphasis> (TGS) issues service tickets to "
15194
"clients upon request."
15195
msgstr ""
15196
15197
#: serverguide/C/network-auth.xml:2068(para)
15198
msgid ""
15199
"<emphasis>Tickets:</emphasis> confirm the identity of the two principals. "
15200
"One principal being a user and the other a service requested by the user. "
15201
"Tickets establish an encryption key used for secure communication during the "
15202
"authenticated session."
15203
msgstr ""
15204
15205
#: serverguide/C/network-auth.xml:2074(para)
15206
msgid ""
15207
"<emphasis>Keytab Files:</emphasis> are files extracted from the KDC "
15208
"principal database and contain the encryption key for a service or host."
15209
msgstr ""
15210
15211
#: serverguide/C/network-auth.xml:2081(para)
15212
msgid ""
15213
"To put the pieces together, a Realm has at least one KDC, preferably two for "
15214
"redundancy, which contains a database of Principals. When a user principal "
15215
"logs into a workstation, configured for Kerberos authentication, the KDC "
15216
"issues a Ticket Granting Ticket (TGT). If the user supplied credentials "
15217
"match, the user is authenticated and can then request tickets for Kerberized "
15218
"services from the Ticket Granting Server (TGS). The service tickets allow "
15219
"the user to authenticate to the service without entering another username "
15220
"and password."
15221
msgstr ""
15222
15223
#: serverguide/C/network-auth.xml:2090(title)
15224
msgid "Kerberos Server"
15225
msgstr ""
15226
15227
#: serverguide/C/network-auth.xml:2094(para)
15228
msgid ""
15229
"Before installing the Kerberos server a properly configured DNS server is "
15230
"needed for your domain. Since the Kerberos Realm by convention matches the "
15231
"domain name, this section uses the <emphasis>example.com</emphasis> domain "
15232
"configured in <xref linkend=\"dns-primarymaster-configuration\"/>."
15233
msgstr ""
15234
15235
#: serverguide/C/network-auth.xml:2100(para)
15236
msgid ""
15237
"Also, Kerberos is a time sensitive protocol. So if the local system time "
15238
"between a client machine and the server differs by more than five minutes "
15239
"(by default), the workstation will not be able to authenticate. To correct "
15240
"the problem all hosts should have their time synchronized using the "
15241
"<emphasis>Network Time Protocol (NTP)</emphasis>. For details on setting up "
15242
"NTP see <xref linkend=\"NTP\"/>."
15243
msgstr ""
15244
15245
#: serverguide/C/network-auth.xml:2107(para)
15246
msgid ""
15247
"The first step in installing a Kerberos Realm is to install the "
15248
"<application>krb5-kdc</application> and <application>krb5-admin-"
15249
"server</application> packages. From a terminal enter:"
15250
msgstr ""
15251
15252
#: serverguide/C/network-auth.xml:2113(command) serverguide/C/network-auth.xml:2288(command)
15253
msgid "sudo apt-get install krb5-kdc krb5-admin-server"
15254
msgstr ""
15255
15256
#: serverguide/C/network-auth.xml:2116(para)
15257
msgid ""
15258
"You will be asked at the end of the install to supply a name for the "
15259
"Kerberos and Admin servers, which may or may not be the same server, for the "
15260
"realm."
15261
msgstr ""
15262
15263
#: serverguide/C/network-auth.xml:2121(para)
15264
msgid ""
15265
"Next, create the new realm with the <application>kdb5_newrealm</application> "
15266
"utility:"
15267
msgstr ""
15268
15269
#: serverguide/C/network-auth.xml:2126(command)
15270
msgid "sudo krb5_newrealm"
15271
msgstr ""
15272
15273
#: serverguide/C/network-auth.xml:2133(para)
15274
msgid ""
15275
"The questions asked during installation are used to configure the "
15276
"<filename>/etc/krb5.conf</filename> file. If you need to adjust the Key "
15277
"Distribution Center (KDC) settings simply edit the file and restart the "
15278
"<application>krb5-kdc</application> daemon."
15279
msgstr ""
15280
15281
#: serverguide/C/network-auth.xml:2141(para)
15282
msgid ""
15283
"Now that the KDC running an admin user is needed. It is recommended to use a "
15284
"different username from your everyday username. Using the "
15285
"<application>kadmin.local</application> utility in a terminal prompt enter:"
15286
msgstr ""
15287
15288
#: serverguide/C/network-auth.xml:2147(command) serverguide/C/network-auth.xml:2943(command)
15289
msgid "sudo kadmin.local"
15290
msgstr ""
15291
15292
#: serverguide/C/network-auth.xml:2148(computeroutput)
15293
#, no-wrap
15294
msgid ""
15295
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
15296
"kadmin.local:"
15297
msgstr ""
15298
15299
#: serverguide/C/network-auth.xml:2149(userinput)
15300
#, no-wrap
15301
msgid " addprinc steve/admin"
15302
msgstr ""
15303
15304
#: serverguide/C/network-auth.xml:2150(computeroutput)
15305
#, no-wrap
15306
msgid ""
15307
"WARNING: no policy specified for steve/admin@EXAMPLE.COM; defaulting to no "
15308
"policy\n"
15309
"Enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15310
"Re-enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15311
"Principal \"steve/admin@EXAMPLE.COM\" created.\n"
15312
"kadmin.local:"
15313
msgstr ""
15314
15315
#: serverguide/C/network-auth.xml:2154(userinput)
15316
#, no-wrap
15317
msgid " quit"
15318
msgstr ""
15319
15320
#: serverguide/C/network-auth.xml:2157(para)
15321
msgid ""
15322
"In the above example <emphasis role=\"italic\">steve</emphasis> is the "
15323
"<emphasis>Principal</emphasis>, <emphasis role=\"italic\">/admin</emphasis> "
15324
"is an <emphasis>Instance</emphasis>, and <emphasis "
15325
"role=\"italic\">@EXAMPLE.COM</emphasis> signifies the realm. The <emphasis "
15326
"role=\"italic\">\"every day\"</emphasis> Principal would be "
15327
"<emphasis>steve@EXAMPLE.COM</emphasis>, and should have only normal user "
15328
"rights."
15329
msgstr ""
15330
15331
#: serverguide/C/network-auth.xml:2165(para)
15332
msgid ""
15333
"Replace <emphasis>EXAMPLE.COM</emphasis> and <emphasis>steve</emphasis> with "
15334
"your Realm and admin username."
15335
msgstr ""
15336
15337
#: serverguide/C/network-auth.xml:2173(para)
15338
msgid ""
15339
"Next, the new admin user needs to have the appropriate Access Control List "
15340
"(ACL) permissions. The permissions are configured in the "
15341
"<filename>/etc/krb5kdc/kadm5.acl</filename> file:"
15342
msgstr ""
15343
15344
#: serverguide/C/network-auth.xml:2178(programlisting)
15345
#, no-wrap
15346
msgid ""
15347
"\n"
15348
"steve/admin@EXAMPLE.COM *\n"
15349
msgstr ""
15350
15351
#: serverguide/C/network-auth.xml:2182(para)
15352
msgid ""
15353
"This entry grants <emphasis>steve/admin</emphasis> the ability to perform "
15354
"any operation on all principals in the realm."
15355
msgstr ""
15356
15357
#: serverguide/C/network-auth.xml:2189(para)
15358
msgid ""
15359
"Now restart the <application>krb5-admin-server</application> for the new ACL "
15360
"to take affect:"
15361
msgstr ""
15362
15363
#: serverguide/C/network-auth.xml:2194(command)
15364
msgid "sudo /etc/init.d/krb5-admin-server restart"
15365
msgstr ""
15366
15367
#: serverguide/C/network-auth.xml:2200(para)
15368
msgid ""
15369
"The new user principal can be tested using the <application>kinit "
15370
"utility</application>:"
15371
msgstr ""
15372
15373
#: serverguide/C/network-auth.xml:2205(command)
15374
msgid "kinit steve/admin"
15375
msgstr ""
15376
15377
#: serverguide/C/network-auth.xml:2206(computeroutput)
15378
#, no-wrap
15379
msgid "steve/admin@EXAMPLE.COM's Password:"
15380
msgstr ""
15381
15382
#: serverguide/C/network-auth.xml:2209(para)
15383
msgid ""
15384
"After entering the password, use the <application>klist</application> "
15385
"utility to view information about the Ticket Granting Ticket (TGT):"
15386
msgstr ""
15387
15388
#: serverguide/C/network-auth.xml:2215(command) serverguide/C/network-auth.xml:2550(command)
15389
msgid "klist"
15390
msgstr ""
15391
15392
#: serverguide/C/network-auth.xml:2216(computeroutput)
15393
#, no-wrap
15394
msgid ""
15395
"Credentials cache: FILE:/tmp/krb5cc_1000\n"
15396
" Principal: steve/admin@EXAMPLE.COM\n"
15397
"\n"
15398
" Issued Expires Principal\n"
15399
"Jul 13 17:53:34 Jul 14 03:53:34 krbtgt/EXAMPLE.COM@EXAMPLE.COM"
15400
msgstr ""
15401
15402
#: serverguide/C/network-auth.xml:2223(para)
15403
msgid ""
15404
"You may need to add an entry into the <filename>/etc/hosts</filename> for "
15405
"the KDC. For example:"
15406
msgstr ""
15407
15408
#: serverguide/C/network-auth.xml:2227(programlisting)
15409
#, no-wrap
15410
msgid ""
15411
"\n"
15412
"192.168.0.1 kdc01.example.com kdc01\n"
15413
msgstr ""
15414
15415
#: serverguide/C/network-auth.xml:2231(para)
15416
msgid ""
15417
"Replacing <emphasis>192.168.0.1</emphasis> with the IP address of your KDC."
15418
msgstr ""
15419
15420
#: serverguide/C/network-auth.xml:2238(para)
15421
msgid ""
15422
"In order for clients to determine the KDC for the Realm some DNS SRV records "
15423
"are needed. Add the following to "
15424
"<filename>/etc/named/db.example.com</filename>:"
15425
msgstr ""
15426
15427
#: serverguide/C/network-auth.xml:2243(programlisting)
15428
#, no-wrap
15429
msgid ""
15430
"\n"
15431
"_kerberos._udp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15432
"_kerberos._tcp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15433
"_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15434
"_kerberos._tcp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15435
"_kerberos-adm._tcp.EXAMPLE.COM. IN SRV 1 0 749 kdc01.example.com.\n"
15436
"_kpasswd._udp.EXAMPLE.COM. IN SRV 1 0 464 kdc01.example.com.\n"
15437
msgstr ""
15438
15439
#: serverguide/C/network-auth.xml:2253(para)
15440
msgid ""
15441
"Replace <emphasis>EXAMPLE.COM</emphasis>, <emphasis>kdc01</emphasis>, and "
15442
"<emphasis>kdc02</emphasis> with your domain name, primary KDC, and secondary "
15443
"KDC."
15444
msgstr ""
15445
15446
#: serverguide/C/network-auth.xml:2259(para)
15447
msgid ""
15448
"See <xref linkend=\"dns\"/> for detailed instructions on setting up DNS."
15449
msgstr ""
15450
15451
#: serverguide/C/network-auth.xml:2266(para)
15452
msgid "Your new Kerberos Realm is now ready to authenticate clients."
15453
msgstr ""
15454
15455
#: serverguide/C/network-auth.xml:2273(title)
15456
msgid "Secondary KDC"
15457
msgstr ""
15458
15459
#: serverguide/C/network-auth.xml:2275(para)
15460
msgid ""
15461
"Once you have one Key Distribution Center (KDC) on your network, it is good "
15462
"practice to have a Secondary KDC in case the primary becomes unavailable."
15463
msgstr ""
15464
15465
#: serverguide/C/network-auth.xml:2283(para)
15466
msgid ""
15467
"First, install the packages, and when asked for the Kerberos and Admin "
15468
"server names enter the name of the Primary KDC:"
15469
msgstr ""
15470
15471
#: serverguide/C/network-auth.xml:2294(para)
15472
msgid ""
15473
"Once you have the packages installed, create the Secondary KDC's host "
15474
"principal. From a terminal prompt, enter:"
15475
msgstr ""
15476
15477
#: serverguide/C/network-auth.xml:2299(command)
15478
msgid "kadmin -q \"addprinc -randkey host/kdc02.example.com\""
15479
msgstr ""
15480
15481
#: serverguide/C/network-auth.xml:2303(para)
15482
msgid ""
15483
"After, issuing any <application>kadmin</application> commands you will be "
15484
"prompted for your <emphasis>username/admin@EXAMPLE.COM</emphasis> principal "
15485
"password."
15486
msgstr ""
15487
15488
#: serverguide/C/network-auth.xml:2312(para)
15489
msgid "Extract the <emphasis>keytab</emphasis> file:"
15490
msgstr ""
15491
15492
#: serverguide/C/network-auth.xml:2317(command)
15493
msgid "kadmin -q \"ktadd -k keytab.kdc02 host/kdc02.example.com\""
15494
msgstr ""
15495
15496
#: serverguide/C/network-auth.xml:2323(para)
15497
msgid ""
15498
"There should now be a <filename>keytab.kdc02</filename> in the current "
15499
"directory, move the file to <filename>/etc/krb5.keytab</filename>:"
15500
msgstr ""
15501
15502
#: serverguide/C/network-auth.xml:2329(command)
15503
msgid "sudo mv keytab.kdc02 /etc/krb5.keytab"
15504
msgstr ""
15505
15506
#: serverguide/C/network-auth.xml:2333(para)
15507
msgid ""
15508
"If the path to the <filename>keytab.kdc02</filename> file is different "
15509
"adjust accordingly."
15510
msgstr ""
15511
15512
#: serverguide/C/network-auth.xml:2338(para)
15513
msgid ""
15514
"Also, you can list the principals in a Keytab file, which can be useful when "
15515
"troubleshooting, using the <application>klist</application> utility:"
15516
msgstr ""
15517
15518
#: serverguide/C/network-auth.xml:2344(command)
15519
msgid "sudo klist -k /etc/krb5.keytab"
15520
msgstr ""
15521
15522
#: serverguide/C/network-auth.xml:2350(para)
15523
msgid ""
15524
"Next, there needs to be a <filename>kpropd.acl</filename> file on each KDC "
15525
"that lists all KDCs for the Realm. For example, on both primary and "
15526
"secondary KDC, create <filename>/etc/krb5kdc/kpropd.acl</filename>:"
15527
msgstr ""
15528
15529
#: serverguide/C/network-auth.xml:2355(programlisting)
15530
#, no-wrap
15531
msgid ""
15532
"\n"
15533
"host/kdc01.example.com@EXAMPLE.COM\n"
15534
"host/kdc02.example.com@EXAMPLE.COM\n"
15535
msgstr ""
15536
15537
#: serverguide/C/network-auth.xml:2363(para)
15538
msgid "Create an empty database on the <emphasis>Secondary KDC</emphasis>:"
15539
msgstr ""
15540
15541
#: serverguide/C/network-auth.xml:2368(command)
15542
msgid "sudo kdb5_util -s create"
15543
msgstr ""
15544
15545
#: serverguide/C/network-auth.xml:2374(para)
15546
msgid ""
15547
"Now start the <application>kpropd</application> daemon, which listens for "
15548
"connections from the <application>kprop</application> utility. "
15549
"<application>kprop</application> is used to transfer dump files:"
15550
msgstr ""
15551
15552
#: serverguide/C/network-auth.xml:2381(command)
15553
msgid "sudo kpropd -S"
15554
msgstr ""
15555
15556
#: serverguide/C/network-auth.xml:2387(para)
15557
msgid ""
15558
"From a terminal on the <emphasis>Primary KDC</emphasis>, create a dump file "
15559
"of the principal database:"
15560
msgstr ""
15561
15562
#: serverguide/C/network-auth.xml:2392(command)
15563
msgid "sudo kdb5_util dump /var/lib/krb5kdc/dump"
15564
msgstr ""
15565
15566
#: serverguide/C/network-auth.xml:2398(para)
15567
msgid ""
15568
"Extract the Primary KDC's <emphasis>keytab</emphasis> file and copy it to "
15569
"<filename>/etc/krb5.keytab</filename>:"
15570
msgstr ""
15571
15572
#: serverguide/C/network-auth.xml:2403(command)
15573
msgid "kadmin -q \"ktadd -k keytab.kdc01 host/kdc01.example.com\""
15574
msgstr ""
15575
15576
#: serverguide/C/network-auth.xml:2404(command)
15577
msgid "sudo mv keytab.kdc01 /etc/kr5b.keytab"
15578
msgstr ""
15579
15580
#: serverguide/C/network-auth.xml:2408(para)
15581
msgid ""
15582
"Make sure there is a <emphasis>host</emphasis> for "
15583
"<emphasis>kdc01.example.com</emphasis> before extracting the Keytab."
15584
msgstr ""
15585
15586
#: serverguide/C/network-auth.xml:2416(para)
15587
msgid ""
15588
"Using the <application>kprop</application> utility push the database to the "
15589
"Secondary KDC:"
15590
msgstr ""
15591
15592
#: serverguide/C/network-auth.xml:2421(command)
15593
msgid "sudo kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com"
15594
msgstr ""
15595
15596
#: serverguide/C/network-auth.xml:2425(para)
15597
msgid ""
15598
"There should be a <emphasis>SUCCEEDED</emphasis> message if the propagation "
15599
"worked. If there is an error message check "
15600
"<filename>/var/log/syslog</filename> on the secondary KDC for more "
15601
"information."
15602
msgstr ""
15603
15604
#: serverguide/C/network-auth.xml:2431(para)
15605
msgid ""
15606
"You may also want to create a <application>cron</application> job to "
15607
"periodically update the database on the Secondary KDC. For example, the "
15608
"following will push the database every hour:"
15609
msgstr ""
15610
15611
#: serverguide/C/network-auth.xml:2436(programlisting)
15612
#, no-wrap
15613
msgid ""
15614
"\n"
15615
"# m h dom mon dow command\n"
15616
"0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && "
15617
"/usr/sbin/kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com\n"
15618
msgstr ""
15619
15620
#: serverguide/C/network-auth.xml:2444(para)
15621
msgid ""
15622
"Back on the <emphasis>Secondary KDC</emphasis>, create a "
15623
"<emphasis>stash</emphasis> file to hold the Kerberos master key:"
15624
msgstr ""
15625
15626
#: serverguide/C/network-auth.xml:2450(command)
15627
msgid "sudo kdb5_util stash"
15628
msgstr ""
15629
15630
#: serverguide/C/network-auth.xml:2456(para)
15631
msgid ""
15632
"Finally, start the <application>krb5-kdc</application> daemon on the "
15633
"Secondary KDC:"
15634
msgstr ""
15635
15636
#: serverguide/C/network-auth.xml:2461(command) serverguide/C/network-auth.xml:3073(command)
15637
msgid "sudo /etc/init.d/krb5-kdc start"
15638
msgstr ""
15639
15640
#: serverguide/C/network-auth.xml:2467(para)
15641
msgid ""
15642
"The <emphasis>Secondary KDC</emphasis> should now be able to issue tickets "
15643
"for the Realm. You can test this by stopping the <application>krb5-"
15644
"kdc</application> daemon on the Primary KDC, then use "
15645
"<application>kinit</application> to request a ticket. If all goes well you "
15646
"should receive a ticket from the Secondary KDC."
15647
msgstr ""
15648
15649
#: serverguide/C/network-auth.xml:2475(title)
15650
msgid "Kerberos Linux Client"
15651
msgstr ""
15652
15653
#: serverguide/C/network-auth.xml:2477(para)
15654
msgid ""
15655
"This section covers configuring a Linux system as a "
15656
"<application>Kerberos</application> client. This will allow access to any "
15657
"kerberized services once a user has successfully logged into the system."
15658
msgstr ""
15659
15660
#: serverguide/C/network-auth.xml:2485(para)
15661
msgid ""
15662
"In order to authenticate to a Kerberos Realm, the <application>krb5-"
15663
"user</application> and <application>libpam-krb5</application> packages are "
15664
"needed, along with a few others that are not strictly necessary but make "
15665
"life easier. To install the packages enter the following in a terminal "
15666
"prompt:"
15667
msgstr ""
15668
15669
#: serverguide/C/network-auth.xml:2492(command)
15670
msgid ""
15671
"sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config"
15672
msgstr ""
15673
15674
#: serverguide/C/network-auth.xml:2495(para)
15675
msgid ""
15676
"The <application>auth-client-config</application> package allows simple "
15677
"configuration of PAM for authentication from multiple sources, and the "
15678
"<application>libpam-ccreds</application> will cache authentication "
15679
"credentials allowing you to login in case the Key Distribution Center (KDC) "
15680
"is unavailable. This package is also useful for laptops that may "
15681
"authenticate using Kerberos while on the corporate network, but will need to "
15682
"be accessed off the network as well."
15683
msgstr ""
15684
15685
#: serverguide/C/network-auth.xml:2506(para)
15686
msgid "To configure the client in a terminal enter:"
15687
msgstr ""
15688
15689
#: serverguide/C/network-auth.xml:2511(command)
15690
msgid "sudo dpkg-reconfigure krb5-config"
15691
msgstr ""
15692
15693
#: serverguide/C/network-auth.xml:2514(para)
15694
msgid ""
15695
"You will then be prompted to enter the name of the Kerberos Realm. Also, if "
15696
"you don't have DNS configured with Kerberos <emphasis>SRV</emphasis> "
15697
"records, the menu will prompt you for the hostname of the Key Distribution "
15698
"Center (KDC) and Realm Administration server."
15699
msgstr ""
15700
15701
#: serverguide/C/network-auth.xml:2520(para)
15702
msgid ""
15703
"The <application>dpkg-reconfigure</application> adds entries to the "
15704
"<filename>/etc/krb5.conf</filename> file for your Realm. You should have "
15705
"entries similar to the following:"
15706
msgstr ""
15707
15708
#: serverguide/C/network-auth.xml:2525(programlisting)
15709
#, no-wrap
15710
msgid ""
15711
"\n"
15712
"[libdefaults]\n"
15713
" default_realm = EXAMPLE.COM\n"
15714
"...\n"
15715
"[realms]\n"
15716
" EXAMPLE.COM = } \n"
15717
" kdc = 192.168.0.1 \n"
15718
" admin_server = 192.168.0.1\n"
15719
" }\n"
15720
msgstr ""
15721
15722
#: serverguide/C/network-auth.xml:2536(para)
15723
msgid ""
15724
"You can test the configuration by requesting a ticket using the "
15725
"<application>kinit</application> utility. For example:"
15726
msgstr ""
15727
15728
#: serverguide/C/network-auth.xml:2541(command)
15729
msgid "kinit steve@EXAMPLE.COM"
15730
msgstr ""
15731
15732
#: serverguide/C/network-auth.xml:2542(computeroutput)
15733
#, no-wrap
15734
msgid "Password for steve@EXAMPLE.COM:"
15735
msgstr ""
15736
15737
#: serverguide/C/network-auth.xml:2545(para)
15738
msgid ""
15739
"When a ticket has been granted, the details can be viewed using "
15740
"<application>klist</application>:"
15741
msgstr ""
15742
15743
#: serverguide/C/network-auth.xml:2551(computeroutput)
15744
#, no-wrap
15745
msgid ""
15746
"Ticket cache: FILE:/tmp/krb5cc_1000\n"
15747
"Default principal: steve@EXAMPLE.COM\n"
15748
"\n"
15749
"Valid starting Expires Service principal\n"
15750
"07/24/08 05:18:56 07/24/08 15:18:56 krbtgt/EXAMPLE.COM@EXAMPLE.COM\n"
15751
" renew until 07/25/08 05:18:57\n"
15752
"\n"
15753
"\n"
15754
"Kerberos 4 ticket cache: /tmp/tkt1000\n"
15755
"klist: You have no tickets cached"
15756
msgstr ""
15757
15758
#: serverguide/C/network-auth.xml:2563(para)
15759
msgid ""
15760
"Next, use the <application>auth-client-config</application> to configure the "
15761
"<application>libpam-krb5</application> module to request a ticket during "
15762
"login:"
15763
msgstr ""
15764
15765
#: serverguide/C/network-auth.xml:2569(command)
15766
msgid "sudo auth-client-config -a -p kerberos_example"
15767
msgstr ""
15768
15769
#: serverguide/C/network-auth.xml:2572(para)
15770
msgid ""
15771
"You will should now receive a ticket upon successful login authentication."
15772
msgstr ""
15773
15774
#: serverguide/C/network-auth.xml:2583(para)
15775
msgid ""
15776
"For more information on Kerberos see the <ulink "
15777
"url=\"http://web.mit.edu/Kerberos/\">MIT Kerberos</ulink> site."
15778
msgstr ""
15779
15780
#: serverguide/C/network-auth.xml:2588(para)
15781
msgid ""
15782
"The <ulink url=\"https://help.ubuntu.com/community/Kerberos\">Ubuntu Wiki "
15783
"Kerberos</ulink> page has more details."
15784
msgstr ""
15785
15786
#: serverguide/C/network-auth.xml:2593(para)
15787
msgid ""
15788
"O'Reilly's <ulink "
15789
"url=\"http://oreilly.com/catalog/9780596004033/\">Kerberos: The Definitive "
15790
"Guide</ulink> is a great reference when setting up Kerberos."
15791
msgstr ""
15792
15793
#: serverguide/C/network-auth.xml:2599(para)
15794
msgid ""
15795
"Also, feel free to stop by the <emphasis>#ubuntu-server</emphasis> IRC "
15796
"channel on <ulink url=\"http://freenode.net/\">Freenode</ulink> if you have "
15797
"Kerberos questions."
15798
msgstr ""
15799
15800
#: serverguide/C/network-auth.xml:2609(title)
15801
msgid "Kerberos and LDAP"
15802
msgstr ""
15803
15804
#: serverguide/C/network-auth.xml:2611(para)
15805
msgid ""
15806
"Replicating a Kerberos principal database between two servers can be "
15807
"complicated, and adds an additional user database to your network. "
15808
"Fortunately, MIT Kerberos can be configured to use an "
15809
"<application>LDAP</application> directory as a principal database. This "
15810
"section covers configuring a primary and secondary kerberos server to use "
15811
"<application>OpenLDAP</application> for the principal database."
15812
msgstr ""
15813
15814
#: serverguide/C/network-auth.xml:2619(title)
15815
msgid "Configuring OpenLDAP"
15816
msgstr ""
15817
15818
#: serverguide/C/network-auth.xml:2621(para)
15819
msgid ""
15820
"First, the necessary <emphasis>schema</emphasis> needs to be loaded on an "
15821
"<application>OpenLDAP</application> server that has network connectivity to "
15822
"the Primary and Secondary KDCs. The rest of this section assumes that you "
15823
"also have LDAP replication configured between at least two servers. For "
15824
"information on setting up OpenLDAP see <xref linkend=\"openldap-server\"/>."
15825
msgstr ""
15826
15827
#: serverguide/C/network-auth.xml:2628(para)
15828
msgid ""
15829
"It is also required to configure OpenLDAP for TLS and SSL connections, so "
15830
"that traffic between the KDC and LDAP server is encrypted. See <xref "
15831
"linkend=\"openldap-tls\"/> for details."
15832
msgstr ""
15833
15834
#: serverguide/C/network-auth.xml:2635(para)
15835
msgid ""
15836
"To load the schema into LDAP, on the LDAP server install the "
15837
"<application>krb5-kdc-ldap</application> package. From a terminal enter:"
15838
msgstr ""
15839
15840
#: serverguide/C/network-auth.xml:2641(command)
15841
msgid "sudo apt-get install krb5-kdc-ldap"
15842
msgstr ""
15843
15844
#: serverguide/C/network-auth.xml:2646(para)
15845
msgid "Next, extract the <filename>kerberos.schema.gz</filename> file:"
15846
msgstr ""
15847
15848
#: serverguide/C/network-auth.xml:2651(command)
15849
msgid "sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz"
15850
msgstr ""
15851
15852
#: serverguide/C/network-auth.xml:2652(command)
15853
msgid ""
15854
"sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/"
15855
msgstr ""
15856
15857
#: serverguide/C/network-auth.xml:2658(para)
15858
msgid ""
15859
"The <emphasis>kerberos</emphasis> schema needs to be added to the "
15860
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
15861
"<application>slapd</application> is also detailed in <xref "
15862
"linkend=\"openldap-configuration\"/>."
15863
msgstr ""
15864
15865
#: serverguide/C/network-auth.xml:2671(programlisting)
15866
#, no-wrap
15867
msgid ""
15868
"\n"
15869
"include /etc/ldap/schema/core.schema\n"
15870
"include /etc/ldap/schema/collective.schema\n"
15871
"include /etc/ldap/schema/corba.schema\n"
15872
"include /etc/ldap/schema/cosine.schema\n"
15873
"include /etc/ldap/schema/duaconf.schema\n"
15874
"include /etc/ldap/schema/dyngroup.schema\n"
15875
"include /etc/ldap/schema/inetorgperson.schema\n"
15876
"include /etc/ldap/schema/java.schema\n"
15877
"include /etc/ldap/schema/misc.schema\n"
15878
"include /etc/ldap/schema/nis.schema\n"
15879
"include /etc/ldap/schema/openldap.schema\n"
15880
"include /etc/ldap/schema/ppolicy.schema\n"
15881
"include /etc/ldap/schema/kerberos.schema\n"
15882
msgstr ""
15883
15884
#: serverguide/C/network-auth.xml:2691(para)
15885
msgid "Create a temporary directory to hold the LDIF files:"
15886
msgstr ""
15887
15888
#: serverguide/C/network-auth.xml:2706(command)
15889
msgid ""
15890
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
15891
"\"cn={12}kerberos,cn=schema,cn=config\" > /tmp/cn=kerberos.ldif"
15892
msgstr ""
15893
15894
#: serverguide/C/network-auth.xml:2716(para)
15895
msgid ""
15896
"Edit the generated <filename>/tmp/cn\\=kerberos.ldif</filename> file, "
15897
"changing the following attributes:"
15898
msgstr ""
15899
15900
#: serverguide/C/network-auth.xml:2720(programlisting)
15901
#, no-wrap
15902
msgid ""
15903
"\n"
15904
"dn: cn=kerberos,cn=schema,cn=config\n"
15905
"...\n"
15906
"cn: kerberos\n"
15907
msgstr ""
15908
15909
#: serverguide/C/network-auth.xml:2726(para)
15910
msgid "And remove the following lines from the end of the file:"
15911
msgstr ""
15912
15913
#: serverguide/C/network-auth.xml:2730(programlisting)
15914
#, no-wrap
15915
msgid ""
15916
"\n"
15917
"structuralObjectClass: olcSchemaConfig\n"
15918
"entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc\n"
15919
"creatorsName: cn=config\n"
15920
"createTimestamp: 20090111203515Z\n"
15921
"entryCSN: 20090111203515.326445Z#000000#000#000000\n"
15922
"modifiersName: cn=config\n"
15923
"modifyTimestamp: 20090111203515Z\n"
15924
msgstr ""
15925
15926
#: serverguide/C/network-auth.xml:2749(para)
15927
msgid "Load the new schema with <application>ldapadd</application>:"
15928
msgstr ""
15929
15930
#: serverguide/C/network-auth.xml:2754(command)
15931
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=kerberos.ldif"
15932
msgstr ""
15933
15934
#: serverguide/C/network-auth.xml:2760(para)
15935
msgid ""
15936
"Add an index for the <emphasis>krb5principalname</emphasis> attribute:"
15937
msgstr ""
15938
15939
#: serverguide/C/network-auth.xml:2765(command) serverguide/C/network-auth.xml:2782(command)
15940
msgid "ldapmodify -x -D cn=admin,cn=config -W"
15941
msgstr ""
15942
15943
#: serverguide/C/network-auth.xml:2767(userinput)
15944
#, no-wrap
15945
msgid ""
15946
"dn: olcDatabase={1}hdb,cn=config\n"
15947
"add: olcDbIndex\n"
15948
"olcDbIndex: krbPrincipalName eq,pres,sub"
15949
msgstr ""
15950
15951
#: serverguide/C/network-auth.xml:2766(computeroutput)
15952
#, no-wrap
15953
msgid ""
15954
"Enter LDAP Password:\n"
15955
"<placeholder-1/>\n"
15956
"\n"
15957
"modifying entry \"olcDatabase={1}hdb,cn=config\""
15958
msgstr ""
15959
15960
#: serverguide/C/network-auth.xml:2777(para)
15961
msgid "Finally, update the Access Control Lists (ACL):"
15962
msgstr ""
15963
15964
#: serverguide/C/network-auth.xml:2784(userinput)
15965
#, no-wrap
15966
msgid ""
15967
"dn: olcDatabase={1}hdb,cn=config\n"
15968
"replace: olcAccess\n"
15969
"olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by "
15970
"dn=\"cn=admin,dc=exampl\n"
15971
" e,dc=com\" write by anonymous auth by self write by * none\n"
15972
"-\n"
15973
"add: olcAccess\n"
15974
"olcAccess: to dn.base=\"\" by * read\n"
15975
"-\n"
15976
"add: olcAccess\n"
15977
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read"
15978
msgstr ""
15979
15980
#: serverguide/C/network-auth.xml:2783(computeroutput)
15981
#, no-wrap
15982
msgid ""
15983
"Enter LDAP Password: \n"
15984
"<placeholder-1/>\n"
15985
"\n"
15986
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
15987
msgstr ""
15988
15989
#: serverguide/C/network-auth.xml:2804(para)
15990
msgid ""
15991
"That's it, your LDAP directory is now ready to serve as a Kerberos principal "
15992
"database."
15993
msgstr ""
15994
15995
#: serverguide/C/network-auth.xml:2810(title)
15996
msgid "Primary KDC Configuration"
15997
msgstr ""
15998
15999
#: serverguide/C/network-auth.xml:2812(para)
16000
msgid ""
16001
"With <application>OpenLDAP</application> configured it is time to configure "
16002
"the KDC."
16003
msgstr ""
16004
16005
#: serverguide/C/network-auth.xml:2818(para)
16006
msgid "First, install the necessary packages, from a terminal enter:"
16007
msgstr ""
16008
16009
#: serverguide/C/network-auth.xml:2823(command) serverguide/C/network-auth.xml:2980(command)
16010
msgid "sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap"
16011
msgstr ""
16012
16013
#: serverguide/C/network-auth.xml:2829(para)
16014
msgid ""
16015
"Now edit <filename>/etc/krb5.conf</filename> adding the following options to "
16016
"under the appropriate sections:"
16017
msgstr ""
16018
16019
#: serverguide/C/network-auth.xml:2833(programlisting)
16020
#, no-wrap
16021
msgid ""
16022
"\n"
16023
"[libdefaults]\n"
16024
" default_realm = EXAMPLE.COM\n"
16025
"\n"
16026
"...\n"
16027
"\n"
16028
"[realms]\n"
16029
" EXAMPLE.COM = {\n"
16030
" kdc = kdc01.example.com\n"
16031
" kdc = kdc02.example.com\n"
16032
" admin_server = kdc01.example.com\n"
16033
" admin_server = kdc02.example.com\n"
16034
" default_domain = example.com\n"
16035
" database_module = openldap_ldapconf\n"
16036
" }\n"
16037
"\n"
16038
"...\n"
16039
"\n"
16040
"[domain_realm]\n"
16041
" .example.com = EXAMPLE.COM\n"
16042
"\n"
16043
"\n"
16044
"...\n"
16045
"\n"
16046
"[dbdefaults]\n"
16047
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16048
"\n"
16049
"[dbmodules]\n"
16050
" openldap_ldapconf = {\n"
16051
" db_library = kldap\n"
16052
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16053
"\n"
16054
" # this object needs to have read rights on\n"
16055
" # the realm container, principal container and realm sub-"
16056
"trees\n"
16057
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16058
"\n"
16059
" # this object needs to have read and write rights on\n"
16060
" # the realm container, principal container and realm sub-"
16061
"trees\n"
16062
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16063
" ldap_servers = ldaps://ldap01.example.com "
16064
"ldaps://ldap02.example.com\n"
16065
" ldap_conns_per_server = 5\n"
16066
" }\n"
16067
msgstr ""
16068
16069
#: serverguide/C/network-auth.xml:2878(para)
16070
msgid ""
16071
"Change <emphasis>example.com</emphasis>, "
16072
"<emphasis>dc=example,dc=com</emphasis>, "
16073
"<emphasis>cn=admin,dc=example,dc=com</emphasis>, and "
16074
"<emphasis>ldap01.example.com</emphasis> to the appropriate domain, LDAP "
16075
"object, and LDAP server for your network."
16076
msgstr ""
16077
16078
#: serverguide/C/network-auth.xml:2887(para)
16079
msgid ""
16080
"Next, use the <application>kdb5_ldap_util</application> utility to create "
16081
"the realm:"
16082
msgstr ""
16083
16084
#: serverguide/C/network-auth.xml:2892(command)
16085
msgid ""
16086
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees "
16087
"dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com"
16088
msgstr ""
16089
16090
#: serverguide/C/network-auth.xml:2898(para)
16091
msgid ""
16092
"Create a stash of the password used to bind to the LDAP server. This "
16093
"password is used by the <emphasis>ldap_kdc_dn</emphasis> and "
16094
"<emphasis>ldap_kadmin_dn</emphasis> options in "
16095
"<filename>/etc/krb5.conf</filename>:"
16096
msgstr ""
16097
16098
#: serverguide/C/network-auth.xml:2904(command) serverguide/C/network-auth.xml:3042(command)
16099
msgid ""
16100
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com stashsrvpw -f "
16101
"/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com"
16102
msgstr ""
16103
16104
#: serverguide/C/network-auth.xml:2910(para)
16105
msgid "Copy the CA certificate from the LDAP server:"
16106
msgstr ""
16107
16108
#: serverguide/C/network-auth.xml:2915(command)
16109
msgid "scp ldap01:/etc/ssl/certs/cacert.pem ."
16110
msgstr ""
16111
16112
#: serverguide/C/network-auth.xml:2916(command)
16113
msgid "sudo cp cacert.pem /etc/ssl/certs"
16114
msgstr ""
16115
16116
#: serverguide/C/network-auth.xml:2919(para)
16117
msgid ""
16118
"And edit <filename>/etc/ldap/ldap.conf</filename> to use the certificate:"
16119
msgstr ""
16120
16121
#: serverguide/C/network-auth.xml:2923(programlisting)
16122
#, no-wrap
16123
msgid ""
16124
"\n"
16125
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
16126
msgstr ""
16127
16128
#: serverguide/C/network-auth.xml:2928(para)
16129
msgid ""
16130
"The certificate will also need to be copied to the Secondary KDC, to allow "
16131
"the connection to the LDAP servers using LDAPS."
16132
msgstr ""
16133
16134
#: serverguide/C/network-auth.xml:2937(para)
16135
msgid ""
16136
"You can now add Kerberos principals to the LDAP database, and they will be "
16137
"copied to any other LDAP servers configured for replication. To add a "
16138
"principal using the <application>kadmin.local</application> utility enter:"
16139
msgstr ""
16140
16141
#: serverguide/C/network-auth.xml:2945(userinput)
16142
#, no-wrap
16143
msgid "addprinc -x dn=\"uid=steve,ou=people,dc=example,dc=com\" steve"
16144
msgstr ""
16145
16146
#: serverguide/C/network-auth.xml:2944(computeroutput)
16147
#, no-wrap
16148
msgid ""
16149
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
16150
"kadmin.local: <placeholder-1/>\n"
16151
"WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy\n"
16152
"Enter password for principal \"steve@EXAMPLE.COM\": \n"
16153
"Re-enter password for principal \"steve@EXAMPLE.COM\": \n"
16154
"Principal \"steve@EXAMPLE.COM\" created."
16155
msgstr ""
16156
16157
#: serverguide/C/network-auth.xml:2952(para)
16158
msgid ""
16159
"There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and "
16160
"krbExtraData attributes added to the "
16161
"<emphasis>uid=steve,ou=people,dc=example,dc=com</emphasis> user object. Use "
16162
"the <application>kinit</application> and <application>klist</application> "
16163
"utilities to test that the user is indeed issued a ticket."
16164
msgstr ""
16165
16166
#: serverguide/C/network-auth.xml:2959(para)
16167
msgid ""
16168
"If the user object is already created the <emphasis>-x dn=\"...\"</emphasis> "
16169
"option is needed to add the Kerberos attributes. Otherwise a new "
16170
"<emphasis>principal</emphasis> object will be created in the realm subtree."
16171
msgstr ""
16172
16173
#: serverguide/C/network-auth.xml:2967(title)
16174
msgid "Secondary KDC Configuration"
16175
msgstr ""
16176
16177
#: serverguide/C/network-auth.xml:2969(para)
16178
msgid ""
16179
"Configuring a Secondary KDC using the LDAP backend is similar to configuring "
16180
"one using the normal Kerberos database."
16181
msgstr ""
16182
16183
#: serverguide/C/network-auth.xml:2975(para)
16184
msgid "First, install the necessary packages. In a terminal enter:"
16185
msgstr ""
16186
16187
#: serverguide/C/network-auth.xml:2986(para)
16188
msgid ""
16189
"Next, edit <filename>/etc/krb5.conf</filename> to use the LDAP backend:"
16190
msgstr ""
16191
16192
#: serverguide/C/network-auth.xml:2990(programlisting)
16193
#, no-wrap
16194
msgid ""
16195
"\n"
16196
"[libdefaults]\n"
16197
" default_realm = EXAMPLE.COM\n"
16198
"\n"
16199
"...\n"
16200
"\n"
16201
"[realms]\n"
16202
" EXAMPLE.COM = {\n"
16203
" kdc = kdc01.example.com\n"
16204
" kdc = kdc02.example.com\n"
16205
" admin_server = kdc01.example.com\n"
16206
" admin_server = kdc02.example.com\n"
16207
" default_domain = example.com\n"
16208
" database_module = openldap_ldapconf\n"
16209
" }\n"
16210
"\n"
16211
"...\n"
16212
"\n"
16213
"[domain_realm]\n"
16214
" .example.com = EXAMPLE.COM\n"
16215
"\n"
16216
"...\n"
16217
"\n"
16218
"[dbdefaults]\n"
16219
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16220
"\n"
16221
"[dbmodules]\n"
16222
" openldap_ldapconf = {\n"
16223
" db_library = kldap\n"
16224
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16225
"\n"
16226
" # this object needs to have read rights on\n"
16227
" # the realm container, principal container and realm sub-"
16228
"trees\n"
16229
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16230
"\n"
16231
" # this object needs to have read and write rights on\n"
16232
" # the realm container, principal container and realm sub-"
16233
"trees\n"
16234
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16235
" ldap_servers = ldaps://ldap01.example.com "
16236
"ldaps://ldap02.example.com\n"
16237
" ldap_conns_per_server = 5\n"
16238
" }\n"
16239
msgstr ""
16240
16241
#: serverguide/C/network-auth.xml:3037(para)
16242
msgid "Create the stash for the LDAP bind password:"
16243
msgstr ""
16244
16245
#: serverguide/C/network-auth.xml:3048(para)
16246
msgid ""
16247
"Now, on the <emphasis>Primary KDC</emphasis> copy the "
16248
"<filename>/etc/krb5kdc/.k5.EXAMPLE.COM</filename><emphasis>Master "
16249
"Key</emphasis> stash to the Secondary KDC. Be sure to copy the file over an "
16250
"encrypted connection such as <application>scp</application>, or on physical "
16251
"media."
16252
msgstr ""
16253
16254
#: serverguide/C/network-auth.xml:3055(command)
16255
msgid "sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM steve@kdc02.example.com:~"
16256
msgstr ""
16257
16258
#: serverguide/C/network-auth.xml:3056(command)
16259
msgid "sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/"
16260
msgstr ""
16261
16262
#: serverguide/C/network-auth.xml:3060(para)
16263
msgid ""
16264
"Again, replace <emphasis>EXAMPLE.COM</emphasis> with your actual realm."
16265
msgstr ""
16266
16267
#: serverguide/C/network-auth.xml:3068(para)
16268
msgid "Finally, start the <application>krb5-kdc</application> daemon:"
16269
msgstr ""
16270
16271
#: serverguide/C/network-auth.xml:3079(para)
16272
msgid ""
16273
"You now have redundant KDCs on your network, and with redundant LDAP servers "
16274
"you should be able to continue to authenticate users if one LDAP server, one "
16275
"Kerberos server, or one LDAP and one Kerberos server become unavailable."
16276
msgstr ""
16277
16278
#: serverguide/C/network-auth.xml:3091(para)
16279
msgid ""
16280
"The <ulink url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16281
"admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend\"> Kerberos Admin "
16282
"Guide</ulink> has some additional details."
16283
msgstr ""
16284
16285
#: serverguide/C/network-auth.xml:3097(para)
16286
msgid ""
16287
"For more information on <application>kdb5_ldap_util</application> see <ulink "
16288
"url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16289
"admin.html#Global-Operations-on-the-Kerberos-LDAP-Database\"> Section "
16290
"5.6</ulink> and the <ulink "
16291
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/kdb5_ldap_util.8.html"
16292
"\">kdb5_ldap_util man page</ulink>."
16293
msgstr ""
16294
16295
#: serverguide/C/network-auth.xml:3105(para)
16296
msgid ""
16297
"Another useful link is the <ulink "
16298
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/krb5.conf.5.html\">kr"
16299
"b5.conf man page</ulink>."
16300
msgstr ""
16301
16302
#: serverguide/C/network-auth.xml:3110(para)
16303
msgid ""
16304
"Also, see the <ulink "
16305
"url=\"https://help.ubuntu.com/community/Kerberos#kerberos-ldap\">Kerberos "
16306
"and LDAP</ulink> Ubuntu wiki page."
16307
msgstr ""
16308
16309
#: serverguide/C/monitoring.xml:13(title)
16310
msgid "Monitoring"
16311
msgstr ""
16312
16313
#: serverguide/C/monitoring.xml:17(para)
16314
msgid ""
16315
"The monitoring of essential servers and services is an important part of "
16316
"system administration. Most network services are monitored for performance, "
16317
"availability, or both. This section will cover installation and "
16318
"configuration of <application>Nagios</application> for availability "
16319
"monitoring, and <application>Munin</application> for performance monitoring."
16320
msgstr ""
16321
16322
#: serverguide/C/monitoring.xml:24(para)
16323
msgid ""
16324
"The examples in this section will use two servers with hostnames "
16325
"<emphasis>server01</emphasis> and <emphasis>server02</emphasis>. "
16326
"<emphasis>Server01</emphasis> will be configured with "
16327
"<application>Nagios</application> to monitor services on itself and "
16328
"<emphasis>server02</emphasis>. Server01 will also be setup with the "
16329
"<application>munin</application> package to gather information from the "
16330
"network. Using the <application>munin-node</application> package, "
16331
"<emphasis>server02</emphasis> will be configured to send information to "
16332
"<emphasis>server01</emphasis>."
16333
msgstr ""
16334
16335
#: serverguide/C/monitoring.xml:33(para)
16336
msgid ""
16337
"Hopefully these simple examples will allow you to monitor additional servers "
16338
"and services on your network."
16339
msgstr ""
16340
16341
#: serverguide/C/monitoring.xml:39(title)
16342
msgid "Nagios"
16343
msgstr ""
16344
16345
#: serverguide/C/monitoring.xml:44(para)
16346
msgid ""
16347
"First, on <emphasis>server01</emphasis> install the "
16348
"<application>nagios</application> package. In a terminal enter:"
16349
msgstr ""
16350
16351
#: serverguide/C/monitoring.xml:50(command)
16352
msgid "sudo apt-get install nagios3 nagios-nrpe-plugin"
16353
msgstr ""
16354
16355
#: serverguide/C/monitoring.xml:53(para)
16356
msgid ""
16357
"You will be asked to enter a password for the "
16358
"<emphasis>nagiosadmin</emphasis> user. The user's credentials are stored in "
16359
"<filename>/etc/nagios3/htpasswd.users</filename>. To change the "
16360
"<emphasis>nagiosadmin</emphasis> password, or add additional users to the "
16361
"Nagios CGI scripts, use the <application>htpasswd</application> that is part "
16362
"of the <application>apache2-utils</application> package."
16363
msgstr ""
16364
16365
#: serverguide/C/monitoring.xml:60(para)
16366
msgid ""
16367
"For example, to change the password for the <emphasis>nagiosadmin</emphasis> "
16368
"user enter:"
16369
msgstr ""
16370
16371
#: serverguide/C/monitoring.xml:65(command)
16372
msgid "sudo htpasswd /etc/nagios3/htpasswd.users nagiosadmin"
16373
msgstr ""
16374
16375
#: serverguide/C/monitoring.xml:68(para)
16376
msgid "To add a user:"
16377
msgstr ""
16378
16379
#: serverguide/C/monitoring.xml:73(command)
16380
msgid "sudo htpasswd /etc/nagios3/htpasswd.users steve"
16381
msgstr ""
16382
16383
#: serverguide/C/monitoring.xml:76(para)
16384
msgid ""
16385
"Next, on <emphasis>server02</emphasis> install the <application>nagios-nrpe-"
16386
"server</application> package. From a terminal on server02 enter:"
16387
msgstr ""
16388
16389
#: serverguide/C/monitoring.xml:82(command)
16390
msgid "sudo apt-get install nagios-nrpe-server"
16391
msgstr ""
16392
16393
#: serverguide/C/monitoring.xml:86(para)
16394
msgid ""
16395
"<application>NRPE</application> allows you to execute local checks on remote "
16396
"hosts. There are other ways of accomplishing this through other Nagios "
16397
"plugins as well as other checks."
16398
msgstr ""
16399
16400
#: serverguide/C/monitoring.xml:94(title)
16401
msgid "Configuration Overview"
16402
msgstr ""
16403
16404
#: serverguide/C/monitoring.xml:96(para)
16405
msgid ""
16406
"There are a couple of directories containing "
16407
"<application>Nagios</application> configuration and check files."
16408
msgstr ""
16409
16410
#: serverguide/C/monitoring.xml:102(para)
16411
msgid ""
16412
"<filename>/etc/nagios3</filename>: contains configuration files for the "
16413
"operation of the <application>nagios</application> daemon, CGI files, hosts, "
16414
"etc."
16415
msgstr ""
16416
16417
#: serverguide/C/monitoring.xml:108(para)
16418
msgid ""
16419
"<filename>/etc/nagios-plugins</filename>: houses configuration files for the "
16420
"service checks."
16421
msgstr ""
16422
16423
#: serverguide/C/monitoring.xml:113(para)
16424
msgid ""
16425
"<filename>/etc/nagios</filename>: on the remote host contains the "
16426
"<application>nagios-nrpe-server</application> configuration files."
16427
msgstr ""
16428
16429
#: serverguide/C/monitoring.xml:118(para)
16430
msgid ""
16431
"<filename>/usr/lib/nagios/plugins/</filename>: where the check binaries are "
16432
"stored. To see the options of a check use the <emphasis>-h</emphasis> option."
16433
msgstr ""
16434
16435
#: serverguide/C/monitoring.xml:123(para)
16436
msgid "For example: <command>/usr/lib/nagios/plugins/check_dhcp -h</command>"
16437
msgstr ""
16438
16439
#: serverguide/C/monitoring.xml:129(para)
16440
msgid ""
16441
"There are a plethora of checks <application>Nagios</application> can be "
16442
"configured to execute for any given host. For this example Nagios will be "
16443
"configured to check disk space, DNS, and a MySQL hostgroup. The DNS check "
16444
"will be on <emphasis>server02</emphasis>, and the MySQL hostgroup will "
16445
"include both <emphasis>server01</emphasis> and <emphasis>server02</emphasis>."
16446
msgstr ""
16447
16448
#: serverguide/C/monitoring.xml:136(para)
16449
msgid ""
16450
"See <xref linkend=\"httpd\"/> for details on setting up Apache, <xref "
16451
"linkend=\"dns\"/> for DNS, and <xref linkend=\"mysql\"/> for MySQL."
16452
msgstr ""
16453
16454
#: serverguide/C/monitoring.xml:141(para)
16455
msgid ""
16456
"Additionally, there are some terms that once explained will hopefully make "
16457
"understanding Nagios configuration easier:"
16458
msgstr ""
16459
16460
#: serverguide/C/monitoring.xml:147(para)
16461
msgid ""
16462
"<emphasis>Host</emphasis>: a server, workstation, network device, etc that "
16463
"is being monitored."
16464
msgstr ""
16465
16466
#: serverguide/C/monitoring.xml:152(para)
16467
msgid ""
16468
"<emphasis>Host Group</emphasis>: a group of similar hosts. For example, you "
16469
"could group all web servers, file server, etc."
16470
msgstr ""
16471
16472
#: serverguide/C/monitoring.xml:157(para)
16473
msgid ""
16474
"<emphasis>Service</emphasis>: the service being monitored on the host. Such "
16475
"as HTTP, DNS, NFS, etc."
16476
msgstr ""
16477
16478
#: serverguide/C/monitoring.xml:162(para)
16479
msgid ""
16480
"<emphasis>Service Group</emphasis>: allows you to group multiple services "
16481
"together. This is useful for grouping multiple HTTP for example."
16482
msgstr ""
16483
16484
#: serverguide/C/monitoring.xml:168(para)
16485
msgid ""
16486
"<emphasis>Contact</emphasis>: person to be notified when an event takes "
16487
"place. Nagios can be configured to send emails, SMS messages, etc."
16488
msgstr ""
16489
16490
#: serverguide/C/monitoring.xml:174(para)
16491
msgid ""
16492
"By default Nagios is configured to check HTTP, disk space, SSH, current "
16493
"users, processes, and load on the <emphasis>localhost</emphasis>. Nagios "
16494
"will also <application>ping</application> check the "
16495
"<emphasis>gateway</emphasis>."
16496
msgstr ""
16497
16498
#: serverguide/C/monitoring.xml:179(para)
16499
msgid ""
16500
"Large Nagios installations can be quite complex to configure. It is usually "
16501
"best to start small, one or two hosts, get things configured the way you "
16502
"like then expand."
16503
msgstr ""
16504
16505
#: serverguide/C/monitoring.xml:194(para)
16506
msgid ""
16507
"First, create a <emphasis>host</emphasis> configuration file for "
16508
"<emphasis>server02</emphasis>. In a terminal enter:"
16509
msgstr ""
16510
16511
#: serverguide/C/monitoring.xml:199(command)
16512
msgid ""
16513
"sudo cp /etc/nagios3/conf.d/localhost_nagios2.cfg "
16514
"/etc/nagios3/conf.d/server02.cfg"
16515
msgstr ""
16516
16517
#: serverguide/C/monitoring.xml:203(para)
16518
msgid ""
16519
"In the above and following command examples, replace "
16520
"<emphasis>\"server01\"</emphasis>, "
16521
"<emphasis>\"server02\"</emphasis><emphasis>172.18.100.100</emphasis>, and "
16522
"<emphasis>172.18.100.101</emphasis> with the host names and IP addresses of "
16523
"your servers."
16524
msgstr ""
16525
16526
#: serverguide/C/monitoring.xml:212(para)
16527
msgid "Next, edit <filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16528
msgstr ""
16529
16530
#: serverguide/C/monitoring.xml:216(programlisting)
16531
#, no-wrap
16532
msgid ""
16533
"\n"
16534
"define host{\n"
16535
" use generic-host ; Name of host "
16536
"template to use\n"
16537
" host_name server02\n"
16538
" alias Server 02\n"
16539
" address 172.18.100.101\n"
16540
"}\n"
16541
"\n"
16542
"# check DNS service.\n"
16543
"define service {\n"
16544
" use generic-service\n"
16545
" host_name server02\n"
16546
" service_description DNS\n"
16547
" check_command check_dns!172.18.100.101\n"
16548
"}\n"
16549
msgstr ""
16550
16551
#: serverguide/C/monitoring.xml:236(para)
16552
msgid ""
16553
"Restart the <application>nagios</application> daemon to enable the new "
16554
"configuration:"
16555
msgstr ""
16556
16557
#: serverguide/C/monitoring.xml:241(command) serverguide/C/monitoring.xml:308(command) serverguide/C/monitoring.xml:375(command)
16558
msgid "sudo /etc/init.d/nagios3 restart"
16559
msgstr ""
16560
16561
#: serverguide/C/monitoring.xml:251(para)
16562
msgid ""
16563
"Now add a service definition for the MySQL check by adding the following to "
16564
"<filename>/etc/nagios3/conf.d/services_nagios2.cfg</filename>:"
16565
msgstr ""
16566
16567
#: serverguide/C/monitoring.xml:255(programlisting)
16568
#, no-wrap
16569
msgid ""
16570
"\n"
16571
"# check MySQL servers.\n"
16572
"define service {\n"
16573
" hostgroup_name mysql-servers\n"
16574
" service_description MySQL\n"
16575
" check_command "
16576
"check_mysql_cmdlinecred!nagios!secret!$HOSTADDRESS\n"
16577
" use generic-service\n"
16578
" notification_interval 0 ; set > 0 if you want to be "
16579
"renotified\n"
16580
"}\n"
16581
msgstr ""
16582
16583
#: serverguide/C/monitoring.xml:269(para)
16584
msgid ""
16585
"A <emphasis>mysqsl-servers</emphasis> hostgroup now needs to be defined. "
16586
"Edit <filename>/etc/nagios3/conf.d/hostgroups_nagios2.cfg</filename> adding:"
16587
msgstr ""
16588
16589
#: serverguide/C/monitoring.xml:274(programlisting)
16590
#, no-wrap
16591
msgid ""
16592
"\n"
16593
"# MySQL hostgroup.\n"
16594
"define hostgroup {\n"
16595
" hostgroup_name mysql-servers\n"
16596
" alias MySQL servers\n"
16597
" members localhost, server02\n"
16598
" }\n"
16599
msgstr ""
16600
16601
#: serverguide/C/monitoring.xml:286(para)
16602
msgid ""
16603
"The Nagios check needs to authenticate to MySQL. To add a "
16604
"<emphasis>nagios</emphasis> user to MySQL enter:"
16605
msgstr ""
16606
16607
#: serverguide/C/monitoring.xml:291(command)
16608
msgid "mysql -u root -p -e \"create user nagios identified by 'secret';\""
16609
msgstr ""
16610
16611
#: serverguide/C/monitoring.xml:295(para)
16612
msgid ""
16613
"The <emphasis>nagios</emphasis> user will need to be added all hosts in the "
16614
"<emphasis>mysql-servers</emphasis> hostgroup."
16615
msgstr ""
16616
16617
#: serverguide/C/monitoring.xml:303(para)
16618
msgid ""
16619
"Restart <application>nagios</application> to start checking the MySQL "
16620
"servers."
16621
msgstr ""
16622
16623
#: serverguide/C/monitoring.xml:318(para)
16624
msgid ""
16625
"Lastly configure NRPE to check the disk space on "
16626
"<emphasis>server02</emphasis>."
16627
msgstr ""
16628
16629
#: serverguide/C/monitoring.xml:322(para)
16630
msgid ""
16631
"On <emphasis>server01</emphasis> add the service check to "
16632
"<filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16633
msgstr ""
16634
16635
#: serverguide/C/monitoring.xml:327(programlisting)
16636
#, no-wrap
16637
msgid ""
16638
"\n"
16639
"# NRPE disk check.\n"
16640
"define service {\n"
16641
" use generic-service\n"
16642
" host_name server02\n"
16643
" service_description nrpe-disk\n"
16644
" check_command "
16645
"check_nrpe_1arg!check_all_disks!172.18.100.101\n"
16646
"}\n"
16647
msgstr ""
16648
16649
#: serverguide/C/monitoring.xml:340(para)
16650
msgid ""
16651
"Now on <emphasis>server02</emphasis> edit "
16652
"<filename>/etc/nagios/nrpe.cfg</filename> changing:"
16653
msgstr ""
16654
16655
#: serverguide/C/monitoring.xml:344(programlisting)
16656
#, no-wrap
16657
msgid ""
16658
"\n"
16659
"allowed_hosts=172.18.100.100\n"
16660
msgstr ""
16661
16662
#: serverguide/C/monitoring.xml:348(para)
16663
msgid "And below in the command definition area add:"
16664
msgstr ""
16665
16666
#: serverguide/C/monitoring.xml:352(programlisting)
16667
#, no-wrap
16668
msgid ""
16669
"\n"
16670
"command[check_all_disks]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -"
16671
"e\n"
16672
msgstr ""
16673
16674
#: serverguide/C/monitoring.xml:359(para)
16675
msgid "Finally, restart <application>nagios-nrpe-server</application>:"
16676
msgstr ""
16677
16678
#: serverguide/C/monitoring.xml:364(command)
16679
msgid "sudo /etc/init.d/nagios-nrpe-server restart"
16680
msgstr ""
16681
16682
#: serverguide/C/monitoring.xml:370(para)
16683
msgid ""
16684
"Also, on <emphasis>server01</emphasis> restart "
16685
"<application>nagios</application>:"
16686
msgstr ""
16687
16688
#: serverguide/C/monitoring.xml:383(para)
16689
msgid ""
16690
"You should now be able to see the host and service checks in the Nagios CGI "
16691
"files. To access them point a browser to http://server01/nagios3. You will "
16692
"then be prompted for the <emphasis>nagiosadmin</emphasis> username and "
16693
"password."
16694
msgstr ""
16695
16696
#: serverguide/C/monitoring.xml:393(para)
16697
msgid ""
16698
"This section has just scratched the surface of Nagios' features. The "
16699
"<application>nagios-plugins-extra</application> and <application>nagios-snmp-"
16700
"plugins</application> contain many more service checks."
16701
msgstr ""
16702
16703
#: serverguide/C/monitoring.xml:400(para)
16704
msgid ""
16705
"For more information see <ulink "
16706
"url=\"http://www.nagios.org/\">Nagios</ulink> website."
16707
msgstr ""
16708
16709
#: serverguide/C/monitoring.xml:405(para)
16710
msgid ""
16711
"Specifically the <ulink "
16712
"url=\"http://nagios.sourceforge.net/docs/3_0/\">Online Documentation</ulink> "
16713
"site."
16714
msgstr ""
16715
16716
#: serverguide/C/monitoring.xml:410(para)
16717
msgid ""
16718
"There is also a list of <ulink "
16719
"url=\"http://www.nagios.org/propaganda/books/\">books</ulink> related to "
16720
"Nagios and network monitoring:"
16721
msgstr ""
16722
16723
#: serverguide/C/monitoring.xml:416(para)
16724
msgid ""
16725
"The <ulink url=\"https://help.ubuntu.com/community/Nagios\">Nagios Ubuntu "
16726
"Wiki</ulink> page also has more details."
16727
msgstr ""
16728
16729
#: serverguide/C/monitoring.xml:425(title)
16730
msgid "Munin"
16731
msgstr ""
16732
16733
#: serverguide/C/monitoring.xml:430(para)
16734
msgid ""
16735
"Before installing <application>Munin</application> on "
16736
"<emphasis>server01</emphasis><application>apache2</application> will need to "
16737
"be installed. The default configuration is fine for running a "
16738
"<application>munin</application> server. For more information see <xref "
16739
"linkend=\"httpd\"/>."
16740
msgstr ""
16741
16742
#: serverguide/C/monitoring.xml:436(para)
16743
msgid ""
16744
"First, on <emphasis>server01</emphasis> install "
16745
"<application>munin</application>. In a terminal enter:"
16746
msgstr ""
16747
16748
#: serverguide/C/monitoring.xml:441(command)
16749
msgid "sudo apt-get install munin"
16750
msgstr ""
16751
16752
#: serverguide/C/monitoring.xml:444(para)
16753
msgid ""
16754
"Now on <emphasis>server02</emphasis> install the <application>munin-"
16755
"node</application> package:"
16756
msgstr ""
16757
16758
#: serverguide/C/monitoring.xml:449(command)
16759
msgid "sudo apt-get install munin-node"
16760
msgstr ""
16761
16762
#: serverguide/C/monitoring.xml:456(para)
16763
msgid ""
16764
"On <emphasis>server01</emphasis> edit the "
16765
"<filename>/etc/munin/munin.conf</filename> adding the IP address for "
16766
"<emphasis>server02</emphasis>:"
16767
msgstr ""
16768
16769
#: serverguide/C/monitoring.xml:461(programlisting)
16770
#, no-wrap
16771
msgid ""
16772
"\n"
16773
"## First our \"normal\" host.\n"
16774
"[server02]\n"
16775
" address 172.18.100.101\n"
16776
msgstr ""
16777
16778
#: serverguide/C/monitoring.xml:468(para)
16779
msgid ""
16780
"Replace <emphasis>server02</emphasis> and "
16781
"<emphasis>172.18.100.101</emphasis> with the actual hostname and IP address "
16782
"for your server."
16783
msgstr ""
16784
16785
#: serverguide/C/monitoring.xml:474(para)
16786
msgid ""
16787
"Next, configure <application>munin-node</application> on "
16788
"<emphasis>server02</emphasis>. Edit <filename>/etc/munin/munin-"
16789
"node.conf</filename> to allow access by <emphasis>server01</emphasis>:"
16790
msgstr ""
16791
16792
#: serverguide/C/monitoring.xml:479(programlisting)
16793
#, no-wrap
16794
msgid ""
16795
"\n"
16796
"allow ^172\\.18\\.100\\.100$\n"
16797
msgstr ""
16798
16799
#: serverguide/C/monitoring.xml:484(para)
16800
msgid ""
16801
"Replace <emphasis>^172\\.18\\.100\\.100$</emphasis> with IP address for your "
16802
"<application>munin</application> server."
16803
msgstr ""
16804
16805
#: serverguide/C/monitoring.xml:489(para)
16806
msgid ""
16807
"Now restart <application>munin-node</application> on "
16808
"<emphasis>server02</emphasis> for the changes to take effect:"
16809
msgstr ""
16810
16811
#: serverguide/C/monitoring.xml:494(command)
16812
msgid "sudo /etc/init.d/munin-node restart"
16813
msgstr ""
16814
16815
#: serverguide/C/monitoring.xml:497(para)
16816
msgid ""
16817
"Finally, in a browser go to <emphasis>http://server01/munin</emphasis>, and "
16818
"you should see links to nice graphs displaying information from the standard "
16819
"<emphasis>munin-plugins</emphasis> for disk, network, processes, and system."
16820
msgstr ""
16821
16822
#: serverguide/C/monitoring.xml:503(para)
16823
msgid ""
16824
"Since this is a new install it may take some time for the graphs to display "
16825
"anything useful."
16826
msgstr ""
16827
16828
#: serverguide/C/monitoring.xml:510(title)
16829
msgid "Additional Plugins"
16830
msgstr ""
16831
16832
#: serverguide/C/monitoring.xml:512(para)
16833
msgid ""
16834
"The <application>munin-plugins-extra</application> package contains "
16835
"performance checks additional services such as DNS, DHCP, Samba, etc. To "
16836
"install the package, from a terminal enter:"
16837
msgstr ""
16838
16839
#: serverguide/C/monitoring.xml:518(command)
16840
msgid "sudo apt-get install munin-plugins-extra"
16841
msgstr ""
16842
16843
#: serverguide/C/monitoring.xml:521(para)
16844
msgid "Be sure to install the package on both the server and node machines."
16845
msgstr ""
16846
16847
#: serverguide/C/monitoring.xml:531(para)
16848
msgid ""
16849
"See the <ulink url=\"http://munin.projects.linpro.no/\">Munin</ulink> "
16850
"website for more details."
16851
msgstr ""
16852
16853
#: serverguide/C/monitoring.xml:536(para)
16854
msgid ""
16855
"Specifically the <ulink "
16856
"url=\"http://munin.projects.linpro.no/wiki/Documentation\">Munin "
16857
"Documentation</ulink> page includes information on additional plugins, "
16858
"writing plugins, etc."
16859
msgstr ""
16860
16861
#: serverguide/C/monitoring.xml:542(para)
16862
msgid ""
16863
"Also, there is a book in German by Open Source Press: <ulink "
16864
"url=\"https://www.opensourcepress.de/index.php?26&backPID=178&tt_prod"
16865
"ucts=152\">Munin Graphisches Netzwerk- und System-Monitoring</ulink>."
16866
msgstr ""
16867
16868
#: serverguide/C/monitoring.xml:548(para)
16869
msgid ""
16870
"Another resource is the <ulink "
16871
"url=\"https://help.ubuntu.com/community/Munin\">Munin Ubuntu Wiki</ulink> "
16872
"page."
16873
msgstr ""
16874
16875
#: serverguide/C/mail.xml:13(title)
16876
msgid "Email Services"
16877
msgstr ""
16878
16879
#: serverguide/C/mail.xml:14(para)
16880
msgid ""
16881
"The process of getting an email from one person to another over a network or "
16882
"the Internet involves many systems working together. Each of these systems "
16883
"must be correctly configured for the process to work. The sender uses a "
16884
"<emphasis>Mail User Agent</emphasis> (MUA), or email client, to send the "
16885
"message through one or more <emphasis>Mail Transfer Agents</emphasis> (MTA), "
16886
"the last of which will hand it off to a <emphasis>Mail Delivery "
16887
"Agent</emphasis> (MDA) for delivery to the recipient's mailbox, from which "
16888
"it will be retrieved by the recipient's email client, usually via a POP3 or "
16889
"IMAP server."
16890
msgstr ""
16891
16892
#: serverguide/C/mail.xml:24(title) serverguide/C/mail.xml:832(application) serverguide/C/mail.xml:866(title) serverguide/C/mail.xml:944(title) serverguide/C/mail.xml:1510(title)
16893
msgid "Postfix"
16894
msgstr ""
16895
16896
#: serverguide/C/mail.xml:25(para)
16897
msgid ""
16898
"<application>Postfix</application> is the default Mail Transfer Agent (MTA) "
16899
"in Ubuntu. It attempts to be fast and easy to administer and secure. It is "
16900
"compatible with the MTA <application>sendmail</application>. This section "
16901
"explains how to install and configure <application>postfix</application>. It "
16902
"also explains how to set it up as an SMTP server using a secure connection "
16903
"(for sending emails securely)."
16904
msgstr ""
16905
16906
#: serverguide/C/mail.xml:34(para)
16907
msgid ""
16908
"This guide does not cover setting up Postfix <emphasis>Virtual "
16909
"Domains</emphasis>, for information on Virtual Domains and other advanced "
16910
"configurations see <xref linkend=\"postfix-references\"/>."
16911
msgstr ""
16912
16913
#: serverguide/C/mail.xml:41(para)
16914
msgid ""
16915
"To install <application>postfix</application> run the following command:"
16916
msgstr ""
16917
16918
#: serverguide/C/mail.xml:47(para)
16919
msgid ""
16920
"Simply press return when the installation process asks questions, the "
16921
"configuration will be done in greater detail in the next stage."
16922
msgstr ""
16923
16924
#: serverguide/C/mail.xml:52(title)
16925
msgid "Basic Configuration"
16926
msgstr ""
16927
16928
#: serverguide/C/mail.xml:53(para)
16929
msgid ""
16930
"To configure <application>postfix</application>, run the following command:"
16931
msgstr ""
16932
16933
#: serverguide/C/mail.xml:57(command)
16934
msgid "sudo dpkg-reconfigure postfix"
16935
msgstr ""
16936
16937
#: serverguide/C/mail.xml:63(para)
16938
msgid "Internet Site"
16939
msgstr ""
16940
16941
#: serverguide/C/mail.xml:64(para)
16942
msgid "mail.example.com"
16943
msgstr ""
16944
16945
#: serverguide/C/mail.xml:65(para)
16946
msgid "steve"
16947
msgstr ""
16948
16949
#: serverguide/C/mail.xml:66(para)
16950
msgid "mail.example.com, localhost.localdomain, localhost"
16951
msgstr ""
16952
16953
#: serverguide/C/mail.xml:67(para)
16954
msgid "No"
16955
msgstr ""
16956
16957
#: serverguide/C/mail.xml:68(para)
16958
msgid "127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24"
16959
msgstr ""
16960
16961
#: serverguide/C/mail.xml:69(para)
16962
msgid "0"
16963
msgstr ""
16964
16965
#: serverguide/C/mail.xml:70(para)
16966
msgid "+"
16967
msgstr ""
16968
16969
#: serverguide/C/mail.xml:71(para)
16970
msgid "all"
16971
msgstr ""
16972
16973
#: serverguide/C/mail.xml:59(para)
16974
msgid ""
16975
"The user interface will be displayed. On each screen, select the following "
16976
"values: <placeholder-1/>"
16977
msgstr ""
16978
16979
#: serverguide/C/mail.xml:75(para)
16980
msgid ""
16981
"Replace mail.example.com with the domain for which you'll accept email, "
16982
"192.168.0.0/24 with the actual network and class range of your mail server, "
16983
"and steve with the appropriate username."
16984
msgstr ""
16985
16986
#: serverguide/C/mail.xml:81(para)
16987
msgid ""
16988
"Now is a good time to decide which mailbox format you want to use. By "
16989
"default Postfix will use <emphasis role=\"strong\">mbox</emphasis> for the "
16990
"mailbox format. Rather than editing the configuration file directly, you can "
16991
"use the <command>postconf</command> command to configure all "
16992
"<application>postfix</application> parameters. The configuration parameters "
16993
"will be stored in <filename>/etc/postfix/main.cf</filename> file. Later if "
16994
"you wish to re-configure a particular parameter, you can either run the "
16995
"command or change it manually in the file."
16996
msgstr ""
16997
16998
#: serverguide/C/mail.xml:92(para)
16999
msgid ""
17000
"To configure the mailbox format for <emphasis "
17001
"role=\"strong\">Maildir:</emphasis>"
17002
msgstr ""
17003
17004
#: serverguide/C/mail.xml:97(command)
17005
msgid "sudo postconf -e 'home_mailbox = Maildir/'"
17006
msgstr ""
17007
17008
#: serverguide/C/mail.xml:100(para)
17009
msgid ""
17010
"This will place new mail in /home/<emphasis "
17011
"role=\"italic\">username</emphasis>/Maildir so you will need to configure "
17012
"your Mail Delivery Agent (MDA) to use the same path."
17013
msgstr ""
17014
17015
#: serverguide/C/mail.xml:108(title) serverguide/C/mail.xml:556(title)
17016
msgid "SMTP Authentication"
17017
msgstr ""
17018
17019
#: serverguide/C/mail.xml:110(para)
17020
msgid ""
17021
"SMTP-AUTH allows a client to identify itself through an authentication "
17022
"mechanism (SASL). Transport Layer Security (TLS) should be used to encrypt "
17023
"the authentication process. Once authenticated the SMTP server will allow "
17024
"the client to relay mail."
17025
msgstr ""
17026
17027
#: serverguide/C/mail.xml:117(para)
17028
msgid "Configure Postfix for SMTP-AUTH using SASL (Dovecot SASL):"
17029
msgstr ""
17030
17031
#: serverguide/C/mail.xml:120(screen)
17032
#, no-wrap
17033
msgid ""
17034
"\n"
17035
"sudo postconf -e 'smtpd_sasl_type = dovecot'\n"
17036
"sudo postconf -e 'smtpd_sasl_path = private/auth-client'\n"
17037
"sudo postconf -e 'smtpd_sasl_local_domain ='\n"
17038
"sudo postconf -e 'smtpd_sasl_security_options = noanonymous'\n"
17039
"sudo postconf -e 'broken_sasl_auth_clients = yes'\n"
17040
"sudo postconf -e 'smtpd_sasl_auth_enable = yes'\n"
17041
"sudo postconf -e 'smtpd_recipient_restrictions = "
17042
"permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'\n"
17043
"sudo postconf -e 'inet_interfaces = all'\n"
17044
msgstr ""
17045
17046
#: serverguide/C/mail.xml:131(para)
17047
msgid ""
17048
"The <emphasis>smtpd_sasl_path</emphasis> configuration is a path relative to "
17049
"the Postfix queue directory."
17050
msgstr ""
17051
17052
#: serverguide/C/mail.xml:137(para)
17053
msgid ""
17054
"Next, obtain a digital certificate for TLS. See <xref linkend=\"certificates-"
17055
"and-security\"/> for details. This example also uses a Certificate Authority "
17056
"(CA). For information on generating a CA certificate see <xref "
17057
"linkend=\"certificate-authority\"/>."
17058
msgstr ""
17059
17060
#: serverguide/C/mail.xml:143(para)
17061
msgid ""
17062
"You can get the digital certificate from a certificate authority. But unlike "
17063
"web clients, SMTP clients rarely complain about \"self-signed "
17064
"certificates\", so alternatively, you can create the certificate yourself. "
17065
"Refer to <xref linkend=\"creating-a-self-signed-certificate\"/> for more "
17066
"details."
17067
msgstr ""
17068
17069
#: serverguide/C/mail.xml:155(para)
17070
msgid ""
17071
"Once you have a certificate, configure Postfix to provide TLS encryption for "
17072
"both incoming and outgoing mail:"
17073
msgstr ""
17074
17075
#: serverguide/C/mail.xml:158(screen)
17076
#, no-wrap
17077
msgid ""
17078
"\n"
17079
"sudo postconf -e 'smtpd_tls_auth_only = no'\n"
17080
"sudo postconf -e 'smtp_use_tls = yes'\n"
17081
"sudo postconf -e 'smtpd_use_tls = yes'\n"
17082
"sudo postconf -e 'smtp_tls_note_starttls_offer = yes'\n"
17083
"sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'\n"
17084
"sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'\n"
17085
"sudo postconf -e 'smtpd_tls_loglevel = 1'\n"
17086
"sudo postconf -e 'smtpd_tls_received_header = yes'\n"
17087
"sudo postconf -e 'smtpd_tls_session_cache_timeout = 3600s'\n"
17088
"sudo postconf -e 'tls_random_source = dev:/dev/urandom'\n"
17089
"sudo postconf -e 'myhostname = mail.example.com'\n"
17090
msgstr ""
17091
17092
#: serverguide/C/mail.xml:173(para)
17093
msgid ""
17094
"If you are using your own <emphasis>Certificate Authority</emphasis> to sign "
17095
"the certificate enter:"
17096
msgstr ""
17097
17098
#: serverguide/C/mail.xml:177(command)
17099
msgid "sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'"
17100
msgstr ""
17101
17102
#: serverguide/C/mail.xml:180(para)
17103
msgid ""
17104
"Again, for more details about certificates see <xref linkend=\"certificates-"
17105
"and-security\"/>."
17106
msgstr ""
17107
17108
#: serverguide/C/mail.xml:186(para)
17109
msgid ""
17110
"After running all the commands, <application>Postfix</application> is "
17111
"configured for SMTP-AUTH and a self-signed certificate has been created for "
17112
"TLS encryption."
17113
msgstr ""
17114
17115
#: serverguide/C/mail.xml:191(para)
17116
msgid ""
17117
"Now, the file <filename>/etc/postfix/main.cf</filename> should look like "
17118
"<ulink url=\"../sample/postfix_configuration\">this</ulink>."
17119
msgstr ""
17120
17121
#: serverguide/C/mail.xml:195(para)
17122
msgid ""
17123
"The postfix initial configuration is complete. Run the following command to "
17124
"restart the postfix daemon:"
17125
msgstr ""
17126
17127
#: serverguide/C/mail.xml:201(command) serverguide/C/mail.xml:315(command) serverguide/C/mail.xml:378(command) serverguide/C/mail.xml:984(command) serverguide/C/mail.xml:1561(command)
17128
msgid "sudo /etc/init.d/postfix restart"
17129
msgstr ""
17130
17131
#: serverguide/C/mail.xml:204(para)
17132
msgid ""
17133
"<application>Postfix</application> supports SMTP-AUTH as defined in <ulink "
17134
"url=\"ftp://ftp.isi.edu/in-notes/rfc2554.txt\">RFC2554</ulink>. It is based "
17135
"on <ulink url=\"ftp://ftp.isi.edu/in-notes/rfc2222.txt\">SASL</ulink>. "
17136
"However it is still necessary to set up SASL authentication before you can "
17137
"use SMTP-AUTH."
17138
msgstr ""
17139
17140
#: serverguide/C/mail.xml:214(title) serverguide/C/mail.xml:609(title)
17141
msgid "Configuring SASL"
17142
msgstr ""
17143
17144
#: serverguide/C/mail.xml:215(para)
17145
msgid ""
17146
"Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To "
17147
"enable Dovecot SASL the <application>dovecot-common</application> package "
17148
"will need to be installed. From a terminal prompt enter the following:"
17149
msgstr ""
17150
17151
#: serverguide/C/mail.xml:221(command)
17152
msgid "sudo apt-get install dovecot-common"
17153
msgstr ""
17154
17155
#: serverguide/C/mail.xml:223(para)
17156
msgid ""
17157
"Next you will need to edit <filename>/etc/dovecot/dovecot.conf</filename>. "
17158
"In the <emphasis>auth default</emphasis> section uncomment the "
17159
"<emphasis>socket listen</emphasis> option and change the following:"
17160
msgstr ""
17161
17162
#: serverguide/C/mail.xml:227(programlisting)
17163
#, no-wrap
17164
msgid ""
17165
"\n"
17166
" socket listen {\n"
17167
" #master {\n"
17168
" # Master socket provides access to userdb information. It's typically\n"
17169
" # used to give Dovecot's local delivery agent access to userdb so it\n"
17170
" # can find mailbox locations.\n"
17171
" #path = /var/run/dovecot/auth-master\n"
17172
" #mode = 0600\n"
17173
" # Default user/group is the one who started dovecot-auth (root)\n"
17174
" #user = \n"
17175
" #group = \n"
17176
" #}\n"
17177
" client {\n"
17178
" # The client socket is generally safe to export to everyone. Typical "
17179
"use\n"
17180
" # is to export it to your SMTP server so it can do SMTP AUTH lookups\n"
17181
" # using it.\n"
17182
" path = /var/spool/postfix/private/auth-client\n"
17183
" mode = 0660\n"
17184
" user = postfix\n"
17185
" group = postfix\n"
17186
" }\n"
17187
" }\n"
17188
msgstr ""
17189
17190
#: serverguide/C/mail.xml:251(para)
17191
msgid ""
17192
"In order to let <application>Outlook</application> clients use SMTPAUTH, in "
17193
"the <emphasis>auth default</emphasis> section of /etc/dovecot/dovecot.conf "
17194
"add <emphasis>\"login\"</emphasis>:"
17195
msgstr ""
17196
17197
#: serverguide/C/mail.xml:256(programlisting)
17198
#, no-wrap
17199
msgid ""
17200
"\n"
17201
" mechanisms = plain login\n"
17202
msgstr ""
17203
17204
#: serverguide/C/mail.xml:260(para)
17205
msgid ""
17206
"Once you have <application>Dovecot</application> configured restart it with:"
17207
msgstr ""
17208
17209
#: serverguide/C/mail.xml:264(command) serverguide/C/mail.xml:735(command)
17210
msgid "sudo /etc/init.d/dovecot restart"
17211
msgstr ""
17212
17213
#: serverguide/C/mail.xml:269(title)
17214
msgid "Postfix-Dovecot"
17215
msgstr ""
17216
17217
#: serverguide/C/mail.xml:271(para)
17218
msgid ""
17219
"Another option for configuring <application>Postfix</application> for SMTP-"
17220
"AUTH is using the <application>dovecot-postfix</application> package. This "
17221
"package will install <application>Dovecot</application> and configure "
17222
"<application>Postfix</application> to use it for both SASL authentication "
17223
"and as a Mail Delivery Agent (MDA). The package also configures "
17224
"<application>Dovecot</application> for IMAP, IMAPS, POP3, and POP3S."
17225
msgstr ""
17226
17227
#: serverguide/C/mail.xml:280(para)
17228
msgid ""
17229
"You may or may not want to run IMAP, IMAPS, POP3, or POP3S on your mail "
17230
"server. For example, if you are configuring your server to be a mail "
17231
"gateway, spam/virus filter, etc. If this is the case it may be easier to use "
17232
"the above commands to configure Postfix for SMTPAUTH."
17233
msgstr ""
17234
17235
#: serverguide/C/mail.xml:287(para)
17236
msgid "To install the package, from a terminal prompt enter:"
17237
msgstr ""
17238
17239
#: serverguide/C/mail.xml:292(command)
17240
msgid "sudo apt-get install dovecot-postfix"
17241
msgstr ""
17242
17243
#: serverguide/C/mail.xml:295(para)
17244
msgid ""
17245
"You should now have a working mail server, but there are a few options that "
17246
"you may wish to further customize. For example, the package uses the "
17247
"certificate and key from the <application>ssl-cert</application> package, "
17248
"and in a production environment you should use a certificate and key "
17249
"generated for the host. See <xref linkend=\"certificates-and-security\"/> "
17250
"for more details."
17251
msgstr ""
17252
17253
#: serverguide/C/mail.xml:301(para)
17254
msgid ""
17255
"Once you have a customized certificate and key for the host, change the "
17256
"following options in <filename>/etc/postfix/main.cf</filename>:"
17257
msgstr ""
17258
17259
#: serverguide/C/mail.xml:305(programlisting)
17260
#, no-wrap
17261
msgid ""
17262
"\n"
17263
"smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem\n"
17264
"smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key\n"
17265
msgstr ""
17266
17267
#: serverguide/C/mail.xml:310(para)
17268
msgid "Then restart Postfix:"
17269
msgstr ""
17270
17271
#: serverguide/C/mail.xml:321(para)
17272
msgid ""
17273
"SMTP-AUTH configuration is complete. Now it is time to test the setup."
17274
msgstr ""
17275
17276
#: serverguide/C/mail.xml:324(para)
17277
msgid "To see if SMTP-AUTH and TLS work properly, run the following command:"
17278
msgstr ""
17279
17280
#: serverguide/C/mail.xml:329(command)
17281
msgid "telnet mail.example.com 25"
17282
msgstr ""
17283
17284
#: serverguide/C/mail.xml:331(para)
17285
msgid ""
17286
"After you have established the connection to the postfix mail server, type:"
17287
msgstr ""
17288
17289
#: serverguide/C/mail.xml:335(screen)
17290
#, no-wrap
17291
msgid ""
17292
"\n"
17293
"ehlo mail.example.com\n"
17294
msgstr ""
17295
17296
#: serverguide/C/mail.xml:338(para)
17297
msgid ""
17298
"If you see the following lines among others, then everything is working "
17299
"perfectly. Type <command>quit</command> to exit."
17300
msgstr ""
17301
17302
#: serverguide/C/mail.xml:342(programlisting)
17303
#, no-wrap
17304
msgid ""
17305
"\n"
17306
"250-STARTTLS\n"
17307
"250-AUTH LOGIN PLAIN\n"
17308
"250-AUTH=LOGIN PLAIN\n"
17309
"250 8BITMIME\n"
17310
msgstr ""
17311
17312
#: serverguide/C/mail.xml:352(para)
17313
msgid ""
17314
"This section introduces some common ways to determine the cause if problems "
17315
"arise."
17316
msgstr ""
17317
17318
#: serverguide/C/mail.xml:356(title)
17319
msgid "Escaping chroot"
17320
msgstr ""
17321
17322
#: serverguide/C/mail.xml:357(para)
17323
msgid ""
17324
"The Ubuntu <application>postfix</application> package will by default "
17325
"install into a <emphasis>chroot</emphasis> environment for security reasons. "
17326
"This can add greater complexity when troubleshooting problems."
17327
msgstr ""
17328
17329
#: serverguide/C/mail.xml:361(para)
17330
msgid ""
17331
"To turn off the chroot operation locate for the following line in the "
17332
"<filename>/etc/postfix/master.cf</filename> configuration file:"
17333
msgstr ""
17334
17335
#: serverguide/C/mail.xml:365(screen)
17336
#, no-wrap
17337
msgid ""
17338
"\n"
17339
"smtp inet n - - - - smtpd\n"
17340
msgstr ""
17341
17342
#: serverguide/C/mail.xml:368(para)
17343
msgid "and modify it as follows:"
17344
msgstr ""
17345
17346
#: serverguide/C/mail.xml:371(screen)
17347
#, no-wrap
17348
msgid ""
17349
"\n"
17350
"smtp inet n - n - - smtpd\n"
17351
msgstr ""
17352
17353
#: serverguide/C/mail.xml:374(para)
17354
msgid ""
17355
"You will then need to restart Postfix to use the new configuration. From a "
17356
"terminal prompt enter:"
17357
msgstr ""
17358
17359
#: serverguide/C/mail.xml:382(title)
17360
msgid "Log Files"
17361
msgstr ""
17362
17363
#: serverguide/C/mail.xml:383(para)
17364
msgid ""
17365
"<application>Postfix</application> sends all log messages to "
17366
"<filename>/var/log/mail.log</filename>. However error and warning messages "
17367
"can sometimes get lost in the normal log output so they are also logged to "
17368
"<filename>/var/log/mail.err</filename> and "
17369
"<filename>/var/log/mail.warn</filename> respectively."
17370
msgstr ""
17371
17372
#: serverguide/C/mail.xml:388(para)
17373
msgid ""
17374
"To see messages entered into the logs in real time you can use the "
17375
"<application>tail -f</application> command:"
17376
msgstr ""
17377
17378
#: serverguide/C/mail.xml:393(command)
17379
msgid "tail -f /var/log/mail.err"
17380
msgstr ""
17381
17382
#: serverguide/C/mail.xml:395(para)
17383
msgid ""
17384
"The amount of detail that is recorded in the logs can be increased. Below "
17385
"are some configuration options for increasing the log level for some of the "
17386
"areas covered above."
17387
msgstr ""
17388
17389
#: serverguide/C/mail.xml:401(para)
17390
msgid ""
17391
"To increase <emphasis>TLS</emphasis> activity logging set the "
17392
"<emphasis>smtpd_tls_loglevel</emphasis> option to a value from 1 to 4."
17393
msgstr ""
17394
17395
#: serverguide/C/mail.xml:405(command)
17396
msgid "sudo postconf -e 'smtpd_tls_loglevel = 4'"
17397
msgstr ""
17398
17399
#: serverguide/C/mail.xml:409(para)
17400
msgid ""
17401
"If you are having trouble sending or receiving mail from a specific domain "
17402
"you can add the domain to the <emphasis>debug_peer_list</emphasis> parameter."
17403
msgstr ""
17404
17405
#: serverguide/C/mail.xml:414(command)
17406
msgid "sudo postconf -e 'debug_peer_list = problem.domain'"
17407
msgstr ""
17408
17409
#: serverguide/C/mail.xml:418(para)
17410
msgid ""
17411
"You can increase the verbosity of any <application>Postfix</application> "
17412
"daemon process by editing the <filename>/etc/postfix/master.cf</filename> "
17413
"and adding a <emphasis>-v</emphasis> after the entry. For example edit the "
17414
"<emphasis>smtp</emphasis> entry:"
17415
msgstr ""
17416
17417
#: serverguide/C/mail.xml:422(programlisting)
17418
#, no-wrap
17419
msgid ""
17420
"\n"
17421
"smtp unix - - - - - smtp -v\n"
17422
msgstr ""
17423
17424
#: serverguide/C/mail.xml:428(para)
17425
msgid ""
17426
"It is important to note that after making one of the logging changes above "
17427
"the <application>Postfix</application> process will need to be reloaded in "
17428
"order to recognize the new configuration: <command>sudo /etc/init.d/postfix "
17429
"reload</command>"
17430
msgstr ""
17431
17432
#: serverguide/C/mail.xml:435(para)
17433
msgid ""
17434
"To increase the amount of information logged when troubleshooting "
17435
"<emphasis>SASL</emphasis> issues you can set the following options in "
17436
"<filename>/etc/dovecot/dovecot.conf</filename>"
17437
msgstr ""
17438
17439
#: serverguide/C/mail.xml:439(programlisting)
17440
#, no-wrap
17441
msgid ""
17442
"\n"
17443
"auth_debug=yes\n"
17444
"auth_debug_passwords=yes\n"
17445
msgstr ""
17446
17447
#: serverguide/C/mail.xml:446(para)
17448
msgid ""
17449
"Just like <application>Postfix</application> if you change a "
17450
"<application>Dovecot</application> configuration the process will need to be "
17451
"reloaded: <command>sudo /etc/init.d/dovecot reload</command>."
17452
msgstr ""
17453
17454
#: serverguide/C/mail.xml:452(para)
17455
msgid ""
17456
"Some of the options above can drastically increase the amount of information "
17457
"sent to the log files. Remember to return the log level back to normal after "
17458
"you have corrected the problem. Then reload the appropriate daemon for the "
17459
"new configuration to take affect."
17460
msgstr ""
17461
17462
#: serverguide/C/mail.xml:460(para)
17463
msgid ""
17464
"Administering a <application>Postfix</application> server can be a very "
17465
"complicated task. At some point you may need to turn to the Ubuntu community "
17466
"for more experienced help."
17467
msgstr ""
17468
17469
#: serverguide/C/mail.xml:464(para)
17470
msgid ""
17471
"A great place to ask for <application>Postfix</application> assistance, and "
17472
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
17473
"server</emphasis> IRC channel on <ulink "
17474
"url=\"http://freenode.net\">freenode</ulink>. You can also post a message to "
17475
"one of the <ulink "
17476
"url=\"http://www.ubuntu.com/support/community/webforums\">Web Forums</ulink>."
17477
msgstr ""
17478
17479
#: serverguide/C/mail.xml:469(para)
17480
msgid ""
17481
"For in depth <application>Postfix</application> information Ubuntu "
17482
"developers highly recommend: <ulink url=\"http://www.postfix-book.com/\">The "
17483
"Book of Postfix</ulink>."
17484
msgstr ""
17485
17486
#: serverguide/C/mail.xml:473(para)
17487
msgid ""
17488
"Finally, the <ulink "
17489
"url=\"http://www.postfix.org/documentation.html\">Postfix</ulink> website "
17490
"also has great documentation on all the different configuration options "
17491
"available."
17492
msgstr ""
17493
17494
#: serverguide/C/mail.xml:477(para)
17495
msgid ""
17496
"Also, the <ulink url=\"https://help.ubuntu.com/community/Postfix\">Ubuntu "
17497
"Wiki Postifx</ulink> page has more information."
17498
msgstr ""
17499
17500
#: serverguide/C/mail.xml:485(title) serverguide/C/mail.xml:872(title) serverguide/C/mail.xml:988(title)
17501
msgid "Exim4"
17502
msgstr ""
17503
17504
#: serverguide/C/mail.xml:486(para)
17505
msgid ""
17506
"<application>Exim4</application> is another Message Transfer Agent (MTA) "
17507
"developed at the University of Cambridge for use on Unix systems connected "
17508
"to the Internet. Exim can be installed in place of "
17509
"<application>sendmail</application>, although the configuration of "
17510
"<application>exim</application> is quite different to that of "
17511
"<application>sendmail</application>."
17512
msgstr ""
17513
17514
#: serverguide/C/mail.xml:497(para)
17515
msgid ""
17516
"To install <application>exim4</application>, run the following command: "
17517
"<screen>\n"
17518
"<command>sudo apt-get install exim4</command>\n"
17519
"</screen>"
17520
msgstr ""
17521
17522
#: serverguide/C/mail.xml:506(para)
17523
msgid ""
17524
"To configure <application>Exim4</application>, run the following command:"
17525
msgstr ""
17526
17527
#: serverguide/C/mail.xml:510(command)
17528
msgid "sudo dpkg-reconfigure exim4-config"
17529
msgstr ""
17530
17531
#: serverguide/C/mail.xml:512(para)
17532
msgid ""
17533
"The user interface will be displayed. The user interface lets you configure "
17534
"many parameters. For example, In <application>Exim4</application> the "
17535
"configuration files are split among multiple files. If you wish to have them "
17536
"in one file you can configure accordingly in this user interface."
17537
msgstr ""
17538
17539
#: serverguide/C/mail.xml:520(para)
17540
msgid ""
17541
"All the parameters you configure in the user interface are stored in "
17542
"<filename>/etc/exim4/update-exim4.conf.conf</filename> file. If you wish to "
17543
"re-configure, either you re-run the configuration wizard or manually edit "
17544
"this file using your favorite editor. Once you configure, you can run the "
17545
"following command to generate the master configuration file:"
17546
msgstr ""
17547
17548
#: serverguide/C/mail.xml:531(command) serverguide/C/mail.xml:604(command)
17549
msgid "sudo update-exim4.conf"
17550
msgstr ""
17551
17552
#: serverguide/C/mail.xml:533(para)
17553
msgid ""
17554
"The master configuration file, is generated and it is stored in "
17555
"<filename>/var/lib/exim4/config.autogenerated</filename>."
17556
msgstr ""
17557
17558
#: serverguide/C/mail.xml:539(para)
17559
msgid ""
17560
"At any time, you should not edit the master configuration file, "
17561
"<filename>/var/lib/exim4/config.autogenerated</filename> manually. It is "
17562
"updated automatically every time you run <command>update-exim4.conf</command>"
17563
msgstr ""
17564
17565
#: serverguide/C/mail.xml:547(para)
17566
msgid ""
17567
"You can run the following command to start <application>Exim4</application> "
17568
"daemon."
17569
msgstr ""
17570
17571
#: serverguide/C/mail.xml:552(command) serverguide/C/mail.xml:994(command)
17572
msgid "sudo /etc/init.d/exim4 start"
17573
msgstr ""
17574
17575
#: serverguide/C/mail.xml:557(para)
17576
msgid ""
17577
"This section covers configuring Exim4 to use SMTP-AUTH with TLS and SASL."
17578
msgstr ""
17579
17580
#: serverguide/C/mail.xml:560(para)
17581
msgid ""
17582
"The first step is to create a certificate for use with TLS. Enter the "
17583
"following into a terminal prompt:"
17584
msgstr ""
17585
17586
#: serverguide/C/mail.xml:564(command)
17587
msgid "sudo /usr/share/doc/exim4-base/examples/exim-gencert"
17588
msgstr ""
17589
17590
#: serverguide/C/mail.xml:566(para)
17591
msgid ""
17592
"Now Exim4 needs to be configured for TLS by editing "
17593
"<filename>/etc/exim4/conf.d/main/03_exim4-config_tlsoptions</filename> add "
17594
"the following:"
17595
msgstr ""
17596
17597
#: serverguide/C/mail.xml:570(programlisting)
17598
#, no-wrap
17599
msgid ""
17600
"\n"
17601
"MAIN_TLS_ENABLE = yes\n"
17602
msgstr ""
17603
17604
#: serverguide/C/mail.xml:573(para)
17605
msgid ""
17606
"Next you need to configure <application>Exim4</application> to use the "
17607
"<application>saslauthd</application> for authentication. Edit "
17608
"<filename>/etc/exim4/conf.d/auth/30_exim4-config_examples</filename> and "
17609
"uncomment the <emphasis>plain_saslauthd_server</emphasis> and "
17610
"<emphasis>login_saslauthd_server</emphasis> sections:"
17611
msgstr ""
17612
17613
#: serverguide/C/mail.xml:578(programlisting)
17614
#, no-wrap
17615
msgid ""
17616
"\n"
17617
" plain_saslauthd_server:\n"
17618
" driver = plaintext\n"
17619
" public_name = PLAIN\n"
17620
" server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}\n"
17621
" server_set_id = $auth2\n"
17622
" server_prompts = :\n"
17623
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17624
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17625
" .endif\n"
17626
"#\n"
17627
" login_saslauthd_server:\n"
17628
" driver = plaintext\n"
17629
" public_name = LOGIN\n"
17630
" server_prompts = \"Username:: : Password::\"\n"
17631
" # don't send system passwords over unencrypted connections\n"
17632
" server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}\n"
17633
" server_set_id = $auth1\n"
17634
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17635
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17636
" .endif\n"
17637
msgstr ""
17638
17639
#: serverguide/C/mail.xml:600(para)
17640
msgid "Finally, update the Exim4 configuration and restart the service:"
17641
msgstr ""
17642
17643
#: serverguide/C/mail.xml:605(command)
17644
msgid "sudo /etc/init.d/exim4 restart"
17645
msgstr ""
17646
17647
#: serverguide/C/mail.xml:610(para)
17648
msgid ""
17649
"This section provides details on configuring the saslauthd to provide "
17650
"authentication for <application>Exim4</application>."
17651
msgstr ""
17652
17653
#: serverguide/C/mail.xml:613(para)
17654
msgid ""
17655
"The first step is to install the sasl2-bin package. From a terminal prompt "
17656
"enter the following:"
17657
msgstr ""
17658
17659
#: serverguide/C/mail.xml:617(command)
17660
msgid "sudo apt-get install sasl2-bin"
17661
msgstr ""
17662
17663
#: serverguide/C/mail.xml:619(para)
17664
msgid ""
17665
"To configure saslauthd edit the /etc/default/saslauthd configuration file "
17666
"and set START=no to:"
17667
msgstr ""
17668
17669
#: serverguide/C/mail.xml:622(programlisting)
17670
#, no-wrap
17671
msgid ""
17672
"\n"
17673
"START=yes\n"
17674
msgstr ""
17675
17676
#: serverguide/C/mail.xml:625(para)
17677
msgid ""
17678
"Next the <emphasis>Debian-exim</emphasis> user needs to be part of the "
17679
"<emphasis>sasl</emphasis> group in order for Exim4 to use the saslauthd "
17680
"service:"
17681
msgstr ""
17682
17683
#: serverguide/C/mail.xml:630(command)
17684
msgid "sudo adduser Debian-exim sasl"
17685
msgstr ""
17686
17687
#: serverguide/C/mail.xml:632(para)
17688
msgid "Now start the <application>saslauthd</application> service:"
17689
msgstr ""
17690
17691
#: serverguide/C/mail.xml:636(command)
17692
msgid "sudo /etc/init.d/saslauthd start"
17693
msgstr ""
17694
17695
#: serverguide/C/mail.xml:638(para)
17696
msgid ""
17697
"<application>Exim4</application> is now configured with SMTP-AUTH using TLS "
17698
"and SASL authentication."
17699
msgstr ""
17700
17701
#: serverguide/C/mail.xml:647(para)
17702
msgid ""
17703
"See <ulink url=\"http://www.exim.org/\">exim.org</ulink> for more "
17704
"information."
17705
msgstr ""
17706
17707
#: serverguide/C/mail.xml:652(para)
17708
msgid ""
17709
"There is also an <ulink url=\"http://www.uit.co.uk/content/exim-smtp-mail-"
17710
"server\">Exim4 Book</ulink> available."
17711
msgstr ""
17712
17713
#: serverguide/C/mail.xml:657(para)
17714
msgid ""
17715
"Another resource is the <ulink "
17716
"url=\"https://help.ubuntu.com/community/Exim4\">Exim4 Ubuntu Wiki </ulink> "
17717
"page."
17718
msgstr ""
17719
17720
#: serverguide/C/mail.xml:666(title)
17721
msgid "Dovecot Server"
17722
msgstr ""
17723
17724
#: serverguide/C/mail.xml:667(para)
17725
msgid ""
17726
"<application>Dovecot</application> is a Mail Delivery Agent, written with "
17727
"security primarily in mind. It supports the major mailbox formats: mbox or "
17728
"Maildir. This section explain how to set it up as an imap or pop3 server."
17729
msgstr ""
17730
17731
#: serverguide/C/mail.xml:675(para)
17732
msgid ""
17733
"To install <application>dovecot</application>, run the following command in "
17734
"the command prompt:"
17735
msgstr ""
17736
17737
#: serverguide/C/mail.xml:680(command)
17738
msgid "sudo apt-get install dovecot-imapd dovecot-pop3d"
17739
msgstr ""
17740
17741
#: serverguide/C/mail.xml:685(para)
17742
msgid ""
17743
"To configure <application>dovecot</application>, you can edit the file "
17744
"<filename>/etc/dovecot/dovecot.conf</filename>. You can choose the protocol "
17745
"you use. It could be pop3, pop3s (pop3 secure), imap and imaps (imap "
17746
"secure). A description of these protocols is beyond the scope of this guide. "
17747
"For further information, refer to the Wikipedia articles on <ulink "
17748
"url=\"http://en.wikipedia.org/wiki/POP3\">POP3</ulink> and <ulink "
17749
"url=\"http://en.wikipedia.org/wiki/Internet_Message_Access_Protocol\">IMAP</u"
17750
"link>."
17751
msgstr ""
17752
17753
#: serverguide/C/mail.xml:695(para)
17754
msgid ""
17755
"IMAPS and POP3S are more secure that the simple IMAP and POP3 because they "
17756
"use SSL encryption to connect. Once you have chosen the protocol, amend the "
17757
"following line in the file <filename>/etc/dovecot/dovecot.conf</filename>:"
17758
msgstr ""
17759
17760
#: serverguide/C/mail.xml:701(programlisting)
17761
#, no-wrap
17762
msgid ""
17763
"\n"
17764
"protocols = pop3 pop3s imap imaps\n"
17765
msgstr ""
17766
17767
#: serverguide/C/mail.xml:704(para)
17768
msgid ""
17769
"Next, choose the mailbox you would like to use. "
17770
"<application>Dovecot</application> supports <emphasis "
17771
"role=\"strong\">maildir</emphasis> and <emphasis "
17772
"role=\"strong\">mbox</emphasis> formats. These are the most commonly used "
17773
"mailbox formats. They both have their own benefits and are discussed on "
17774
"<ulink url=\"http://wiki.dovecot.org/MailboxFormat\">the Dovecot web "
17775
"site</ulink>."
17776
msgstr ""
17777
17778
#: serverguide/C/mail.xml:712(para)
17779
msgid ""
17780
"Once you have chosen your mailbox type, edit the file "
17781
"<filename>/etc/dovecot/dovecot.conf</filename> and change the following line:"
17782
msgstr ""
17783
17784
#: serverguide/C/mail.xml:717(programlisting)
17785
#, no-wrap
17786
msgid ""
17787
"\n"
17788
"mail_location = maildir:~/Maildir # (for maildir)\n"
17789
"or\n"
17790
"mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u # (for mbox)\n"
17791
msgstr ""
17792
17793
#: serverguide/C/mail.xml:723(para)
17794
msgid ""
17795
"You should configure your Mail Transport Agent (MTA) to transfer the "
17796
"incoming mail to this type of mailbox if it is different from the one you "
17797
"have configured."
17798
msgstr ""
17799
17800
#: serverguide/C/mail.xml:729(para)
17801
msgid ""
17802
"Once you have configured dovecot, restart the "
17803
"<application>dovecot</application> daemon in order to test your setup:"
17804
msgstr ""
17805
17806
#: serverguide/C/mail.xml:738(para)
17807
msgid ""
17808
"If you have enabled imap, or pop3, you can also try to log in with the "
17809
"commands <command>telnet localhost pop3</command> or <command>telnet "
17810
"localhost imap2</command>. If you see something like the following, the "
17811
"installation has been successful:"
17812
msgstr ""
17813
17814
#: serverguide/C/mail.xml:745(programlisting)
17815
#, no-wrap
17816
msgid ""
17817
"\n"
17818
"bhuvan@rainbow:~$ telnet localhost pop3\n"
17819
"Trying 127.0.0.1...\n"
17820
"Connected to localhost.localdomain.\n"
17821
"Escape character is '^]'.\n"
17822
"+OK Dovecot ready.\n"
17823
msgstr ""
17824
17825
#: serverguide/C/mail.xml:754(title)
17826
msgid "Dovecot SSL Configuration"
17827
msgstr ""
17828
17829
#: serverguide/C/mail.xml:755(para)
17830
msgid ""
17831
"To configure <application>dovecot</application> to use SSL, you can edit the "
17832
"file <filename>/etc/dovecot/dovecot.conf</filename> and amend following "
17833
"lines:"
17834
msgstr ""
17835
17836
#: serverguide/C/mail.xml:760(programlisting)
17837
#, no-wrap
17838
msgid ""
17839
"\n"
17840
"ssl_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem\n"
17841
"ssl_key_file = /etc/ssl/private/ssl-cert-snakeoil.key\n"
17842
"ssl_disable = no\n"
17843
"disable_plaintext_auth = no\n"
17844
msgstr ""
17845
17846
#: serverguide/C/mail.xml:766(para)
17847
msgid ""
17848
"You can get the SSL certificate from a Certificate Issuing Authority or you "
17849
"can create self signed SSL certificate. The latter is a good option for "
17850
"email, because SMTP clients rarely complain about \"self-signed "
17851
"certificates\". Please refer to <xref linkend=\"certificates-and-"
17852
"security\"/> for details about how to create self signed SSL certificate. "
17853
"Once you create the certificate, you will have a key file and a certificate "
17854
"file. Please copy them to the location pointed in the "
17855
"<filename>/etc/dovecot/dovecot.conf</filename> configuration file."
17856
msgstr ""
17857
17858
#: serverguide/C/mail.xml:781(title)
17859
msgid "Firewall Configuration for an Email Server"
17860
msgstr ""
17861
17862
#: serverguide/C/mail.xml:787(para)
17863
msgid "IMAP - 143"
17864
msgstr ""
17865
17866
#: serverguide/C/mail.xml:788(para)
17867
msgid "IMAPS - 993"
17868
msgstr ""
17869
17870
#: serverguide/C/mail.xml:789(para)
17871
msgid "POP3 - 110"
17872
msgstr ""
17873
17874
#: serverguide/C/mail.xml:790(para)
17875
msgid "POP3S - 995"
17876
msgstr ""
17877
17878
#: serverguide/C/mail.xml:782(para)
17879
msgid ""
17880
"To access your mail server from another computer, you must configure your "
17881
"firewall to allow connections to the server on the necessary ports. "
17882
"<placeholder-1/>"
17883
msgstr ""
17884
17885
#: serverguide/C/mail.xml:799(para)
17886
msgid ""
17887
"See the <ulink url=\"http://www.dovecot.org/\">Dovecot website</ulink> for "
17888
"more information."
17889
msgstr ""
17890
17891
#: serverguide/C/mail.xml:804(para)
17892
msgid ""
17893
"Also, the <ulink url=\"https://help.ubuntu.com/community/Dovecot\">Dovecot "
17894
"Ubuntu Wiki</ulink> page has more details."
17895
msgstr ""
17896
17897
#: serverguide/C/mail.xml:813(title) serverguide/C/mail.xml:890(title) serverguide/C/mail.xml:1113(title)
17898
msgid "Mailman"
17899
msgstr ""
17900
17901
#: serverguide/C/mail.xml:814(para)
17902
msgid ""
17903
"Mailman is an open source program for managing electronic mail discussions "
17904
"and e-newsletter lists. Many open source mailing lists (including all the "
17905
"<ulink url=\"http://lists.ubuntu.com\">Ubuntu mailing lists</ulink>) use "
17906
"Mailman as their mailing list software. It is powerful and easy to install "
17907
"and maintain."
17908
msgstr ""
17909
17910
#: serverguide/C/mail.xml:824(para)
17911
msgid ""
17912
"Mailman provides a web interface for the administrators and users, using an "
17913
"external mail server to send and receive emails. It works perfectly with the "
17914
"following mail servers:"
17915
msgstr ""
17916
17917
#: serverguide/C/mail.xml:835(application)
17918
msgid "Exim"
17919
msgstr ""
17920
17921
#: serverguide/C/mail.xml:838(application)
17922
msgid "Sendmail"
17923
msgstr ""
17924
17925
#: serverguide/C/mail.xml:841(application)
17926
msgid "Qmail"
17927
msgstr ""
17928
17929
#: serverguide/C/mail.xml:846(para)
17930
msgid ""
17931
"We will see how to install and configure Mailman with, the Apache web "
17932
"server, and either the Postfix or Exim mail server. If you wish to install "
17933
"Mailman with a different mail server, please refer to the references section."
17934
msgstr ""
17935
17936
#: serverguide/C/mail.xml:853(para)
17937
msgid ""
17938
"You only need to install one mail server and "
17939
"<application>Postfix</application> is the default Ubuntu Mail Transfer Agent."
17940
msgstr ""
17941
17942
#: serverguide/C/mail.xml:858(title) serverguide/C/mail.xml:917(title)
17943
msgid "Apache2"
17944
msgstr ""
17945
17946
#: serverguide/C/mail.xml:859(para)
17947
msgid ""
17948
"To install apache2 you refer to <ulink url=\"./web-servers.xml#http-"
17949
"installation\">HTTPD Installation</ulink> section for details."
17950
msgstr ""
17951
17952
#: serverguide/C/mail.xml:867(para)
17953
msgid ""
17954
"For instructions on installing and configuring Postfix refer to <xref "
17955
"linkend=\"postfix\"/>"
17956
msgstr ""
17957
17958
#: serverguide/C/mail.xml:873(para)
17959
msgid "To install Exim4 refer to <xref linkend=\"exim4\"/>."
17960
msgstr ""
17961
17962
#: serverguide/C/mail.xml:884(application)
17963
msgid "dc_use_split_config='true'"
17964
msgstr ""
17965
17966
#: serverguide/C/mail.xml:876(para)
17967
msgid ""
17968
"Once exim4 is installed, the configuration files are stored in the "
17969
"<filename>/etc/exim4</filename> directory. In Ubuntu, by default, the exim4 "
17970
"configuration files are split across different files. You can change this "
17971
"behavior by changing the following variable in the "
17972
"<filename>/etc/exim4/update-exim4.conf</filename> file: <placeholder-1/>"
17973
msgstr ""
17974
17975
#: serverguide/C/mail.xml:891(para)
17976
msgid ""
17977
"To install <application>Mailman</application>, run following command at a "
17978
"terminal prompt:"
17979
msgstr ""
17980
17981
#: serverguide/C/mail.xml:895(command)
17982
msgid "sudo apt-get install mailman"
17983
msgstr ""
17984
17985
#: serverguide/C/mail.xml:897(para)
17986
msgid ""
17987
"It copies the installation files in "
17988
"<application>/var/lib/mailman</application> directory. It installs the CGI "
17989
"scripts in <application>/usr/lib/cgi-bin/mailman</application> directory. It "
17990
"creates <emphasis>list</emphasis> linux user. It creates the "
17991
"<emphasis>list</emphasis> linux group. The mailman process will be owned by "
17992
"this user."
17993
msgstr ""
17994
17995
#: serverguide/C/mail.xml:909(para)
17996
msgid ""
17997
"This section assumes you have successfully installed "
17998
"<application>mailman</application>, <application>apache2</application>, and "
17999
"<application>postfix</application> or <application>exim4</application>. Now "
18000
"you just need to configure them."
18001
msgstr ""
18002
18003
#: serverguide/C/mail.xml:918(para)
18004
msgid ""
18005
"An example Apache configuration file comes with "
18006
"<application>Mailman</application> and is placed in "
18007
"<filename>/etc/mailman/apache.conf</filename>. In order for Apache to use "
18008
"the config file it needs to be copied to <filename>/etc/apache2/sites-"
18009
"available</filename>:"
18010
msgstr ""
18011
18012
#: serverguide/C/mail.xml:924(command)
18013
msgid ""
18014
"sudo cp /etc/mailman/apache.conf /etc/apache2/sites-available/mailman.conf"
18015
msgstr ""
18016
18017
#: serverguide/C/mail.xml:926(para)
18018
msgid ""
18019
"This will setup a new Apache <emphasis>VirtualHost</emphasis> for the "
18020
"Mailman administration site. Now enable the new configuration and restart "
18021
"Apache:"
18022
msgstr ""
18023
18024
#: serverguide/C/mail.xml:931(command)
18025
msgid "sudo a2ensite mailman.conf"
18026
msgstr ""
18027
18028
#: serverguide/C/mail.xml:934(para)
18029
msgid ""
18030
"Mailman uses apache2 to render its CGI scripts. The mailman CGI scripts are "
18031
"installed in the <application>/usr/lib/cgi-bin/mailman</application> "
18032
"directory. So, the mailman url will be http://hostname/cgi-bin/mailman/. You "
18033
"can make changes to the <filename>/etc/apache2/sites-"
18034
"available/mailman.conf</filename> file if you wish to change this behavior."
18035
msgstr ""
18036
18037
#: serverguide/C/mail.xml:945(para)
18038
msgid ""
18039
"For <application>Postfix</application> integration, we will associate the "
18040
"domain lists.example.com with the mailing lists. Please replace "
18041
"<emphasis>lists.example.com</emphasis> with the domain of your choosing."
18042
msgstr ""
18043
18044
#: serverguide/C/mail.xml:949(para)
18045
msgid ""
18046
"You can use the postconf command to add the necessary configuration to "
18047
"<filename>/etc/postfix/main.cf</filename>:"
18048
msgstr ""
18049
18050
#: serverguide/C/mail.xml:953(command)
18051
msgid "sudo postconf -e 'relay_domains = lists.example.com'"
18052
msgstr ""
18053
18054
#: serverguide/C/mail.xml:954(command)
18055
msgid "sudo postconf -e 'transport_maps = hash:/etc/postfix/transport'"
18056
msgstr ""
18057
18058
#: serverguide/C/mail.xml:955(command)
18059
msgid "sudo postconf -e 'mailman_destination_recipient_limit = 1'"
18060
msgstr ""
18061
18062
#: serverguide/C/mail.xml:957(para)
18063
msgid ""
18064
"In <filename>/etc/postfix/master.cf</filename> double check that you have "
18065
"the following transport:"
18066
msgstr ""
18067
18068
#: serverguide/C/mail.xml:960(programlisting)
18069
#, no-wrap
18070
msgid ""
18071
"\n"
18072
"mailman unix - n n - - pipe\n"
18073
" flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py\n"
18074
" ${nexthop} ${user}\n"
18075
msgstr ""
18076
18077
#: serverguide/C/mail.xml:965(para)
18078
msgid ""
18079
"It calls the <emphasis>postfix-to-mailman.py</emphasis> script when a mail "
18080
"is delivered to a list."
18081
msgstr ""
18082
18083
#: serverguide/C/mail.xml:968(para)
18084
msgid ""
18085
"Associate the domain lists.example.com to the Mailman transport with the "
18086
"transport map. Edit the file <filename>/etc/postfix/transport</filename>:"
18087
msgstr ""
18088
18089
#: serverguide/C/mail.xml:971(programlisting)
18090
#, no-wrap
18091
msgid ""
18092
"\n"
18093
"lists.example.com mailman:\n"
18094
msgstr ""
18095
18096
#: serverguide/C/mail.xml:974(para)
18097
msgid ""
18098
"Now have <application>Postfix</application> build the transport map by "
18099
"entering the following from a terminal prompt:"
18100
msgstr ""
18101
18102
#: serverguide/C/mail.xml:978(command)
18103
msgid "sudo postmap -v /etc/postfix/transport"
18104
msgstr ""
18105
18106
#: serverguide/C/mail.xml:980(para)
18107
msgid "Then restart Postfix to enable the new configurations:"
18108
msgstr ""
18109
18110
#: serverguide/C/mail.xml:989(para)
18111
msgid ""
18112
"Once Exim4 is installed, you can start the Exim server using the following "
18113
"command from a terminal prompt:"
18114
msgstr ""
18115
18116
#: serverguide/C/mail.xml:1005(para) serverguide/C/mail.xml:1020(title)
18117
msgid "Main"
18118
msgstr ""
18119
18120
#: serverguide/C/mail.xml:1008(para) serverguide/C/mail.xml:1060(title)
18121
msgid "Transport"
18122
msgstr ""
18123
18124
#: serverguide/C/mail.xml:1011(para) serverguide/C/mail.xml:1083(title)
18125
msgid "Router"
18126
msgstr ""
18127
18128
#: serverguide/C/mail.xml:996(para)
18129
msgid ""
18130
"In order to make mailman work with Exim4, you need to configure Exim4. As "
18131
"mentioned earlier, by default, Exim4 uses multiple configuration files of "
18132
"different types. For details, please refer to the <ulink "
18133
"url=\"http://www.exim.org\">Exim</ulink> web site. To run mailman, we should "
18134
"add new a configuration file to the following configuration types: "
18135
"<placeholder-1/> Exim creates a master configuration file by sorting all "
18136
"these mini configuration files. So, the order of these configuration files "
18137
"is very important."
18138
msgstr ""
18139
18140
#: serverguide/C/mail.xml:1027(programlisting)
18141
#, no-wrap
18142
msgid ""
18143
"\n"
18144
"# start\n"
18145
"# Home dir for your Mailman installation -- aka Mailman's prefix\n"
18146
"# directory.\n"
18147
"# On Ubuntu this should be \"/var/lib/mailman\"\n"
18148
"# This is normally the same as ~mailman\n"
18149
"MM_HOME=/var/lib/mailman\n"
18150
"#\n"
18151
"# User and group for Mailman, should match your --with-mail-gid\n"
18152
"# switch to Mailman's configure script. Value is normally \"mailman\"\n"
18153
"MM_UID=list\n"
18154
"MM_GID=list\n"
18155
"#\n"
18156
"# Domains that your lists are in - colon separated list\n"
18157
"# you may wish to add these into local_domains as well\n"
18158
"domainlist mm_domains=hostname.com\n"
18159
"#\n"
18160
"# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
18161
"#\n"
18162
"# These values are derived from the ones above and should not need\n"
18163
"# editing unless you have munged your mailman installation\n"
18164
"#\n"
18165
"# The path of the Mailman mail wrapper script\n"
18166
"MM_WRAP=MM_HOME/mail/mailman\n"
18167
"#\n"
18168
"# The path of the list config file (used as a required file when\n"
18169
"# verifying list addresses)\n"
18170
"MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck\n"
18171
"# end\n"
18172
msgstr ""
18173
18174
#: serverguide/C/mail.xml:1021(para)
18175
msgid ""
18176
"All the configuration files belonging to the main type are stored in the "
18177
"<filename>/etc/exim4/conf.d/main/</filename> directory. You can add the "
18178
"following content to a new file, named <filename>04_exim4-"
18179
"config_mailman</filename>: <placeholder-1/>"
18180
msgstr ""
18181
18182
#: serverguide/C/mail.xml:1067(programlisting)
18183
#, no-wrap
18184
msgid ""
18185
"\n"
18186
" mailman_transport:\n"
18187
" driver = pipe\n"
18188
" command = MM_WRAP \\\n"
18189
" '${if def:local_part_suffix \\\n"
18190
" {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} "
18191
"\\\n"
18192
" {post}}' \\\n"
18193
" $local_part\n"
18194
" current_directory = MM_HOME\n"
18195
" home_directory = MM_HOME\n"
18196
" user = MM_UID\n"
18197
" group = MM_GID\n"
18198
msgstr ""
18199
18200
#: serverguide/C/mail.xml:1061(para)
18201
msgid ""
18202
"All the configuration files belonging to transport type are stored in the "
18203
"<filename>/etc/exim4/conf.d/transport/</filename> directory. You can add the "
18204
"following content to a new file named <filename> 40_exim4-"
18205
"config_mailman</filename>: <placeholder-1/>"
18206
msgstr ""
18207
18208
#: serverguide/C/mail.xml:1088(programlisting)
18209
#, no-wrap
18210
msgid ""
18211
"\n"
18212
" mailman_router:\n"
18213
" driver = accept\n"
18214
" require_files = MM_HOME/lists/$local_part/config.pck\n"
18215
" local_part_suffix_optional\n"
18216
" local_part_suffix = -bounces : -bounces+* : \\\n"
18217
" -confirm+* : -join : -leave : \\\n"
18218
" -owner : -request : -admin\n"
18219
" transport = mailman_transport\n"
18220
msgstr ""
18221
18222
#: serverguide/C/mail.xml:1084(para)
18223
msgid ""
18224
"All the configuration files belonging to router type are stored in the "
18225
"<filename>/etc/exim4/conf.d/router/</filename> directory. You can add the "
18226
"following content in to a new file named <filename>101_exim4-"
18227
"config_mailman</filename>: <placeholder-1/>"
18228
msgstr ""
18229
18230
#: serverguide/C/mail.xml:1101(para)
18231
msgid ""
18232
"The order of main and transport configuration files can be in any order. "
18233
"But, the order of router configuration files must be the same. This "
18234
"particular file must appear before the <application>200_exim4-"
18235
"config_primary</application> file. These two configuration files contain "
18236
"same type of information. The first file takes the precedence. For more "
18237
"details, please refer to the references section."
18238
msgstr ""
18239
18240
#: serverguide/C/mail.xml:1114(para)
18241
msgid ""
18242
"Once mailman is installed, you can run it using the following command:"
18243
msgstr ""
18244
18245
#: serverguide/C/mail.xml:1118(command)
18246
msgid "sudo /etc/init.d/mailman start"
18247
msgstr ""
18248
18249
#: serverguide/C/mail.xml:1120(para)
18250
msgid ""
18251
"Once mailman is installed, you should create the default mailing list. Run "
18252
"the following command to create the mailing list:"
18253
msgstr ""
18254
18255
#: serverguide/C/mail.xml:1126(command)
18256
msgid "sudo /usr/sbin/newlist mailman"
18257
msgstr ""
18258
18259
#: serverguide/C/mail.xml:1129(programlisting)
18260
#, no-wrap
18261
msgid ""
18262
"\n"
18263
" Enter the email address of the person running the list: bhuvan at "
18264
"ubuntu.com\n"
18265
" Initial mailman password:\n"
18266
" To finish creating your mailing list, you must edit your "
18267
"<filename>/etc/aliases</filename> (or\n"
18268
" equivalent) file by adding the following lines, and possibly running the\n"
18269
" `newaliases' program:\n"
18270
"\n"
18271
" ## mailman mailing list\n"
18272
" mailman: \"|/var/lib/mailman/mail/mailman post mailman\"\n"
18273
" mailman-admin: \"|/var/lib/mailman/mail/mailman admin mailman\"\n"
18274
" mailman-bounces: \"|/var/lib/mailman/mail/mailman bounces mailman\"\n"
18275
" mailman-confirm: \"|/var/lib/mailman/mail/mailman confirm mailman\"\n"
18276
" mailman-join: \"|/var/lib/mailman/mail/mailman join mailman\"\n"
18277
" mailman-leave: \"|/var/lib/mailman/mail/mailman leave mailman\"\n"
18278
" mailman-owner: \"|/var/lib/mailman/mail/mailman owner mailman\"\n"
18279
" mailman-request: \"|/var/lib/mailman/mail/mailman request mailman\"\n"
18280
" mailman-subscribe: \"|/var/lib/mailman/mail/mailman subscribe "
18281
"mailman\"\n"
18282
" mailman-unsubscribe: \"|/var/lib/mailman/mail/mailman unsubscribe "
18283
"mailman\"\n"
18284
"\n"
18285
" Hit enter to notify mailman owner...\n"
18286
"\n"
18287
" # \n"
18288
msgstr ""
18289
18290
#: serverguide/C/mail.xml:1152(para)
18291
msgid ""
18292
"We have configured either Postfix or Exim4 to recognize all emails from "
18293
"mailman. So, it is not mandatory to make any new entries in "
18294
"<filename>/etc/aliases</filename>. If you have made any changes to the "
18295
"configuration files, please ensure that you restart those services before "
18296
"continuing to next section."
18297
msgstr ""
18298
18299
#: serverguide/C/mail.xml:1160(para)
18300
msgid ""
18301
"The Exim4 does not use the above aliases to forward mails to Mailman, as it "
18302
"uses a <emphasis>discover</emphasis> approach. To suppress the aliases while "
18303
"creating the list, you can add <emphasis>MTA=None</emphasis> line in Mailman "
18304
"configuration file, <filename>/etc/mailman/mm_cfg.py</filename>."
18305
msgstr ""
18306
18307
#: serverguide/C/mail.xml:1171(title)
18308
msgid "Administration"
18309
msgstr ""
18310
18311
#: serverguide/C/mail.xml:1172(para)
18312
msgid ""
18313
"We assume you have a default installation. The mailman cgi scripts are still "
18314
"in the <application>/usr/lib/cgi-bin/mailman/</application> directory. "
18315
"Mailman provides a web based administration facility. To access this page, "
18316
"point your browser to the following url:"
18317
msgstr ""
18318
18319
#: serverguide/C/mail.xml:1180(para)
18320
msgid "http://hostname/cgi-bin/mailman/admin"
18321
msgstr ""
18322
18323
#: serverguide/C/mail.xml:1184(para)
18324
msgid ""
18325
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18326
"screen. If you click the mailing list name, it will ask for your "
18327
"authentication password. If you enter the correct password, you will be able "
18328
"to change administrative settings of this mailing list. You can create a new "
18329
"mailing list using the command line utility "
18330
"(<command>/usr/sbin/newlist</command>). Alternatively, you can create a new "
18331
"mailing list using the web interface."
18332
msgstr ""
18333
18334
#: serverguide/C/mail.xml:1197(title)
18335
msgid "Users"
18336
msgstr ""
18337
18338
#: serverguide/C/mail.xml:1198(para)
18339
msgid ""
18340
"Mailman provides a web based interface for users. To access this page, point "
18341
"your browser to the following url:"
18342
msgstr ""
18343
18344
#: serverguide/C/mail.xml:1203(para)
18345
msgid "http://hostname/cgi-bin/mailman/listinfo"
18346
msgstr ""
18347
18348
#: serverguide/C/mail.xml:1207(para)
18349
msgid ""
18350
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18351
"screen. If you click the mailing list name, it will display the subscription "
18352
"form. You can enter your email address, name (optional), and password to "
18353
"subscribe. An email invitation will be sent to you. You can follow the "
18354
"instructions in the email to subscribe."
18355
msgstr ""
18356
18357
#: serverguide/C/mail.xml:1219(ulink)
18358
msgid "GNU Mailman - Installation Manual"
18359
msgstr ""
18360
18361
#: serverguide/C/mail.xml:1223(ulink)
18362
msgid "HOWTO - Using Exim 4 and Mailman 2.1 together"
18363
msgstr ""
18364
18365
#: serverguide/C/mail.xml:1226(para)
18366
msgid ""
18367
"Also, see the <ulink "
18368
"url=\"https://help.ubuntu.com/community/Mailman\">Mailman Ubuntu "
18369
"Wiki</ulink> page."
18370
msgstr ""
18371
18372
#: serverguide/C/mail.xml:1232(title)
18373
msgid "Mail Filtering"
18374
msgstr ""
18375
18376
#: serverguide/C/mail.xml:1233(para)
18377
msgid ""
18378
"One of the largest issues with email today is the problem of Unsolicited "
18379
"Bulk Email (UBE). Also known as SPAM, such messages may also carry viruses "
18380
"and other forms of malware. According to some reports these messages make up "
18381
"the bulk of all email traffic on the Internet."
18382
msgstr ""
18383
18384
#: serverguide/C/mail.xml:1238(para)
18385
msgid ""
18386
"This section will cover integrating <application>Amavisd-new</application>, "
18387
"<application>Spamassassin</application>, and "
18388
"<application>ClamAV</application> with the "
18389
"<application>Postfix</application> Mail Transport Agent (MTA). "
18390
"<application>Postfix</application> can also check email validity by passing "
18391
"it through external content filters. These filters can sometimes determine "
18392
"if a message is spam without needing to process it with more resource "
18393
"intensive applications. Two common filters are <application>dkim-"
18394
"filter</application> and <application>python-policyd-spf</application>."
18395
msgstr ""
18396
18397
#: serverguide/C/mail.xml:1248(para)
18398
msgid ""
18399
"<application>Amavisd-new</application> is a wrapper program that can call "
18400
"any number of content filtering programs for spam detection, antivirus, etc."
18401
msgstr ""
18402
18403
#: serverguide/C/mail.xml:1254(para)
18404
msgid ""
18405
"<application>Spamassassin</application> uses a variety of mechanisms to "
18406
"filter email based on the message content."
18407
msgstr ""
18408
18409
#: serverguide/C/mail.xml:1259(para)
18410
msgid ""
18411
"<application>ClamAV</application> is an open source antivirus application."
18412
msgstr ""
18413
18414
#: serverguide/C/mail.xml:1264(para)
18415
msgid ""
18416
"<application>dkim-filter</application> implements a Sendmail Mail Filter "
18417
"(Milter) for the DomainKeys Identified Mail (DKIM) standard."
18418
msgstr ""
18419
18420
#: serverguide/C/mail.xml:1270(para)
18421
msgid ""
18422
"<application>python-policyd-spf</application> enables Sender Policy "
18423
"Framework (SPF) checking with <application>Postfix</application>."
18424
msgstr ""
18425
18426
#: serverguide/C/mail.xml:1275(para)
18427
msgid "This is how the pieces fit together:"
18428
msgstr ""
18429
18430
#: serverguide/C/mail.xml:1280(para)
18431
msgid "An email message is accepted by <application>Postfix</application>."
18432
msgstr ""
18433
18434
#: serverguide/C/mail.xml:1285(para)
18435
msgid ""
18436
"The message is passed through any external filters <application>dkim-"
18437
"filter</application> and <application>python-policyd-spf</application> in "
18438
"this case."
18439
msgstr ""
18440
18441
#: serverguide/C/mail.xml:1291(para)
18442
msgid "<application>Amavisd-new</application> then processes the message."
18443
msgstr ""
18444
18445
#: serverguide/C/mail.xml:1296(para)
18446
msgid ""
18447
"<application>ClamAV</application> is used to scan the message. If the "
18448
"message contains a virus <application>Postfix</application> will reject the "
18449
"message."
18450
msgstr ""
18451
18452
#: serverguide/C/mail.xml:1302(para)
18453
msgid ""
18454
"Clean messages will then be analyzed by "
18455
"<application>Spamassassin</application> to find out if the message is spam. "
18456
"<application>Spamassassin</application> will then add X-Header lines "
18457
"allowing <application>Amavisd-new</application> to further manipulate the "
18458
"message."
18459
msgstr ""
18460
18461
#: serverguide/C/mail.xml:1309(para)
18462
msgid ""
18463
"For example, if a message has a Spam score of over fifty the message could "
18464
"be automatically dropped from the queue without the recipient ever having to "
18465
"be bothered. Another, way to handle flagged messages is to deliver them to "
18466
"the Mail User Agent (MUA) allowing the user to deal with the message as they "
18467
"see fit."
18468
msgstr ""
18469
18470
#: serverguide/C/mail.xml:1316(para)
18471
msgid ""
18472
"See <xref linkend=\"postfix\"/> for instructions on installing and "
18473
"configuring Postfix."
18474
msgstr ""
18475
18476
#: serverguide/C/mail.xml:1319(para)
18477
msgid ""
18478
"To install the rest of the applications enter the following from a terminal "
18479
"prompt:"
18480
msgstr ""
18481
18482
#: serverguide/C/mail.xml:1323(command)
18483
msgid "sudo apt-get install amavisd-new spamassassin clamav-daemon"
18484
msgstr ""
18485
18486
#: serverguide/C/mail.xml:1324(command)
18487
msgid "sudo apt-get install dkim-filter python-policyd-spf"
18488
msgstr ""
18489
18490
#: serverguide/C/mail.xml:1326(para)
18491
msgid ""
18492
"There are some optional packages that integrate with "
18493
"<application>Spamassassin</application> for better spam detection:"
18494
msgstr ""
18495
18496
#: serverguide/C/mail.xml:1330(command)
18497
msgid "sudo apt-get install pyzor razor"
18498
msgstr ""
18499
18500
#: serverguide/C/mail.xml:1332(para)
18501
msgid ""
18502
"Along with the main filtering applications compression utilities are needed "
18503
"to process some email attachments:"
18504
msgstr ""
18505
18506
#: serverguide/C/mail.xml:1336(command)
18507
msgid ""
18508
"sudo apt-get install arj cabextract cpio lha nomarch pax rar unrar unzip zip"
18509
msgstr ""
18510
18511
#: serverguide/C/mail.xml:1339(para)
18512
msgid ""
18513
"If some packages are not found, check that the "
18514
"<emphasis>multiverse</emphasis> repository is enabled in "
18515
"<filename>/etc/apt/sources.list</filename>"
18516
msgstr ""
18517
18518
#: serverguide/C/mail.xml:1340(para)
18519
msgid ""
18520
"If you make changes to the file, be sure to run <command>sudo apt-get "
18521
"update</command> before trying to install again."
18522
msgstr ""
18523
18524
#: serverguide/C/mail.xml:1345(para)
18525
msgid "Now configure everything to work together and filter email."
18526
msgstr ""
18527
18528
#: serverguide/C/mail.xml:1349(title)
18529
msgid "ClamAV"
18530
msgstr ""
18531
18532
#: serverguide/C/mail.xml:1350(para)
18533
msgid ""
18534
"The default behaviour of <application>ClamAV</application> will fit our "
18535
"needs. For more ClamAV configuration options, check the configuration files "
18536
"in <filename>/etc/clamav</filename>."
18537
msgstr ""
18538
18539
#: serverguide/C/mail.xml:1355(para)
18540
msgid ""
18541
"Add the <emphasis>clamav</emphasis> user to the <emphasis>amavis</emphasis> "
18542
"group in order for <application>Amavisd-new</application> to have the "
18543
"appropriate access to scan files:"
18544
msgstr ""
18545
18546
#: serverguide/C/mail.xml:1360(command)
18547
msgid "sudo adduser clamav amavis"
18548
msgstr ""
18549
18550
#: serverguide/C/mail.xml:1364(title)
18551
msgid "Spamassassin"
18552
msgstr ""
18553
18554
#: serverguide/C/mail.xml:1365(para)
18555
msgid ""
18556
"Spamassassin automatically detects optional components and will use them if "
18557
"they are present. This means that there is no need to configure "
18558
"<application>pyzor</application> and <application>razor</application>."
18559
msgstr ""
18560
18561
#: serverguide/C/mail.xml:1369(para)
18562
msgid ""
18563
"Edit <filename>/etc/default/spamassassin</filename> to activate the "
18564
"<application>Spamassassin</application> daemon. Change "
18565
"<emphasis>ENABLED=0</emphasis> to:"
18566
msgstr ""
18567
18568
#: serverguide/C/mail.xml:1373(programlisting)
18569
#, no-wrap
18570
msgid ""
18571
"\n"
18572
"ENABLED=1\n"
18573
msgstr ""
18574
18575
#: serverguide/C/mail.xml:1376(para)
18576
msgid "Now start the daemon:"
18577
msgstr ""
18578
18579
#: serverguide/C/mail.xml:1380(command)
18580
msgid "sudo /etc/init.d/spamassassin start"
18581
msgstr ""
18582
18583
#: serverguide/C/mail.xml:1384(title)
18584
msgid "Amavisd-new"
18585
msgstr ""
18586
18587
#: serverguide/C/mail.xml:1385(para)
18588
msgid ""
18589
"First activate spam and antivirus detection in <application>Amavisd-"
18590
"new</application> by editing <filename>/etc/amavis/conf.d/15-"
18591
"content_filter_mode</filename>:"
18592
msgstr ""
18593
18594
#: serverguide/C/mail.xml:1389(programlisting)
18595
#, no-wrap
18596
msgid ""
18597
"\n"
18598
"use strict;\n"
18599
"\n"
18600
"# You can modify this file to re-enable SPAM checking through spamassassin\n"
18601
"# and to re-enable antivirus checking.\n"
18602
"\n"
18603
"#\n"
18604
"# Default antivirus checking mode\n"
18605
"# Uncomment the two lines below to enable it\n"
18606
"#\n"
18607
"\n"
18608
"@bypass_virus_checks_maps = (\n"
18609
" \\%bypass_virus_checks, \\@bypass_virus_checks_acl, \\"
18610
"$bypass_virus_checks_re);\n"
18611
"\n"
18612
"\n"
18613
"#\n"
18614
"# Default SPAM checking mode\n"
18615
"# Uncomment the two lines below to enable it\n"
18616
"#\n"
18617
"\n"
18618
"@bypass_spam_checks_maps = (\n"
18619
" \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\"
18620
"$bypass_spam_checks_re);\n"
18621
"\n"
18622
"1; # insure a defined return\n"
18623
msgstr ""
18624
18625
#: serverguide/C/mail.xml:1414(para)
18626
msgid ""
18627
"Bouncing spam can be a bad idea as the return address is often faked. "
18628
"Consider editing <filename>/etc/amavis/conf.d/20-debian_defaults</filename> "
18629
"to set <emphasis>$final_spam_destiny</emphasis> to D_DISCARD rather than "
18630
"D_BOUNCE, as follows:"
18631
msgstr ""
18632
18633
#: serverguide/C/mail.xml:1420(programlisting)
18634
#, no-wrap
18635
msgid ""
18636
"\n"
18637
"$final_spam_destiny = D_DISCARD;\n"
18638
msgstr ""
18639
18640
#: serverguide/C/mail.xml:1424(para)
18641
msgid ""
18642
"Additionally, you may want to adjust the following options to flag more "
18643
"messages as spam:"
18644
msgstr ""
18645
18646
#: serverguide/C/mail.xml:1428(programlisting)
18647
#, no-wrap
18648
msgid ""
18649
"\n"
18650
"$sa_tag_level_deflt = -999; # add spam info headers if at, or above that "
18651
"level\n"
18652
"$sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level\n"
18653
"$sa_kill_level_deflt = 21.0; # triggers spam evasive actions\n"
18654
"$sa_dsn_cutoff_level = 4; # spam level beyond which a DSN is not sent\n"
18655
msgstr ""
18656
18657
#: serverguide/C/mail.xml:1435(para)
18658
msgid ""
18659
"If the server's <emphasis>hostname</emphasis> is different from the domain's "
18660
"MX record you may need to manually set the <emphasis>$myhostname</emphasis> "
18661
"option. Also, if the server receives mail for multiple domains the "
18662
"<emphasis>@local_domains_acl</emphasis> option will need to be customized. "
18663
"Edit the <filename>/etc/amavis/conf.d/50-user</filename> file:"
18664
msgstr ""
18665
18666
#: serverguide/C/mail.xml:1442(programlisting)
18667
#, no-wrap
18668
msgid ""
18669
"\n"
18670
"$myhostname = 'mail.example.com';\n"
18671
"@local_domains_acl = ( \"example.com\", \"example.org\" );\n"
18672
msgstr ""
18673
18674
#: serverguide/C/mail.xml:1447(para)
18675
msgid ""
18676
"After configuration <application>Amavisd-new</application> needs to be "
18677
"restarted:"
18678
msgstr ""
18679
18680
#: serverguide/C/mail.xml:1451(command) serverguide/C/mail.xml:1497(command)
18681
msgid "sudo /etc/init.d/amavis restart"
18682
msgstr ""
18683
18684
#: serverguide/C/mail.xml:1454(title)
18685
msgid "DKIM Whitelist"
18686
msgstr ""
18687
18688
#: serverguide/C/mail.xml:1456(para)
18689
msgid ""
18690
"<application>Amavisd-new</application> can be configured to automatically "
18691
"<emphasis>Whitelist</emphasis> addresses from domains with valid Domain "
18692
"Keys. There are some pre-configured domains in the "
18693
"<filename>/etc/amavis/conf.d/40-policy_banks</filename>."
18694
msgstr ""
18695
18696
#: serverguide/C/mail.xml:1462(para)
18697
msgid "There are multiple ways to configure the Whitelist for a domain:"
18698
msgstr ""
18699
18700
#: serverguide/C/mail.xml:1468(para)
18701
msgid ""
18702
"<emphasis>'example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18703
"address from the \"example.com\" domain."
18704
msgstr ""
18705
18706
#: serverguide/C/mail.xml:1473(para)
18707
msgid ""
18708
"<emphasis>'.example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18709
"address from any <emphasis>subdomains</emphasis> of \"example.com\" that "
18710
"have a valid signature."
18711
msgstr ""
18712
18713
#: serverguide/C/mail.xml:1479(para)
18714
msgid ""
18715
"<emphasis>'.example.com/@example.com' => 'WHITELIST',</emphasis>: will "
18716
"whitelist subdomains of \"example.com\" that use the signature of <emphasis "
18717
"role=\"italic\">example.com</emphasis> the parent domain."
18718
msgstr ""
18719
18720
#: serverguide/C/mail.xml:1485(para)
18721
msgid ""
18722
"<emphasis>'./@example.com' => 'WHITELIST',</emphasis>: adds addresses "
18723
"that have a valid signature from \"example.com\". This is usually used for "
18724
"discussion groups that sign thier messages."
18725
msgstr ""
18726
18727
#: serverguide/C/mail.xml:1492(para)
18728
msgid ""
18729
"A domain can also have multiple Whitelist configurations. After, editing the "
18730
"file restart <application>amaisd-new</application>:"
18731
msgstr ""
18732
18733
#: serverguide/C/mail.xml:1501(para)
18734
msgid ""
18735
"In this context, once a domain has been added to the Whitelist the message "
18736
"will not receive any anti-virus or spam filtering. This may or may not be "
18737
"the intended behavior you wish for a domain."
18738
msgstr ""
18739
18740
#: serverguide/C/mail.xml:1511(para)
18741
msgid ""
18742
"For <application>Postfix</application> integration, enter the following from "
18743
"a terminal prompt:"
18744
msgstr ""
18745
18746
#: serverguide/C/mail.xml:1515(command)
18747
msgid "sudo postconf -e 'content_filter = smtp-amavis:[127.0.0.1]:10024'"
18748
msgstr ""
18749
18750
#: serverguide/C/mail.xml:1517(para)
18751
msgid ""
18752
"Next edit <filename>/etc/postfix/master.cf</filename> and add the following "
18753
"to the end of the file:"
18754
msgstr ""
18755
18756
#: serverguide/C/mail.xml:1520(programlisting)
18757
#, no-wrap
18758
msgid ""
18759
"\n"
18760
"smtp-amavis unix - - - - 2 smtp\n"
18761
" -o smtp_data_done_timeout=1200\n"
18762
" -o smtp_send_xforward_command=yes\n"
18763
" -o disable_dns_lookups=yes\n"
18764
" -o max_use=20\n"
18765
"\n"
18766
"127.0.0.1:10025 inet n - - - - smtpd\n"
18767
" -o content_filter=\n"
18768
" -o local_recipient_maps=\n"
18769
" -o relay_recipient_maps=\n"
18770
" -o smtpd_restriction_classes=\n"
18771
" -o smtpd_delay_reject=no\n"
18772
" -o smtpd_client_restrictions=permit_mynetworks,reject\n"
18773
" -o smtpd_helo_restrictions=\n"
18774
" -o smtpd_sender_restrictions=\n"
18775
" -o smtpd_recipient_restrictions=permit_mynetworks,reject\n"
18776
" -o smtpd_data_restrictions=reject_unauth_pipelining\n"
18777
" -o smtpd_end_of_data_restrictions=\n"
18778
" -o mynetworks=127.0.0.0/8\n"
18779
" -o smtpd_error_sleep_time=0\n"
18780
" -o smtpd_soft_error_limit=1001\n"
18781
" -o smtpd_hard_error_limit=1000\n"
18782
" -o smtpd_client_connection_count_limit=0\n"
18783
" -o smtpd_client_connection_rate_limit=0\n"
18784
" -o "
18785
"receive_override_options=no_header_body_checks,no_unknown_recipient_checks\n"
18786
msgstr ""
18787
18788
#: serverguide/C/mail.xml:1547(para)
18789
msgid ""
18790
"Also add the following two lines immediately below the "
18791
"<emphasis>\"pickup\"</emphasis> transport service:"
18792
msgstr ""
18793
18794
#: serverguide/C/mail.xml:1550(programlisting)
18795
#, no-wrap
18796
msgid ""
18797
"\n"
18798
" -o content_filter=\n"
18799
" -o receive_override_options=no_header_body_checks\n"
18800
msgstr ""
18801
18802
#: serverguide/C/mail.xml:1554(para)
18803
msgid ""
18804
"This will prevent messages that are generated to report on spam from being "
18805
"classified as spam."
18806
msgstr ""
18807
18808
#: serverguide/C/mail.xml:1557(para)
18809
msgid "Now restart <application>Postfix</application>:"
18810
msgstr ""
18811
18812
#: serverguide/C/mail.xml:1563(para)
18813
msgid "Content filtering with spam and virus detection is now enabled."
18814
msgstr ""
18815
18816
#: serverguide/C/mail.xml:1570(para)
18817
msgid ""
18818
"First, test that the <application>Amavisd-new</application> SMTP is "
18819
"listening:"
18820
msgstr ""
18821
18822
#: serverguide/C/mail.xml:1573(programlisting)
18823
#, no-wrap
18824
msgid ""
18825
"\n"
18826
"telnet localhost 10024\n"
18827
"Trying 127.0.0.1...\n"
18828
"Connected to localhost.\n"
18829
"Escape character is '^]'.\n"
18830
"220 [127.0.0.1] ESMTP amavisd-new service ready\n"
18831
"^]\n"
18832
msgstr ""
18833
18834
#: serverguide/C/mail.xml:1581(para)
18835
msgid ""
18836
"In the Header of messages that go through the content filter you should see:"
18837
msgstr ""
18838
18839
#: serverguide/C/mail.xml:1584(programlisting)
18840
#, no-wrap
18841
msgid ""
18842
"\n"
18843
"X-Spam-Level: \n"
18844
"X-Virus-Scanned: Debian amavisd-new at example.com\n"
18845
"X-Spam-Status: No, hits=-2.3 tagged_above=-1000.0 required=5.0 tests=AWL, "
18846
"BAYES_00\n"
18847
"X-Spam-Level: \n"
18848
msgstr ""
18849
18850
#: serverguide/C/mail.xml:1591(para)
18851
msgid ""
18852
"Your output will vary, but the important thing is that there are <emphasis>X-"
18853
"Virus-Scanned</emphasis> and <emphasis>X-Spam-Status</emphasis> entries."
18854
msgstr ""
18855
18856
#: serverguide/C/mail.xml:1599(para)
18857
msgid ""
18858
"The best way to figure out why something is going wrong is to check the log "
18859
"files."
18860
msgstr ""
18861
18862
#: serverguide/C/mail.xml:1604(para)
18863
msgid ""
18864
"For instructions on <application>Postfix</application> logging see the <xref "
18865
"linkend=\"postfix-troubleshooting\"/> section."
18866
msgstr ""
18867
18868
#: serverguide/C/mail.xml:1610(para)
18869
msgid ""
18870
"<application>Amavisd-new</application> uses "
18871
"<application>Syslog</application> to send messages to "
18872
"<filename>/var/log/mail.log</filename>. The amount of detail can be "
18873
"increased by adding the <emphasis>$log_level</emphasis> option to "
18874
"<filename>/etc/amavis/conf.d/50-user</filename>, and setting the value from "
18875
"1 to 5."
18876
msgstr ""
18877
18878
#: serverguide/C/mail.xml:1615(programlisting)
18879
#, no-wrap
18880
msgid ""
18881
"\n"
18882
"$log_level = 2;\n"
18883
msgstr ""
18884
18885
#: serverguide/C/mail.xml:1619(para)
18886
msgid ""
18887
"When the <application>Amavisd-new</application> log output is increased "
18888
"<application>Spamassassin</application> log output is also increased."
18889
msgstr ""
18890
18891
#: serverguide/C/mail.xml:1626(para)
18892
msgid ""
18893
"The <application>ClamAV</application> log level can be increased by editing "
18894
"<filename>/etc/clamav/clamd.conf</filename> and setting the following option:"
18895
msgstr ""
18896
18897
#: serverguide/C/mail.xml:1630(programlisting)
18898
#, no-wrap
18899
msgid ""
18900
"\n"
18901
"LogVerbose true\n"
18902
msgstr ""
18903
18904
#: serverguide/C/mail.xml:1633(para)
18905
msgid ""
18906
"By default <application>ClamAV</application> will send log messages to "
18907
"<filename>/var/log/clamav/clamav.log</filename>."
18908
msgstr ""
18909
18910
#: serverguide/C/mail.xml:1639(para)
18911
msgid ""
18912
"After changing an applications log settings remember to restart the service "
18913
"for the new settings to take affect. Also, once the issue you are "
18914
"troubleshooting is resolved it is a good idea to change the log settings "
18915
"back to normal."
18916
msgstr ""
18917
18918
#: serverguide/C/mail.xml:1647(para)
18919
msgid "For more information on filtering mail see the following links:"
18920
msgstr ""
18921
18922
#: serverguide/C/mail.xml:1653(ulink)
18923
msgid "Amavisd-new Documentation"
18924
msgstr ""
18925
18926
#: serverguide/C/mail.xml:1657(para)
18927
msgid ""
18928
"<ulink url=\"http://www.clamav.org/doc/latest/html/\">ClamAV "
18929
"Documentation</ulink> and <ulink "
18930
"url=\"http://wiki.clamav.net/Main/WebHome\">ClamAV Wiki</ulink>"
18931
msgstr ""
18932
18933
#: serverguide/C/mail.xml:1664(ulink)
18934
msgid "Spamassassin Wiki"
18935
msgstr ""
18936
18937
#: serverguide/C/mail.xml:1669(ulink)
18938
msgid "Pyzor Homepage"
18939
msgstr ""
18940
18941
#: serverguide/C/mail.xml:1674(ulink)
18942
msgid "Razor Homepage"
18943
msgstr ""
18944
18945
#: serverguide/C/mail.xml:1679(ulink)
18946
msgid "DKIM.org"
18947
msgstr ""
18948
18949
#: serverguide/C/mail.xml:1684(ulink)
18950
msgid "Postfix Amavis New"
18951
msgstr ""
18952
18953
#: serverguide/C/mail.xml:1688(para)
18954
msgid ""
18955
"Also, feel free to ask questions in the <emphasis>#ubuntu-server</emphasis> "
18956
"IRC channel on <ulink url=\"http://freenode.net\">freenode</ulink>."
18957
msgstr ""
18958
18959
#: serverguide/C/lamp-applications.xml:13(title)
18960
msgid "LAMP Applications"
18961
msgstr ""
18962
18963
#: serverguide/C/lamp-applications.xml:19(para)
18964
msgid ""
18965
"LAMP installations (Linux + Apache + MySQL + PHP) are a popular setup for "
18966
"Ubuntu servers. There is a plethora of Open Source applications written "
18967
"using the LAMP application stack. Some popular LAMP applications are Wiki's, "
18968
"Content Management Systems, and Management Software such as phpMyAdmin."
18969
msgstr ""
18970
18971
#: serverguide/C/lamp-applications.xml:26(para)
18972
msgid ""
18973
"One advantage of LAMP is the substantial flexibility for different database, "
18974
"web server, and scripting languages. Popular substitutes for MySQL include "
18975
"Posgresql and SQLite. Python, Perl, and Ruby are also frequently used "
18976
"instead of PHP."
18977
msgstr ""
18978
18979
#: serverguide/C/lamp-applications.xml:32(para)
18980
msgid ""
18981
"The traditional way to install most <emphasis>LAMP</emphasis> applications "
18982
"is:"
18983
msgstr ""
18984
18985
#: serverguide/C/lamp-applications.xml:38(para)
18986
msgid "Download an archive containing the application source files."
18987
msgstr ""
18988
18989
#: serverguide/C/lamp-applications.xml:43(para)
18990
msgid ""
18991
"Unpack the archive, usually in a directory accessible to a web server."
18992
msgstr ""
18993
18994
#: serverguide/C/lamp-applications.xml:48(para)
18995
msgid ""
18996
"Depending on where the source was extracted, configure a web browser to "
18997
"serve the files."
18998
msgstr ""
18999
19000
#: serverguide/C/lamp-applications.xml:53(para)
19001
msgid "Configure the application to connect to the database."
19002
msgstr ""
19003
19004
#: serverguide/C/lamp-applications.xml:58(para)
19005
msgid ""
19006
"Run a script, or browse to a page of the application, to install the "
19007
"database needed by the application."
19008
msgstr ""
19009
19010
#: serverguide/C/lamp-applications.xml:63(para)
19011
msgid ""
19012
"Once the steps above, or similar steps, are completed you are ready to begin "
19013
"using the application."
19014
msgstr ""
19015
19016
#: serverguide/C/lamp-applications.xml:69(para)
19017
msgid ""
19018
"A disadvantage of using this approach is that the application files are not "
19019
"placed in the file system in a standard way, which can cause confusion as to "
19020
"where the application is installed. Another larger disadvantage is updating "
19021
"the application. When a new version is released, the same process used to "
19022
"install the application is needed to apply updates."
19023
msgstr ""
19024
19025
#: serverguide/C/lamp-applications.xml:76(para)
19026
msgid ""
19027
"Fortunately, a number of <emphasis>LAMP</emphasis> applications are already "
19028
"packaged for Ubuntu, and are available for installation in the same way as "
19029
"non-LAMP applications. Depending on the application some extra configuration "
19030
"and setup steps may be needed, however."
19031
msgstr ""
19032
19033
#: serverguide/C/lamp-applications.xml:82(para)
19034
msgid ""
19035
"This section covers howto install and configure the Wiki applications "
19036
"<application>MoinMoin</application>, <application>MediaWiki</application>, "
19037
"and the MySQL management application <application>phpMyAdmin</application>."
19038
msgstr ""
19039
19040
#: serverguide/C/lamp-applications.xml:88(para)
19041
msgid ""
19042
"A Wiki is a website that allows the visitors to easily add, remove and "
19043
"modify available content easily. The ease of interaction and operation makes "
19044
"Wiki an effective tool for mass collaborative authoring. The term Wiki is "
19045
"also referred to the collaborative software."
19046
msgstr ""
19047
19048
#: serverguide/C/lamp-applications.xml:100(title)
19049
msgid "Moin Moin"
19050
msgstr ""
19051
19052
#: serverguide/C/lamp-applications.xml:102(para)
19053
msgid ""
19054
"MoinMoin is a Wiki engine implemented in Python, based on the PikiPiki Wiki "
19055
"engine, and licensed under the GNU GPL."
19056
msgstr ""
19057
19058
#: serverguide/C/lamp-applications.xml:110(para)
19059
msgid ""
19060
"To install <application>MoinMoin</application>, run the following command in "
19061
"the command prompt:"
19062
msgstr ""
19063
19064
#: serverguide/C/lamp-applications.xml:116(command)
19065
msgid "sudo apt-get install python-moinmoin"
19066
msgstr ""
19067
19068
#: serverguide/C/lamp-applications.xml:119(para)
19069
msgid ""
19070
"You should also install <application>apache2</application> web server. For "
19071
"installing <application>apache2</application> web server, please refer to "
19072
"<xref linkend=\"http-installation\"/> sub-section in <xref "
19073
"linkend=\"httpd\"/> section."
19074
msgstr ""
19075
19076
#: serverguide/C/lamp-applications.xml:130(para)
19077
msgid ""
19078
"For configuring your first Wiki application, please run the following set of "
19079
"commands. Let us assume that you are creating a Wiki named "
19080
"<emphasis>mywiki</emphasis>:"
19081
msgstr ""
19082
19083
#: serverguide/C/lamp-applications.xml:137(command)
19084
msgid "cd /usr/share/moin"
19085
msgstr ""
19086
19087
#: serverguide/C/lamp-applications.xml:138(command)
19088
msgid "sudo mkdir mywiki"
19089
msgstr ""
19090
19091
#: serverguide/C/lamp-applications.xml:139(command)
19092
msgid "sudo cp -R data mywiki"
19093
msgstr ""
19094
19095
#: serverguide/C/lamp-applications.xml:140(command)
19096
msgid "sudo cp -R underlay mywiki"
19097
msgstr ""
19098
19099
#: serverguide/C/lamp-applications.xml:141(command)
19100
msgid "sudo cp server/moin.cgi mywiki"
19101
msgstr ""
19102
19103
#: serverguide/C/lamp-applications.xml:142(command)
19104
msgid "sudo chown -R www-data.www-data mywiki"
19105
msgstr ""
19106
19107
#: serverguide/C/lamp-applications.xml:143(command)
19108
msgid "sudo chmod -R ug+rwX mywiki"
19109
msgstr ""
19110
19111
#: serverguide/C/lamp-applications.xml:144(command)
19112
msgid "sudo chmod -R o-rwx mywiki"
19113
msgstr ""
19114
19115
#: serverguide/C/lamp-applications.xml:147(para)
19116
msgid ""
19117
"Now you should configure <application>MoinMoin</application> to find your "
19118
"new Wiki <emphasis>mywiki</emphasis>. To configure "
19119
"<application>MoinMoin</application>, open "
19120
"<filename>/etc/moin/mywiki.py</filename> file and change the following line:"
19121
msgstr ""
19122
19123
#: serverguide/C/lamp-applications.xml:155(programlisting)
19124
#, no-wrap
19125
msgid "data_dir = '/org/mywiki/data'"
19126
msgstr ""
19127
19128
#: serverguide/C/lamp-applications.xml:157(para)
19129
msgid "to"
19130
msgstr ""
19131
19132
#: serverguide/C/lamp-applications.xml:161(programlisting)
19133
#, no-wrap
19134
msgid "data_dir = '/usr/share/moin/mywiki/data'"
19135
msgstr ""
19136
19137
#: serverguide/C/lamp-applications.xml:163(para)
19138
msgid ""
19139
"Also, below the <emphasis>data_dir</emphasis> option add the "
19140
"<emphasis>data_underlay_dir</emphasis>:"
19141
msgstr ""
19142
19143
#: serverguide/C/lamp-applications.xml:167(programlisting)
19144
#, no-wrap
19145
msgid ""
19146
"\n"
19147
"data_underlay_dir='/usr/share/moin/mywiki/underlay'\n"
19148
msgstr ""
19149
19150
#: serverguide/C/lamp-applications.xml:172(para)
19151
msgid ""
19152
"If the <filename>/etc/moin/mywiki.py</filename> file does not exists, you "
19153
"should copy <filename>/etc/moin/moinmaster.py</filename> file to "
19154
"<filename>/etc/moin/mywiki.py</filename> file and do the above mentioned "
19155
"change."
19156
msgstr ""
19157
19158
#: serverguide/C/lamp-applications.xml:181(para)
19159
msgid ""
19160
"If you have named your Wiki as <emphasis>my_wiki_name</emphasis> you should "
19161
"insert a line <quote>(\"my_wiki_name\", r\".*\")</quote> in "
19162
"<filename>/etc/moin/farmconfig.py</filename> file after the line "
19163
"<quote>(\"mywiki\", r\".*\")</quote>."
19164
msgstr ""
19165
19166
#: serverguide/C/lamp-applications.xml:189(para)
19167
msgid ""
19168
"Once you have configured <application>MoinMoin</application> to find your "
19169
"first Wiki application <emphasis>mywiki</emphasis>, you should configure "
19170
"<application>apache2</application> and make it ready for your Wiki "
19171
"application."
19172
msgstr ""
19173
19174
#: serverguide/C/lamp-applications.xml:196(para)
19175
msgid ""
19176
"You should add the following lines in <filename>/etc/apache2/sites-"
19177
"available/default</filename> file inside the <quote><VirtualHost "
19178
"*></quote> tag:"
19179
msgstr ""
19180
19181
#: serverguide/C/lamp-applications.xml:202(programlisting)
19182
#, no-wrap
19183
msgid ""
19184
"\n"
19185
"### moin\n"
19186
" ScriptAlias /mywiki \"/usr/share/moin/mywiki/moin.cgi\"\n"
19187
" alias /moin_static184 \"/usr/share/moin/htdocs\"\n"
19188
" <Directory /usr/share/moin/htdocs>\n"
19189
" Order allow,deny\n"
19190
" allow from all\n"
19191
" </Directory>\n"
19192
"### end moin\n"
19193
msgstr ""
19194
19195
#: serverguide/C/lamp-applications.xml:214(para)
19196
msgid ""
19197
"Adjust the <emphasis>\"moin_static184\"</emphasis> in the "
19198
"<emphasis>alias</emphasis> line above, to the "
19199
"<application>moinmoin</application> version installed."
19200
msgstr ""
19201
19202
#: serverguide/C/lamp-applications.xml:220(para)
19203
msgid ""
19204
"Once you configure the <application>apache2</application> web server and "
19205
"make it ready for your Wiki application, you should restart it. You can run "
19206
"the following command to restart the <application>apache2</application> web "
19207
"server:"
19208
msgstr ""
19209
19210
#: serverguide/C/lamp-applications.xml:233(title)
19211
msgid "Verification"
19212
msgstr ""
19213
19214
#: serverguide/C/lamp-applications.xml:235(para)
19215
msgid ""
19216
"You can verify the Wiki application and see if it works by pointing your web "
19217
"browser to the following URL:"
19218
msgstr ""
19219
19220
#: serverguide/C/lamp-applications.xml:239(programlisting)
19221
#, no-wrap
19222
msgid ""
19223
"\n"
19224
"http://localhost/mywiki\n"
19225
msgstr ""
19226
19227
#: serverguide/C/lamp-applications.xml:243(para)
19228
msgid ""
19229
"You can also run the test command by pointing your web browser to the "
19230
"following URL:"
19231
msgstr ""
19232
19233
#: serverguide/C/lamp-applications.xml:248(programlisting)
19234
#, no-wrap
19235
msgid ""
19236
"\n"
19237
"http://localhost/mywiki?action=test\n"
19238
msgstr ""
19239
19240
#: serverguide/C/lamp-applications.xml:252(para)
19241
msgid ""
19242
"For more details, please refer to the <ulink "
19243
"url=\"http://moinmo.in/\">MoinMoin</ulink> web site."
19244
msgstr ""
19245
19246
#: serverguide/C/lamp-applications.xml:263(para)
19247
msgid ""
19248
"For more information see the <ulink url=\"http://moinmo.in/\">moinmoin "
19249
"Wiki</ulink>."
19250
msgstr ""
19251
19252
#: serverguide/C/lamp-applications.xml:268(para)
19253
msgid ""
19254
"Also, see the <ulink "
19255
"url=\"https://help.ubuntu.com/community/MoinMoin\">Ubuntu Wiki "
19256
"MoinMoin</ulink> page."
19257
msgstr ""
19258
19259
#: serverguide/C/lamp-applications.xml:277(title)
19260
msgid "MediaWiki"
19261
msgstr ""
19262
19263
#: serverguide/C/lamp-applications.xml:279(para)
19264
msgid ""
19265
"MediaWiki is an web based Wiki software written in the PHP language. It can "
19266
"either use <application>MySQL</application> or "
19267
"<application>PostgreSQL</application> Database Management System."
19268
msgstr ""
19269
19270
#: serverguide/C/lamp-applications.xml:289(para)
19271
msgid ""
19272
"Before installing <application>MediaWiki</application> you should also "
19273
"install <application>Apache2</application>, the "
19274
"<application>PHP5</application> scripting language and Database a Management "
19275
"System. <application>MySQL</application> or "
19276
"<application>PostgreSQL</application> are the most common, choose one "
19277
"depending on your need. Please refer to those sections in this manual for "
19278
"installation instructions."
19279
msgstr ""
19280
19281
#: serverguide/C/lamp-applications.xml:297(para)
19282
msgid ""
19283
"To install <application>MediaWiki</application>, run the following command "
19284
"in the command prompt:"
19285
msgstr ""
19286
19287
#: serverguide/C/lamp-applications.xml:303(command)
19288
msgid "sudo apt-get install mediawiki php5-gd"
19289
msgstr ""
19290
19291
#: serverguide/C/lamp-applications.xml:306(para)
19292
msgid ""
19293
"For additional <application>MediaWiki</application> functionality see the "
19294
"<application>mediawiki-extensions</application> package."
19295
msgstr ""
19296
19297
#: serverguide/C/lamp-applications.xml:316(para)
19298
msgid ""
19299
"The Apache configuration file <filename>mediawiki.conf</filename> for "
19300
"MediaWiki is installed in <filename>/etc/apache2/conf.d/</filename> "
19301
"directory. You should uncomment the following line in this file to access "
19302
"MediaWiki application."
19303
msgstr ""
19304
19305
#: serverguide/C/lamp-applications.xml:324(screen)
19306
#, no-wrap
19307
msgid ""
19308
"\n"
19309
"# Alias /mediawiki /var/lib/mediawiki\n"
19310
msgstr ""
19311
19312
#: serverguide/C/lamp-applications.xml:328(para)
19313
msgid ""
19314
"After you uncomment the above line, restart Apache server and access "
19315
"MediaWiki using the following url:"
19316
msgstr ""
19317
19318
#: serverguide/C/lamp-applications.xml:333(programlisting)
19319
#, no-wrap
19320
msgid ""
19321
"\n"
19322
"http://localhost/mediawiki/config/index.php\n"
19323
msgstr ""
19324
19325
#: serverguide/C/lamp-applications.xml:338(para)
19326
msgid ""
19327
"Please read the <quote>Checking environment...</quote> section in this page. "
19328
"You should be able to fix many issues by carefully reading this section."
19329
msgstr ""
19330
19331
#: serverguide/C/lamp-applications.xml:345(para)
19332
msgid ""
19333
"Once the configuration is complete, you should copy the "
19334
"<filename>LocalSettings.php</filename> file to "
19335
"<filename>/etc/mediawiki</filename> directory:"
19336
msgstr ""
19337
19338
#: serverguide/C/lamp-applications.xml:352(command)
19339
msgid "sudo mv /var/lib/mediawiki/config/LocalSettings.php /etc/mediawiki/"
19340
msgstr ""
19341
19342
#: serverguide/C/lamp-applications.xml:355(para)
19343
msgid ""
19344
"You may also want to edit "
19345
"<filename>/etc/mediawiki/LocalSettings.php</filename> adjusting:"
19346
msgstr ""
19347
19348
#: serverguide/C/lamp-applications.xml:360(programlisting)
19349
#, no-wrap
19350
msgid ""
19351
"\n"
19352
"ini_set( 'memory_limit', '64M' );\n"
19353
msgstr ""
19354
19355
#: serverguide/C/lamp-applications.xml:367(title)
19356
msgid "Extensions"
19357
msgstr ""
19358
19359
#: serverguide/C/lamp-applications.xml:368(para)
19360
msgid ""
19361
"The extensions add new features and enhancements for the MediaWiki "
19362
"application. The extensions give wiki administrators and end users the "
19363
"ability to customize MediaWiki to their requirements."
19364
msgstr ""
19365
19366
#: serverguide/C/lamp-applications.xml:374(para)
19367
msgid ""
19368
"You can download MediaWiki extensions as an archive file or checkout from "
19369
"the Subversion repository. You should copy it to "
19370
"<filename>/var/lib/mediawiki/extensions</filename> directory. You should "
19371
"also add the following line at the end of file: "
19372
"<filename>/etc/mediawiki/LocalSettings.php</filename>."
19373
msgstr ""
19374
19375
#: serverguide/C/lamp-applications.xml:382(programlisting)
19376
#, no-wrap
19377
msgid ""
19378
"\n"
19379
"require_once \"$IP/extensions/ExtentionName/ExtentionName.php\";\n"
19380
msgstr ""
19381
19382
#: serverguide/C/lamp-applications.xml:392(para)
19383
msgid ""
19384
"For more details, please refer to the <ulink "
19385
"url=\"http://www.mediawiki.org\">MediaWiki</ulink> web site."
19386
msgstr ""
19387
19388
#: serverguide/C/lamp-applications.xml:398(para)
19389
msgid ""
19390
"The <ulink url=\"http://www.packtpub.com/Mediawiki/book\">MediaWiki "
19391
"Administrators’ Tutorial Guide</ulink> contains a wealth of information for "
19392
"new MediaWiki administrators."
19393
msgstr ""
19394
19395
#: serverguide/C/lamp-applications.xml:404(para)
19396
msgid ""
19397
"Also, the <ulink url=\"https://help.ubuntu.com/community/MediaWiki\">Ubuntu "
19398
"Wiki MediaWiki</ulink> page is a good resource."
19399
msgstr ""
19400
19401
#: serverguide/C/lamp-applications.xml:414(title)
19402
msgid "phpMyAdmin"
19403
msgstr ""
19404
19405
#: serverguide/C/lamp-applications.xml:416(para)
19406
msgid ""
19407
"<application>phpMyAdmin</application> is a LAMP application specifically "
19408
"written for administering <application>MySQL</application> servers. Written "
19409
"in <application>PHP</application>, and accessed through a web browser, "
19410
"phpMyAdmin provides a graphical interface for database administration tasks."
19411
msgstr ""
19412
19413
#: serverguide/C/lamp-applications.xml:425(para)
19414
msgid ""
19415
"Before installing <application>phpMyAdmin</application> you will need access "
19416
"to a <application>MySQL</application> database either on the same host as "
19417
"that phpMyAdmin is installed on, or on a host accessible over the network. "
19418
"For more information see <xref linkend=\"mysql\"/>. From a terminal prompt "
19419
"enter:"
19420
msgstr ""
19421
19422
#: serverguide/C/lamp-applications.xml:432(command)
19423
msgid "sudo apt-get install phpmyadmin"
19424
msgstr ""
19425
19426
#: serverguide/C/lamp-applications.xml:435(para)
19427
msgid ""
19428
"At the prompt choose which web server to be configured for "
19429
"<application>phpMyAdmin</application>. The rest of this section will use "
19430
"<application>Apache2</application> for the web server."
19431
msgstr ""
19432
19433
#: serverguide/C/lamp-applications.xml:440(para)
19434
msgid ""
19435
"In a browser go to <emphasis>http://servername/phpmyadmin</emphasis>, "
19436
"replacing <emphasis role=\"italic\">serveranme</emphasis> with the server's "
19437
"actual hostname. At the login, page enter <emphasis>root</emphasis> for the "
19438
"<emphasis>username</emphasis>, or another <application>MySQL</application> "
19439
"user if you any setup, and enter the <application>MySQL</application> user's "
19440
"password."
19441
msgstr ""
19442
19443
#: serverguide/C/lamp-applications.xml:447(para)
19444
msgid ""
19445
"Once logged in you can reset the <emphasis>root</emphasis> password if "
19446
"needed, create users, create/destroy databases and tables, etc."
19447
msgstr ""
19448
19449
#: serverguide/C/lamp-applications.xml:455(para)
19450
msgid ""
19451
"The configuration files for <application>phpMyAdmin</application> are "
19452
"located in <filename>/etc/phpmyadmin</filename>. The main configuration file "
19453
"is <filename>/etc/phpmyadmin/config.inc.php</filename>. This file contains "
19454
"configuration options that apply globally to "
19455
"<application>phpMyAdmin</application>."
19456
msgstr ""
19457
19458
#: serverguide/C/lamp-applications.xml:461(para)
19459
msgid ""
19460
"To use <application>phpMyAdmin</application> to administer a MySQL database "
19461
"hosted on another server, adjust the following in "
19462
"<filename>/etc/phpmyadmin/config.inc.php</filename>:"
19463
msgstr ""
19464
19465
#: serverguide/C/lamp-applications.xml:466(programlisting)
19466
#, no-wrap
19467
msgid ""
19468
"\n"
19469
"$cfg['Servers'][$i]['host'] = 'db_server';\n"
19470
msgstr ""
19471
19472
#: serverguide/C/lamp-applications.xml:471(para)
19473
msgid ""
19474
"Replace <emphasis role=\"italic\">db_server</emphasis> with the actual "
19475
"remote database server name or IP address. Also, be sure that the "
19476
"<application>phpMyAdmin</application> host has permissions to access the "
19477
"remote database."
19478
msgstr ""
19479
19480
#: serverguide/C/lamp-applications.xml:477(para)
19481
msgid ""
19482
"Once configured, log out of <application>phpMyAdmin</application> and back "
19483
"in, and you should be accessing the new server."
19484
msgstr ""
19485
19486
#: serverguide/C/lamp-applications.xml:481(para)
19487
msgid ""
19488
"The <filename>config.header.inc.php</filename> and "
19489
"<filename>config.footer.inc.php</filename> files are used to add a HTML "
19490
"header and footer to <application>phpMyAdmin</application>."
19491
msgstr ""
19492
19493
#: serverguide/C/lamp-applications.xml:486(para)
19494
msgid ""
19495
"Another important configuration file is "
19496
"<filename>/etc/phpmyadmin/apache.conf</filename>, this file is symlinked to "
19497
"<filename>/etc/apache2/conf.d/phpmyadmin.conf</filename>, and is used to "
19498
"configure <application>Apache2</application> to serve the "
19499
"<application>phpMyAdmin</application> site. The file contains directives for "
19500
"loading <application>PHP</application>, directory permissions, etc. For more "
19501
"information on configuring <application>Apache2</application> see <xref "
19502
"linkend=\"httpd\"/>."
19503
msgstr ""
19504
19505
#: serverguide/C/lamp-applications.xml:500(para)
19506
msgid ""
19507
"The <application>phpMyAdmin</application> documentation comes installed with "
19508
"the package and can be accessed from the <emphasis>phpMyAdmin "
19509
"Documentation</emphasis> link (a question mark with a box around it) under "
19510
"the phpMyAdmin logo. The official docs can also be access on the <ulink "
19511
"url=\"http://www.phpmyadmin.net/home_page/docs.php\">phpMyAdmin</ulink> site."
19512
msgstr ""
19513
19514
#: serverguide/C/lamp-applications.xml:507(para)
19515
msgid ""
19516
"Also, <ulink url=\"http://www.packtpub.com/phpmyadmin-3rd-"
19517
"edition/book\">Mastering phpMyAdmin</ulink> is a great resource."
19518
msgstr ""
19519
19520
#: serverguide/C/lamp-applications.xml:512(para)
19521
msgid ""
19522
"A third resource is the <ulink "
19523
"url=\"https://help.ubuntu.com/community/phpMyAdmin\">phpMyAdmin Ubuntu "
19524
"Wiki</ulink> page."
19525
msgstr ""
19526
19527
#: serverguide/C/introduction.xml:14(para)
19528
msgid "Welcome to the <emphasis>Ubuntu Server Guide</emphasis>!"
19529
msgstr ""
19530
19531
#: serverguide/C/introduction.xml:15(para)
19532
msgid ""
19533
"Here you can find information on how to install and configure various server "
19534
"applications. It is a step-by-step, task-oriented guide for configuring and "
19535
"customizing your system."
19536
msgstr ""
19537
19538
#: serverguide/C/introduction.xml:19(para)
19539
msgid ""
19540
"This guide assumes you have a basic understanding of your Ubuntu system. "
19541
"Some installation details are covered in <xref linkend=\"installation\"/>, "
19542
"but if you need detailed instructions installing Ubuntu please refer to the "
19543
"<ulink url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19544
"Installation Guide</ulink>."
19545
msgstr ""
19546
19547
#: serverguide/C/introduction.xml:25(para)
19548
msgid ""
19549
"A HTML version of the manual is available online at <ulink "
19550
"url=\"http://help.ubuntu.com\">the Ubuntu Documentation website</ulink>. The "
19551
"HTML files are also available in the <application>ubuntu-"
19552
"serverguide</application> package. See <xref linkend=\"package-"
19553
"management\"/> for details on installing packages."
19554
msgstr ""
19555
19556
#: serverguide/C/introduction.xml:32(para)
19557
msgid ""
19558
"If you choose to install the <application>ubuntu-serverguide</application> "
19559
"you can view this document from a console by:"
19560
msgstr ""
19561
19562
#: serverguide/C/introduction.xml:36(command)
19563
msgid "w3m /usr/share/ubuntu-serverguide/html/C/index.html"
19564
msgstr ""
19565
19566
#: serverguide/C/introduction.xml:39(para)
19567
msgid ""
19568
"If you are using a localized version of Ubuntu, replace "
19569
"<emphasis>C</emphasis> with your language localization (e.g. "
19570
"<emphasis>en_GB</emphasis>)."
19571
msgstr ""
19572
19573
#: serverguide/C/introduction.xml:53(title)
19574
msgid "Support"
19575
msgstr ""
19576
19577
#: serverguide/C/introduction.xml:55(para)
19578
msgid ""
19579
"There are a couple of different ways that Ubuntu Server Edition is "
19580
"supported, commercial support and community support. The main commercial "
19581
"support (and development funding) is available from Canonical Ltd. They "
19582
"supply reasonably priced support contracts on a per desktop or per server "
19583
"basis. For more information see the <ulink "
19584
"url=\"http://www.canonical.com/services/support\">Canonical Services</ulink> "
19585
"page."
19586
msgstr ""
19587
19588
#: serverguide/C/introduction.xml:62(para)
19589
msgid ""
19590
"Community support is also provided by dedicated individuals, and companies, "
19591
"that wish to make Ubuntu the best distribution possible. Support is provided "
19592
"through multiple mailing lists, IRC channels, forums, blogs, wikis, etc. The "
19593
"large amount of information available can be overwhelming, but a good search "
19594
"engine query can usually provide an answer to your questions. See the <ulink "
19595
"url=\"http://www.ubuntu.com/support\">Ubuntu Support</ulink> page for more "
19596
"information."
19597
msgstr ""
19598
19599
#: serverguide/C/installation.xml:14(para)
19600
msgid ""
19601
"This chapter provides a quick overview of installing Ubuntu 10.04 LTS Server "
19602
"Edition. For more detailed instructions, please refer to the <ulink "
19603
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19604
"Installation Guide</ulink>."
19605
msgstr ""
19606
19607
#: serverguide/C/installation.xml:19(title)
19608
msgid "Preparing to Install"
19609
msgstr ""
19610
19611
#: serverguide/C/installation.xml:20(para)
19612
msgid ""
19613
"This section explains various aspects to consider before starting the "
19614
"installation."
19615
msgstr ""
19616
19617
#: serverguide/C/installation.xml:24(title)
19618
msgid "System Requirements"
19619
msgstr ""
19620
19621
#: serverguide/C/installation.xml:25(para)
19622
msgid ""
19623
"Ubuntu 10.04 LTS Server Edition supports two (2) major architectures: Intel "
19624
"x86 and AMD64. The table below lists recommended hardware specifications. "
19625
"Depending on your needs, you might manage with less than this. However, most "
19626
"users risk being frustrated if they ignore these suggestions."
19627
msgstr ""
19628
19629
#: serverguide/C/installation.xml:27(title)
19630
msgid "Recommended Minimum Requirements"
19631
msgstr ""
19632
19633
#: serverguide/C/installation.xml:35(para)
19634
msgid "Install Type"
19635
msgstr ""
19636
19637
#: serverguide/C/installation.xml:36(para)
19638
msgid "RAM"
19639
msgstr ""
19640
19641
#: serverguide/C/installation.xml:37(para)
19642
msgid "Hard Drive Space"
19643
msgstr ""
19644
19645
#: serverguide/C/installation.xml:40(para)
19646
msgid "Base System"
19647
msgstr ""
19648
19649
#: serverguide/C/installation.xml:41(para)
19650
msgid "All Tasks Installed"
19651
msgstr ""
19652
19653
#: serverguide/C/installation.xml:46(para)
19654
msgid "Server"
19655
msgstr ""
19656
19657
#: serverguide/C/installation.xml:47(para)
19658
msgid "128 megabytes"
19659
msgstr ""
19660
19661
#: serverguide/C/installation.xml:48(para)
19662
msgid "500 megabytes"
19663
msgstr ""
19664
19665
#: serverguide/C/installation.xml:49(para)
19666
msgid "1 gigabyte"
19667
msgstr ""
19668
19669
#: serverguide/C/installation.xml:54(para)
19670
msgid ""
19671
"The Server Edition provides a common base for all sorts of server "
19672
"applications. It is a minimalist design providing a platform for the desired "
19673
"services, such as file/print services, web hosting, email hosting, etc."
19674
msgstr ""
19675
19676
#: serverguide/C/installation.xml:60(para)
19677
msgid ""
19678
"The requirements for UEC are slightly different for Front End requirements "
19679
"see <xref linkend=\"uec-frontend-requirements\"/> and for UEC Node "
19680
"requirements see <xref linkend=\"uec-node-requirements\"/>."
19681
msgstr ""
19682
19683
#: serverguide/C/installation.xml:68(title)
19684
msgid "Server and Desktop Differences"
19685
msgstr ""
19686
19687
#: serverguide/C/installation.xml:69(para)
19688
msgid ""
19689
"There are a few differences between the <emphasis>Ubuntu Server "
19690
"Edition</emphasis> and the <emphasis>Ubuntu Desktop Edition</emphasis>. It "
19691
"should be noted that both editions use the same "
19692
"<application>apt</application> repositories. Making it just as easy to "
19693
"install a <emphasis role=\"italic\">server</emphasis> application on the "
19694
"Desktop Edition as it is on the Server Edition."
19695
msgstr ""
19696
19697
#: serverguide/C/installation.xml:75(para)
19698
msgid ""
19699
"The differences between the two editions are the lack of an X window "
19700
"environment in the Server Edition, the installation process, and different "
19701
"Kernel options."
19702
msgstr ""
19703
19704
#: serverguide/C/installation.xml:82(title)
19705
msgid "Kernel Differences:"
19706
msgstr ""
19707
19708
#: serverguide/C/installation.xml:85(para)
19709
msgid ""
19710
"The Server Edition uses the <emphasis>Deadline</emphasis> I/O scheduler "
19711
"instead of the <emphasis>CFQ</emphasis> scheduler used by the Desktop "
19712
"Edition."
19713
msgstr ""
19714
19715
#: serverguide/C/installation.xml:91(para)
19716
msgid "<emphasis>Preemption</emphasis> is turned off in the Server Edition."
19717
msgstr ""
19718
19719
#: serverguide/C/installation.xml:96(para)
19720
msgid ""
19721
"The timer interrupt is 100 Hz in the Server Edition and 250 Hz in the "
19722
"Desktop Edition."
19723
msgstr ""
19724
19725
#: serverguide/C/installation.xml:102(para)
19726
msgid ""
19727
"When running a 64-bit version of Ubuntu on 64-bit processors you are not "
19728
"limited by memory addressing space."
19729
msgstr ""
19730
19731
#: serverguide/C/installation.xml:107(para)
19732
msgid ""
19733
"To see all kernel configuration options you can look through "
19734
"<filename>/boot/config-2.6.31-server</filename>. Also, <ulink "
19735
"url=\"http://www.kroah.com/lkn/\">Linux Kernel in a Nutshell</ulink> is a "
19736
"great resource on the options available."
19737
msgstr ""
19738
19739
#: serverguide/C/installation.xml:116(title)
19740
msgid "Backing Up"
19741
msgstr ""
19742
19743
#: serverguide/C/installation.xml:119(para)
19744
msgid ""
19745
"Before installing <application>Ubuntu Server Edition</application> you "
19746
"should make sure all data on the system is backed up. See <xref "
19747
"linkend=\"backups\"/> for backup options."
19748
msgstr ""
19749
19750
#: serverguide/C/installation.xml:123(para)
19751
msgid ""
19752
"If this is not the first time an operating system has been installed on your "
19753
"computer, it is likely you will need to re-partition your disk to make room "
19754
"for Ubuntu."
19755
msgstr ""
19756
19757
#: serverguide/C/installation.xml:127(para)
19758
msgid ""
19759
"Any time you partition your disk, you should be prepared to lose everything "
19760
"on the disk should you make a mistake or something goes wrong during "
19761
"partitioning. The programs used in installation are quite reliable, most "
19762
"have seen years of use, but they also perform destructive actions."
19763
msgstr ""
19764
19765
#: serverguide/C/installation.xml:139(title)
19766
msgid "Installing from CD"
19767
msgstr ""
19768
19769
#: serverguide/C/installation.xml:140(para)
19770
msgid ""
19771
"The basic steps to install Ubuntu Server Edition from CD are the same for "
19772
"installing any operating system from CD. Unlike the <emphasis>Desktop "
19773
"Edition</emphasis> the <emphasis>Server Edition</emphasis> does not include "
19774
"a graphical installation program. Instead the Server Edition uses a console "
19775
"menu based process."
19776
msgstr ""
19777
19778
#: serverguide/C/installation.xml:147(para)
19779
msgid ""
19780
"First, download and burn the appropriate ISO file from the <ulink "
19781
"url=\"http://www.ubuntu.com/getubuntu/download\"> Ubuntu web site</ulink>."
19782
msgstr ""
19783
19784
#: serverguide/C/installation.xml:153(para)
19785
msgid "Boot the system from the CD-ROM drive."
19786
msgstr ""
19787
19788
#: serverguide/C/installation.xml:158(para)
19789
msgid ""
19790
"At the boot prompt you will be asked to select the language. Afterwards the "
19791
"installation process begins by asking for your keyboard layout."
19792
msgstr ""
19793
19794
#: serverguide/C/installation.xml:164(para)
19795
msgid ""
19796
"From the main boot menu there are some additional options to install Ubuntu "
19797
"Server Edition. You can install a basic Ubuntu Server, or install Ubuntu "
19798
"Server as part of a <emphasis>Ubuntu Enterprise Cloud</emphasis>. For more "
19799
"information on UEC see <xref linkend=\"uec\"/>. The rest of this section "
19800
"will cover the basic Ubuntu Server install."
19801
msgstr ""
19802
19803
#: serverguide/C/installation.xml:172(para)
19804
msgid ""
19805
"The installer then discovers your hardware configuration, and configures the "
19806
"network settings using DHCP. If you do not wish to use DHCP at the next "
19807
"screen choose \"Go Back\", and you have the option to \"Configure the "
19808
"network manually\"."
19809
msgstr ""
19810
19811
#: serverguide/C/installation.xml:179(para)
19812
msgid "Next, the installer asks for the system's hostname and Time Zone."
19813
msgstr ""
19814
19815
#: serverguide/C/installation.xml:184(para)
19816
msgid ""
19817
"You can then choose from several options to configure the hard drive layout. "
19818
"For advanced disk options see <xref linkend=\"advanced-installation\"/>."
19819
msgstr ""
19820
19821
#: serverguide/C/installation.xml:190(para)
19822
msgid "The Ubuntu base system is then installed."
19823
msgstr ""
19824
19825
#: serverguide/C/installation.xml:195(para)
19826
msgid ""
19827
"A new user is setup, this user will have <emphasis>root</emphasis> access "
19828
"through the <application>sudo</application> utility."
19829
msgstr ""
19830
19831
#: serverguide/C/installation.xml:201(para)
19832
msgid ""
19833
"After the user is setup, you will be asked to encrypt your <filename "
19834
"role=\"directory\">home</filename> directory."
19835
msgstr ""
19836
19837
#: serverguide/C/installation.xml:207(para)
19838
msgid ""
19839
"The next step in the installation process is to decide how you want to "
19840
"update the system. There are three options:"
19841
msgstr ""
19842
19843
#: serverguide/C/installation.xml:213(para)
19844
msgid ""
19845
"<emphasis>No automatic updates</emphasis>: this requires an administrator to "
19846
"log into the machine and manually install updates."
19847
msgstr ""
19848
19849
#: serverguide/C/installation.xml:219(para)
19850
msgid ""
19851
"<emphasis>Install security updates Automatically</emphasis>: will install "
19852
"the <application>unattended-upgrades</application> package, which will "
19853
"install security updates without the intervention of an administrator. For "
19854
"more details see <xref linkend=\"automatic-updates\"/>."
19855
msgstr ""
19856
19857
#: serverguide/C/installation.xml:226(para)
19858
msgid ""
19859
"<emphasis>Manage the system with Landscape</emphasis>: Landscape is a paid "
19860
"service provided by Canonical to help manage your Ubuntu machines. See the "
19861
"<ulink url=\"http://www.canonical.com/projects/landscape\">Landscape</ulink> "
19862
"site for details."
19863
msgstr ""
19864
19865
#: serverguide/C/installation.xml:235(para)
19866
msgid ""
19867
"You now have the option to install, or not install, several package tasks. "
19868
"See <xref linkend=\"install-tasks\"/> for details. Also, there is an option "
19869
"to launch <application>aptitude</application> to choose specific packages to "
19870
"install. For more information see <xref linkend=\"aptitude\"/>."
19871
msgstr ""
19872
19873
#: serverguide/C/installation.xml:243(para)
19874
msgid "Finally, the last step before rebooting is to set the clock to UTC."
19875
msgstr ""
19876
19877
#: serverguide/C/installation.xml:249(para)
19878
msgid ""
19879
"If at any point during installation you are not satisfied by the default "
19880
"setting, use the \"Go Back\" function at any prompt to be brought to a "
19881
"detailed installation menu that will allow you to modify the default "
19882
"settings."
19883
msgstr ""
19884
19885
#: serverguide/C/installation.xml:254(para)
19886
msgid ""
19887
"At some point during the installation process you may want to read the help "
19888
"screen provided by the installation system. To do this, press F1."
19889
msgstr ""
19890
19891
#: serverguide/C/installation.xml:259(para)
19892
msgid ""
19893
"Once again, for detailed instructions see the <ulink "
19894
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\"> Ubuntu "
19895
"Installation Guide</ulink>."
19896
msgstr ""
19897
19898
#: serverguide/C/installation.xml:265(title)
19899
msgid "Package Tasks"
19900
msgstr ""
19901
19902
#: serverguide/C/installation.xml:266(para)
19903
msgid ""
19904
"During the Server Edition installation you have the option of installing "
19905
"additional packages from the CD. The packages are grouped by the type of "
19906
"service they provide."
19907
msgstr ""
19908
19909
#: serverguide/C/installation.xml:272(para)
19910
msgid "Cloud computing: Walrus storage service"
19911
msgstr ""
19912
19913
#: serverguide/C/installation.xml:277(para)
19914
msgid "Cloud computing: all-in-one cluster"
19915
msgstr ""
19916
19917
#: serverguide/C/installation.xml:282(para)
19918
msgid "Cloud computing: Cluster controller"
19919
msgstr ""
19920
19921
#: serverguide/C/installation.xml:287(para)
19922
msgid "Cloud computing: Node controller"
19923
msgstr ""
19924
19925
#: serverguide/C/installation.xml:292(para)
19926
msgid "Cloud computing: Storage controller"
19927
msgstr ""
19928
19929
#: serverguide/C/installation.xml:297(para)
19930
msgid "Cloud computing: top-level cloud controller"
19931
msgstr ""
19932
19933
#: serverguide/C/installation.xml:302(para)
19934
msgid "DNS server: Selects the BIND DNS server and its documentation."
19935
msgstr ""
19936
19937
#: serverguide/C/installation.xml:307(para)
19938
msgid "LAMP server: Selects a ready-made Linux/Apache/MySQL/PHP server."
19939
msgstr ""
19940
19941
#: serverguide/C/installation.xml:312(para)
19942
msgid ""
19943
"Mail server: This task selects a variety of package useful for a general "
19944
"purpose mail server system."
19945
msgstr ""
19946
19947
#: serverguide/C/installation.xml:317(para)
19948
msgid "OpenSSH server: Selects packages needed for an OpenSSH server."
19949
msgstr ""
19950
19951
#: serverguide/C/installation.xml:322(para)
19952
msgid ""
19953
"PostgreSQL database: This task selects client and server packages for the "
19954
"PostgreSQL database."
19955
msgstr ""
19956
19957
#: serverguide/C/installation.xml:327(para)
19958
msgid "Print server: This task sets up your system to be a print server."
19959
msgstr ""
19960
19961
#: serverguide/C/installation.xml:332(para)
19962
msgid ""
19963
"Samba File server: This task sets up your system to be a Samba file server, "
19964
"which is especially suitable in networks with both Windows and Linux systems."
19965
msgstr ""
19966
19967
#: serverguide/C/installation.xml:338(para)
19968
msgid ""
19969
"Tomcat server: Installs the Apache Tomcat and needed dependencies Java, gcj, "
19970
"etc."
19971
msgstr ""
19972
19973
#: serverguide/C/installation.xml:343(para)
19974
msgid ""
19975
"Virtual machine host: Includes packages needed to run KVM virtual machines."
19976
msgstr ""
19977
19978
#: serverguide/C/installation.xml:348(para)
19979
msgid ""
19980
"Manually select packages: Executes <application>apptitude</application> "
19981
"allowing you to individually select packages."
19982
msgstr ""
19983
19984
#: serverguide/C/installation.xml:353(para)
19985
msgid ""
19986
"Installing the package groups is accomplished using the "
19987
"<application>tasksel</application> utility. One of the important difference "
19988
"between Ubuntu (or Debian) and other GNU/Linux distribution is that, when "
19989
"installed, a package is also configured to reasonable defaults, eventually "
19990
"prompting you for additional required information. Likewise, when installing "
19991
"a task, the packages are not only installed, but also configured to provided "
19992
"a fully integrated service."
19993
msgstr ""
19994
19995
#: serverguide/C/installation.xml:360(para)
19996
msgid ""
19997
"For more information on the <emphasis>Cloud Computing</emphasis> tasks see "
19998
"<xref linkend=\"uec\"/>."
19999
msgstr ""
20000
20001
#: serverguide/C/installation.xml:363(para)
20002
msgid ""
20003
"Once the installation process has finished you can view a list of available "
20004
"tasks by entering the following from a terminal prompt:"
20005
msgstr ""
20006
20007
#: serverguide/C/installation.xml:368(command)
20008
msgid "tasksel --list-tasks"
20009
msgstr ""
20010
20011
#: serverguide/C/installation.xml:371(para)
20012
msgid ""
20013
"The output will list tasks from other Ubuntu based distributions such as "
20014
"Kubuntu and Edubuntu. Note that you can also invoke the "
20015
"<command>tasksel</command> command by itself, which will bring up a menu of "
20016
"the different tasks available."
20017
msgstr ""
20018
20019
#: serverguide/C/installation.xml:377(para)
20020
msgid ""
20021
"You can view a list of which packages are installed with each task using the "
20022
"<emphasis>--task-packages</emphasis> option. For example, to list the "
20023
"packages installed with the <emphasis>DNS Server</emphasis> task enter the "
20024
"following:"
20025
msgstr ""
20026
20027
#: serverguide/C/installation.xml:382(command)
20028
msgid "tasksel --task-packages dns-server"
20029
msgstr ""
20030
20031
#: serverguide/C/installation.xml:384(para)
20032
msgid "The output of the command should list:"
20033
msgstr ""
20034
20035
#: serverguide/C/installation.xml:387(programlisting)
20036
#, no-wrap
20037
msgid ""
20038
"\n"
20039
"bind9-doc \n"
20040
"bind9utils \n"
20041
"bind9\n"
20042
msgstr ""
20043
20044
#: serverguide/C/installation.xml:392(para)
20045
msgid ""
20046
"Also, if you did not install one of the tasks during the installation "
20047
"process, but for example you decide to make your new LAMP server a DNS "
20048
"server as well. Simply insert the installation CD and from a terminal:"
20049
msgstr ""
20050
20051
#: serverguide/C/installation.xml:397(command)
20052
msgid "sudo tasksel install dns-server"
20053
msgstr ""
20054
20055
#: serverguide/C/installation.xml:402(title)
20056
msgid "Upgrading"
20057
msgstr ""
20058
20059
#: serverguide/C/installation.xml:403(para)
20060
msgid ""
20061
"There are several ways to upgrade from one Ubuntu release to another. This "
20062
"section gives an overview of the recommended upgrade method."
20063
msgstr ""
20064
20065
#: serverguide/C/installation.xml:407(title) serverguide/C/installation.xml:422(command)
20066
msgid "do-release-upgrade"
20067
msgstr ""
20068
20069
#: serverguide/C/installation.xml:408(para)
20070
msgid ""
20071
"The recommended way to upgrade a Server Edition installation is to use the "
20072
"<application>do-release-upgrade</application> utility. Part of the "
20073
"<emphasis>update-manager-core</emphasis> package, it does not have any "
20074
"graphical dependencies and is installed by default."
20075
msgstr ""
20076
20077
#: serverguide/C/installation.xml:413(para)
20078
msgid ""
20079
"Debian based systems can also be upgraded by using <command>apt-get dist-"
20080
"upgrade</command>. However, using <application>do-release-"
20081
"upgrade</application> is recommended because it has the ability to handle "
20082
"system configuration changes sometimes needed between releases."
20083
msgstr ""
20084
20085
#: serverguide/C/installation.xml:418(para)
20086
msgid "To upgrade to a newer release, from a terminal prompt enter:"
20087
msgstr ""
20088
20089
#: serverguide/C/installation.xml:424(para)
20090
msgid ""
20091
"It is also possible to use <application>do-release-upgrade</application> to "
20092
"upgrade to a development version of Ubuntu. To accomplish this use the "
20093
"<emphasis>-d</emphasis> switch:"
20094
msgstr ""
20095
20096
#: serverguide/C/installation.xml:429(command)
20097
msgid "do-release-upgrade -d"
20098
msgstr ""
20099
20100
#: serverguide/C/installation.xml:432(para)
20101
msgid ""
20102
"Upgrading to a development release is <emphasis>not</emphasis> recommended "
20103
"for production environments."
20104
msgstr ""
20105
20106
#: serverguide/C/installation.xml:439(title)
20107
msgid "Advanced Installation"
20108
msgstr ""
20109
20110
#: serverguide/C/installation.xml:442(title)
20111
msgid "Software RAID"
20112
msgstr ""
20113
20114
#: serverguide/C/installation.xml:444(para)
20115
msgid ""
20116
"RAID is a method of configuring multiple hard drives to act as one, reducing "
20117
"the probability of catastrophic data loss in case of drive failure. RAID is "
20118
"implemented in either software (where the operating system knows about both "
20119
"drives and actively maintains both of them) or hardware (where a special "
20120
"controller makes the OS think there's only one drive and maintains the "
20121
"drives 'invisibly')."
20122
msgstr ""
20123
20124
#: serverguide/C/installation.xml:451(para)
20125
msgid ""
20126
"The RAID software included with current versions of Linux (and Ubuntu) is "
20127
"based on the <application>'mdadm'</application> driver and works very well, "
20128
"better even than many so-called 'hardware' RAID controllers. This section "
20129
"will guide you through installing Ubuntu Server Edition using two RAID1 "
20130
"partitions on two physical hard drives, one for <emphasis>/</emphasis> and "
20131
"another for <emphasis>swap</emphasis>."
20132
msgstr ""
20133
20134
#: serverguide/C/installation.xml:461(para) serverguide/C/installation.xml:975(para)
20135
msgid ""
20136
"Follow the installation steps until you get to the <emphasis>Partition "
20137
"disks</emphasis> step, then:"
20138
msgstr ""
20139
20140
#: serverguide/C/installation.xml:468(para)
20141
msgid "Select <emphasis>Manual</emphasis> as the partition method."
20142
msgstr ""
20143
20144
#: serverguide/C/installation.xml:475(para)
20145
msgid ""
20146
"Select the first hard drive, and agree to <emphasis>\"Create a new empty "
20147
"partition table on this device?\"</emphasis>."
20148
msgstr ""
20149
20150
#: serverguide/C/installation.xml:479(para)
20151
msgid ""
20152
"Repeat this step for each drive you wish to be part of the RAID array."
20153
msgstr ""
20154
20155
#: serverguide/C/installation.xml:486(para)
20156
msgid ""
20157
"Select the <emphasis>\"FREE SPACE\"</emphasis> on the first drive then "
20158
"select <emphasis>\"Create a new partition\"</emphasis>."
20159
msgstr ""
20160
20161
#: serverguide/C/installation.xml:493(para)
20162
msgid ""
20163
"Next, select the <emphasis>Size</emphasis> of the partition. This partition "
20164
"will be the <emphasis>swap</emphasis> partition, and a general rule for swap "
20165
"size is twice that of RAM. Enter the partition size, then choose "
20166
"<emphasis>Primary</emphasis>, then <emphasis>Beginning</emphasis>."
20167
msgstr ""
20168
20169
#: serverguide/C/installation.xml:502(para)
20170
msgid ""
20171
"Select the <emphasis>\"Use as:\"</emphasis> line at the top. By default this "
20172
"is <emphasis role=\"italic\">\"Ext4 journaling file system\"</emphasis>, "
20173
"change that to <emphasis>\"physical volume for RAID\"</emphasis> then "
20174
"<emphasis>\"Done setting up partition\"</emphasis>."
20175
msgstr ""
20176
20177
#: serverguide/C/installation.xml:511(para)
20178
msgid ""
20179
"For the <emphasis>/</emphasis> partition once again select <emphasis>\"Free "
20180
"Space\"</emphasis> on the first drive then <emphasis>\"Create a new "
20181
"partition\"</emphasis>."
20182
msgstr ""
20183
20184
#: serverguide/C/installation.xml:519(para)
20185
msgid ""
20186
"Use the rest of the free space on the drive and choose "
20187
"<emphasis>Continue</emphasis>, then <emphasis>Primary</emphasis>."
20188
msgstr ""
20189
20190
#: serverguide/C/installation.xml:526(para)
20191
msgid ""
20192
"As with the swap partition, select the <emphasis>\"Use as:\"</emphasis> line "
20193
"at the top, changing it to <emphasis>\"physical volume for "
20194
"RAID\"</emphasis>. Also select the <emphasis>\"Bootable flag:\"</emphasis> "
20195
"line to change the value to <emphasis>\"on\"</emphasis>. Then choose "
20196
"<emphasis>\"Done setting up partition\"</emphasis>."
20197
msgstr ""
20198
20199
#: serverguide/C/installation.xml:536(para)
20200
msgid "Repeat steps three through eight for the other disk and partitions."
20201
msgstr ""
20202
20203
#: serverguide/C/installation.xml:545(title)
20204
msgid "RAID Configuration"
20205
msgstr ""
20206
20207
#: serverguide/C/installation.xml:547(para)
20208
msgid "With the partitions setup the arrays are ready to be configured:"
20209
msgstr ""
20210
20211
#: serverguide/C/installation.xml:554(para)
20212
msgid ""
20213
"Back in the main \"Partition Disks\" page, select <emphasis>\"Configure "
20214
"Software RAID\"</emphasis> at the top."
20215
msgstr ""
20216
20217
#: serverguide/C/installation.xml:561(para)
20218
msgid "Select <emphasis>\"yes\"</emphasis> to write the changes to disk."
20219
msgstr ""
20220
20221
#: serverguide/C/installation.xml:568(para)
20222
msgid "Choose <emphasis>\"Create MD device\"</emphasis>."
20223
msgstr ""
20224
20225
#: serverguide/C/installation.xml:575(para)
20226
msgid ""
20227
"For this example, select <emphasis>\"RAID1\"</emphasis>, but if you are "
20228
"using a different setup choose the appropriate type (RAID0 RAID1 RAID5)."
20229
msgstr ""
20230
20231
#: serverguide/C/installation.xml:581(para)
20232
msgid ""
20233
"In order to use <emphasis>RAID5</emphasis> you need at least "
20234
"<emphasis>three</emphasis> drives. Using RAID0 or RAID1 only "
20235
"<emphasis>two</emphasis> drives are required."
20236
msgstr ""
20237
20238
#: serverguide/C/installation.xml:590(para)
20239
msgid ""
20240
"Enter the number of active devices <emphasis>\"2\"</emphasis>, or the amount "
20241
"of hard drives you have, for the array. Then select "
20242
"<emphasis>\"Continue\"</emphasis>."
20243
msgstr ""
20244
20245
#: serverguide/C/installation.xml:598(para)
20246
msgid ""
20247
"Next, enter the number of spare devices <emphasis>\"0\"</emphasis> by "
20248
"default, then choose <emphasis>\"Continue\"</emphasis>."
20249
msgstr ""
20250
20251
#: serverguide/C/installation.xml:605(para)
20252
msgid ""
20253
"Choose which partitions to use. Generally they will be sda1, sdb1, sdc1, "
20254
"etc. The numbers will usually match and the different letters correspond to "
20255
"different hard drives."
20256
msgstr ""
20257
20258
#: serverguide/C/installation.xml:610(para)
20259
msgid ""
20260
"For the <emphasis>swap</emphasis> partition choose <emphasis>sda1</emphasis> "
20261
"and <emphasis>sdb1</emphasis>. Select <emphasis>\"Continue\"</emphasis> to "
20262
"go to the next step."
20263
msgstr ""
20264
20265
#: serverguide/C/installation.xml:618(para)
20266
msgid ""
20267
"Repeat steps <emphasis>three</emphasis> through <emphasis>seven</emphasis> "
20268
"for the <emphasis>/</emphasis> partition choosing <emphasis>sda2</emphasis> "
20269
"and <emphasis>sdb2</emphasis>."
20270
msgstr ""
20271
20272
#: serverguide/C/installation.xml:626(para)
20273
msgid "Once done select <emphasis>\"Finish\"</emphasis>."
20274
msgstr ""
20275
20276
#: serverguide/C/installation.xml:636(title)
20277
msgid "Formatting"
20278
msgstr ""
20279
20280
#: serverguide/C/installation.xml:638(para)
20281
msgid ""
20282
"There should now be a list of hard drives and RAID devices. The next step is "
20283
"to format and set the mount point for the RAID devices. Treat the RAID "
20284
"device as a local hard drive, format and mount accordingly."
20285
msgstr ""
20286
20287
#: serverguide/C/installation.xml:646(para)
20288
msgid ""
20289
"Select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20290
"#0\"</emphasis> partition."
20291
msgstr ""
20292
20293
#: serverguide/C/installation.xml:653(para)
20294
msgid ""
20295
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"swap "
20296
"area\"</emphasis>, then <emphasis>\"Done setting up partition\"</emphasis>."
20297
msgstr ""
20298
20299
#: serverguide/C/installation.xml:661(para)
20300
msgid ""
20301
"Next, select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20302
"#1\"</emphasis> partition."
20303
msgstr ""
20304
20305
#: serverguide/C/installation.xml:668(para)
20306
msgid ""
20307
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"Ext4 "
20308
"journaling file system\"</emphasis>."
20309
msgstr ""
20310
20311
#: serverguide/C/installation.xml:675(para)
20312
msgid ""
20313
"Then select the <emphasis>\"Mount point\"</emphasis> and choose "
20314
"<emphasis>\"/ - the root file system\"</emphasis>. Change any of the other "
20315
"options as appropriate, then select <emphasis>\"Done setting up "
20316
"partition\"</emphasis>."
20317
msgstr ""
20318
20319
#: serverguide/C/installation.xml:683(para)
20320
msgid ""
20321
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20322
"disk\"</emphasis>."
20323
msgstr ""
20324
20325
#: serverguide/C/installation.xml:690(para)
20326
msgid ""
20327
"If you choose to place the root partition on a RAID array, the installer "
20328
"will then ask if you would like to boot in a <emphasis>degraded</emphasis> "
20329
"state. See <xref linkend=\"raid-degraded\"/> for further details."
20330
msgstr ""
20331
20332
#: serverguide/C/installation.xml:695(para)
20333
msgid "The installation process will then continue normally."
20334
msgstr ""
20335
20336
#: serverguide/C/installation.xml:701(title)
20337
msgid "Degraded RAID"
20338
msgstr ""
20339
20340
#: serverguide/C/installation.xml:703(para)
20341
msgid ""
20342
"At some point in the life of the computer a disk failure event may occur. "
20343
"When this happens, using Software RAID, the operating system will place the "
20344
"array into what is known as a <emphasis>degraded</emphasis> state."
20345
msgstr ""
20346
20347
#: serverguide/C/installation.xml:708(para)
20348
msgid ""
20349
"If the array has become degraded, due to the chance of data corruption, by "
20350
"default Ubuntu Server Edition will boot to <emphasis>initramfs</emphasis> "
20351
"after thirty seconds. Once the initramfs has booted there is a fifteen "
20352
"second prompt giving you the option to go ahead and boot the system, or "
20353
"attempt manual recover. Booting to the initramfs prompt may or may not be "
20354
"the desired behavior, especially if the machine is in a remote location. "
20355
"Booting to a degraded array can be configured several ways:"
20356
msgstr ""
20357
20358
#: serverguide/C/installation.xml:719(para)
20359
msgid ""
20360
"The <application>dpkg-reconfigure</application> utility can be used to "
20361
"configure the default behavior, and during the process you will be queried "
20362
"about additional settings related to the array. Such as monitoring, email "
20363
"alerts, etc. To reconfigure <application>mdadm</application> enter the "
20364
"following:"
20365
msgstr ""
20366
20367
#: serverguide/C/installation.xml:726(command)
20368
msgid "sudo dpkg-reconfigure mdadm"
20369
msgstr ""
20370
20371
#: serverguide/C/installation.xml:732(para)
20372
msgid ""
20373
"The <command>dpkg-reconfigure mdadm</command> process will change the "
20374
"<filename>/etc/initramfs-tools/conf.d/mdadm</filename> configuration file. "
20375
"The file has the advantage of being able to pre-configure the system's "
20376
"behavior, and can also be manually edited:"
20377
msgstr ""
20378
20379
#: serverguide/C/installation.xml:738(programlisting)
20380
#, no-wrap
20381
msgid ""
20382
"\n"
20383
"BOOT_DEGRADED=true\n"
20384
msgstr ""
20385
20386
#: serverguide/C/installation.xml:743(para)
20387
msgid "The configuration file can be overridden by using a Kernel argument."
20388
msgstr ""
20389
20390
#: serverguide/C/installation.xml:751(para)
20391
msgid ""
20392
"Using a Kernel argument will allow the system to boot to a degraded array as "
20393
"well:"
20394
msgstr ""
20395
20396
#: serverguide/C/installation.xml:757(para)
20397
msgid ""
20398
"When the server is booting press <keycap>Shift</keycap> to open the "
20399
"<application>Grub</application> menu."
20400
msgstr ""
20401
20402
#: serverguide/C/installation.xml:762(para)
20403
msgid "Press <keycap>e</keycap> to edit your kernel command options."
20404
msgstr ""
20405
20406
#: serverguide/C/installation.xml:767(para)
20407
msgid "Press the <keycap>down</keycap> arrow to highlight the kernel line."
20408
msgstr ""
20409
20410
#: serverguide/C/installation.xml:772(para)
20411
msgid ""
20412
"Add <emphasis>\"bootdegraded=true\"</emphasis> (without the quotes) to the "
20413
"end of the line."
20414
msgstr ""
20415
20416
#: serverguide/C/installation.xml:777(para)
20417
msgid ""
20418
"Press <keycombo><keycap>Ctrl</keycap><keycap>x</keycap></keycombo> to boot "
20419
"the system."
20420
msgstr ""
20421
20422
#: serverguide/C/installation.xml:786(para)
20423
msgid ""
20424
"Once the system has booted you can either repair the array see <xref "
20425
"linkend=\"raid-maintenance\"/> for details, or copy important data to "
20426
"another machine due to major hardware failure."
20427
msgstr ""
20428
20429
#: serverguide/C/installation.xml:793(title)
20430
msgid "RAID Maintenance"
20431
msgstr ""
20432
20433
#: serverguide/C/installation.xml:795(para)
20434
msgid ""
20435
"The <application>mdadm</application> utility can be used to view the status "
20436
"of an array, add disks to an array, remove disks, etc:"
20437
msgstr ""
20438
20439
#: serverguide/C/installation.xml:802(para)
20440
msgid "To view the status of an array, from a terminal prompt enter:"
20441
msgstr ""
20442
20443
#: serverguide/C/installation.xml:806(command)
20444
msgid "sudo mdadm -D /dev/md0"
20445
msgstr ""
20446
20447
#: serverguide/C/installation.xml:809(para)
20448
msgid ""
20449
"The <emphasis>-D</emphasis> tells <application>mdadm</application> to "
20450
"display <emphasis>detailed</emphasis> information about the "
20451
"<filename>/dev/md0</filename> device. Replace <filename>/dev/md0</filename> "
20452
"with the appropriate RAID device."
20453
msgstr ""
20454
20455
#: serverguide/C/installation.xml:815(para)
20456
msgid "To view the status of a disk in an array:"
20457
msgstr ""
20458
20459
#: serverguide/C/installation.xml:819(command)
20460
msgid "sudo mdadm -E /dev/sda1"
20461
msgstr ""
20462
20463
#: serverguide/C/installation.xml:821(para)
20464
msgid ""
20465
"The output if very similar to the <command>mdadm -D</command> command, "
20466
"adjust <filename>/dev/sda1</filename> for each disk."
20467
msgstr ""
20468
20469
#: serverguide/C/installation.xml:826(para)
20470
msgid "If a disk fails and needs to be removed from an array enter:"
20471
msgstr ""
20472
20473
#: serverguide/C/installation.xml:830(command)
20474
msgid "sudo mdadm --remove /dev/md0 /dev/sda1"
20475
msgstr ""
20476
20477
#: serverguide/C/installation.xml:832(para)
20478
msgid ""
20479
"Change <filename>/dev/md0</filename> and <filename>/dev/sda1</filename> to "
20480
"the appropriate RAID device and disk."
20481
msgstr ""
20482
20483
#: serverguide/C/installation.xml:837(para)
20484
msgid "Similarly, to add a new disk:"
20485
msgstr ""
20486
20487
#: serverguide/C/installation.xml:841(command)
20488
msgid "sudo mdadm --add /dev/md0 /dev/sda1"
20489
msgstr ""
20490
20491
#: serverguide/C/installation.xml:846(para)
20492
msgid ""
20493
"Sometimes a disk can change to a <emphasis>faulty</emphasis> state even "
20494
"though there is nothing physically wrong with the drive. It is usually "
20495
"worthwhile to remove the drive from the array then re-add it. This will "
20496
"cause the drive to re-sync with the array. If the drive will not sync with "
20497
"the array, it is a good indication of hardware failure."
20498
msgstr ""
20499
20500
#: serverguide/C/installation.xml:852(para)
20501
msgid ""
20502
"The <filename>/proc/mdstat</filename> file also contains useful information "
20503
"about the system's RAID devices:"
20504
msgstr ""
20505
20506
#: serverguide/C/installation.xml:857(command)
20507
msgid "cat /proc/mdstat"
20508
msgstr ""
20509
20510
#: serverguide/C/installation.xml:858(computeroutput)
20511
#, no-wrap
20512
msgid ""
20513
"Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] "
20514
"[raid10] \n"
20515
"md0 : active raid1 sda1[0] sdb1[1]\n"
20516
" 10016384 blocks [2/2] [UU]\n"
20517
" \n"
20518
"unused devices: <none>"
20519
msgstr ""
20520
20521
#: serverguide/C/installation.xml:865(para)
20522
msgid ""
20523
"The following command is great for watching the status of a syncing drive:"
20524
msgstr ""
20525
20526
#: serverguide/C/installation.xml:870(command)
20527
msgid "watch -n1 cat /proc/mdstat"
20528
msgstr ""
20529
20530
#: serverguide/C/installation.xml:873(para)
20531
msgid ""
20532
"Press <emphasis>Ctrl+c</emphasis> to stop the "
20533
"<application>watch</application> command."
20534
msgstr ""
20535
20536
#: serverguide/C/installation.xml:877(para)
20537
msgid ""
20538
"If you do need to replace a faulty drive, after the drive has been replaced "
20539
"and synced, <application>grub</application> will need to be installed. To "
20540
"install <application>grub</application> on the new drive, enter the "
20541
"following:"
20542
msgstr ""
20543
20544
#: serverguide/C/installation.xml:883(command)
20545
msgid "sudo grub-install /dev/md0"
20546
msgstr ""
20547
20548
#: serverguide/C/installation.xml:886(para)
20549
msgid ""
20550
"Replace <filename>/dev/md0</filename> with the appropriate array device name."
20551
msgstr ""
20552
20553
#: serverguide/C/installation.xml:894(para)
20554
msgid ""
20555
"The topic of RAID arrays is a complex one due to the plethora of ways RAID "
20556
"can be configured. Please see the following links for more information:"
20557
msgstr ""
20558
20559
#: serverguide/C/installation.xml:901(para)
20560
msgid ""
20561
"<ulink url=\"https://help.ubuntu.com/community/Installation#raid\">Ubuntu "
20562
"Wiki Articles on RAID</ulink>."
20563
msgstr ""
20564
20565
#: serverguide/C/installation.xml:907(ulink)
20566
msgid "Software RAID HOWTO"
20567
msgstr ""
20568
20569
#: serverguide/C/installation.xml:912(ulink)
20570
msgid "Managing RAID on Linux"
20571
msgstr ""
20572
20573
#: serverguide/C/installation.xml:919(title)
20574
msgid "Logical Volume Manager (LVM)"
20575
msgstr ""
20576
20577
#: serverguide/C/installation.xml:921(para)
20578
msgid ""
20579
"Logical Volume Manger, or <emphasis>LVM</emphasis>, allows administrators to "
20580
"create <emphasis>logical</emphasis> volumes out of one or multiple physical "
20581
"hard disks. LVM volumes can be created on both software RAID partitions and "
20582
"standard partitions residing on a single disk. Volumes can also be extended, "
20583
"giving greater flexibility to systems as requirements change."
20584
msgstr ""
20585
20586
#: serverguide/C/installation.xml:930(para)
20587
msgid ""
20588
"A side effect of LVM's power and flexibility is a greater degree of "
20589
"complication. Before diving into the LVM installation process, it is best to "
20590
"get familiar with some terms."
20591
msgstr ""
20592
20593
#: serverguide/C/installation.xml:937(para)
20594
msgid ""
20595
"<emphasis>Volume Group (VG):</emphasis> contains one or several Logical "
20596
"Volumes (LV)."
20597
msgstr ""
20598
20599
#: serverguide/C/installation.xml:942(para)
20600
msgid ""
20601
"<emphasis>Logical Volume (LV):</emphasis> is similar to a partition in a non-"
20602
"LVM system. Multiple Physical Volumes (PV) can make up one LV, on top of "
20603
"which resides the actual EXT3, XFS, JFS, etc filesystem."
20604
msgstr ""
20605
20606
#: serverguide/C/installation.xml:948(para)
20607
msgid ""
20608
"<emphasis>Physical Volume (PV):</emphasis> physical hard disk or software "
20609
"RAID partition. The Volume Group can be extended by adding more PVs."
20610
msgstr ""
20611
20612
#: serverguide/C/installation.xml:959(para)
20613
msgid ""
20614
"As an example this section covers installing Ubuntu Server Edition with "
20615
"<filename role=\"directory\">/srv</filename> mounted on a LVM volume. During "
20616
"the initial install only one Physical Volume (PV) will be part of the Volume "
20617
"Group (VG). Another PV will be added after install to demonstrate how a VG "
20618
"can be extended."
20619
msgstr ""
20620
20621
#: serverguide/C/installation.xml:965(para)
20622
msgid ""
20623
"There are several installation options for LVM, <emphasis>\"Guided - use the "
20624
"entire disk and setup LVM\"</emphasis> which will also allow you to assign a "
20625
"portion of the available space to LVM, <emphasis>\"Guided - use entire and "
20626
"setup encrypted LVM\"</emphasis>, or <emphasis>Manually</emphasis> setup the "
20627
"partitions and configure LVM. At this time the only way to configure a "
20628
"system with both LVM and standard partitions, during installation, is to use "
20629
"the Manual approach."
20630
msgstr ""
20631
20632
#: serverguide/C/installation.xml:982(para)
20633
msgid ""
20634
"At the <emphasis>\"Partition Disks</emphasis> screen choose "
20635
"<emphasis>\"Manual\"</emphasis>."
20636
msgstr ""
20637
20638
#: serverguide/C/installation.xml:989(para)
20639
msgid ""
20640
"Select the hard disk and on the next screen choose \"yes\" to "
20641
"<emphasis>\"Create a new empty partition table on this device\"</emphasis>."
20642
msgstr ""
20643
20644
#: serverguide/C/installation.xml:996(para)
20645
msgid ""
20646
"Next, create standard <emphasis>/boot</emphasis>, <emphasis>swap</emphasis>, "
20647
"and <emphasis>/</emphasis> partitions with whichever filesystem you prefer."
20648
msgstr ""
20649
20650
#: serverguide/C/installation.xml:1004(para)
20651
msgid ""
20652
"For the LVM <emphasis>/srv</emphasis>, create a new "
20653
"<emphasis>Logical</emphasis> partition. Then change <emphasis>\"Use "
20654
"as\"</emphasis> to <emphasis>\"physical volume for LVM\"</emphasis> then "
20655
"<emphasis>\"Done setting up the partition\"</emphasis>."
20656
msgstr ""
20657
20658
#: serverguide/C/installation.xml:1012(para)
20659
msgid ""
20660
"Now select <emphasis>\"Configure the Logical Volume Manager\"</emphasis> at "
20661
"the top, and choose <emphasis>\"Yes\"</emphasis> to write the changes to "
20662
"disk."
20663
msgstr ""
20664
20665
#: serverguide/C/installation.xml:1020(para)
20666
msgid ""
20667
"For the <emphasis>\"LVM configuration action\"</emphasis> on the next "
20668
"screen, choose <emphasis>\"Create volume group\"</emphasis>. Enter a name "
20669
"for the VG such as <emphasis>vg01</emphasis>, or something more descriptive. "
20670
"After entering a name, select the partition configured for LVM, and choose "
20671
"<emphasis>\"Continue\"</emphasis>."
20672
msgstr ""
20673
20674
#: serverguide/C/installation.xml:1029(para)
20675
msgid ""
20676
"Back at the <emphasis>\"LVM configuration action\"</emphasis> screen, select "
20677
"<emphasis>\"Create logical volume\"</emphasis>. Select the newly created "
20678
"volume group, and enter a name for the new LV, for example "
20679
"<emphasis>srv</emphasis> since that is the intended mount point. Then choose "
20680
"a size, which may be the full partition because it can always be extended "
20681
"later. Choose <emphasis>\"Finish\"</emphasis> and you should be back at the "
20682
"main <emphasis>\"Partition Disks\"</emphasis> screen."
20683
msgstr ""
20684
20685
#: serverguide/C/installation.xml:1039(para)
20686
msgid ""
20687
"Now add a filesystem to the new LVM. Select the partition under "
20688
"<emphasis>\"LVM VG vg01, LV srv\"</emphasis>, or whatever name you have "
20689
"chosen, the choose <emphasis>Use as</emphasis>. Setup a file system as "
20690
"normal selecting <emphasis>/srv</emphasis> as the mount point. Once done, "
20691
"select <emphasis>\"Done setting up the partition\"</emphasis>."
20692
msgstr ""
20693
20694
#: serverguide/C/installation.xml:1048(para)
20695
msgid ""
20696
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20697
"disk\"</emphasis>. Then confirm the changes and continue with the rest of "
20698
"the installation."
20699
msgstr ""
20700
20701
#: serverguide/C/installation.xml:1056(para)
20702
msgid "There are some useful utilities to view information about LVM:"
20703
msgstr ""
20704
20705
#: serverguide/C/installation.xml:1061(para)
20706
msgid ""
20707
"<emphasis>vgdisplay:</emphasis> shows information about Volume Groups."
20708
msgstr ""
20709
20710
#: serverguide/C/installation.xml:1062(para)
20711
msgid ""
20712
"<emphasis>lvdisplay:</emphasis> has information about Logical Volumes."
20713
msgstr ""
20714
20715
#: serverguide/C/installation.xml:1063(para)
20716
msgid ""
20717
"<emphasis>pvdisplay:</emphasis> similarly displays information about "
20718
"Physical Volumes."
20719
msgstr ""
20720
20721
#: serverguide/C/installation.xml:1068(title)
20722
msgid "Extending Volume Groups"
20723
msgstr ""
20724
20725
#: serverguide/C/installation.xml:1070(para)
20726
msgid ""
20727
"Continuing with <emphasis>srv</emphasis> as an LVM volume example, this "
20728
"section covers adding a second hard disk, creating a Physical Volume (PV), "
20729
"adding it to the volume group (VG), extending the logical volume <filename "
20730
"role=\"directory\">srv</filename> and finally extending the filesystem. This "
20731
"example assumes a second hard disk has been added to the system. This hard "
20732
"disk will be named <filename>/dev/sdb</filename> in our example. BEWARE: "
20733
"make sure you don't already have an existing <filename>/dev/sdb</filename> "
20734
"before issuing the commands below. You could lose some data if you issue "
20735
"those commands on a non-empty disk. In our example we will use the entire "
20736
"disk as a physical volume (you could choose to create partitions and use "
20737
"them as different physical volumes)"
20738
msgstr ""
20739
20740
#: serverguide/C/installation.xml:1082(para)
20741
msgid "First, create the physical volume, in a terminal execute:"
20742
msgstr ""
20743
20744
#: serverguide/C/installation.xml:1087(command)
20745
msgid "sudo pvcreate /dev/sdb"
20746
msgstr ""
20747
20748
#: serverguide/C/installation.xml:1093(para)
20749
msgid "Now extend the Volume Group (VG):"
20750
msgstr ""
20751
20752
#: serverguide/C/installation.xml:1098(command)
20753
msgid "sudo vgextend vg01 /dev/sdb"
20754
msgstr ""
20755
20756
#: serverguide/C/installation.xml:1104(para)
20757
msgid ""
20758
"Use <application>vgdisplay</application> to find out the free physical "
20759
"extents - Free PE / size (the size you can allocate). We will assume a free "
20760
"size of 511 PE (equivalent to 2GB with a PE size of 4MB) and we will use the "
20761
"whole free space available. Use your own PE and/or free space."
20762
msgstr ""
20763
20764
#: serverguide/C/installation.xml:1110(para)
20765
msgid ""
20766
"The Logical Volume (LV) can now be extended by different methods, we will "
20767
"only see how to use the PE to extend the LV:"
20768
msgstr ""
20769
20770
#: serverguide/C/installation.xml:1115(command)
20771
msgid "sudo lvextend /dev/vg01/srv -l +511"
20772
msgstr ""
20773
20774
#: serverguide/C/installation.xml:1118(para)
20775
msgid ""
20776
"The <emphasis>-l</emphasis> option allows the LV to be extended using PE. "
20777
"The <emphasis>-L</emphasis> option allows the LV to be extended using Meg, "
20778
"Gig, Tera, etc bytes."
20779
msgstr ""
20780
20781
#: serverguide/C/installation.xml:1126(para)
20782
msgid ""
20783
"Even though you are supposed to be able to <emphasis>expand</emphasis> an "
20784
"ext3 or ext4 filesystem without unmounting it first, it may be a good "
20785
"pratice to unmount it anyway and check the filesystem, so that you don't "
20786
"mess up the day you want to reduce a logical volume (in that case unmounting "
20787
"first is compulsory)."
20788
msgstr ""
20789
20790
#: serverguide/C/installation.xml:1132(para)
20791
msgid ""
20792
"The following commands are for an <emphasis>EXT3</emphasis> or "
20793
"<emphasis>EXT4</emphasis> filesystem. If you are using another filesystem "
20794
"there may be other utilities available."
20795
msgstr ""
20796
20797
#: serverguide/C/installation.xml:1139(command)
20798
msgid "sudo e2fsck -f /dev/vg01/srv"
20799
msgstr ""
20800
20801
#: serverguide/C/installation.xml:1142(para)
20802
msgid ""
20803
"The <emphasis>-f</emphasis> option of <application>e2fsck</application> "
20804
"forces checking even if the system seems clean."
20805
msgstr ""
20806
20807
#: serverguide/C/installation.xml:1149(para)
20808
msgid "Finally, resize the filesystem:"
20809
msgstr ""
20810
20811
#: serverguide/C/installation.xml:1154(command)
20812
msgid "sudo resize2fs /dev/vg01/srv"
20813
msgstr ""
20814
20815
#: serverguide/C/installation.xml:1160(para)
20816
msgid "Now mount the partition and check its size."
20817
msgstr ""
20818
20819
#: serverguide/C/installation.xml:1165(command)
20820
msgid "mount /dev/vg01/srv /srv && df -h /srv"
20821
msgstr ""
20822
20823
#: serverguide/C/installation.xml:1177(para)
20824
msgid ""
20825
"See the <ulink "
20826
"url=\"https://help.ubuntu.com/community/Installation#lvm\">Ubuntu Wiki LVM "
20827
"Articles</ulink>."
20828
msgstr ""
20829
20830
#: serverguide/C/installation.xml:1182(para)
20831
msgid ""
20832
"See the <ulink url=\"http://tldp.org/HOWTO/LVM-HOWTO/index.html\">LVM "
20833
"HOWTO</ulink> for more information."
20834
msgstr ""
20835
20836
#: serverguide/C/installation.xml:1187(para)
20837
msgid ""
20838
"Another good article is <ulink "
20839
"url=\"http://www.linuxdevcenter.com/pub/a/linux/2006/04/27/managing-disk-"
20840
"space-with-lvm.html\">Managing Disk Space with LVM</ulink> on O'Reilly's "
20841
"linuxdevcenter.com site."
20842
msgstr ""
20843
20844
#: serverguide/C/installation.xml:1194(para)
20845
msgid ""
20846
"For more information on <application>fdisk</application> see the <ulink "
20847
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/fdisk.8.html\">fdisk "
20848
"man page</ulink>."
20849
msgstr ""
20850
20851
#: serverguide/C/file-server.xml:13(title)
20852
msgid "File Servers"
20853
msgstr ""
20854
20855
#: serverguide/C/file-server.xml:15(para)
20856
msgid ""
20857
"If you have more than one computer on a single network. At some point you "
20858
"will probably need to share files between them. In this section we cover "
20859
"installing and configuring FTP, NFS, and CUPS."
20860
msgstr ""
20861
20862
#: serverguide/C/file-server.xml:22(title)
20863
msgid "FTP Server"
20864
msgstr ""
20865
20866
#: serverguide/C/file-server.xml:24(para)
20867
msgid ""
20868
"File Transfer Protocol (FTP) is a TCP protocol for uploading and downloading "
20869
"files between computers. FTP works on a client/server model. The server "
20870
"component is called an <emphasis>FTP daemon</emphasis>. It continuously "
20871
"listens for FTP requests from remote clients. When a request is received, it "
20872
"manages the login and sets up the connection. For the duration of the "
20873
"session it executes any of commands sent by the FTP client."
20874
msgstr ""
20875
20876
#: serverguide/C/file-server.xml:33(para)
20877
msgid "Access to an FTP server can be managed in two ways:"
20878
msgstr ""
20879
20880
#: serverguide/C/file-server.xml:37(para)
20881
msgid "Anonymous"
20882
msgstr ""
20883
20884
#: serverguide/C/file-server.xml:40(para)
20885
msgid "Authenticated"
20886
msgstr ""
20887
20888
#: serverguide/C/file-server.xml:43(para)
20889
msgid ""
20890
"In the Anonymous mode, remote clients can access the FTP server by using the "
20891
"default user account called \"anonymous\" or \"ftp\" and sending an email "
20892
"address as the password. In the Authenticated mode a user must have an "
20893
"account and a password. User access to the FTP server directories and files "
20894
"is dependent on the permissions defined for the account used at login. As a "
20895
"general rule, the FTP daemon will hide the root directory of the FTP server "
20896
"and change it to the FTP Home directory. This hides the rest of the file "
20897
"system from remote sessions."
20898
msgstr ""
20899
20900
#: serverguide/C/file-server.xml:55(title)
20901
msgid "vsftpd - FTP Server Installation"
20902
msgstr ""
20903
20904
#: serverguide/C/file-server.xml:57(para)
20905
msgid ""
20906
"vsftpd is an FTP daemon available in Ubuntu. It is easy to install, set up, "
20907
"and maintain. To install <application>vsftpd</application> you can run the "
20908
"following command:"
20909
msgstr ""
20910
20911
#: serverguide/C/file-server.xml:65(command)
20912
msgid "sudo apt-get install vsftpd"
20913
msgstr ""
20914
20915
#: serverguide/C/file-server.xml:71(title)
20916
msgid "Anonymous FTP Configuration"
20917
msgstr ""
20918
20919
#: serverguide/C/file-server.xml:73(para)
20920
msgid ""
20921
"By default <application>vsftpd</application> is configured to only allow "
20922
"anonymous download. During installation a <emphasis>ftp</emphasis> user is "
20923
"created with a home directory of <filename>/home/ftp</filename>. This is the "
20924
"default FTP directory."
20925
msgstr ""
20926
20927
#: serverguide/C/file-server.xml:80(para)
20928
msgid ""
20929
"If you wish to change this location, to <filename>/srv/ftp</filename> for "
20930
"example, simply create a directory in another location and change the "
20931
"<emphasis>ftp</emphasis> user's home directory:"
20932
msgstr ""
20933
20934
#: serverguide/C/file-server.xml:87(command)
20935
msgid "sudo mkdir /srv/ftp"
20936
msgstr ""
20937
20938
#: serverguide/C/file-server.xml:88(command)
20939
msgid "sudo usermod -d /srv/ftp ftp"
20940
msgstr ""
20941
20942
#: serverguide/C/file-server.xml:91(para)
20943
msgid "After making the change restart <application>vsftpd</application>:"
20944
msgstr ""
20945
20946
#: serverguide/C/file-server.xml:96(command) serverguide/C/file-server.xml:124(command) serverguide/C/file-server.xml:189(command) serverguide/C/file-server.xml:237(command)
20947
msgid "sudo /etc/init.d/vsftpd restart"
20948
msgstr ""
20949
20950
#: serverguide/C/file-server.xml:99(para)
20951
msgid ""
20952
"Finally, copy any files and directories you would like to make available "
20953
"through anonymous FTP to <filename>/srv/ftp</filename>."
20954
msgstr ""
20955
20956
#: serverguide/C/file-server.xml:106(title)
20957
msgid "User Authenticated FTP Configuration"
20958
msgstr ""
20959
20960
#: serverguide/C/file-server.xml:108(para)
20961
msgid ""
20962
"To configure <application>vsftpd</application> to authenticate system users "
20963
"and allow them to upload files edit <filename>/etc/vsftpd.conf</filename>:"
20964
msgstr ""
20965
20966
#: serverguide/C/file-server.xml:114(programlisting)
20967
#, no-wrap
20968
msgid ""
20969
"\n"
20970
"local_enable=YES\n"
20971
"write_enable=YES\n"
20972
msgstr ""
20973
20974
#: serverguide/C/file-server.xml:119(para)
20975
msgid "Now restart <application>vsftpd</application>:"
20976
msgstr ""
20977
20978
#: serverguide/C/file-server.xml:127(para)
20979
msgid ""
20980
"Now when system users login to FTP they will start in their "
20981
"<emphasis>home</emphasis> directories where they can download, upload, "
20982
"create directories, etc."
20983
msgstr ""
20984
20985
#: serverguide/C/file-server.xml:133(para)
20986
msgid ""
20987
"Similarly, by default, the anonymous users are not allowed to upload files "
20988
"to FTP server. To change this setting, you should uncomment the following "
20989
"line, and restart <application>vsftpd</application>:"
20990
msgstr ""
20991
20992
#: serverguide/C/file-server.xml:140(programlisting)
20993
#, no-wrap
20994
msgid ""
20995
"\n"
20996
"anon_upload_enable=YES\n"
20997
msgstr ""
20998
20999
#: serverguide/C/file-server.xml:145(para)
21000
msgid ""
21001
"Enabling anonymous FTP upload can be an extreme security risk. It is best to "
21002
"not enable anonymous upload on servers accessed directly from the Internet."
21003
msgstr ""
21004
21005
#: serverguide/C/file-server.xml:151(para)
21006
msgid ""
21007
"The configuration file consists of many configuration parameters. The "
21008
"information about each parameter is available in the configuration file. "
21009
"Alternatively, you can refer to the man page, <command>man 5 "
21010
"vsftpd.conf</command> for details of each parameter."
21011
msgstr ""
21012
21013
#: serverguide/C/file-server.xml:162(title)
21014
msgid "Securing FTP"
21015
msgstr ""
21016
21017
#: serverguide/C/file-server.xml:164(para)
21018
msgid ""
21019
"There are options in <filename>/etc/vsftpd.conf</filename> to help make "
21020
"<application>vsftpd</application> more secure. For example users can be "
21021
"limited to their home directories by uncommenting:"
21022
msgstr ""
21023
21024
#: serverguide/C/file-server.xml:170(programlisting)
21025
#, no-wrap
21026
msgid ""
21027
"\n"
21028
"chroot_local_user=YES\n"
21029
msgstr ""
21030
21031
#: serverguide/C/file-server.xml:174(para)
21032
msgid ""
21033
"You can also limit a specific list of users to just their home directories:"
21034
msgstr ""
21035
21036
#: serverguide/C/file-server.xml:178(programlisting)
21037
#, no-wrap
21038
msgid ""
21039
"\n"
21040
"chroot_list_enable=YES\n"
21041
"chroot_list_file=/etc/vsftpd.chroot_list\n"
21042
msgstr ""
21043
21044
#: serverguide/C/file-server.xml:183(para)
21045
msgid ""
21046
"After uncommenting the above options, create a "
21047
"<filename>/etc/vsftpd.chroot_list</filename> containing a list of users one "
21048
"per line. Then restart <application>vsftpd</application>:"
21049
msgstr ""
21050
21051
#: serverguide/C/file-server.xml:192(para)
21052
msgid ""
21053
"Also, the <filename>/etc/ftpusers</filename> file is a list of users that "
21054
"are <emphasis>disallowed</emphasis> FTP access. The default list includes "
21055
"root, daemon, nobody, etc. To disable FTP access for additional users simply "
21056
"add them to the list."
21057
msgstr ""
21058
21059
#: serverguide/C/file-server.xml:199(para)
21060
msgid ""
21061
"FTP can also be encrypted using <emphasis>FTPS</emphasis>. Different from "
21062
"<emphasis>SFTP</emphasis>, <emphasis>FTPS</emphasis> is FTP over Secure "
21063
"Socket Layer (SSL). <emphasis>SFTP</emphasis> is a FTP like session over an "
21064
"encrypted <emphasis>SSH</emphasis> connection. A major difference is that "
21065
"users of SFTP need to have a <emphasis>shell</emphasis> account on the "
21066
"system, instead of a <emphasis>nologin</emphasis> shell. Providing all users "
21067
"with a shell may not be ideal for some environments, such as a shared web "
21068
"host."
21069
msgstr ""
21070
21071
#: serverguide/C/file-server.xml:208(para)
21072
msgid ""
21073
"To configure <emphasis>FTPS</emphasis>, edit "
21074
"<filename>/etc/vsftpd.conf</filename> and at the bottom add:"
21075
msgstr ""
21076
21077
#: serverguide/C/file-server.xml:212(programlisting)
21078
#, no-wrap
21079
msgid ""
21080
"\n"
21081
"ssl_enable=Yes\n"
21082
msgstr ""
21083
21084
#: serverguide/C/file-server.xml:216(para)
21085
msgid "Also, notice the certificate and key related options:"
21086
msgstr ""
21087
21088
#: serverguide/C/file-server.xml:220(programlisting)
21089
#, no-wrap
21090
msgid ""
21091
"\n"
21092
"rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
21093
"rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
21094
msgstr ""
21095
21096
#: serverguide/C/file-server.xml:225(para)
21097
msgid ""
21098
"By default these options are set the certificate and key provided by the "
21099
"<application>ssl-cert</application> package. In a production environment "
21100
"these should be replaced with a certificate and key generated for the "
21101
"specific host. For more information on certificates see <xref "
21102
"linkend=\"certificates-and-security\"/>."
21103
msgstr ""
21104
21105
#: serverguide/C/file-server.xml:231(para)
21106
msgid ""
21107
"Now restart <application>vsftpd</application>, and non-anonymous users will "
21108
"be forced to use <emphasis>FTPS</emphasis>:"
21109
msgstr ""
21110
21111
#: serverguide/C/file-server.xml:240(para)
21112
msgid ""
21113
"To allow users with a shell of <filename>/usr/sbin/nologin</filename> access "
21114
"to FTP, but have no shell access, edit <filename>/etc/shells</filename> "
21115
"adding the <emphasis>nologin</emphasis> shell:"
21116
msgstr ""
21117
21118
#: serverguide/C/file-server.xml:245(programlisting)
21119
#, no-wrap
21120
msgid ""
21121
"\n"
21122
"# /etc/shells: valid login shells\n"
21123
"/bin/csh\n"
21124
"/bin/sh\n"
21125
"/usr/bin/es\n"
21126
"/usr/bin/ksh\n"
21127
"/bin/ksh\n"
21128
"/usr/bin/rc\n"
21129
"/usr/bin/tcsh\n"
21130
"/bin/tcsh\n"
21131
"/usr/bin/esh\n"
21132
"/bin/dash\n"
21133
"/bin/bash\n"
21134
"/bin/rbash\n"
21135
"/usr/bin/screen\n"
21136
"/usr/sbin/nologin\n"
21137
msgstr ""
21138
21139
#: serverguide/C/file-server.xml:263(para)
21140
msgid ""
21141
"This is necessary because, by default <application>vsftpd</application> uses "
21142
"PAM for authentication, and the <filename>/etc/pam.d/vsftpd</filename> "
21143
"configuration file contains:"
21144
msgstr ""
21145
21146
#: serverguide/C/file-server.xml:268(programlisting)
21147
#, no-wrap
21148
msgid ""
21149
"\n"
21150
"auth required pam_shells.so\n"
21151
msgstr ""
21152
21153
#: serverguide/C/file-server.xml:272(para)
21154
msgid ""
21155
"The <emphasis>shells</emphasis> PAM module restricts access to shells listed "
21156
"in the <filename>/etc/shells</filename> file."
21157
msgstr ""
21158
21159
#: serverguide/C/file-server.xml:277(para)
21160
msgid ""
21161
"Most popular FTP clients can be configured connect using FTPS. The "
21162
"<application>lftp</application> command line FTP client has the ability to "
21163
"use FTPS as well."
21164
msgstr ""
21165
21166
#: serverguide/C/file-server.xml:288(para)
21167
msgid ""
21168
"See the <ulink url=\"http://vsftpd.beasts.org/vsftpd_conf.html\">vsftpd "
21169
"website</ulink> for more information."
21170
msgstr ""
21171
21172
#: serverguide/C/file-server.xml:293(para)
21173
msgid ""
21174
"For detailed <filename>/etc/vsftpd.conf</filename> options see the <ulink "
21175
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/vsftpd.conf.5.html\">"
21176
"vsftpd.conf man page</ulink>."
21177
msgstr ""
21178
21179
#: serverguide/C/file-server.xml:299(para)
21180
msgid ""
21181
"The CodeGurus article <ulink "
21182
"url=\"http://www.codeguru.com/csharp/.net/net_general/internet/article.php/c1"
21183
"4329\"> FTPS vs. SFTP: What to Choose</ulink> has useful information "
21184
"contrasting FTPS and SFTP."
21185
msgstr ""
21186
21187
#: serverguide/C/file-server.xml:305(para)
21188
msgid ""
21189
"Also, for more information see the <ulink "
21190
"url=\"https://help.ubuntu.com/community/vsftpd\">Ubuntu Wiki vsftpd</ulink> "
21191
"page."
21192
msgstr ""
21193
21194
#: serverguide/C/file-server.xml:315(title)
21195
msgid "Network File System (NFS)"
21196
msgstr ""
21197
21198
#: serverguide/C/file-server.xml:316(para)
21199
msgid ""
21200
"NFS allows a system to share directories and files with others over a "
21201
"network. By using NFS, users and programs can access files on remote systems "
21202
"almost as if they were local files."
21203
msgstr ""
21204
21205
#: serverguide/C/file-server.xml:322(para)
21206
msgid "Some of the most notable benefits that NFS can provide are:"
21207
msgstr ""
21208
21209
#: serverguide/C/file-server.xml:328(para)
21210
msgid ""
21211
"Local workstations use less disk space because commonly used data can be "
21212
"stored on a single machine and still remain accessible to others over the "
21213
"network."
21214
msgstr ""
21215
21216
#: serverguide/C/file-server.xml:333(para)
21217
msgid ""
21218
"There is no need for users to have separate home directories on every "
21219
"network machine. Home directories could be set up on the NFS server and made "
21220
"available throughout the network."
21221
msgstr ""
21222
21223
#: serverguide/C/file-server.xml:339(para)
21224
msgid ""
21225
"Storage devices such as floppy disks, CDROM drives, and USB Thumb drives can "
21226
"be used by other machines on the network. This may reduce the number of "
21227
"removable media drives throughout the network."
21228
msgstr ""
21229
21230
#: serverguide/C/file-server.xml:349(para)
21231
msgid ""
21232
"At a terminal prompt enter the following command to install the NFS Server:"
21233
msgstr ""
21234
21235
#: serverguide/C/file-server.xml:355(command)
21236
msgid "sudo apt-get install nfs-kernel-server"
21237
msgstr ""
21238
21239
#: serverguide/C/file-server.xml:361(para)
21240
msgid ""
21241
"You can configure the directories to be exported by adding them to the "
21242
"<filename>/etc/exports</filename> file. For example:"
21243
msgstr ""
21244
21245
#: serverguide/C/file-server.xml:366(screen)
21246
#, no-wrap
21247
msgid ""
21248
"\n"
21249
"/ubuntu *(ro,sync,no_root_squash)\n"
21250
"/home *(rw,sync,no_root_squash)\n"
21251
msgstr ""
21252
21253
#: serverguide/C/file-server.xml:372(para)
21254
msgid ""
21255
"You can replace * with one of the hostname formats. Make the hostname "
21256
"declaration as specific as possible so unwanted systems cannot access the "
21257
"NFS mount."
21258
msgstr ""
21259
21260
#: serverguide/C/file-server.xml:378(para)
21261
msgid ""
21262
"To start the NFS server, you can run the following command at a terminal "
21263
"prompt:"
21264
msgstr ""
21265
21266
#: serverguide/C/file-server.xml:383(command)
21267
msgid "sudo /etc/init.d/nfs-kernel-server start"
21268
msgstr ""
21269
21270
#: serverguide/C/file-server.xml:388(title)
21271
msgid "NFS Client Configuration"
21272
msgstr ""
21273
21274
#: serverguide/C/file-server.xml:389(para)
21275
msgid ""
21276
"Use the <application>mount</application> command to mount a shared NFS "
21277
"directory from another machine, by typing a command line similar to the "
21278
"following at a terminal prompt:"
21279
msgstr ""
21280
21281
#: serverguide/C/file-server.xml:395(command)
21282
msgid "sudo mount example.hostname.com:/ubuntu /local/ubuntu"
21283
msgstr ""
21284
21285
#: serverguide/C/file-server.xml:399(para)
21286
msgid ""
21287
"The mount point directory <filename>/local/ubuntu</filename> must exist. "
21288
"There should be no files or subdirectories in the "
21289
"<filename>/local/ubuntu</filename> directory."
21290
msgstr ""
21291
21292
#: serverguide/C/file-server.xml:406(para)
21293
msgid ""
21294
"An alternate way to mount an NFS share from another machine is to add a line "
21295
"to the <filename>/etc/fstab</filename> file. The line must state the "
21296
"hostname of the NFS server, the directory on the server being exported, and "
21297
"the directory on the local machine where the NFS share is to be mounted."
21298
msgstr ""
21299
21300
#: serverguide/C/file-server.xml:414(para)
21301
msgid ""
21302
"The general syntax for the line in <filename>/etc/fstab</filename> file is "
21303
"as follows:"
21304
msgstr ""
21305
21306
#: serverguide/C/file-server.xml:420(programlisting)
21307
#, no-wrap
21308
msgid ""
21309
"\n"
21310
"example.hostname.com:/ubuntu /local/ubuntu nfs "
21311
"rsize=8192,wsize=8192,timeo=14,intr\n"
21312
msgstr ""
21313
21314
#: serverguide/C/file-server.xml:424(para)
21315
msgid ""
21316
"If you have trouble mounting an NFS share, make sure the <application>nfs-"
21317
"common</application> package is installed on your client. To install "
21318
"<application>nfs-common</application> enter the following command at the "
21319
"terminal prompt: <screen>\n"
21320
"<command>sudo apt-get install nfs-common</command>\n"
21321
"</screen>"
21322
msgstr ""
21323
21324
#: serverguide/C/file-server.xml:437(ulink)
21325
msgid "Linux NFS faq"
21326
msgstr ""
21327
21328
#: serverguide/C/file-server.xml:439(ulink)
21329
msgid "Ubuntu Wiki NFS Howto"
21330
msgstr ""
21331
21332
#: serverguide/C/file-server.xml:445(title)
21333
msgid "CUPS - Print Server"
21334
msgstr ""
21335
21336
#: serverguide/C/file-server.xml:446(para)
21337
msgid ""
21338
"The primary mechanism for Ubuntu printing and print services is the "
21339
"<emphasis role=\"bold\">Common UNIX Printing System</emphasis> (CUPS). This "
21340
"printing system is a freely available, portable printing layer which has "
21341
"become the new standard for printing in most Linux distributions."
21342
msgstr ""
21343
21344
#: serverguide/C/file-server.xml:453(para)
21345
msgid ""
21346
"CUPS manages print jobs and queues and provides network printing using the "
21347
"standard Internet Printing Protocol (IPP), while offering support for a very "
21348
"large range of printers, from dot-matrix to laser and many in between. CUPS "
21349
"also supports PostScript Printer Description (PPD) and auto-detection of "
21350
"network printers, and features a simple web-based configuration and "
21351
"administration tool."
21352
msgstr ""
21353
21354
#: serverguide/C/file-server.xml:463(para)
21355
msgid ""
21356
"To install CUPS on your Ubuntu computer, simply use "
21357
"<application>sudo</application> with the <application>apt-get</application> "
21358
"command and give the packages to install as the first parameter. A complete "
21359
"CUPS install has many package dependencies, but they may all be specified on "
21360
"the same command line. Enter the following at a terminal prompt to install "
21361
"CUPS:"
21362
msgstr ""
21363
21364
#: serverguide/C/file-server.xml:468(command)
21365
msgid "sudo apt-get install cups"
21366
msgstr ""
21367
21368
#: serverguide/C/file-server.xml:471(para)
21369
msgid ""
21370
"Upon authenticating with your user password, the packages should be "
21371
"downloaded and installed without error. Upon the conclusion of installation, "
21372
"the CUPS server will be started automatically."
21373
msgstr ""
21374
21375
#: serverguide/C/file-server.xml:476(para)
21376
msgid ""
21377
"For troubleshooting purposes, you can access CUPS server errors via the "
21378
"error log file at: <filename>/var/log/cups/error_log</filename>. If the "
21379
"error log does not show enough information to troubleshoot any problems you "
21380
"encounter, the verbosity of the CUPS log can be increased by changing the "
21381
"<emphasis role=\"bold\">LogLevel</emphasis> directive in the configuration "
21382
"file (discussed below) to \"debug\" or even \"debug2\", which logs "
21383
"everything, from the default of \"info\". If you make this change, remember "
21384
"to change it back once you've solved your problem, to prevent the log file "
21385
"from becoming overly large."
21386
msgstr ""
21387
21388
#: serverguide/C/file-server.xml:489(para)
21389
msgid ""
21390
"The Common UNIX Printing System server's behavior is configured through the "
21391
"directives contained in the file <filename>/etc/cups/cupsd.conf</filename>. "
21392
"The CUPS configuration file follows the same syntax as the primary "
21393
"configuration file for the Apache HTTP server, so users familiar with "
21394
"editing Apache's configuration file should feel at ease when editing the "
21395
"CUPS configuration file. Some examples of settings you may wish to change "
21396
"initially will be presented here."
21397
msgstr ""
21398
21399
#: serverguide/C/file-server.xml:499(para)
21400
msgid ""
21401
"Prior to editing the configuration file, you should make a copy of the "
21402
"original file and protect it from writing, so you will have the original "
21403
"settings as a reference, and to reuse as necessary."
21404
msgstr ""
21405
21406
#: serverguide/C/file-server.xml:503(para)
21407
msgid ""
21408
"Copy the <filename>/etc/cups/cupsd.conf</filename> file and protect it from "
21409
"writing with the following commands, issued at a terminal prompt:"
21410
msgstr ""
21411
21412
#: serverguide/C/file-server.xml:509(command)
21413
msgid "sudo cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.original"
21414
msgstr ""
21415
21416
#: serverguide/C/file-server.xml:510(command)
21417
msgid "sudo chmod a-w /etc/cups/cupsd.conf.original"
21418
msgstr ""
21419
21420
#: serverguide/C/file-server.xml:515(para)
21421
msgid ""
21422
"<emphasis role=\"bold\">ServerAdmin</emphasis>: To configure the email "
21423
"address of the designated administrator of the CUPS server, simply edit the "
21424
"<filename>/etc/cups/cupsd.conf</filename> configuration file with your "
21425
"preferred text editor, and add or modify the <emphasis "
21426
"role=\"italics\">ServerAdmin</emphasis> line accordingly. For example, if "
21427
"you are the Administrator for the CUPS server, and your e-mail address is "
21428
"'bjoy@somebigco.com', then you would modify the ServerAdmin line to appear "
21429
"as such:"
21430
msgstr ""
21431
21432
#: serverguide/C/file-server.xml:526(screen)
21433
#, no-wrap
21434
msgid ""
21435
"\n"
21436
"ServerAdmin bjoy@somebigco.com\n"
21437
msgstr ""
21438
21439
#: serverguide/C/file-server.xml:532(para)
21440
msgid ""
21441
"<emphasis role=\"bold\">Listen</emphasis>: By default on Ubuntu, the CUPS "
21442
"server installation listens only on the loopback interface at IP address "
21443
"<emphasis>127.0.0.1</emphasis>. In order to instruct the CUPS server to "
21444
"listen on an actual network adapter's IP address, you must specify either a "
21445
"hostname, the IP address, or optionally, an IP address/port pairing via the "
21446
"addition of a Listen directive. For example, if your CUPS server resides on "
21447
"a local network at the IP address <emphasis "
21448
"role=\"italics\">192.168.10.250</emphasis> and you'd like to make it "
21449
"accessible to the other systems on this subnetwork, you would edit the "
21450
"<filename>/etc/cups/cupsd.conf</filename> and add a Listen directive, as "
21451
"such:"
21452
msgstr ""
21453
21454
#: serverguide/C/file-server.xml:546(screen)
21455
#, no-wrap
21456
msgid ""
21457
"\n"
21458
"Listen 127.0.0.1:631 # existing loopback Listen\n"
21459
"Listen /var/run/cups/cups.sock # existing socket Listen\n"
21460
"Listen 192.168.10.250:631 # Listen on the LAN interface, Port 631 "
21461
"(IPP)\n"
21462
msgstr ""
21463
21464
#: serverguide/C/file-server.xml:552(para)
21465
msgid ""
21466
"In the example above, you may comment out or remove the reference to the "
21467
"Loopback address (127.0.0.1) if you do not wish <application>cupsd "
21468
"</application> to listen on that interface, but would rather have it only "
21469
"listen on the Ethernet interfaces of the Local Area Network (LAN). To enable "
21470
"listening for all network interfaces for which a certain hostname is bound, "
21471
"including the Loopback, you could create a Listen entry for the hostname "
21472
"<emphasis>socrates</emphasis> as such:"
21473
msgstr ""
21474
21475
#: serverguide/C/file-server.xml:562(screen)
21476
#, no-wrap
21477
msgid ""
21478
"\n"
21479
"Listen socrates:631 # Listen on all interfaces for the hostname 'socrates'\n"
21480
msgstr ""
21481
21482
#: serverguide/C/file-server.xml:566(para)
21483
msgid ""
21484
"or by omitting the Listen directive and using <emphasis>Port</emphasis> "
21485
"instead, as in:"
21486
msgstr ""
21487
21488
#: serverguide/C/file-server.xml:568(screen)
21489
#, no-wrap
21490
msgid ""
21491
"\n"
21492
"Port 631 # Listen on port 631 on all interfaces\n"
21493
msgstr ""
21494
21495
#: serverguide/C/file-server.xml:575(para)
21496
msgid ""
21497
"For more examples of configuration directives in the CUPS server "
21498
"configuration file, view the associated system manual page by entering the "
21499
"following command at a terminal prompt:"
21500
msgstr ""
21501
21502
#: serverguide/C/file-server.xml:582(command)
21503
msgid "man cupsd.conf"
21504
msgstr ""
21505
21506
#: serverguide/C/file-server.xml:586(para)
21507
msgid ""
21508
"Whenever you make changes to the <filename>/etc/cups/cupsd.conf</filename> "
21509
"configuration file, you'll need to restart the CUPS server by typing the "
21510
"following command at a terminal prompt:"
21511
msgstr ""
21512
21513
#: serverguide/C/file-server.xml:592(command)
21514
msgid "sudo /etc/init.d/cups restart"
21515
msgstr ""
21516
21517
#: serverguide/C/file-server.xml:598(title)
21518
msgid "Web Interface"
21519
msgstr ""
21520
21521
#: serverguide/C/file-server.xml:600(para)
21522
msgid ""
21523
"CUPS can be configured and monitored using a web interface, which by default "
21524
"is available at <ulink "
21525
"url=\"http://localhost:631/admin\">http://localhost:631/admin</ulink>. The "
21526
"web interface can be used to perform all printer management tasks."
21527
msgstr ""
21528
21529
#: serverguide/C/file-server.xml:604(para)
21530
msgid ""
21531
"In order to perform administrative tasks via the web interface, you must "
21532
"either have the root account enabled on your server, or authenticate as a "
21533
"user in the <emphasis role=\"italic\">lpadmin</emphasis> group. For security "
21534
"reasons, CUPS won't authenticate a user that doesn't have a password."
21535
msgstr ""
21536
21537
#: serverguide/C/file-server.xml:607(para)
21538
msgid ""
21539
"To add a user to the <emphasis role=\"italic\">lpadmin</emphasis> group, run "
21540
"at the terminal prompt: <screen>\n"
21541
"<command>sudo usermod -aG lpadmin username</command>\n"
21542
"</screen>"
21543
msgstr ""
21544
21545
#: serverguide/C/file-server.xml:613(para)
21546
msgid ""
21547
"Further documentation is available in the <emphasis "
21548
"role=\"italic\">Documentation/Help</emphasis> tab of the web interface."
21549
msgstr ""
21550
21551
#: serverguide/C/file-server.xml:621(ulink)
21552
msgid "CUPS Website"
21553
msgstr ""
21554
21555
#: serverguide/C/file-server.xml:624(ulink)
21556
msgid "Ubuntu Wiki CUPS page"
21557
msgstr ""
21558
21559
#: serverguide/C/dns.xml:13(title)
21560
msgid "Domain Name Service (DNS)"
21561
msgstr ""
21562
21563
#: serverguide/C/dns.xml:14(para)
21564
msgid ""
21565
"Domain Name Service (DNS) is an Internet service that maps IP addresses and "
21566
"fully qualified domain names (FQDN) to one another. In this way, DNS "
21567
"alleviates the need to remember IP addresses. Computers that run DNS are "
21568
"called <emphasis>name servers</emphasis>. Ubuntu ships with "
21569
"<application>BIND</application> (Berkley Internet Naming Daemon), the most "
21570
"common program used for maintaining a name server on Linux."
21571
msgstr ""
21572
21573
#: serverguide/C/dns.xml:24(para)
21574
msgid ""
21575
"At a terminal prompt, enter the following command to install "
21576
"<application>dns</application>:"
21577
msgstr ""
21578
21579
#: serverguide/C/dns.xml:28(command)
21580
msgid "sudo apt-get install bind9"
21581
msgstr ""
21582
21583
#: serverguide/C/dns.xml:30(para)
21584
msgid ""
21585
"A very useful package for testing and troubleshooting DNS issues is the "
21586
"dnsutils package. To install <application>dnsutils</application> enter the "
21587
"following:"
21588
msgstr ""
21589
21590
#: serverguide/C/dns.xml:35(command)
21591
msgid "sudo apt-get install dnsutils"
21592
msgstr ""
21593
21594
#: serverguide/C/dns.xml:40(para)
21595
msgid ""
21596
"There a many ways to configure <application>BIND9</application>. Some of the "
21597
"most common configurations are a caching nameserver, primary master, and a "
21598
"as a secondary master."
21599
msgstr ""
21600
21601
#: serverguide/C/dns.xml:46(para)
21602
msgid ""
21603
"When configured as a caching nameserver BIND9 will find the answer to name "
21604
"queries and remember the answer when the domain is queried again."
21605
msgstr ""
21606
21607
#: serverguide/C/dns.xml:52(para)
21608
msgid ""
21609
"As a primary master server BIND9 reads the data for a zone from a file on "
21610
"it's host and is authoritative for that zone."
21611
msgstr ""
21612
21613
#: serverguide/C/dns.xml:57(para)
21614
msgid ""
21615
"In a secondary master configuration BIND9 gets the zone data from another "
21616
"nameserver authoritative for the zone."
21617
msgstr ""
21618
21619
#: serverguide/C/dns.xml:65(para)
21620
msgid ""
21621
"The DNS configuration files are stored in the <filename>/etc/bind</filename> "
21622
"directory. The primary configuration file is "
21623
"<filename>/etc/bind/named.conf</filename>."
21624
msgstr ""
21625
21626
#: serverguide/C/dns.xml:72(para)
21627
msgid ""
21628
"The <emphasis>include</emphasis> line specifies the filename which contains "
21629
"the DNS options. The <emphasis>directory</emphasis> line in the "
21630
"<filename>/etc/bind/named.conf.options</filename> file tells DNS where to "
21631
"look for files. All files BIND uses will be relative to this directory."
21632
msgstr ""
21633
21634
#: serverguide/C/dns.xml:80(para)
21635
msgid ""
21636
"The file named <filename>/etc/bind/db.root</filename> describes the root "
21637
"nameservers in the world. The servers change over time, so the "
21638
"<filename>/etc/bind/db.root</filename> file must be maintained now and then. "
21639
"This is usually done as updates to the <application>bind9</application> "
21640
"package. The <emphasis>zone</emphasis> section defines a master server, and "
21641
"it is stored in a file mentioned in the <emphasis>file</emphasis> option."
21642
msgstr ""
21643
21644
#: serverguide/C/dns.xml:90(para)
21645
msgid ""
21646
"It is possible to configure the same server to be a caching name server, "
21647
"primary master, and secondary master. A server can be the Start of Authority "
21648
"(SOA) for one zone, while providing secondary service for another zone. All "
21649
"the while providing caching services for hosts on the local LAN."
21650
msgstr ""
21651
21652
#: serverguide/C/dns.xml:98(title)
21653
msgid "Caching Nameserver"
21654
msgstr ""
21655
21656
#: serverguide/C/dns.xml:99(para)
21657
msgid ""
21658
"The default configuration is setup to act as a caching server. All that is "
21659
"required is simply adding the IP Addresses of your ISP's DNS servers. Simply "
21660
"uncomment and edit the following in "
21661
"<filename>/etc/bind/named.conf.options</filename>:"
21662
msgstr ""
21663
21664
#: serverguide/C/dns.xml:103(programlisting)
21665
#, no-wrap
21666
msgid ""
21667
"\n"
21668
"forwarders {\n"
21669
" 1.2.3.4;\n"
21670
" 5.6.7.8;\n"
21671
" };\n"
21672
msgstr ""
21673
21674
#: serverguide/C/dns.xml:110(para)
21675
msgid ""
21676
"Replace <emphasis>1.2.3.4</emphasis> and <emphasis>5.6.7.8</emphasis> with "
21677
"the IP Adresses of actual nameservers."
21678
msgstr ""
21679
21680
#: serverguide/C/dns.xml:114(para)
21681
msgid ""
21682
"Now restart the DNS server, to enable the new configuration. From a terminal "
21683
"prompt:"
21684
msgstr ""
21685
21686
#: serverguide/C/dns.xml:118(command) serverguide/C/dns.xml:194(command) serverguide/C/dns.xml:253(command) serverguide/C/dns.xml:312(command) serverguide/C/dns.xml:561(command)
21687
msgid "sudo /etc/init.d/bind9 restart"
21688
msgstr ""
21689
21690
#: serverguide/C/dns.xml:120(para)
21691
msgid ""
21692
"See <xref linkend=\"dns-testing-dig\"/> for information on testing a caching "
21693
"DNS server."
21694
msgstr ""
21695
21696
#: serverguide/C/dns.xml:125(title)
21697
msgid "Primary Master"
21698
msgstr ""
21699
21700
#: serverguide/C/dns.xml:126(para)
21701
msgid ""
21702
"In this section <application>BIND9</application> will be configured as the "
21703
"Primary Master for the domain <emphasis>example.com</emphasis>. Simply "
21704
"replace <emphasis role=\"italic\">example.com</emphasis> with your FQDN "
21705
"(Fully Qualified Domain Name)."
21706
msgstr ""
21707
21708
#: serverguide/C/dns.xml:132(title)
21709
msgid "Forward Zone File"
21710
msgstr ""
21711
21712
#: serverguide/C/dns.xml:133(para)
21713
msgid ""
21714
"To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the "
21715
"first step is to edit <filename>/etc/bind/named.conf.local</filename>:"
21716
msgstr ""
21717
21718
#: serverguide/C/dns.xml:137(programlisting)
21719
#, no-wrap
21720
msgid ""
21721
"\n"
21722
"zone \"example.com\" {\n"
21723
"\ttype master;\n"
21724
" file \"/etc/bind/db.example.com\";\n"
21725
"};\n"
21726
msgstr ""
21727
21728
#: serverguide/C/dns.xml:143(para)
21729
msgid ""
21730
"Now use an existing zone file as a template to create the "
21731
"<filename>/etc/bind/db.example.com</filename> file:"
21732
msgstr ""
21733
21734
#: serverguide/C/dns.xml:147(command)
21735
msgid "sudo cp /etc/bind/db.local /etc/bind/db.example.com"
21736
msgstr ""
21737
21738
#: serverguide/C/dns.xml:149(para)
21739
msgid ""
21740
"Edit the new zone file <filename>/etc/bind/db.example.com</filename> change "
21741
"<emphasis>localhost.</emphasis> to the FQDN of your server, leaving the "
21742
"additional \".\" at the end. Change <emphasis>127.0.0.1</emphasis> to the "
21743
"nameserver's IP Address and <emphasis>root.localhost</emphasis> to a valid "
21744
"email address, but with a \".\" instead of the usual \"@\" symbol, again "
21745
"leaving the \".\" at the end."
21746
msgstr ""
21747
21748
#: serverguide/C/dns.xml:155(para)
21749
msgid ""
21750
"Also, create an <emphasis>A record</emphasis> for <emphasis "
21751
"role=\"italic\">ns.example.com</emphasis>. The name server in this example:"
21752
msgstr ""
21753
21754
#: serverguide/C/dns.xml:159(programlisting)
21755
#, no-wrap
21756
msgid ""
21757
"\n"
21758
";\n"
21759
"; BIND data file for local loopback interface\n"
21760
";\n"
21761
"$TTL 604800\n"
21762
"@ IN SOA ns.example.com. root.example.com. (\n"
21763
" 2 ; Serial\n"
21764
" 604800 ; Refresh\n"
21765
" 86400 ; Retry\n"
21766
" 2419200 ; Expire\n"
21767
" 604800 ) ; Negative Cache TTL\n"
21768
";\n"
21769
"@ IN NS ns.example.com.\n"
21770
"@ IN A 127.0.0.1\n"
21771
"@ IN AAAA ::1\n"
21772
"ns IN A 192.168.1.10\n"
21773
msgstr ""
21774
21775
#: serverguide/C/dns.xml:176(para)
21776
msgid ""
21777
"You must increment the <emphasis>Serial Number</emphasis> every time you "
21778
"make changes to the zone file. If you make multiple changes before "
21779
"restarting BIND9, simply increment the Serial once."
21780
msgstr ""
21781
21782
#: serverguide/C/dns.xml:180(para)
21783
msgid ""
21784
"Now, you can add DNS records to the bottom of the zone file. See <xref "
21785
"linkend=\"dns-record-types\"/> for details."
21786
msgstr ""
21787
21788
#: serverguide/C/dns.xml:184(para)
21789
msgid ""
21790
"Many admins like to use the last date edited as the serial of a zone, such "
21791
"as <emphasis>2007010100</emphasis> which is yyyymmddss (where "
21792
"<emphasis>ss</emphasis> is the Serial Number)"
21793
msgstr ""
21794
21795
#: serverguide/C/dns.xml:189(para)
21796
msgid ""
21797
"Once you have made a change to the zone file "
21798
"<application>BIND9</application> will need to be restarted for the changes "
21799
"to take effect:"
21800
msgstr ""
21801
21802
#: serverguide/C/dns.xml:198(title)
21803
msgid "Reverse Zone File"
21804
msgstr ""
21805
21806
#: serverguide/C/dns.xml:199(para)
21807
msgid ""
21808
"Now that the zone is setup and resolving names to IP Adresses a "
21809
"<emphasis>Reverse zone</emphasis> is also required. A Reverse zone allows "
21810
"DNS to resolve an address to a name."
21811
msgstr ""
21812
21813
#: serverguide/C/dns.xml:203(para)
21814
msgid "Edit /etc/bind/named.conf.local and add the following:"
21815
msgstr ""
21816
21817
#: serverguide/C/dns.xml:206(programlisting)
21818
#, no-wrap
21819
msgid ""
21820
"\n"
21821
"zone \"1.168.192.in-addr.arpa\" {\n"
21822
" type master;\n"
21823
" notify no;\n"
21824
" file \"/etc/bind/db.192\";\n"
21825
"};\n"
21826
msgstr ""
21827
21828
#: serverguide/C/dns.xml:214(para)
21829
msgid ""
21830
"Replace <emphasis>1.168.192</emphasis> with the first three octets of "
21831
"whatever network you are using. Also, name the zone file "
21832
"<filename>/etc/bind/db.192</filename> appropriately. It should match the "
21833
"first octet of your network."
21834
msgstr ""
21835
21836
#: serverguide/C/dns.xml:219(para)
21837
msgid "Now create the <filename>/etc/bind/db.192</filename> file:"
21838
msgstr ""
21839
21840
#: serverguide/C/dns.xml:223(command)
21841
msgid "sudo cp /etc/bind/db.127 /etc/bind/db.192"
21842
msgstr ""
21843
21844
#: serverguide/C/dns.xml:225(para)
21845
msgid ""
21846
"Next edit <filename>/etc/bind/db.192</filename> changing the basically the "
21847
"same options as <filename>/etc/bind/db.example.com</filename>:"
21848
msgstr ""
21849
21850
#: serverguide/C/dns.xml:229(programlisting)
21851
#, no-wrap
21852
msgid ""
21853
"\n"
21854
";\n"
21855
"; BIND reverse data file for local loopback interface\n"
21856
";\n"
21857
"$TTL 604800\n"
21858
"@ IN SOA ns.example.com. root.example.com. (\n"
21859
" 2 ; Serial\n"
21860
" 604800 ; Refresh\n"
21861
" 86400 ; Retry\n"
21862
" 2419200 ; Expire\n"
21863
" 604800 ) ; Negative Cache TTL\n"
21864
";\n"
21865
"@ IN NS ns.\n"
21866
"10 IN PTR ns.example.com.\n"
21867
msgstr ""
21868
21869
#: serverguide/C/dns.xml:244(para)
21870
msgid ""
21871
"The <emphasis>Serial Number</emphasis> in the Reverse zone needs to be "
21872
"incremented on each changes as well. For each <emphasis>A record</emphasis> "
21873
"you configure in <filename>/etc/bind/db.example.com</filename> you need to "
21874
"create a <emphasis>PTR record</emphasis> in "
21875
"<filename>/etc/bind/db.192</filename>."
21876
msgstr ""
21877
21878
#: serverguide/C/dns.xml:249(para)
21879
msgid ""
21880
"After creating the reverse zone file restart "
21881
"<application>BIND9</application>:"
21882
msgstr ""
21883
21884
#: serverguide/C/dns.xml:258(title)
21885
msgid "Secondary Master"
21886
msgstr ""
21887
21888
#: serverguide/C/dns.xml:259(para)
21889
msgid ""
21890
"Once a <emphasis>Primary Master</emphasis> has been configured a "
21891
"<emphasis>Secondary Master</emphasis> is needed in order to maintain the "
21892
"availability of the domain should the Primary become unavailable."
21893
msgstr ""
21894
21895
#: serverguide/C/dns.xml:263(para)
21896
msgid ""
21897
"First, on the Primary Master server, the zone transfer needs to be allowed. "
21898
"Add the <emphasis>allow-transfer</emphasis> option to the example Forward "
21899
"and Reverse zone definitions in "
21900
"<filename>/etc/bind/named.conf.local</filename>:"
21901
msgstr ""
21902
21903
#: serverguide/C/dns.xml:267(programlisting)
21904
#, no-wrap
21905
msgid ""
21906
"\n"
21907
"zone \"example.com\" {\n"
21908
" type master;\n"
21909
"\tfile \"/etc/bind/db.example.com\";\n"
21910
" allow-transfer { 192.168.1.11; };\n"
21911
"};\n"
21912
"\n"
21913
"zone \"1.168.192.in-addr.arpa\" {\n"
21914
" type master;\n"
21915
" notify no;\n"
21916
" file \"/etc/bind/db.192\";\n"
21917
"\tallow-transfer { 192.168.1.11; };\n"
21918
"};\n"
21919
msgstr ""
21920
21921
#: serverguide/C/dns.xml:282(para)
21922
msgid ""
21923
"Replace <emphasis>192.168.1.11</emphasis> with the IP Address of your "
21924
"Secondary nameserver."
21925
msgstr ""
21926
21927
#: serverguide/C/dns.xml:286(para)
21928
msgid ""
21929
"Next, on the Secondary Master, install the <application>bind9</application> "
21930
"package the same way as on the Primary. Then edit the "
21931
"<filename>/etc/bind/named.conf.local</filename> and add the following "
21932
"declarations for the Forward and Reverse zones:"
21933
msgstr ""
21934
21935
#: serverguide/C/dns.xml:290(programlisting)
21936
#, no-wrap
21937
msgid ""
21938
"\n"
21939
"zone \"example.com\" {\n"
21940
"\ttype slave;\n"
21941
" file \"/var/cache/bind/db.example.com\";\n"
21942
" masters { 192.168.1.10; };\n"
21943
"}; \n"
21944
" \n"
21945
"zone \"1.168.192.in-addr.arpa\" {\n"
21946
"\ttype slave;\n"
21947
" file \"/var/cache/bind/db.192\";\n"
21948
" masters { 192.168.1.10; };\n"
21949
"};\n"
21950
msgstr ""
21951
21952
#: serverguide/C/dns.xml:304(para)
21953
msgid ""
21954
"Replace <emphasis>192.168.1.10</emphasis> with the IP Address of your "
21955
"Primary nameserver."
21956
msgstr ""
21957
21958
#: serverguide/C/dns.xml:308(para)
21959
msgid "Restart <application>BIND9</application> on the Secondary Master:"
21960
msgstr ""
21961
21962
#: serverguide/C/dns.xml:314(para)
21963
msgid ""
21964
"In <filename>/var/log/syslog</filename> you should see something similar to:"
21965
msgstr ""
21966
21967
#: serverguide/C/dns.xml:317(programlisting)
21968
#, no-wrap
21969
msgid ""
21970
"\n"
21971
"slave zone \"example.com\" (IN) loaded (serial 6)\n"
21972
"slave zone \"100.18.172.in-addr.arpa\" (IN) loaded (serial 3)\n"
21973
msgstr ""
21974
21975
#: serverguide/C/dns.xml:322(para)
21976
msgid ""
21977
"Note: A zone is only transferred if the <emphasis>Serial Number</emphasis> "
21978
"on the Primary is larger than the one on the Secondary."
21979
msgstr ""
21980
21981
#: serverguide/C/dns.xml:328(para)
21982
msgid ""
21983
"The default directory for non-authoritative zone files is "
21984
"<filename>/var/cache/bind/</filename>. This directory is also configured in "
21985
"<application>AppArmor</application> to allow the "
21986
"<application>named</application> daemon to write to. For more information on "
21987
"AppArmor see <xref linkend=\"apparmor\"/>."
21988
msgstr ""
21989
21990
#: serverguide/C/dns.xml:339(para)
21991
msgid ""
21992
"This section covers ways to help determine the cause when problems happen "
21993
"with DNS and <application>BIND9</application>."
21994
msgstr ""
21995
21996
#: serverguide/C/dns.xml:345(title)
21997
msgid "resolv.conf"
21998
msgstr ""
21999
22000
#: serverguide/C/dns.xml:346(para)
22001
msgid ""
22002
"The first step in testing <application>BIND9</application> is to add the "
22003
"nameserver's IP Address to a hosts resolver. The Primary nameserver should "
22004
"be configured as well as another host to double check things. Simply edit "
22005
"<filename>/etc/resolv.conf</filename> and add the following:"
22006
msgstr ""
22007
22008
#: serverguide/C/dns.xml:351(programlisting)
22009
#, no-wrap
22010
msgid ""
22011
"\n"
22012
"nameserver\t192.168.1.10\n"
22013
"nameserver\t192.168.1.11\n"
22014
msgstr ""
22015
22016
#: serverguide/C/dns.xml:356(para)
22017
msgid ""
22018
"You should also add the IP Address of the Secondary nameserver in case the "
22019
"Primary becomes unavailable."
22020
msgstr ""
22021
22022
#: serverguide/C/dns.xml:362(title)
22023
msgid "dig"
22024
msgstr ""
22025
22026
#: serverguide/C/dns.xml:363(para)
22027
msgid ""
22028
"If you installed the <application>dnsutils</application> package you can "
22029
"test your setup using the DNS lookup utility <application>dig</application>:"
22030
msgstr ""
22031
22032
#: serverguide/C/dns.xml:369(para)
22033
msgid ""
22034
"After installing <application>BIND9</application> use "
22035
"<application>dig</application> against the loopback interface to make sure "
22036
"it is listening on port 53. From a terminal prompt:"
22037
msgstr ""
22038
22039
#: serverguide/C/dns.xml:374(command)
22040
msgid "dig -x 127.0.0.1"
22041
msgstr ""
22042
22043
#: serverguide/C/dns.xml:376(para)
22044
msgid "You should see lines similar to the following in the command output:"
22045
msgstr ""
22046
22047
#: serverguide/C/dns.xml:379(programlisting)
22048
#, no-wrap
22049
msgid ""
22050
"\n"
22051
";; Query time: 1 msec\n"
22052
";; SERVER: 192.168.1.10#53(192.168.1.10)\n"
22053
msgstr ""
22054
22055
#: serverguide/C/dns.xml:385(para)
22056
msgid ""
22057
"If you have configured <application>BIND9</application> as a "
22058
"<emphasis>Caching</emphasis> nameserver \"dig\" an outside domain to check "
22059
"the query time:"
22060
msgstr ""
22061
22062
#: serverguide/C/dns.xml:390(command)
22063
msgid "dig ubuntu.com"
22064
msgstr ""
22065
22066
#: serverguide/C/dns.xml:392(para)
22067
msgid "Note the query time toward the end of the command output:"
22068
msgstr ""
22069
22070
#: serverguide/C/dns.xml:395(programlisting)
22071
#, no-wrap
22072
msgid ""
22073
"\n"
22074
";; Query time: 49 msec\n"
22075
msgstr ""
22076
22077
#: serverguide/C/dns.xml:398(para)
22078
msgid "After a second dig there should be improvement:"
22079
msgstr ""
22080
22081
#: serverguide/C/dns.xml:401(programlisting)
22082
#, no-wrap
22083
msgid ""
22084
"\n"
22085
";; Query time: 1 msec\n"
22086
msgstr ""
22087
22088
#: serverguide/C/dns.xml:408(title)
22089
msgid "ping"
22090
msgstr ""
22091
22092
#: serverguide/C/dns.xml:410(para)
22093
msgid ""
22094
"Now to demonstrate how applications make use of DNS to resolve a host name "
22095
"use the <application>ping</application> utility to send an ICMP echo "
22096
"request. From a terminal prompt enter:"
22097
msgstr ""
22098
22099
#: serverguide/C/dns.xml:416(command)
22100
msgid "ping example.com"
22101
msgstr ""
22102
22103
#: serverguide/C/dns.xml:418(para)
22104
msgid ""
22105
"This tests if the nameserver can resolve the name "
22106
"<emphasis>ns.example.com</emphasis> to an IP Address. The command output "
22107
"should resemble:"
22108
msgstr ""
22109
22110
#: serverguide/C/dns.xml:422(programlisting)
22111
#, no-wrap
22112
msgid ""
22113
"\n"
22114
"PING ns.example.com (192.168.1.10) 56(84) bytes of data.\n"
22115
"64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms\n"
22116
"64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms\n"
22117
msgstr ""
22118
22119
#: serverguide/C/dns.xml:429(title)
22120
msgid "named-checkzone"
22121
msgstr ""
22122
22123
#: serverguide/C/dns.xml:430(para)
22124
msgid ""
22125
"A great way to test your zone files is by using the <application>named-"
22126
"checkzone</application> utility installed with the "
22127
"<application>bind9</application> package. This utility allows you to make "
22128
"sure the configuration is correct before restarting "
22129
"<application>BIND9</application> and making the changes live."
22130
msgstr ""
22131
22132
#: serverguide/C/dns.xml:437(para)
22133
msgid ""
22134
"To test our example Forward zone file enter the following from a command "
22135
"prompt:"
22136
msgstr ""
22137
22138
#: serverguide/C/dns.xml:441(command)
22139
msgid "named-checkzone example.com /etc/bind/db.example.com"
22140
msgstr ""
22141
22142
#: serverguide/C/dns.xml:443(para)
22143
msgid ""
22144
"If everything is configured correctly you should see output similar to:"
22145
msgstr ""
22146
22147
#: serverguide/C/dns.xml:446(programlisting)
22148
#, no-wrap
22149
msgid ""
22150
"\n"
22151
"zone example.com/IN: loaded serial 6\n"
22152
"OK\n"
22153
msgstr ""
22154
22155
#: serverguide/C/dns.xml:452(para)
22156
msgid "Similarly, to test the Reverse zone file enter the following:"
22157
msgstr ""
22158
22159
#: serverguide/C/dns.xml:456(command)
22160
msgid "named-checkzone example.com /etc/bind/db.192"
22161
msgstr ""
22162
22163
#: serverguide/C/dns.xml:458(para)
22164
msgid "The output should be similar to:"
22165
msgstr ""
22166
22167
#: serverguide/C/dns.xml:461(programlisting)
22168
#, no-wrap
22169
msgid ""
22170
"\n"
22171
"zone example.com/IN: loaded serial 3\n"
22172
"OK\n"
22173
msgstr ""
22174
22175
#: serverguide/C/dns.xml:468(para)
22176
msgid ""
22177
"The <emphasis>Serial Number</emphasis> of your zone file will probably be "
22178
"different."
22179
msgstr ""
22180
22181
#: serverguide/C/dns.xml:475(title)
22182
msgid "Logging"
22183
msgstr ""
22184
22185
#: serverguide/C/dns.xml:476(para)
22186
msgid ""
22187
"<application>BIND9</application> has a wide variety of logging configuration "
22188
"options available. There are two main options. The "
22189
"<emphasis>channel</emphasis> option configures where logs go, and the "
22190
"<emphasis>category</emphasis> option determines what information to log."
22191
msgstr ""
22192
22193
#: serverguide/C/dns.xml:480(para)
22194
msgid "If no logging option is configured the default option is:"
22195
msgstr ""
22196
22197
#: serverguide/C/dns.xml:483(programlisting)
22198
#, no-wrap
22199
msgid ""
22200
"\n"
22201
"logging {\n"
22202
" category default { default_syslog; default_debug; };\n"
22203
" category unmatched { null; };\n"
22204
"};\n"
22205
msgstr ""
22206
22207
#: serverguide/C/dns.xml:489(para)
22208
msgid ""
22209
"This section covers configuring <application>BIND9</application> to send "
22210
"<emphasis>debug</emphasis> messages related to DNS queries to a separate "
22211
"file."
22212
msgstr ""
22213
22214
#: serverguide/C/dns.xml:494(para)
22215
msgid ""
22216
"First, we need to configure a channel to specify which file to send the "
22217
"messages to. Edit <filename>/etc/bind/named.conf.local</filename> and add "
22218
"the following:"
22219
msgstr ""
22220
22221
#: serverguide/C/dns.xml:498(programlisting)
22222
#, no-wrap
22223
msgid ""
22224
"\n"
22225
"logging {\n"
22226
" channel query.log { \n"
22227
" file \"/var/log/query.log\";\n"
22228
" severity debug 3; \n"
22229
" }; \n"
22230
"};\n"
22231
msgstr ""
22232
22233
#: serverguide/C/dns.xml:508(para)
22234
msgid "Next, configure a category to send all DNS queries to the query file:"
22235
msgstr ""
22236
22237
#: serverguide/C/dns.xml:511(programlisting)
22238
#, no-wrap
22239
msgid ""
22240
"\n"
22241
"logging {\n"
22242
" channel query.log { \n"
22243
" file \"/var/log/query.log\"; \n"
22244
" severity debug 3; \n"
22245
" }; \n"
22246
" <emphasis>category queries { query.log; };</emphasis> \n"
22247
"};\n"
22248
msgstr ""
22249
22250
#: serverguide/C/dns.xml:523(para)
22251
msgid ""
22252
"Note: the <emphasis>debug</emphasis> option can be set from 1 to 3. If a "
22253
"level isn't specified level 1 is the default."
22254
msgstr ""
22255
22256
#: serverguide/C/dns.xml:529(para)
22257
msgid ""
22258
"Since the <emphasis>named daemon</emphasis> runs as the "
22259
"<emphasis>bind</emphasis> user the <filename>/var/log/query.log</filename> "
22260
"file must be created and the ownership changed:"
22261
msgstr ""
22262
22263
#: serverguide/C/dns.xml:534(command)
22264
msgid "sudo touch /var/log/query.log"
22265
msgstr ""
22266
22267
#: serverguide/C/dns.xml:535(command)
22268
msgid "sudo chown bind /var/log/query.log"
22269
msgstr ""
22270
22271
#: serverguide/C/dns.xml:539(para)
22272
msgid ""
22273
"Before <application>named</application> daemon can write to the new log file "
22274
"the <application>AppArmor</application> profile must be updated. First, edit "
22275
"<filename>/etc/apparmor.d/usr.sbin.named</filename> and add:"
22276
msgstr ""
22277
22278
#: serverguide/C/dns.xml:543(programlisting)
22279
#, no-wrap
22280
msgid ""
22281
"\n"
22282
"/var/log/query.log w,\n"
22283
msgstr ""
22284
22285
#: serverguide/C/dns.xml:546(para)
22286
msgid "Next, reload the profile:"
22287
msgstr ""
22288
22289
#: serverguide/C/dns.xml:550(command)
22290
msgid "cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r"
22291
msgstr ""
22292
22293
#: serverguide/C/dns.xml:552(para)
22294
msgid ""
22295
"For more information on <application>AppArmor</application> see <xref "
22296
"linkend=\"apparmor\"/>"
22297
msgstr ""
22298
22299
#: serverguide/C/dns.xml:557(para)
22300
msgid ""
22301
"Now restart <application>BIND9</application> for the changes to take effect:"
22302
msgstr ""
22303
22304
#: serverguide/C/dns.xml:565(para)
22305
msgid ""
22306
"You should see the file <filename>/var/log/query.log</filename> fill with "
22307
"query information. This is a simple example of the "
22308
"<application>BIND9</application> logging options. For coverage of advanced "
22309
"options see <xref linkend=\"dns-more-info\"/>."
22310
msgstr ""
22311
22312
#: serverguide/C/dns.xml:574(title)
22313
msgid "Common Record Types"
22314
msgstr ""
22315
22316
#: serverguide/C/dns.xml:575(para)
22317
msgid "This section covers some of the most common DNS record types."
22318
msgstr ""
22319
22320
#: serverguide/C/dns.xml:580(para)
22321
msgid ""
22322
"<emphasis>A</emphasis> record: This record maps an IP Address to a hostname."
22323
msgstr ""
22324
22325
#: serverguide/C/dns.xml:583(programlisting)
22326
#, no-wrap
22327
msgid ""
22328
"\n"
22329
"www IN A 192.168.1.12\n"
22330
msgstr ""
22331
22332
#: serverguide/C/dns.xml:588(para)
22333
msgid ""
22334
"<emphasis>CNAME</emphasis> record: Used to create an alias to an existing A "
22335
"record. You cannot create a CNAME record pointing to another CNAME record."
22336
msgstr ""
22337
22338
#: serverguide/C/dns.xml:591(programlisting)
22339
#, no-wrap
22340
msgid ""
22341
"\n"
22342
"web IN CNAME www\n"
22343
msgstr ""
22344
22345
#: serverguide/C/dns.xml:596(para)
22346
msgid ""
22347
"<emphasis>MX</emphasis> record: Used to define where email should be sent "
22348
"to. Must point to an A record, not a CNAME."
22349
msgstr ""
22350
22351
#: serverguide/C/dns.xml:599(programlisting)
22352
#, no-wrap
22353
msgid ""
22354
"\n"
22355
" IN MX 1 mail.example.com.\n"
22356
"mail IN A 192.168.1.13\n"
22357
msgstr ""
22358
22359
#: serverguide/C/dns.xml:605(para)
22360
msgid ""
22361
"<emphasis>NS</emphasis> record: Used to define which servers serve copies of "
22362
"a zone. It must point to an A record, not a CNAME. This is where Primary and "
22363
"Secondary servers are defined."
22364
msgstr ""
22365
22366
#: serverguide/C/dns.xml:609(programlisting)
22367
#, no-wrap
22368
msgid ""
22369
"\n"
22370
" IN NS ns.example.com.\n"
22371
"\tIN NS ns2.example.com.\n"
22372
"ns IN A 192.168.1.10\n"
22373
"ns2\tIN A\t 192.168.1.11\n"
22374
msgstr ""
22375
22376
#: serverguide/C/dns.xml:622(para)
22377
msgid ""
22378
"The <ulink url=\"http://www.tldp.org/HOWTO/DNS-HOWTO.html\">DNS "
22379
"HOWTO</ulink> explains more advanced options for configuring BIND9."
22380
msgstr ""
22381
22382
#: serverguide/C/dns.xml:627(para)
22383
msgid ""
22384
"For in depth coverage of <emphasis>DNS</emphasis> and "
22385
"<application>BIND9</application> see <ulink "
22386
"url=\"http://www.bind9.net/\">Bind9.net</ulink>."
22387
msgstr ""
22388
22389
#: serverguide/C/dns.xml:632(para)
22390
msgid ""
22391
"<ulink url=\"http://www.oreilly.com/catalog/dns5/index.html\">DNS and "
22392
"BIND</ulink> is a popular book now in it's fifth edition."
22393
msgstr ""
22394
22395
#: serverguide/C/dns.xml:637(para)
22396
msgid ""
22397
"A great place to ask for <application>BIND9</application> assistance, and "
22398
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
22399
"server</emphasis> IRC channel on <ulink "
22400
"url=\"http://freenode.net\">freenode</ulink>."
22401
msgstr ""
22402
22403
#: serverguide/C/dns.xml:643(para)
22404
msgid ""
22405
"Also, see the <ulink "
22406
"url=\"https://help.ubuntu.com/community/BIND9ServerHowto\">BIND9 Server "
22407
"HOWTO</ulink> in the Ubuntu Wiki."
22408
msgstr ""
22409
22410
#: serverguide/C/databases.xml:13(title)
22411
msgid "Databases"
22412
msgstr ""
22413
22414
#: serverguide/C/databases.xml:14(para)
22415
msgid "Ubuntu provides two popular database servers. They are:"
22416
msgstr ""
22417
22418
#: serverguide/C/databases.xml:22(application) serverguide/C/databases.xml:157(title)
22419
msgid "PostgreSQL"
22420
msgstr ""
22421
22422
#: serverguide/C/databases.xml:25(para)
22423
msgid ""
22424
"They are available in the main repository. This section explains how to "
22425
"install and configure these database servers."
22426
msgstr ""
22427
22428
#: serverguide/C/databases.xml:32(para)
22429
msgid ""
22430
"MySQL is a fast, multi-threaded, multi-user, and robust SQL database server. "
22431
"It is intended for mission-critical, heavy-load production systems as well "
22432
"as for embedding into mass-deployed software."
22433
msgstr ""
22434
22435
#: serverguide/C/databases.xml:41(para)
22436
msgid "To install MySQL, run the following command from a terminal prompt:"
22437
msgstr ""
22438
22439
#: serverguide/C/databases.xml:46(command)
22440
msgid "sudo apt-get install mysql-server"
22441
msgstr ""
22442
22443
#: serverguide/C/databases.xml:48(para)
22444
msgid ""
22445
"During the installation process you will be prompted to enter a password for "
22446
"the <application>MySQL</application> root user."
22447
msgstr ""
22448
22449
#: serverguide/C/databases.xml:53(para)
22450
msgid ""
22451
"Once the installation is complete, the MySQL server should be started "
22452
"automatically. You can run the following command from a terminal prompt to "
22453
"check whether the MySQL server is running:"
22454
msgstr ""
22455
22456
#: serverguide/C/databases.xml:61(command)
22457
msgid "sudo netstat -tap | grep mysql"
22458
msgstr ""
22459
22460
#: serverguide/C/databases.xml:70(programlisting)
22461
#, no-wrap
22462
msgid ""
22463
"\n"
22464
"tcp 0 0 localhost:mysql *:* LISTEN "
22465
" 2556/mysqld\n"
22466
msgstr ""
22467
22468
#: serverguide/C/databases.xml:74(para)
22469
msgid ""
22470
"If the server is not running correctly, you can type the following command "
22471
"to start it:"
22472
msgstr ""
22473
22474
#: serverguide/C/databases.xml:79(command) serverguide/C/databases.xml:104(command)
22475
msgid "sudo /etc/init.d/mysql restart"
22476
msgstr ""
22477
22478
#: serverguide/C/databases.xml:85(para)
22479
msgid ""
22480
"You can edit the <filename>/etc/mysql/my.cnf</filename> file to configure "
22481
"the basic settings -- log file, port number, etc. For example, to configure "
22482
"<application>MySQL</application> to listen for connections from network "
22483
"hosts, change the <emphasis>bind-address</emphasis> directive to the "
22484
"server's IP address:"
22485
msgstr ""
22486
22487
#: serverguide/C/databases.xml:91(programlisting)
22488
#, no-wrap
22489
msgid ""
22490
"\n"
22491
"bind-address = 192.168.0.5\n"
22492
msgstr ""
22493
22494
#: serverguide/C/databases.xml:95(para)
22495
msgid "Replace 192.168.0.5 with the appropriate address."
22496
msgstr ""
22497
22498
#: serverguide/C/databases.xml:99(para)
22499
msgid ""
22500
"After making a change to <filename>/etc/mysql/my.cnf</filename> the "
22501
"<application>mysql</application> daemon will need to be restarted:"
22502
msgstr ""
22503
22504
#: serverguide/C/databases.xml:107(para)
22505
msgid ""
22506
"If you would like to change the "
22507
"<application>MySQL</application><emphasis>root</emphasis> password, in a "
22508
"terminal enter:"
22509
msgstr ""
22510
22511
#: serverguide/C/databases.xml:113(command)
22512
msgid "sudo dpkg-reconfigure mysql-server-5.1"
22513
msgstr ""
22514
22515
#: serverguide/C/databases.xml:116(para)
22516
msgid ""
22517
"The <application>mysql</application> daemon will be stopped, and you will be "
22518
"prompted to enter a new password."
22519
msgstr ""
22520
22521
#: serverguide/C/databases.xml:125(para)
22522
msgid ""
22523
"See the <ulink url=\"http://www.mysql.com/\">MySQL Home Page</ulink> for "
22524
"more information."
22525
msgstr ""
22526
22527
#: serverguide/C/databases.xml:130(para)
22528
msgid ""
22529
"The <emphasis>MySQL Handbook</emphasis> is also available in the "
22530
"<application>mysql-doc-5.0</application> package. To install the package "
22531
"enter the following in a terminal:"
22532
msgstr ""
22533
22534
#: serverguide/C/databases.xml:135(command)
22535
msgid "sudo apt-get install mysql-doc-5.0"
22536
msgstr ""
22537
22538
#: serverguide/C/databases.xml:137(para)
22539
msgid ""
22540
"The documentation is in HTML format, to view them enter "
22541
"<command>file:///usr/share/doc/mysql-doc-5.0/refman-5.0-en.html-"
22542
"chapter/index.html</command> in your browser's address bar."
22543
msgstr ""
22544
22545
#: serverguide/C/databases.xml:143(para) serverguide/C/databases.xml:290(para)
22546
msgid ""
22547
"For general SQL information see <ulink "
22548
"url=\"http://www.informit.com/store/product.aspx?isbn=0768664128\">Using SQL "
22549
"Special Edition</ulink> by Rafe Colburn."
22550
msgstr ""
22551
22552
#: serverguide/C/databases.xml:149(para)
22553
msgid ""
22554
"The <ulink url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache "
22555
"MySQL PHP Ubuntu Wiki</ulink> page also has useful information."
22556
msgstr ""
22557
22558
#: serverguide/C/databases.xml:158(para)
22559
msgid ""
22560
"PostgreSQL is an object-relational database system that has the features of "
22561
"traditional commercial database systems with enhancements to be found in "
22562
"next-generation DBMS systems."
22563
msgstr ""
22564
22565
#: serverguide/C/databases.xml:165(para)
22566
msgid ""
22567
"To install PostgreSQL, run the following command in the command prompt:"
22568
msgstr ""
22569
22570
#: serverguide/C/databases.xml:172(command)
22571
msgid "sudo apt-get install postgresql"
22572
msgstr ""
22573
22574
#: serverguide/C/databases.xml:176(para)
22575
msgid ""
22576
"Once the installation is complete, you should configure the PostgreSQL "
22577
"server based on your needs, although the default configuration is viable."
22578
msgstr ""
22579
22580
#: serverguide/C/databases.xml:184(para)
22581
msgid ""
22582
"By default, connection via TCP/IP is disabled. PostgreSQL supports multiple "
22583
"client authentication methods. By default, IDENT authentication method is "
22584
"used for <application>postgres</application> and local users. Please refer "
22585
"<ulink url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the "
22586
"PostgreSQL Administrator's Guide</ulink>."
22587
msgstr ""
22588
22589
#: serverguide/C/databases.xml:191(para)
22590
msgid ""
22591
"The following discussion assumes that you wish to enable TCP/IP connections "
22592
"and use the MD5 method for client authentication. PostgreSQL configuration "
22593
"files are stored in the "
22594
"<filename>/etc/postgresql/<version>/main</filename> directory. For "
22595
"example, if you install PostgreSQL 8.4, the configuration files are stored "
22596
"in the <filename>/etc/postgresql/8.4/main</filename> directory."
22597
msgstr ""
22598
22599
#: serverguide/C/databases.xml:201(para)
22600
msgid ""
22601
"To configure <emphasis>ident</emphasis> authentication, add entries to the "
22602
"<filename>/etc/postgresql/8.4/main/pg_ident.conf</filename> file."
22603
msgstr ""
22604
22605
#: serverguide/C/databases.xml:208(para)
22606
msgid ""
22607
"To enable TCP/IP connections, edit the file "
22608
"<filename>/etc/postgresql/8.4/main/postgresql.conf</filename>"
22609
msgstr ""
22610
22611
#: serverguide/C/databases.xml:210(para)
22612
msgid ""
22613
"Locate the line <emphasis>#listen_addresses = 'localhost'</emphasis> and "
22614
"change it to:"
22615
msgstr ""
22616
22617
#: serverguide/C/databases.xml:213(programlisting)
22618
#, no-wrap
22619
msgid ""
22620
"\n"
22621
"listen_addresses = 'localhost'\n"
22622
msgstr ""
22623
22624
#: serverguide/C/databases.xml:217(para)
22625
msgid ""
22626
"To allow other computers to connect to your "
22627
"<application>PostgreSQL</application> server replace 'localhost' with the "
22628
"<emphasis>IP Address</emphasis> of your server."
22629
msgstr ""
22630
22631
#: serverguide/C/databases.xml:222(para)
22632
msgid ""
22633
"You may also edit all other parameters, if you know what you are doing! For "
22634
"details, refer to the configuration file or to the PostgreSQL documentation."
22635
msgstr ""
22636
22637
#: serverguide/C/databases.xml:227(para)
22638
msgid ""
22639
"Now that we can connect to our <application>PostgreSQL</application> server, "
22640
"the next step is to set a password for the <emphasis>postgres</emphasis> "
22641
"user. Run the following command at a terminal prompt to connect to the "
22642
"default PostgreSQL template database:"
22643
msgstr ""
22644
22645
#: serverguide/C/databases.xml:234(command)
22646
msgid "sudo -u postgres psql template1"
22647
msgstr ""
22648
22649
#: serverguide/C/databases.xml:236(para)
22650
msgid ""
22651
"The above command connects to PostgreSQL database "
22652
"<emphasis>template1</emphasis> as user <emphasis>postgres</emphasis>. Once "
22653
"you connect to the PostgreSQL server, you will be at a SQL prompt. You can "
22654
"run the following SQL command at the <application>psql</application> prompt "
22655
"to configure the password for the user <emphasis "
22656
"role=\"italics\">postgres</emphasis>."
22657
msgstr ""
22658
22659
#: serverguide/C/databases.xml:244(command)
22660
msgid "ALTER USER postgres with encrypted password 'your_password';"
22661
msgstr ""
22662
22663
#: serverguide/C/databases.xml:246(para)
22664
msgid ""
22665
"After configuring the password, edit the file "
22666
"<filename>/etc/postgresql/8.4/main/pg_hba.conf</filename> to use "
22667
"<emphasis>MD5</emphasis> authentication with the "
22668
"<emphasis>postgres</emphasis> user:"
22669
msgstr ""
22670
22671
#: serverguide/C/databases.xml:252(programlisting)
22672
#, no-wrap
22673
msgid ""
22674
"\n"
22675
"local all postgres md5\n"
22676
msgstr ""
22677
22678
#: serverguide/C/databases.xml:256(para)
22679
msgid ""
22680
"Finally, you should restart the <application>PostgreSQL</application> "
22681
"service to initialize the new configuration. From a terminal prompt enter "
22682
"the following to restart <application>PostgreSQL</application>:"
22683
msgstr ""
22684
22685
#: serverguide/C/databases.xml:262(command)
22686
msgid "sudo /etc/init.d/postgresql-8.4 restart"
22687
msgstr ""
22688
22689
#: serverguide/C/databases.xml:265(para)
22690
msgid ""
22691
"The above configuration is not complete by any means. Please refer <ulink "
22692
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the PostgreSQL "
22693
"Administrator's Guide</ulink> to configure more parameters."
22694
msgstr ""
22695
22696
#: serverguide/C/databases.xml:276(para)
22697
msgid ""
22698
"As mentioned above the <ulink "
22699
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\">Administrator's "
22700
"Guide</ulink> is an excellent resource. The guide is also available in the "
22701
"<application>postgresql-doc-8.4</application> package. Execute the following "
22702
"in a terminal to install the package:"
22703
msgstr ""
22704
22705
#: serverguide/C/databases.xml:282(command)
22706
msgid "sudo apt-get install postgresql-doc-8.4"
22707
msgstr ""
22708
22709
#: serverguide/C/databases.xml:284(para)
22710
msgid ""
22711
"To view the guide enter <command>file:///usr/share/doc/postgresql-doc-"
22712
"8.4/html/index.html</command> into the address bar of your browser."
22713
msgstr ""
22714
22715
#: serverguide/C/databases.xml:296(para)
22716
msgid ""
22717
"Also, see the <ulink "
22718
"url=\"https://help.ubuntu.com/community/PostgreSQL\">PostgreSQL Ubuntu "
22719
"Wiki</ulink> page for more information."
22720
msgstr ""
22721
22722
#: serverguide/C/clustering.xml:13(title)
22723
msgid "Clustering"
22724
msgstr ""
22725
22726
#: serverguide/C/clustering.xml:16(title)
22727
msgid "DRBD"
22728
msgstr ""
22729
22730
#: serverguide/C/clustering.xml:18(para)
22731
msgid ""
22732
"Distributed Replicated Block Device (DRBD) mirrors block devices between "
22733
"multiple hosts. The replication is transparent to other applications on the "
22734
"host systems. Any block device hard disks, partitions, RAID devices, logical "
22735
"volumes, etc can be mirrored."
22736
msgstr ""
22737
22738
#: serverguide/C/clustering.xml:24(para)
22739
msgid ""
22740
"To get started using <application>drbd</application>, first install the "
22741
"necessary packages. From a terminal enter:"
22742
msgstr ""
22743
22744
#: serverguide/C/clustering.xml:29(command)
22745
msgid "sudo apt-get install drbd8-utils"
22746
msgstr ""
22747
22748
#: serverguide/C/clustering.xml:33(para)
22749
msgid ""
22750
"If you are using the <emphasis>virtual kernel</emphasis> as part of a "
22751
"virtual machine you will need to manually compile the "
22752
"<application>drbd</application> module. It may be easier to install the "
22753
"<application>linux-server</application> package inside the virtual machine."
22754
msgstr ""
22755
22756
#: serverguide/C/clustering.xml:40(para)
22757
msgid ""
22758
"This section covers setting up a <application>drbd</application> to "
22759
"replicate a separate <filename>/srv</filename> partition, with an "
22760
"<application>ext3</application> filesystem between two hosts. The partition "
22761
"size is not particularly relevant, but both partitions need to be the same "
22762
"size."
22763
msgstr ""
22764
22765
#: serverguide/C/clustering.xml:49(para)
22766
msgid ""
22767
"The two hosts in this example will be called <emphasis>drbd01</emphasis> and "
22768
"<emphasis>drbd02</emphasis>. They will need to have name resolution "
22769
"configured either through DNS or the <filename>/etc/hosts</filename> file. "
22770
"See <xref linkend=\"dns\"/> for details."
22771
msgstr ""
22772
22773
#: serverguide/C/clustering.xml:57(para)
22774
msgid ""
22775
"To configure <application>drbd</application>, on the first host edit "
22776
"<filename>/etc/drbd.conf</filename>:"
22777
msgstr ""
22778
22779
#: serverguide/C/clustering.xml:61(programlisting)
22780
#, no-wrap
22781
msgid ""
22782
"\n"
22783
"global { usage-count no; }\n"
22784
"common { syncer { rate 100M; } }\n"
22785
"resource r0 {\n"
22786
" protocol C;\n"
22787
" startup {\n"
22788
" wfc-timeout 15;\n"
22789
" degr-wfc-timeout 60;\n"
22790
" }\n"
22791
" net {\n"
22792
" cram-hmac-alg sha1;\n"
22793
" shared-secret \"secret\";\n"
22794
" }\n"
22795
" on drbd01 {\n"
22796
" device /dev/drbd0;\n"
22797
" disk /dev/sdb1;\n"
22798
" address 192.168.0.1:7788;\n"
22799
" meta-disk internal;\n"
22800
" }\n"
22801
" on drbd02 {\n"
22802
" device /dev/drbd0;\n"
22803
" disk /dev/sdb1;\n"
22804
" address 192.168.0.2:7788;\n"
22805
" meta-disk internal;\n"
22806
" }\n"
22807
"} \n"
22808
msgstr ""
22809
22810
#: serverguide/C/clustering.xml:90(para)
22811
msgid ""
22812
"There are many other options in <filename>/etc/drbd.conf</filename>, but for "
22813
"this example their default values are fine."
22814
msgstr ""
22815
22816
#: serverguide/C/clustering.xml:98(para)
22817
msgid "Now copy <filename>/etc/drbd.conf</filename> to the second host:"
22818
msgstr ""
22819
22820
#: serverguide/C/clustering.xml:103(command)
22821
msgid "scp /etc/drbd.conf drbd02:~"
22822
msgstr ""
22823
22824
#: serverguide/C/clustering.xml:109(para)
22825
msgid ""
22826
"And, on <emphasis>drbd02</emphasis> move the file to "
22827
"<filename>/etc</filename>:"
22828
msgstr ""
22829
22830
#: serverguide/C/clustering.xml:114(command)
22831
msgid "sudo mv drbd.conf /etc/"
22832
msgstr ""
22833
22834
#: serverguide/C/clustering.xml:120(para)
22835
msgid ""
22836
"Next, on both hosts, start the <application>drbd</application> daemon:"
22837
msgstr ""
22838
22839
#: serverguide/C/clustering.xml:125(command)
22840
msgid "sudo /etc/init.d/drbd start"
22841
msgstr ""
22842
22843
#: serverguide/C/clustering.xml:131(para)
22844
msgid ""
22845
"Now using the <application>drbdadm</application> utility initialize the meta "
22846
"data storage. On each server execute:"
22847
msgstr ""
22848
22849
#: serverguide/C/clustering.xml:137(command)
22850
msgid "sudo drbdadm create-md r0"
22851
msgstr ""
22852
22853
#: serverguide/C/clustering.xml:143(para)
22854
msgid ""
22855
"On the <emphasis>drbd01</emphasis>, or whichever host you wish to be the "
22856
"primary, enter the following:"
22857
msgstr ""
22858
22859
#: serverguide/C/clustering.xml:148(command)
22860
msgid "sudo drbdadm -- --overwrite-data-of-peer primary all"
22861
msgstr ""
22862
22863
#: serverguide/C/clustering.xml:154(para)
22864
msgid ""
22865
"After executing the above command, the data will start syncing with the "
22866
"secondary host. To watch the progresss, on <emphasis>drbd02</emphasis> enter "
22867
"the following:"
22868
msgstr ""
22869
22870
#: serverguide/C/clustering.xml:160(command)
22871
msgid "watch -n1 cat /proc/drbd"
22872
msgstr ""
22873
22874
#: serverguide/C/clustering.xml:163(para)
22875
msgid "To stop watching the output press <emphasis>Ctrl+c</emphasis>."
22876
msgstr ""
22877
22878
#: serverguide/C/clustering.xml:170(para)
22879
msgid ""
22880
"Finally, add a filesystem to <filename>/dev/drbd0</filename> and mount it:"
22881
msgstr ""
22882
22883
#: serverguide/C/clustering.xml:175(command)
22884
msgid "sudo mkfs.ext3 /dev/drbd0"
22885
msgstr ""
22886
22887
#: serverguide/C/clustering.xml:176(command) serverguide/C/clustering.xml:224(command)
22888
msgid "sudo mount /dev/drbd0 /srv"
22889
msgstr ""
22890
22891
#: serverguide/C/clustering.xml:186(para)
22892
msgid ""
22893
"To test that the data is actually syncing between the hosts copy some files "
22894
"on the <emphasis>drbd01</emphasis>, the primary, to "
22895
"<filename>/srv</filename>:"
22896
msgstr ""
22897
22898
#: serverguide/C/clustering.xml:195(para)
22899
msgid "Next, unmount <filename>/srv</filename>:"
22900
msgstr ""
22901
22902
#: serverguide/C/clustering.xml:203(para)
22903
msgid ""
22904
"<emphasis>Demote</emphasis> the <emphasis>primary</emphasis> server to the "
22905
"<emphasis>secondary</emphasis> role:"
22906
msgstr ""
22907
22908
#: serverguide/C/clustering.xml:208(command)
22909
msgid "sudo drbdadm secondary r0"
22910
msgstr ""
22911
22912
#: serverguide/C/clustering.xml:211(para)
22913
msgid ""
22914
"Now on the <emphasis>secondary</emphasis> server "
22915
"<emphasis>promote</emphasis> it to the <emphasis>primary</emphasis> role:"
22916
msgstr ""
22917
22918
#: serverguide/C/clustering.xml:216(command)
22919
msgid "sudo drbdadm primary r0"
22920
msgstr ""
22921
22922
#: serverguide/C/clustering.xml:219(para)
22923
msgid "Lastly, mount the partition:"
22924
msgstr ""
22925
22926
#: serverguide/C/clustering.xml:227(para)
22927
msgid ""
22928
"Using <emphasis>ls</emphasis> you should see "
22929
"<filename>/srv/default</filename> copied from the former "
22930
"<emphasis>primary</emphasis> host <emphasis>drbd01</emphasis>."
22931
msgstr ""
22932
22933
#: serverguide/C/clustering.xml:238(para)
22934
msgid ""
22935
"For more information on <application>DRBD</application> see the <ulink "
22936
"url=\"http://www.drbd.org/\">DRBD web site</ulink>."
22937
msgstr ""
22938
22939
#: serverguide/C/clustering.xml:243(para)
22940
msgid ""
22941
"The <ulink "
22942
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/drbd.conf.5.html\">dr"
22943
"bd.conf man page</ulink> contains details on the options not covered in this "
22944
"guide."
22945
msgstr ""
22946
22947
#: serverguide/C/clustering.xml:249(para)
22948
msgid ""
22949
"Also, see the <ulink "
22950
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/drbdadm.8.html\">drbd"
22951
"adm man page</ulink>."
22952
msgstr ""
22953
22954
#: serverguide/C/clustering.xml:254(para)
22955
msgid ""
22956
"The <ulink url=\"https://help.ubuntu.com/community/DRBD\">DRBD Ubuntu "
22957
"Wiki</ulink> page also has more information."
22958
msgstr ""
22959
22960
#: serverguide/C/chat.xml:13(title)
22961
msgid "Chat Applications"
22962
msgstr ""
22963
22964
#: serverguide/C/chat.xml:19(para)
22965
msgid ""
22966
"In this section, we will discuss how to install and configure a IRC server, "
22967
"<application>ircd-irc2</application>. We will also discuss how to install "
22968
"and configure Jabber, an instance messaging server."
22969
msgstr ""
22970
22971
#: serverguide/C/chat.xml:28(title)
22972
msgid "IRC Server"
22973
msgstr ""
22974
22975
#: serverguide/C/chat.xml:30(para)
22976
msgid ""
22977
"The Ubuntu repository has many Internet Relay Chat servers. This section "
22978
"explains how to install and configure the original IRC server "
22979
"<application>ircd-irc2</application>."
22980
msgstr ""
22981
22982
#: serverguide/C/chat.xml:39(para)
22983
msgid ""
22984
"To install <application>ircd-irc2</application>, run the following command "
22985
"in the command prompt:"
22986
msgstr ""
22987
22988
#: serverguide/C/chat.xml:45(command)
22989
msgid "sudo apt-get install ircd-irc2"
22990
msgstr ""
22991
22992
#: serverguide/C/chat.xml:48(para)
22993
msgid ""
22994
"The configuration files are stored in <filename>/etc/ircd</filename> "
22995
"directory. The documents are available in <filename>/usr/share/doc/ircd-"
22996
"irc2</filename> directory."
22997
msgstr ""
22998
22999
#: serverguide/C/chat.xml:59(para)
23000
msgid ""
23001
"The IRC settings can be done in the configuration file "
23002
"<filename>/etc/ircd/ircd.conf</filename>. You can set the IRC host name in "
23003
"this file by editing the following line:"
23004
msgstr ""
23005
23006
#: serverguide/C/chat.xml:64(programlisting)
23007
#, no-wrap
23008
msgid ""
23009
"\n"
23010
"M:irc.localhost::Debian ircd default configuration::000A\n"
23011
msgstr ""
23012
23013
#: serverguide/C/chat.xml:68(para)
23014
msgid ""
23015
"Please make sure you add DNS aliases for the IRC host name. For instance, if "
23016
"you set irc.livecipher.com as IRC host name, please make sure "
23017
"irc.livecipher.com is resolvable in your Domain Name Server. The IRC host "
23018
"name should not be same as the host name."
23019
msgstr ""
23020
23021
#: serverguide/C/chat.xml:75(para)
23022
msgid ""
23023
"The IRC admin details can be configured by editting the following line:"
23024
msgstr ""
23025
23026
#: serverguide/C/chat.xml:80(programlisting)
23027
#, no-wrap
23028
msgid ""
23029
"\n"
23030
"A:Organization, IRC dept.:Daemon <ircd@example.irc.org>:Client "
23031
"Server::IRCnet:\n"
23032
msgstr ""
23033
23034
#: serverguide/C/chat.xml:84(para)
23035
msgid ""
23036
"You should add specific lines to configure the list of IRC ports to listen "
23037
"on, to configure Operator credentials, to configure client authentication, "
23038
"etc. For details, please refer to the example configuration file "
23039
"<filename>/usr/share/doc/ircd-irc2/ircd.conf.example.gz</filename>."
23040
msgstr ""
23041
23042
#: serverguide/C/chat.xml:92(para)
23043
msgid ""
23044
"The IRC banner to be displayed in the IRC client, when the user connects to "
23045
"the server can be set in <filename>/etc/ircd/ircd.motd</filename> file."
23046
msgstr ""
23047
23048
#: serverguide/C/chat.xml:97(para)
23049
msgid ""
23050
"After making necessary changes to the configuration file, you can restart "
23051
"the IRC server using following command:"
23052
msgstr ""
23053
23054
#: serverguide/C/chat.xml:101(programlisting)
23055
#, no-wrap
23056
msgid ""
23057
"\n"
23058
"sudo /etc/init.d/ircd-irc2 restart\n"
23059
msgstr ""
23060
23061
#: serverguide/C/chat.xml:109(para)
23062
msgid ""
23063
"You may also be interested to take a look at other IRC servers available in "
23064
"Ubuntu Repository. It includes, <application>ircd-ircu</application> and "
23065
"<application>ircd-hybrid</application>."
23066
msgstr ""
23067
23068
#: serverguide/C/chat.xml:117(para)
23069
msgid ""
23070
"Refer to <ulink url=\"http://www.irc.org/tech_docs/ircnet/faq.html\">IRCD "
23071
"FAQ</ulink> for more details about the IRC Server."
23072
msgstr ""
23073
23074
#: serverguide/C/chat.xml:124(para)
23075
msgid ""
23076
"Also, the <ulink url=\"https://help.ubuntu.com/community/ircd\">Ubuntu Wiki "
23077
"IRCD</ulink> page has more information."
23078
msgstr ""
23079
23080
#: serverguide/C/chat.xml:132(title)
23081
msgid "Jabber Instant Messaging Server"
23082
msgstr ""
23083
23084
#: serverguide/C/chat.xml:134(para)
23085
msgid ""
23086
"<emphasis>Jabber</emphasis> a popular instant message protocol is based on "
23087
"XMPP, an open standard for instant messaging, and used by many popular "
23088
"applications. This section covers setting up a <emphasis>Jabberd "
23089
"2</emphasis> server on a local LAN. This configuration can also be adapted "
23090
"to providing messaging services to users over the Internet."
23091
msgstr ""
23092
23093
#: serverguide/C/chat.xml:143(para)
23094
msgid "To install <application>jabberd2</application>, in a terminal enter:"
23095
msgstr ""
23096
23097
#: serverguide/C/chat.xml:148(command)
23098
msgid "sudo apt-get install jabberd2"
23099
msgstr ""
23100
23101
#: serverguide/C/chat.xml:155(para)
23102
msgid ""
23103
"A couple of XML configuration files will be used to configure "
23104
"<application>jabberd2</application> for <emphasis>Berkely DB</emphasis> user "
23105
"authentication. This is a very simple form of authentication. However, "
23106
"<application>jabberd2</application> can be configured to use LDAP, MySQL, "
23107
"Postgresql, etc for for user authentication."
23108
msgstr ""
23109
23110
#: serverguide/C/chat.xml:162(para)
23111
msgid "First, edit <filename>/etc/jabberd2/sm.xml</filename> changing:"
23112
msgstr ""
23113
23114
#: serverguide/C/chat.xml:166(programlisting)
23115
#, no-wrap
23116
msgid ""
23117
"\n"
23118
" <id>jabber.example.com</id>\n"
23119
msgstr ""
23120
23121
#: serverguide/C/chat.xml:171(para)
23122
msgid ""
23123
"Replace <emphasis>jabber.example.com</emphasis> with the hostname, or other "
23124
"id, of your server."
23125
msgstr ""
23126
23127
#: serverguide/C/chat.xml:176(para)
23128
msgid "Now in the <storage> section change the <driver> to:"
23129
msgstr ""
23130
23131
#: serverguide/C/chat.xml:180(programlisting)
23132
#, no-wrap
23133
msgid ""
23134
"\n"
23135
" <driver>db</driver>\n"
23136
msgstr ""
23137
23138
#: serverguide/C/chat.xml:184(para)
23139
msgid ""
23140
"Next, edit <filename>/etc/jabberd2/c2s.xml</filename> in the "
23141
"<emphasis><local></emphasis> section change:"
23142
msgstr ""
23143
23144
#: serverguide/C/chat.xml:188(programlisting)
23145
#, no-wrap
23146
msgid ""
23147
"\n"
23148
" <id>jabber.example.com</id>\n"
23149
msgstr ""
23150
23151
#: serverguide/C/chat.xml:192(para)
23152
msgid ""
23153
"And in the <authreg> section adjust the <module> section to:"
23154
msgstr ""
23155
23156
#: serverguide/C/chat.xml:196(programlisting)
23157
#, no-wrap
23158
msgid ""
23159
"\n"
23160
" <module>db</module>\n"
23161
msgstr ""
23162
23163
#: serverguide/C/chat.xml:200(para)
23164
msgid ""
23165
"Finally, restart <application>jabberd2</application> to enable the new "
23166
"settings:"
23167
msgstr ""
23168
23169
#: serverguide/C/chat.xml:205(command)
23170
msgid "sudo /etc/init.d/jabberd2 restart"
23171
msgstr ""
23172
23173
#: serverguide/C/chat.xml:208(para)
23174
msgid ""
23175
"You should now be able to connect to the server using a Jabber client like "
23176
"<application>Pidgin</application> for example."
23177
msgstr ""
23178
23179
#: serverguide/C/chat.xml:213(para)
23180
msgid ""
23181
"The advantage of using Berkeley DB for user data is that after being "
23182
"configured no additional maintenance is required. If you need more control "
23183
"over user accounts and credentials another authentication method is "
23184
"recommended."
23185
msgstr ""
23186
23187
#: serverguide/C/chat.xml:225(para)
23188
msgid ""
23189
"The <ulink url=\"http://codex.xiaoka.com/wiki/jabberd2:start\">Jabberd2 Web "
23190
"Site</ulink> contains more details on configuring "
23191
"<application>Jabberd2</application>."
23192
msgstr ""
23193
23194
#: serverguide/C/chat.xml:231(para)
23195
msgid ""
23196
"For more authentication options see the <ulink "
23197
"url=\"http://jabberd2.xiaoka.com/wiki/InstallGuide\">Jabberd2 Install "
23198
"Guide</ulink>."
23199
msgstr ""
23200
23201
#: serverguide/C/chat.xml:236(para)
23202
msgid ""
23203
"Also, the <ulink "
23204
"url=\"https://help.ubuntu.com/community/SettingUpJabberServer\">Setting Up "
23205
"Jabber Server Ubuntu Wiki</ulink> page has more information."
23206
msgstr ""
23207
23208
#: serverguide/C/backups.xml:13(title)
23209
msgid "Backups"
23210
msgstr ""
23211
23212
#: serverguide/C/backups.xml:14(para)
23213
msgid ""
23214
"There are many ways to backup an Ubuntu installation. The most important "
23215
"thing about backups is to develop a <emphasis>backup plan</emphasis> "
23216
"consisting of what to backup, where to back it up to, and how to restore it."
23217
msgstr ""
23218
23219
#: serverguide/C/backups.xml:18(para)
23220
msgid ""
23221
"The following sections discuss various ways of accomplishing these tasks."
23222
msgstr ""
23223
23224
#: serverguide/C/backups.xml:22(title)
23225
msgid "Shell Scripts"
23226
msgstr ""
23227
23228
#: serverguide/C/backups.xml:23(para)
23229
msgid ""
23230
"One of the simplest ways to backup a system is using a <emphasis>shell "
23231
"script</emphasis>. For example, a script can be used to configure which "
23232
"directories to backup, and use those directories as arguments to the "
23233
"<application>tar</application> utility creating an archive file. The archive "
23234
"file can then be moved or copied to another location. The archive can also "
23235
"be created on a remote file system such as an <emphasis>NFS</emphasis> mount."
23236
msgstr ""
23237
23238
#: serverguide/C/backups.xml:29(para)
23239
msgid ""
23240
"The <application>tar</application> utility creates one archive file out of "
23241
"many files or directories. <application>tar</application> can also filter "
23242
"the files through compression utilities reducing the size of the archive "
23243
"file."
23244
msgstr ""
23245
23246
#: serverguide/C/backups.xml:35(title)
23247
msgid "Simple Shell Script"
23248
msgstr ""
23249
23250
#: serverguide/C/backups.xml:36(para)
23251
msgid ""
23252
"The following shell script uses <application>tar</application> to create an "
23253
"archive file on a remotely mounted NFS file system. The archive filename is "
23254
"determined using additional command line utilities."
23255
msgstr ""
23256
23257
#: serverguide/C/backups.xml:40(programlisting)
23258
#, no-wrap
23259
msgid ""
23260
"\n"
23261
"#!/bin/sh\n"
23262
"####################################\n"
23263
"#\n"
23264
"# Backup to NFS mount script.\n"
23265
"#\n"
23266
"####################################\n"
23267
"\n"
23268
"# What to backup. \n"
23269
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23270
"\n"
23271
"# Where to backup to.\n"
23272
"dest=\"/mnt/backup\"\n"
23273
"\n"
23274
"# Create archive filename.\n"
23275
"day=$(date +%A)\n"
23276
"hostname=$(hostname -s)\n"
23277
"archive_file=\"$hostname-$day.tgz\"\n"
23278
"\n"
23279
"# Print start status message.\n"
23280
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23281
"date\n"
23282
"echo\n"
23283
"\n"
23284
"# Backup the files using tar.\n"
23285
"tar czf $dest/$archive_file $backup_files\n"
23286
"\n"
23287
"# Print end status message.\n"
23288
"echo\n"
23289
"echo \"Backup finished\"\n"
23290
"date\n"
23291
"\n"
23292
"# Long listing of files in $dest to check file sizes.\n"
23293
"ls -lh $dest\n"
23294
msgstr ""
23295
23296
#: serverguide/C/backups.xml:77(para)
23297
msgid ""
23298
"<emphasis>$backup_files:</emphasis> a variable listing which directories you "
23299
"would like to backup. The list should be customized to fit your needs."
23300
msgstr ""
23301
23302
#: serverguide/C/backups.xml:83(para)
23303
msgid ""
23304
"<emphasis>$day:</emphasis> a variable holding the day of the week (Monday, "
23305
"Tuesday, Wednesday, etc). This is used to create an archive file for each "
23306
"day of the week, giving a backup history of seven days. There are other ways "
23307
"to accomplish this including other ways using the "
23308
"<application>date</application> utility."
23309
msgstr ""
23310
23311
#: serverguide/C/backups.xml:90(para)
23312
msgid ""
23313
"<emphasis>$hostname:</emphasis> variable containing the "
23314
"<emphasis>short</emphasis> hostname of the system. Using the hostname in the "
23315
"archive filename gives you the option of placing daily archive files from "
23316
"multiple systems in the same directory."
23317
msgstr ""
23318
23319
#: serverguide/C/backups.xml:97(para)
23320
msgid "<emphasis>$archive_file:</emphasis> the full archive filename."
23321
msgstr ""
23322
23323
#: serverguide/C/backups.xml:102(para)
23324
msgid ""
23325
"<emphasis>$dest:</emphasis> destination of the archive file. The directory "
23326
"needs to be created and in this case <emphasis>mounted</emphasis> before "
23327
"executing the backup script. See <xref linkend=\"network-file-system\"/> for "
23328
"details using <emphasis>NFS</emphasis>."
23329
msgstr ""
23330
23331
#: serverguide/C/backups.xml:109(para)
23332
msgid ""
23333
"<emphasis>status messages:</emphasis> optional messages printed to the "
23334
"console using the <application>echo</application> utility."
23335
msgstr ""
23336
23337
#: serverguide/C/backups.xml:115(para)
23338
msgid ""
23339
"<emphasis>tar czf $dest/$archive_file $backup_files:</emphasis> the "
23340
"<application>tar</application> command used to create the archive file."
23341
msgstr ""
23342
23343
#: serverguide/C/backups.xml:121(para)
23344
msgid "<emphasis>c:</emphasis> creates an archive."
23345
msgstr ""
23346
23347
#: serverguide/C/backups.xml:126(para)
23348
msgid ""
23349
"<emphasis>z:</emphasis> filter the archive through the "
23350
"<application>gzip</application> utility compressing the archive."
23351
msgstr ""
23352
23353
#: serverguide/C/backups.xml:131(para)
23354
msgid ""
23355
"<emphasis>f:</emphasis> use archive file. Otherwise the "
23356
"<application>tar</application> output will be sent to STDOUT."
23357
msgstr ""
23358
23359
#: serverguide/C/backups.xml:138(para)
23360
msgid ""
23361
"<emphasis>ls -lh $dest:</emphasis> optional statement prints a <emphasis>-"
23362
"l</emphasis> long listing in <emphasis>-h</emphasis> human readable format "
23363
"of the destination directory. This is useful for a quick file size check of "
23364
"the archive file. This check should not replace testing the archive file."
23365
msgstr ""
23366
23367
#: serverguide/C/backups.xml:145(para)
23368
msgid ""
23369
"This is a simple example of a backup shell script. There are large amount of "
23370
"options that can be included in a backup script. See <xref linkend=\"backup-"
23371
"shellscript-references\"/> for links to resources providing more in depth "
23372
"shell scripting information."
23373
msgstr ""
23374
23375
#: serverguide/C/backups.xml:152(title)
23376
msgid "Executing the Script"
23377
msgstr ""
23378
23379
#: serverguide/C/backups.xml:154(title)
23380
msgid "Executing from a Terminal"
23381
msgstr ""
23382
23383
#: serverguide/C/backups.xml:155(para)
23384
msgid ""
23385
"The simplest way of executing the above backup script is to copy and paste "
23386
"the contents into a file. <filename>backup.sh</filename> for example. Then "
23387
"from a terminal prompt:"
23388
msgstr ""
23389
23390
#: serverguide/C/backups.xml:160(command)
23391
msgid "sudo bash backup.sh"
23392
msgstr ""
23393
23394
#: serverguide/C/backups.xml:162(para)
23395
msgid ""
23396
"This is a great way to test the script to make sure everything works as "
23397
"expected."
23398
msgstr ""
23399
23400
#: serverguide/C/backups.xml:167(title)
23401
msgid "Executing with cron"
23402
msgstr ""
23403
23404
#: serverguide/C/backups.xml:168(para)
23405
msgid ""
23406
"The <application>cron</application> utility can be used to automate the "
23407
"script execution. The <application>cron</application> daemon allows the "
23408
"execution of scripts, or commands, at a specified time and date."
23409
msgstr ""
23410
23411
#: serverguide/C/backups.xml:172(para)
23412
msgid ""
23413
"<application>cron</application> is configured through entries in a "
23414
"<filename>crontab</filename> file. <filename>crontab</filename> files are "
23415
"separated into fields:"
23416
msgstr ""
23417
23418
#: serverguide/C/backups.xml:176(programlisting)
23419
#, no-wrap
23420
msgid ""
23421
"\n"
23422
"# m h dom mon dow command\n"
23423
msgstr ""
23424
23425
#: serverguide/C/backups.xml:181(para)
23426
msgid ""
23427
"<emphasis>m:</emphasis> minute the command executes on between 0 and 59."
23428
msgstr ""
23429
23430
#: serverguide/C/backups.xml:186(para)
23431
msgid ""
23432
"<emphasis>h:</emphasis> hour the command executes on between 0 and 23."
23433
msgstr ""
23434
23435
#: serverguide/C/backups.xml:191(para)
23436
msgid "<emphasis>dom:</emphasis> day of month the command executes on."
23437
msgstr ""
23438
23439
#: serverguide/C/backups.xml:196(para)
23440
msgid ""
23441
"<emphasis>mon:</emphasis> the month the command executes on between 1 and 12."
23442
msgstr ""
23443
23444
#: serverguide/C/backups.xml:201(para)
23445
msgid ""
23446
"<emphasis>dow:</emphasis> the day of the week the command executes on "
23447
"between 0 and 7. Sunday may be specified by using 0 or 7, both values are "
23448
"valid."
23449
msgstr ""
23450
23451
#: serverguide/C/backups.xml:206(para)
23452
msgid "<emphasis>command:</emphasis> the command to execute."
23453
msgstr ""
23454
23455
#: serverguide/C/backups.xml:211(para)
23456
msgid ""
23457
"To add or change entries in a <filename>crontab</filename> file the "
23458
"<application>crontab -e</application> command should be used. Also, the "
23459
"contents of a <filename>crontab</filename> file can be viewed using the "
23460
"<application>crontab -l</application> command."
23461
msgstr ""
23462
23463
#: serverguide/C/backups.xml:215(para)
23464
msgid ""
23465
"To execute the <application>backup.sh</application> script listed above "
23466
"using <application>cron</application>. Enter the following from a terminal "
23467
"prompt:"
23468
msgstr ""
23469
23470
#: serverguide/C/backups.xml:220(command)
23471
msgid "sudo crontab -e"
23472
msgstr ""
23473
23474
#: serverguide/C/backups.xml:223(para)
23475
msgid ""
23476
"Using <application>sudo</application> with the <application>crontab -"
23477
"e</application> command edits the <emphasis>root</emphasis> user's crontab. "
23478
"This is necessary if you are backing up directories only the root user has "
23479
"access to."
23480
msgstr ""
23481
23482
#: serverguide/C/backups.xml:228(para)
23483
msgid "Add the following entry to the <filename>crontab</filename> file:"
23484
msgstr ""
23485
23486
#: serverguide/C/backups.xml:231(programlisting)
23487
#, no-wrap
23488
msgid ""
23489
"\n"
23490
"# m h dom mon dow command\n"
23491
"0 0 * * * bash /usr/local/bin/backup.sh\n"
23492
msgstr ""
23493
23494
#: serverguide/C/backups.xml:235(para)
23495
msgid ""
23496
"The <application>backup.sh</application> script will now be executed every "
23497
"day at 12:00 am."
23498
msgstr ""
23499
23500
#: serverguide/C/backups.xml:239(para)
23501
msgid ""
23502
"The <application>backup.sh</application> script will need to be copied to "
23503
"the <filename>/usr/local/bin/</filename> directory in order for this entry "
23504
"to execute properly. The script can reside anywhere on the file system "
23505
"simply change the script path appropriately."
23506
msgstr ""
23507
23508
#: serverguide/C/backups.xml:244(para)
23509
msgid ""
23510
"For more in depth <application>crontab</application> options see <xref "
23511
"linkend=\"backup-shellscript-references\"/>."
23512
msgstr ""
23513
23514
#: serverguide/C/backups.xml:250(title)
23515
msgid "Restoring from the Archive"
23516
msgstr ""
23517
23518
#: serverguide/C/backups.xml:251(para)
23519
msgid ""
23520
"Once an archive has been created it is important to test the archive. The "
23521
"archive can be tested by listing the files it contains, but the best test is "
23522
"to <emphasis>restore</emphasis> a file from the archive."
23523
msgstr ""
23524
23525
#: serverguide/C/backups.xml:257(para)
23526
msgid "To see a listing of the archive contents. From a terminal prompt:"
23527
msgstr ""
23528
23529
#: serverguide/C/backups.xml:261(command)
23530
msgid "tar -tzvf /mnt/backup/host-Monday.tgz"
23531
msgstr ""
23532
23533
#: serverguide/C/backups.xml:265(para)
23534
msgid "To restore a file from the archive to a different directory enter:"
23535
msgstr ""
23536
23537
#: serverguide/C/backups.xml:269(command)
23538
msgid "tar -xzvf /mnt/backup/host-Monday.tgz -C /tmp etc/hosts"
23539
msgstr ""
23540
23541
#: serverguide/C/backups.xml:271(para)
23542
msgid ""
23543
"The <emphasis>-C</emphasis> option to <application>tar</application> "
23544
"redirects the extracted files to the specified directory. The above example "
23545
"will extract the <filename>/etc/hosts</filename> file to "
23546
"<filename>/tmp/etc/hosts</filename>. <application>tar</application> "
23547
"recreates the directory structure that it contains."
23548
msgstr ""
23549
23550
#: serverguide/C/backups.xml:276(para)
23551
msgid ""
23552
"Also, notice the leading <emphasis>\"/\"</emphasis> is left off the path of "
23553
"the file to restore."
23554
msgstr ""
23555
23556
#: serverguide/C/backups.xml:281(para)
23557
msgid "To restore all files in the archive enter the following:"
23558
msgstr ""
23559
23560
#: serverguide/C/backups.xml:285(command)
23561
msgid "cd /"
23562
msgstr ""
23563
23564
#: serverguide/C/backups.xml:286(command)
23565
msgid "sudo tar -xzvf /mnt/backup/host-Monday.tgz"
23566
msgstr ""
23567
23568
#: serverguide/C/backups.xml:291(para)
23569
msgid "This will overwrite the files currently on the file system."
23570
msgstr ""
23571
23572
#: serverguide/C/backups.xml:300(para)
23573
msgid ""
23574
"For more information on shell scripting see the <ulink "
23575
"url=\"http://tldp.org/LDP/abs/html/\">Advanced Bash-Scripting Guide</ulink>"
23576
msgstr ""
23577
23578
#: serverguide/C/backups.xml:305(para)
23579
msgid ""
23580
"The book <ulink url=\"http://safari.samspublishing.com/0672323583\">Teach "
23581
"Yourself Shell Programming in 24 Hours</ulink> is available online and a "
23582
"great resource for shell scripting."
23583
msgstr ""
23584
23585
#: serverguide/C/backups.xml:311(para)
23586
msgid ""
23587
"The <ulink url=\"https://help.ubuntu.com/community/CronHowto\">CronHowto "
23588
"Wiki Page</ulink> contains details on advanced "
23589
"<application>cron</application> options."
23590
msgstr ""
23591
23592
#: serverguide/C/backups.xml:318(para)
23593
msgid ""
23594
"See the <ulink url=\"http://www.gnu.org/software/tar/manual/index.html\">GNU "
23595
"tar Manual</ulink> for more <application>tar</application> options."
23596
msgstr ""
23597
23598
#: serverguide/C/backups.xml:324(para)
23599
msgid ""
23600
"The Wikipedia <ulink "
23601
"url=\"http://en.wikipedia.org/wiki/Backup_rotation_scheme\">Backup Rotation "
23602
"Scheme</ulink> article contains information on other backup rotation schemes."
23603
msgstr ""
23604
23605
#: serverguide/C/backups.xml:330(para)
23606
msgid ""
23607
"The shell script uses <application>tar</application> to create the archive, "
23608
"but there many other command line utilities that can be used. For example:"
23609
msgstr ""
23610
23611
#: serverguide/C/backups.xml:336(para)
23612
msgid ""
23613
"<ulink url=\"http://www.gnu.org/software/cpio/\">cpio</ulink>: used to copy "
23614
"files to and from archives."
23615
msgstr ""
23616
23617
#: serverguide/C/backups.xml:341(para)
23618
msgid ""
23619
"<ulink url=\"http://www.gnu.org/software/coreutils/\">dd</ulink>: part of "
23620
"the <application>coreutils</application> package. A low level utility that "
23621
"can copy data from one format to another"
23622
msgstr ""
23623
23624
#: serverguide/C/backups.xml:347(para)
23625
msgid ""
23626
"<ulink url=\"http://www.rsnapshot.org/\">rsnapshot</ulink>: a file system "
23627
"snap shot utility used to create copies of an entire file system."
23628
msgstr ""
23629
23630
#: serverguide/C/backups.xml:358(title)
23631
msgid "Archive Rotation"
23632
msgstr ""
23633
23634
#: serverguide/C/backups.xml:359(para)
23635
msgid ""
23636
"The shell script in section <xref linkend=\"backup-shellscripts\"/> only "
23637
"allows for seven different archives. For a server whose data doesn't change "
23638
"often this may be enough. If the server has a large amount of data a more "
23639
"robust rotation scheme should be used."
23640
msgstr ""
23641
23642
#: serverguide/C/backups.xml:365(title)
23643
msgid "Rotating NFS Archives"
23644
msgstr ""
23645
23646
#: serverguide/C/backups.xml:366(para)
23647
msgid ""
23648
"In this section the shell script will be slightly modified to implement a "
23649
"grandfather-father-son rotation scheme (monthly-weekly-daily):"
23650
msgstr ""
23651
23652
#: serverguide/C/backups.xml:372(para)
23653
msgid ""
23654
"The rotation will do a <emphasis>daily</emphasis> backup Sunday through "
23655
"Friday."
23656
msgstr ""
23657
23658
#: serverguide/C/backups.xml:377(para)
23659
msgid ""
23660
"On Saturday a <emphasis>weekly</emphasis> backup is done giving you four "
23661
"weekly backups a month."
23662
msgstr ""
23663
23664
#: serverguide/C/backups.xml:382(para)
23665
msgid ""
23666
"The <emphasis>monthly</emphasis> backup is done on the first of the month "
23667
"rotating two monthly backups based on if the month is odd or even."
23668
msgstr ""
23669
23670
#: serverguide/C/backups.xml:388(para)
23671
msgid "Here is the new script:"
23672
msgstr ""
23673
23674
#: serverguide/C/backups.xml:391(programlisting)
23675
#, no-wrap
23676
msgid ""
23677
"\n"
23678
"#!/bin/bash\n"
23679
"####################################\n"
23680
"#\n"
23681
"# Backup to NFS mount script with\n"
23682
"# grandfather-father-son rotation.\n"
23683
"#\n"
23684
"####################################\n"
23685
"\n"
23686
"# What to backup. \n"
23687
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23688
"\n"
23689
"# Where to backup to.\n"
23690
"dest=\"/mnt/backup\"\n"
23691
"\n"
23692
"# Setup variables for the archive filename.\n"
23693
"day=$(date +%A)\n"
23694
"hostname=$(hostname -s)\n"
23695
"\n"
23696
"# Find which week of the month 1-4 it is.\n"
23697
"day_num=$(date +%d)\n"
23698
"if (( $day_num <= 7 )); then\n"
23699
" week_file=\"$hostname-week1.tgz\"\n"
23700
"elif (( $day_num > 7 && $day_num <= 14 )); then\n"
23701
" week_file=\"$hostname-week2.tgz\"\n"
23702
"elif (( $day_num > 14 && $day_num <= 21 )); then\n"
23703
" week_file=\"$hostname-week3.tgz\"\n"
23704
"elif (( $day_num > 21 && $day_num < 32 )); then\n"
23705
" week_file=\"$hostname-week4.tgz\"\n"
23706
"fi\n"
23707
"\n"
23708
"# Find if the Month is odd or even.\n"
23709
"month_num=$(date +%m)\n"
23710
"month=$(expr $month_num % 2)\n"
23711
"if [ $month -eq 0 ]; then\n"
23712
" month_file=\"$hostname-month2.tgz\"\n"
23713
"else\n"
23714
" month_file=\"$hostname-month1.tgz\"\n"
23715
"fi\n"
23716
"\n"
23717
"# Create archive filename.\n"
23718
"if [ $day_num == 1 ]; then\n"
23719
"\tarchive_file=$month_file\n"
23720
"elif [ $day != \"Saturday\" ]; then\n"
23721
" archive_file=\"$hostname-$day.tgz\"\n"
23722
"else \n"
23723
"\tarchive_file=$week_file\n"
23724
"fi\n"
23725
"\n"
23726
"# Print start status message.\n"
23727
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23728
"date\n"
23729
"echo\n"
23730
"\n"
23731
"# Backup the files using tar.\n"
23732
"tar czf $dest/$archive_file $backup_files\n"
23733
"\n"
23734
"# Print end status message.\n"
23735
"echo\n"
23736
"echo \"Backup finished\"\n"
23737
"date\n"
23738
"\n"
23739
"# Long listing of files in $dest to check file sizes.\n"
23740
"ls -lh $dest/\n"
23741
msgstr ""
23742
23743
#: serverguide/C/backups.xml:456(para)
23744
msgid ""
23745
"The script can be executed using the same methods as in <xref "
23746
"linkend=\"backup-executing-shellscript\"/>."
23747
msgstr ""
23748
23749
#: serverguide/C/backups.xml:459(para)
23750
msgid ""
23751
"It is good practice to take backup media off site in case of a disaster. In "
23752
"the shell script example the backup media is another server providing an NFS "
23753
"share. In all likelihood taking the NFS server to another location would not "
23754
"be practical. Depending upon connection speeds it may be an option to copy "
23755
"the archive file over a WAN link to a server in another location."
23756
msgstr ""
23757
23758
#: serverguide/C/backups.xml:465(para)
23759
msgid ""
23760
"Another option is to copy the archive file to an external hard drive which "
23761
"can then be taken off site. Since the price of external hard drives continue "
23762
"to decrease it may be cost affective to use two drives for each archive "
23763
"level. This would allow you to have one external drive attached to the "
23764
"backup server and one in another location."
23765
msgstr ""
23766
23767
#: serverguide/C/backups.xml:472(title)
23768
msgid "Tape Drives"
23769
msgstr ""
23770
23771
#: serverguide/C/backups.xml:473(para)
23772
msgid ""
23773
"A tape drive attached to the server can be used instead of a NFS share. "
23774
"Using a tape drive simplifies archive rotation, and taking the media off "
23775
"site as well."
23776
msgstr ""
23777
23778
#: serverguide/C/backups.xml:477(para)
23779
msgid ""
23780
"When using a tape drive the filename portions of the script aren't needed "
23781
"because the date is sent directly to the tape device. Some commands to "
23782
"manipulate the tape are needed. This is accomplished using "
23783
"<application>mt</application>, a magnetic tape control utility part of the "
23784
"<application>cpio</application> package."
23785
msgstr ""
23786
23787
#: serverguide/C/backups.xml:482(para)
23788
msgid "Here is the shell script modified to use a tape drive:"
23789
msgstr ""
23790
23791
#: serverguide/C/backups.xml:485(programlisting)
23792
#, no-wrap
23793
msgid ""
23794
"\n"
23795
"#!/bin/bash\n"
23796
"####################################\n"
23797
"#\n"
23798
"# Backup to tape drive script.\n"
23799
"#\n"
23800
"####################################\n"
23801
"\n"
23802
"# What to backup. \n"
23803
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23804
"\n"
23805
"# Where to backup to.\n"
23806
"dest=\"/dev/st0\"\n"
23807
"\n"
23808
"# Print start status message.\n"
23809
"echo \"Backing up $backup_files to $dest\"\n"
23810
"date\n"
23811
"echo\n"
23812
"\n"
23813
"# Make sure the tape is rewound.\n"
23814
"mt -f $dest rewind\n"
23815
"\n"
23816
"# Backup the files using tar.\n"
23817
"tar czf $dest $backup_files\n"
23818
"\n"
23819
"# Rewind and eject the tape.\n"
23820
"mt -f $dest rewoffl\n"
23821
"\n"
23822
"# Print end status message.\n"
23823
"echo\n"
23824
"echo \"Backup finished\"\n"
23825
"date\n"
23826
msgstr ""
23827
23828
#: serverguide/C/backups.xml:519(para)
23829
msgid ""
23830
"The default device name for a SCSI tape drive is "
23831
"<filename>/dev/st0</filename>. Use the appropriate device path for your "
23832
"system."
23833
msgstr ""
23834
23835
#: serverguide/C/backups.xml:524(para)
23836
msgid ""
23837
"Restoring from a tape drive is basically the same as restoring from a file. "
23838
"Simply rewind the tape and use the device path instead of a file path. For "
23839
"example to restore the <filename>/etc/hosts</filename> file to "
23840
"<filename>/tmp/etc/hosts</filename>:"
23841
msgstr ""
23842
23843
#: serverguide/C/backups.xml:529(command)
23844
msgid "mt -f /dev/st0 rewind"
23845
msgstr ""
23846
23847
#: serverguide/C/backups.xml:530(command)
23848
msgid "tar -xzf /dev/st0 -C /tmp etc/hosts"
23849
msgstr ""
23850
23851
#: serverguide/C/backups.xml:535(title)
23852
msgid "Bacula"
23853
msgstr ""
23854
23855
#: serverguide/C/backups.xml:536(para)
23856
msgid ""
23857
"<application>Bacula</application> is a backup program enabling you to "
23858
"backup, restore, and verify data across your network. There are Bacula "
23859
"clients for Linux, Windows, and Mac OSX. Making it a cross platform network "
23860
"wide solution."
23861
msgstr ""
23862
23863
#: serverguide/C/backups.xml:542(para)
23864
msgid ""
23865
"<application>Bacula</application> is made up of several components and "
23866
"services used to manage which files to backup and where to back them up to:"
23867
msgstr ""
23868
23869
#: serverguide/C/backups.xml:548(para)
23870
msgid ""
23871
"<application>Bacula Director:</application> a service that controls all "
23872
"backup, restore, verify, and archive operations."
23873
msgstr ""
23874
23875
#: serverguide/C/backups.xml:553(para)
23876
msgid ""
23877
"<application>Bacula Console:</application> an application allowing "
23878
"communication with the Director. There are three versions of the Console:"
23879
msgstr ""
23880
23881
#: serverguide/C/backups.xml:558(para)
23882
msgid "Text based command line version."
23883
msgstr ""
23884
23885
#: serverguide/C/backups.xml:559(para)
23886
msgid "Gnome based GTK+ Graphical User Interface (GUI) interface."
23887
msgstr ""
23888
23889
#: serverguide/C/backups.xml:560(para)
23890
msgid "wxWidgets GUI interface."
23891
msgstr ""
23892
23893
#: serverguide/C/backups.xml:564(para)
23894
msgid ""
23895
"<application>Bacula File:</application> also known as the "
23896
"<application>Bacula Client</application> program. This application is "
23897
"installed on machines to be backed up, and is responsible for the data "
23898
"requested by the Director."
23899
msgstr ""
23900
23901
#: serverguide/C/backups.xml:570(para)
23902
msgid ""
23903
"<application>Bacula Storage:</application> the programs that perform the "
23904
"storage and recovery of data to the physical media."
23905
msgstr ""
23906
23907
#: serverguide/C/backups.xml:575(para)
23908
msgid ""
23909
"<application>Bacula Catalog:</application> is responsible for maintaining "
23910
"the file indexes and volume databases for all files backed up, enabling "
23911
"quick location and restoration of archived files. The Catalog supports three "
23912
"different databases MySQL, PostgreSQL, and SQLite."
23913
msgstr ""
23914
23915
#: serverguide/C/backups.xml:581(para)
23916
msgid ""
23917
"<application>Bacula Monitor:</application> allows the monitoring of the "
23918
"Director, File daemons, and Storage daemons. Currently the Monitor is only "
23919
"available as a GTK+ GUI application."
23920
msgstr ""
23921
23922
#: serverguide/C/backups.xml:587(para)
23923
msgid ""
23924
"These services and applications can be run on multiple servers and clients, "
23925
"or they can be installed on one machine if backing up a single disk or "
23926
"volume."
23927
msgstr ""
23928
23929
#: serverguide/C/backups.xml:594(para)
23930
msgid ""
23931
"There are multiple packages containing the different "
23932
"<application>Bacula</application> components. To install Bacula, from a "
23933
"terminal prompt enter:"
23934
msgstr ""
23935
23936
#: serverguide/C/backups.xml:599(command)
23937
msgid "sudo apt-get install bacula"
23938
msgstr ""
23939
23940
#: serverguide/C/backups.xml:601(para)
23941
msgid ""
23942
"By default installing the <application>bacula</application> package will use "
23943
"a <application>MySQL</application> database for the Catalog. If you want to "
23944
"use SQLite or PostgreSQL, for the Catalog, install <application>bacula-"
23945
"director-sqlite3</application> or <application>bacula-director-"
23946
"pgsql</application> respectively."
23947
msgstr ""
23948
23949
#: serverguide/C/backups.xml:607(para)
23950
msgid ""
23951
"During the install process you will be asked to supply credentials for the "
23952
"database <emphasis>administrator</emphasis> and the "
23953
"<emphasis>bacula</emphasis> database <emphasis>owner</emphasis>. The "
23954
"database administrator will need to have the appropriate rights to create a "
23955
"database, see <xref linkend=\"mysql\"/> for more information."
23956
msgstr ""
23957
23958
#: serverguide/C/backups.xml:617(para)
23959
msgid ""
23960
"<application>Bacula</application> configuration files are formatted based on "
23961
"<emphasis>resources</emphasis> comprising of <emphasis>directives</emphasis> "
23962
"surrounded by <quote>{}</quote> braces. Each Bacula component has an "
23963
"individual file in the <filename role=\"directory\">/etc/bacula</filename> "
23964
"directory."
23965
msgstr ""
23966
23967
#: serverguide/C/backups.xml:622(para)
23968
msgid ""
23969
"The various <application>Bacula</application> components must authorize "
23970
"themselves to each other. This is accomplished using the "
23971
"<emphasis>password</emphasis> directive. For example, the "
23972
"<emphasis>Storage</emphasis> resource password in the "
23973
"<filename>/etc/bacula/bacula-dir.conf</filename> file must match the "
23974
"<emphasis>Director</emphasis> resource password in "
23975
"<filename>/etc/bacula/bacula-sd.conf</filename>."
23976
msgstr ""
23977
23978
#: serverguide/C/backups.xml:628(para)
23979
msgid ""
23980
"By default the backup job named <emphasis>Client1</emphasis> is configured "
23981
"to archive the <application>Bacula</application> Catalog. If you plan on "
23982
"using the server to backup more than one client you should change the name "
23983
"of this job to something more descriptive. To change the name edit "
23984
"<filename>/etc/bacula/bacula-dir.conf</filename>:"
23985
msgstr ""
23986
23987
#: serverguide/C/backups.xml:633(programlisting)
23988
#, no-wrap
23989
msgid ""
23990
"\n"
23991
"#\n"
23992
"# Define the main nightly save backup job\n"
23993
"# By default, this job will back up to disk in \n"
23994
"Job {\n"
23995
" Name = \"BackupServer\"\n"
23996
" JobDefs = \"DefaultJob\"\n"
23997
" Write Bootstrap = \"/var/lib/bacula/Client1.bsr\"\n"
23998
"}\n"
23999
msgstr ""
24000
24001
#: serverguide/C/backups.xml:644(para)
24002
msgid ""
24003
"The example above changes the job name to <emphasis>BackupServer</emphasis> "
24004
"matching the machine's host name. Replace <quote>BackupServer</quote> with "
24005
"your appropriate hostname, or other descriptive name."
24006
msgstr ""
24007
24008
#: serverguide/C/backups.xml:649(para)
24009
msgid ""
24010
"The <emphasis>Console</emphasis> can be used to query the "
24011
"<emphasis>Director</emphasis> about jobs, but to use the Console with a "
24012
"<emphasis>non-root</emphasis> user, the user needs to be in the "
24013
"<emphasis>bacula</emphasis> group. To add a user to the bacula group enter "
24014
"the following from a terminal:"
24015
msgstr ""
24016
24017
#: serverguide/C/backups.xml:655(command)
24018
msgid "sudo adduser $username bacula"
24019
msgstr ""
24020
24021
#: serverguide/C/backups.xml:658(para)
24022
msgid ""
24023
"Replace <emphasis>$username</emphasis> with the actual username. Also, if "
24024
"you are adding the current user to the group you should log out and back in "
24025
"for the new permissions to take effect."
24026
msgstr ""
24027
24028
#: serverguide/C/backups.xml:665(title)
24029
msgid "Localhost Backup"
24030
msgstr ""
24031
24032
#: serverguide/C/backups.xml:666(para)
24033
msgid ""
24034
"This section describes how to backup specified directories on a single host "
24035
"to a local tape drive."
24036
msgstr ""
24037
24038
#: serverguide/C/backups.xml:671(para)
24039
msgid ""
24040
"First, the <emphasis>Storage</emphasis> device needs to be configured. Edit "
24041
"<filename>/etc/bacula/bacula-sd.conf</filename> add:"
24042
msgstr ""
24043
24044
#: serverguide/C/backups.xml:674(programlisting)
24045
#, no-wrap
24046
msgid ""
24047
"\n"
24048
"Device {\n"
24049
" Name = \"Tape Drive\"\n"
24050
" Device Type = tape\n"
24051
" Media Type = DDS-4\n"
24052
" Archive Device = /dev/st0\n"
24053
" Hardware end of medium = No;\n"
24054
" AutomaticMount = yes; # when device opened, read it\n"
24055
" AlwaysOpen = Yes;\n"
24056
" RemovableMedia = yes;\n"
24057
" RandomAccess = no;\n"
24058
" Alert Command = \"sh -c 'tapeinfo -f %c | grep TapeAlert'\"\n"
24059
"}\n"
24060
msgstr ""
24061
24062
#: serverguide/C/backups.xml:688(para)
24063
msgid ""
24064
"The example is for a <emphasis>DDS-4</emphasis> tape drive. Adjust the Media "
24065
"Type and Archive Device to match your hardware."
24066
msgstr ""
24067
24068
#: serverguide/C/backups.xml:691(para)
24069
msgid "You could also uncomment one of the other examples in the file."
24070
msgstr ""
24071
24072
#: serverguide/C/backups.xml:696(para)
24073
msgid ""
24074
"After editing <filename>/etc/bacula/bacula-sd.conf</filename> the "
24075
"<application>Storage</application> daemon will need to be restarted:"
24076
msgstr ""
24077
24078
#: serverguide/C/backups.xml:701(command)
24079
msgid "sudo /etc/init.d/bacula-sd restart"
24080
msgstr ""
24081
24082
#: serverguide/C/backups.xml:705(para)
24083
msgid ""
24084
"Now add a <emphasis>Storage</emphasis> resource in "
24085
"<filename>/etc/bacula/bacula-dir.conf</filename> to use the new Device:"
24086
msgstr ""
24087
24088
#: serverguide/C/backups.xml:708(programlisting)
24089
#, no-wrap
24090
msgid ""
24091
"\n"
24092
"# Definition of \"Tape Drive\" storage device\n"
24093
"Storage {\n"
24094
" Name = TapeDrive\n"
24095
" # Do not use \"localhost\" here \n"
24096
" Address = backupserver # N.B. Use a fully qualified name "
24097
"here\n"
24098
" SDPort = 9103\n"
24099
" Password = \"Cv70F6pf1t6pBopT4vQOnigDrR0v3LT3Cgkiyj\"\n"
24100
" Device = \"Tape Drive\"\n"
24101
" Media Type = tape\n"
24102
"}\n"
24103
msgstr ""
24104
24105
#: serverguide/C/backups.xml:720(para)
24106
msgid ""
24107
"The <emphasis>Address</emphasis> directive needs to be the Fully Qualified "
24108
"Domain Name (FQDN) of the server. Change <emphasis>backupserver</emphasis> "
24109
"to the actual host name."
24110
msgstr ""
24111
24112
#: serverguide/C/backups.xml:724(para)
24113
msgid ""
24114
"Also, make sure the <emphasis>Password</emphasis> directive matches the "
24115
"password string in <filename>/etc/bacula/bacula-sd.conf</filename>."
24116
msgstr ""
24117
24118
#: serverguide/C/backups.xml:730(para)
24119
msgid ""
24120
"Create a new <emphasis>FileSet</emphasis>, which will determine what "
24121
"directories to backup, by adding:"
24122
msgstr ""
24123
24124
#: serverguide/C/backups.xml:733(programlisting)
24125
#, no-wrap
24126
msgid ""
24127
"\n"
24128
"# LocalhostBacup FileSet.\n"
24129
"FileSet {\n"
24130
" Name = \"LocalhostFiles\"\n"
24131
" Include {\n"
24132
" Options {\n"
24133
" signature = MD5\n"
24134
" compression=GZIP\n"
24135
" }\n"
24136
" File = /etc\n"
24137
" File = /home\n"
24138
" }\n"
24139
"}\n"
24140
msgstr ""
24141
24142
#: serverguide/C/backups.xml:747(para)
24143
msgid ""
24144
"This <emphasis>FileSet</emphasis> will backup the <filename "
24145
"role=\"directory\">/etc</filename> and <filename "
24146
"role=\"directory\">/home</filename> directories. The "
24147
"<emphasis>Options</emphasis> resource directives configure the FileSet to "
24148
"create a MD5 signature for each file backed up, and to compress the files "
24149
"using GZIP."
24150
msgstr ""
24151
24152
#: serverguide/C/backups.xml:754(para)
24153
msgid "Next, create a new <emphasis>Schedule</emphasis> for the backup job:"
24154
msgstr ""
24155
24156
#: serverguide/C/backups.xml:757(programlisting)
24157
#, no-wrap
24158
msgid ""
24159
"\n"
24160
"# LocalhostBackup Schedule -- Daily.\n"
24161
"Schedule {\n"
24162
" Name = \"LocalhostDaily\"\n"
24163
" Run = Full daily at 00:01\n"
24164
"}\n"
24165
msgstr ""
24166
24167
#: serverguide/C/backups.xml:764(para)
24168
msgid ""
24169
"The job will run every day at 00:01 or 12:01 am. There are many other "
24170
"scheduling options available."
24171
msgstr ""
24172
24173
#: serverguide/C/backups.xml:769(para)
24174
msgid "Finally create the <emphasis>Job</emphasis>:"
24175
msgstr ""
24176
24177
#: serverguide/C/backups.xml:772(programlisting)
24178
#, no-wrap
24179
msgid ""
24180
"\n"
24181
"# Localhost backup.\n"
24182
"Job {\n"
24183
" Name = \"LocalhostBackup\"\n"
24184
" JobDefs = \"DefaultJob\"\n"
24185
" Enabled = yes\n"
24186
" Level = Full\n"
24187
" FileSet = \"LocalhostFiles\"\n"
24188
" Schedule = \"LocalhostDaily\"\n"
24189
" Storage = TapeDrive\n"
24190
" Write Bootstrap = \"/var/lib/bacula/LocalhostBackup.bsr\"\n"
24191
"} \n"
24192
msgstr ""
24193
24194
#: serverguide/C/backups.xml:785(para)
24195
msgid ""
24196
"The job will do a <emphasis>Full</emphasis> backup every day to the tape "
24197
"drive."
24198
msgstr ""
24199
24200
#: serverguide/C/backups.xml:790(para)
24201
msgid ""
24202
"Each tape used will need to have a <emphasis>Label</emphasis>. If the "
24203
"current tape does not have a label <application>Bacula</application> will "
24204
"send an email letting you know. To label a tape using the "
24205
"<application>Console</application> enter the following from a terminal:"
24206
msgstr ""
24207
24208
#: serverguide/C/backups.xml:796(command)
24209
msgid "bconsole"
24210
msgstr ""
24211
24212
#: serverguide/C/backups.xml:800(para)
24213
msgid "At the Bacula Console prompt enter:"
24214
msgstr ""
24215
24216
#: serverguide/C/backups.xml:804(command)
24217
msgid "label"
24218
msgstr ""
24219
24220
#: serverguide/C/backups.xml:808(para)
24221
msgid ""
24222
"You will then be prompted for the <emphasis>Storage</emphasis> resource:"
24223
msgstr ""
24224
24225
#: serverguide/C/backups.xml:818(userinput)
24226
#, no-wrap
24227
msgid "2"
24228
msgstr ""
24229
24230
#: serverguide/C/backups.xml:812(computeroutput)
24231
#, no-wrap
24232
msgid ""
24233
"\n"
24234
"Automatically selected Catalog: MyCatalog\n"
24235
"Using Catalog \"MyCatalog\"\n"
24236
"The defined Storage resources are:\n"
24237
" 1: File\n"
24238
" 2: TapeDrive\n"
24239
"Select Storage resource (1-2):<placeholder-1/>\n"
24240
msgstr ""
24241
24242
#: serverguide/C/backups.xml:823(para)
24243
msgid "Enter the new <emphasis>Volume</emphasis> name:"
24244
msgstr ""
24245
24246
#: serverguide/C/backups.xml:828(userinput)
24247
#, no-wrap
24248
msgid "Sunday"
24249
msgstr ""
24250
24251
#: serverguide/C/backups.xml:827(computeroutput)
24252
#, no-wrap
24253
msgid ""
24254
"\n"
24255
"Enter new Volume name: <placeholder-1/>\n"
24256
"Defined Pools:\n"
24257
" 1: Default\n"
24258
" 2: Scratch"
24259
msgstr ""
24260
24261
#: serverguide/C/backups.xml:833(para)
24262
msgid "Replace <emphasis>Sunday</emphasis> with the desired label."
24263
msgstr ""
24264
24265
#: serverguide/C/backups.xml:838(para)
24266
msgid "Now, select the <emphasis>Pool</emphasis>:"
24267
msgstr ""
24268
24269
#: serverguide/C/backups.xml:843(userinput)
24270
#, no-wrap
24271
msgid "1"
24272
msgstr ""
24273
24274
#: serverguide/C/backups.xml:842(computeroutput)
24275
#, no-wrap
24276
msgid ""
24277
"\n"
24278
"Select the Pool (1-2): <placeholder-1/>\n"
24279
"Connecting to Storage daemon TapeDrive at backupserver:9103 ...\n"
24280
"Sending label command for Volume \"Sunday\" Slot 0 ...\n"
24281
msgstr ""
24282
24283
#: serverguide/C/backups.xml:850(para)
24284
msgid ""
24285
"Congratulations, you have now configured <emphasis>Bacula</emphasis> to "
24286
"backup the localhost to an attached tape drive."
24287
msgstr ""
24288
24289
#: serverguide/C/backups.xml:858(para)
24290
msgid ""
24291
"For more <emphasis>Bacula</emphasis> configuration options refer to the "
24292
"<ulink url=\"http://www.bacula.org/en/rel-manual/index.html\">Bacula User's "
24293
"Manual</ulink>"
24294
msgstr ""
24295
24296
#: serverguide/C/backups.xml:864(para)
24297
msgid ""
24298
"The <ulink url=\"http://www.bacula.org/\">Bacula Home Page</ulink> contains "
24299
"the latest Bacula news and developments."
24300
msgstr ""
24301
24302
#: serverguide/C/backups.xml:869(para)
24303
msgid ""
24304
"Also, see the <ulink url=\"https://help.ubuntu.com/community/Bacula\">Bacula "
24305
"Ubuntu Wiki</ulink> page."
24306
msgstr ""
24307
24308
#. Put one translator per line, in the form of NAME <EMAIL>, YEAR1, YEAR2
24309
#: serverguide/C/backups.xml:0(None)
24310
msgid "translator-credits"
24311
msgstr ""
24312
"Launchpad Contributions:\n"
24313
" Krasimir Chonov https://launchpad.net/~kchonov\n"
24314
" Pavlin Grucov https://launchpad.net/~pavlin-grucov"
Loggerhead is a web-based interface for Breezy
Version: 2.0.1