« back to all changes in this revision
Viewing changes to serverguide/po/zh_TW.po
- browse files at revision 94
- compare with another revision
- download diff
- download tarball
- view history from revision 94
- Committer: Bazaar Package Importer
- Author(s): Matthew East
- Date: 2010-09-19 11:35:42 UTC
- Revision ID: james.westby@ubuntu.com-20100919113542-mbxqe7yuo4ggnrw3
Tags: 10.10.3
* Amend font-family for browser startpage (LP: #195590)
* Add translations from Launchpad
* Add translations from Launchpad
- files added:
- internet/po/nn.po
- files removed:
- serverguide
- serverguide/C
- serverguide/po
- serverguide/sample
- files modified:
- about-ubuntu/po/ace.po
added
removed
serverguide/po/zh_TW.po
1
# Chinese (Taiwan) translation for ubuntu-docs
2
# Copyright (c) (c) 2006 Canonical Ltd, and Rosetta Contributors 2006
3
# This file is distributed under the same license as the ubuntu-docs package.
4
# FIRST AUTHOR <EMAIL@ADDRESS>, 2006.
5
#
6
msgid ""
7
msgstr ""
8
"Project-Id-Version: ubuntu-docs\n"
9
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
10
"POT-Creation-Date: 2010-03-29 08:26+0100\n"
11
"PO-Revision-Date: 2009-10-20 02:27+0000\n"
12
"Last-Translator: Launchpad Translations Administrators "
13
"<rosetta@launchpad.net>\n"
14
"Language-Team: Chinese (Taiwan) <zh_TW@li.org>\n"
15
"MIME-Version: 1.0\n"
16
"Content-Type: text/plain; charset=UTF-8\n"
17
"Content-Transfer-Encoding: 8bit\n"
18
"X-Launchpad-Export-Date: 2010-04-17 14:51+0000\n"
19
"X-Generator: Launchpad (build Unknown)\n"
20
21
#: serverguide/C/serverguide-C.omf:6(creator) serverguide/C/serverguide-C.omf:7(maintainer)
22
msgid "ubuntu-doc@lists.ubuntu.com (Ubuntu Documentation Project)"
23
msgstr "ubuntu-doc@lists.ubuntu.com (Ubuntu 文件計劃)"
24
25
#: serverguide/C/serverguide-C.omf:8(title) serverguide/C/serverguide-C.omf:11(description) serverguide/C/serverguide.xml:14(title) serverguide/C/bookinfo.xml:13(title)
26
msgid "Ubuntu Server Guide"
27
msgstr "Ubuntu 伺服器指南"
28
29
#: serverguide/C/serverguide-C.omf:9(date)
30
msgid "2007-09-30"
31
msgstr "2007-09-30"
32
33
#: serverguide/C/windows-networking.xml:13(title)
34
msgid "Windows Networking"
35
msgstr "網路芳鄰"
36
37
#: serverguide/C/windows-networking.xml:15(para)
38
msgid ""
39
"Computer networks are often comprised of diverse systems, and while "
40
"operating a network made up entirely of Ubuntu desktop and server computers "
41
"would certainly be fun, some network environments must consist of both "
42
"Ubuntu and <trademark class=\"registered\">Microsoft</trademark><trademark "
43
"class=\"registered\">Windows</trademark> systems working together in "
44
"harmony. This section of the <phrase>Ubuntu</phrase> Server Guide introduces "
45
"principles and tools used in configuring your Ubuntu Server for sharing "
46
"network resources with Windows computers."
47
msgstr ""
48
"網路上通常會同時存在不同的系統，一個完全使用 Ubuntu 桌面版及伺服器版本所組成的網路一定非常有趣，大部分的網路環境上 Ubuntu 和 "
49
"<trademark class=\"registered\">Microsoft</trademark><trademark "
50
"class=\"registered\">Windows</trademark>系統會同時一起運作。<phrase>Ubuntu</phrase> "
51
"伺服器指南中包含了指導你如何設定 Ubuntu 伺服器分享網路資源給 Windows 電腦的原理和工具的使用方法。"
52
53
#: serverguide/C/windows-networking.xml:25(title) serverguide/C/virtualization.xml:402(title) serverguide/C/security.xml:354(title) serverguide/C/remote-administration.xml:22(title) serverguide/C/package-management.xml:20(title) serverguide/C/introduction.xml:13(title)
54
msgid "Introduction"
55
msgstr "簡介"
56
57
#: serverguide/C/windows-networking.xml:27(para)
58
msgid ""
59
"Successfully networking your Ubuntu system with Windows clients involves "
60
"providing and integrating with services common to Windows environments. Such "
61
"services assist the sharing of data and information about the computers and "
62
"users involved in the network, and may be classified under three major "
63
"categories of functionality:"
64
msgstr ""
65
66
#: serverguide/C/windows-networking.xml:35(para)
67
msgid ""
68
"<emphasis role=\"bold\">File and Printer Sharing Services</emphasis>. Using "
69
"the Server Message Block (SMB) protocol to facilitate the sharing of files, "
70
"folders, volumes, and the sharing of printers throughout the network."
71
msgstr ""
72
73
#: serverguide/C/windows-networking.xml:41(para)
74
msgid ""
75
"<emphasis role=\"bold\">Directory Services</emphasis>. Sharing vital "
76
"information about the computers and users of the network with such "
77
"technologies as the Lightweight Directory Access Protocol (LDAP) and "
78
"Microsoft <trademark class=\"registered\">Active Directory</trademark>."
79
msgstr ""
80
81
#: serverguide/C/windows-networking.xml:48(para)
82
msgid ""
83
"<emphasis role=\"bold\">Authentication and Access</emphasis>. Establishing "
84
"the identity of a computer or user of the network and determining the "
85
"information the computer or user is authorized to access using such "
86
"principles and technologies as file permissions, group policies, and the "
87
"Kerberos authentication service."
88
msgstr ""
89
90
#: serverguide/C/windows-networking.xml:56(para)
91
msgid ""
92
"Fortunately, your Ubuntu system may provide all such facilities to Windows "
93
"clients and share network resources among them. One of the principal pieces "
94
"of software your Ubuntu system includes for Windows networking is the Samba "
95
"suite of SMB server applications and tools."
96
msgstr ""
97
98
#: serverguide/C/windows-networking.xml:62(para)
99
msgid ""
100
"This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some "
101
"of the common Samba use cases, and how to install and configure the "
102
"necessary packages. Additional detailed documentation and information on "
103
"Samba can be found on the <ulink url=\"http://www.samba.org\">Samba "
104
"website</ulink>."
105
msgstr ""
106
107
#: serverguide/C/windows-networking.xml:70(title)
108
msgid "Samba File Server"
109
msgstr "Samba File Server"
110
111
#: serverguide/C/windows-networking.xml:72(para)
112
msgid ""
113
"One of the most common ways to network Ubuntu and Windows computers is to "
114
"configure Samba as a File Server. This section covers setting up a "
115
"<application>Samba</application> server to share files with Windows clients."
116
msgstr ""
117
118
#: serverguide/C/windows-networking.xml:77(para)
119
msgid ""
120
"The server will be configured to share files with any client on the network "
121
"without prompting for a password. If your environment requires stricter "
122
"Access Controls see <xref linkend=\"samba-fileprint-security\"/>"
123
msgstr ""
124
125
#: serverguide/C/windows-networking.xml:83(title) serverguide/C/windows-networking.xml:287(title) serverguide/C/windows-networking.xml:1302(title) serverguide/C/web-servers.xml:41(title) serverguide/C/web-servers.xml:675(title) serverguide/C/web-servers.xml:816(title) serverguide/C/web-servers.xml:940(title) serverguide/C/vpn.xml:33(title) serverguide/C/virtualization.xml:62(title) serverguide/C/virtualization.xml:2014(title) serverguide/C/vcs.xml:28(title) serverguide/C/vcs.xml:86(title) serverguide/C/vcs.xml:405(title) serverguide/C/remote-administration.xml:52(title) serverguide/C/remote-administration.xml:233(title) serverguide/C/network-config.xml:937(title) serverguide/C/network-auth.xml:52(title) serverguide/C/network-auth.xml:1581(title) serverguide/C/network-auth.xml:2092(title) serverguide/C/network-auth.xml:2483(title) serverguide/C/monitoring.xml:42(title) serverguide/C/monitoring.xml:428(title) serverguide/C/mail.xml:40(title) serverguide/C/mail.xml:496(title) serverguide/C/mail.xml:674(title) serverguide/C/mail.xml:823(title) serverguide/C/mail.xml:1315(title) serverguide/C/lamp-applications.xml:108(title) serverguide/C/lamp-applications.xml:287(title) serverguide/C/lamp-applications.xml:423(title) serverguide/C/installation.xml:13(title) serverguide/C/installation.xml:957(title) serverguide/C/file-server.xml:347(title) serverguide/C/file-server.xml:462(title) serverguide/C/dns.xml:23(title) serverguide/C/databases.xml:40(title) serverguide/C/databases.xml:164(title) serverguide/C/chat.xml:37(title) serverguide/C/chat.xml:141(title) serverguide/C/backups.xml:593(title)
126
msgid "Installation"
127
msgstr ""
128
129
#: serverguide/C/windows-networking.xml:85(para)
130
msgid ""
131
"The first step is to install the <application>samba</application> package. "
132
"From a terminal prompt enter:"
133
msgstr ""
134
135
#: serverguide/C/windows-networking.xml:90(command) serverguide/C/windows-networking.xml:299(command)
136
msgid "sudo apt-get install samba"
137
msgstr ""
138
139
#: serverguide/C/windows-networking.xml:93(para)
140
msgid ""
141
"That's all there is to it; you are now ready to configure Samba to share "
142
"files."
143
msgstr ""
144
145
#: serverguide/C/windows-networking.xml:99(title) serverguide/C/windows-networking.xml:304(title) serverguide/C/web-servers.xml:61(title) serverguide/C/web-servers.xml:726(title) serverguide/C/web-servers.xml:827(title) serverguide/C/web-servers.xml:967(title) serverguide/C/web-servers.xml:1067(title) serverguide/C/vpn.xml:138(title) serverguide/C/virtualization.xml:2088(title) serverguide/C/vcs.xml:39(title) serverguide/C/vcs.xml:423(title) serverguide/C/remote-administration.xml:74(title) serverguide/C/remote-administration.xml:258(title) serverguide/C/package-management.xml:387(title) serverguide/C/network-config.xml:959(title) serverguide/C/network-auth.xml:2131(title) serverguide/C/network-auth.xml:2504(title) serverguide/C/monitoring.xml:187(title) serverguide/C/monitoring.xml:454(title) serverguide/C/mail.xml:505(title) serverguide/C/mail.xml:684(title) serverguide/C/mail.xml:908(title) serverguide/C/mail.xml:1344(title) serverguide/C/lamp-applications.xml:128(title) serverguide/C/lamp-applications.xml:314(title) serverguide/C/lamp-applications.xml:453(title) serverguide/C/file-server.xml:360(title) serverguide/C/file-server.xml:488(title) serverguide/C/dns.xml:39(title) serverguide/C/databases.xml:84(title) serverguide/C/databases.xml:183(title) serverguide/C/clustering.xml:47(title) serverguide/C/chat.xml:57(title) serverguide/C/chat.xml:153(title) serverguide/C/backups.xml:616(title)
146
msgid "Configuration"
147
msgstr ""
148
149
#: serverguide/C/windows-networking.xml:101(para)
150
msgid ""
151
"The main Samba configuration file is located in "
152
"<filename>/etc/samba/smb.conf</filename>. The default configuration file has "
153
"a significant amount of comments in order to document various configuration "
154
"directives."
155
msgstr ""
156
157
#: serverguide/C/windows-networking.xml:106(para)
158
msgid ""
159
"Not all the available options are included in the default configuration "
160
"file. See the <filename>smb.conf</filename><application>man</application> "
161
"page or the <ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
162
"Collection/\">Samba HOWTO Collection</ulink> for more details."
163
msgstr ""
164
165
#: serverguide/C/windows-networking.xml:116(para)
166
msgid ""
167
"First, edit the following key/value pairs in the "
168
"<emphasis>[global]</emphasis> section of "
169
"<filename>/etc/samba/smb.conf</filename>:"
170
msgstr ""
171
172
#: serverguide/C/windows-networking.xml:121(programlisting) serverguide/C/windows-networking.xml:311(programlisting) serverguide/C/windows-networking.xml:776(programlisting) serverguide/C/windows-networking.xml:990(programlisting)
173
#, no-wrap
174
msgid ""
175
"\n"
176
" workgroup = EXAMPLE\n"
177
" ...\n"
178
" security = user\n"
179
msgstr ""
180
181
#: serverguide/C/windows-networking.xml:127(para)
182
msgid ""
183
"The <emphasis>security</emphasis> parameter is farther down in the [global] "
184
"section, and is commented by default. Also, change "
185
"<emphasis>EXAMPLE</emphasis> to better match your environment."
186
msgstr ""
187
188
#: serverguide/C/windows-networking.xml:135(para)
189
msgid ""
190
"Create a new section at the bottom of the file, or uncomment one of the "
191
"examples, for the directory to be shared:"
192
msgstr ""
193
194
#: serverguide/C/windows-networking.xml:139(programlisting)
195
#, no-wrap
196
msgid ""
197
"\n"
198
"[share]\n"
199
" comment = Ubuntu File Server Share\n"
200
" path = /srv/samba/share\n"
201
" browsable = yes\n"
202
" guest ok = yes\n"
203
" read only = no\n"
204
" create mask = 0755\n"
205
msgstr ""
206
207
#: serverguide/C/windows-networking.xml:151(para)
208
msgid ""
209
"<emphasis>comment:</emphasis> a short description of the share. Adjust to "
210
"fit your needs."
211
msgstr ""
212
213
#: serverguide/C/windows-networking.xml:156(para)
214
msgid "<emphasis>path:</emphasis> the path to the directory to share."
215
msgstr ""
216
217
#: serverguide/C/windows-networking.xml:159(para)
218
msgid ""
219
"This example uses <filename>/srv/samba/sharename</filename> because, "
220
"according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, "
221
"<ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
222
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is where site-"
223
"specific data should be served. Technically Samba shares can be placed "
224
"anywhere on the filesystem as long as the permissions are correct, but "
225
"adhering to standards is recommended."
226
msgstr ""
227
228
#: serverguide/C/windows-networking.xml:168(para)
229
msgid ""
230
"<emphasis>browsable:</emphasis> enables Windows clients to browse the shared "
231
"directory using <application>Windows Explorer</application>."
232
msgstr ""
233
234
#: serverguide/C/windows-networking.xml:174(para)
235
msgid ""
236
"<emphasis>guest ok:</emphasis> allows clients to connect to the share "
237
"without supplying a password."
238
msgstr ""
239
240
#: serverguide/C/windows-networking.xml:179(para)
241
msgid ""
242
"<emphasis>read only:</emphasis> determines if the share is read only or if "
243
"write privileges are granted. Write privileges are allowed only when the "
244
"value is <emphasis>no</emphasis>, as is seen in this example. If the value "
245
"is <emphasis>yes</emphasis>, then access to the share is read only."
246
msgstr ""
247
248
#: serverguide/C/windows-networking.xml:184(para)
249
msgid ""
250
"<emphasis>create mask:</emphasis> determines the permissions new files will "
251
"have when created."
252
msgstr ""
253
254
#: serverguide/C/windows-networking.xml:193(para)
255
msgid ""
256
"Now that <application>Samba</application> is configured, the directory needs "
257
"to be created and the permissions changed. From a terminal enter:"
258
msgstr ""
259
260
#: serverguide/C/windows-networking.xml:199(command)
261
msgid "sudo mkdir -p /srv/samba/share"
262
msgstr ""
263
264
#: serverguide/C/windows-networking.xml:200(command)
265
msgid "sudo chown nobody.nogroup /srv/samba/share/"
266
msgstr ""
267
268
#: serverguide/C/windows-networking.xml:204(para)
269
msgid ""
270
"The <emphasis>-p</emphasis> switch tells mkdir to create the entire "
271
"directory tree if it doesn't exist. Change the share name to fit your "
272
"environment."
273
msgstr ""
274
275
#: serverguide/C/windows-networking.xml:213(para)
276
msgid ""
277
"Finally, restart the <application>samba</application> services to enable the "
278
"new configuration:"
279
msgstr ""
280
281
#: serverguide/C/windows-networking.xml:218(command) serverguide/C/windows-networking.xml:331(command) serverguide/C/windows-networking.xml:468(command) serverguide/C/windows-networking.xml:567(command) serverguide/C/windows-networking.xml:937(command) serverguide/C/windows-networking.xml:1047(command) serverguide/C/windows-networking.xml:1162(command) serverguide/C/network-auth.xml:1860(command)
282
msgid "sudo /etc/init.d/samba restart"
283
msgstr ""
284
285
#: serverguide/C/windows-networking.xml:225(para)
286
msgid ""
287
"Once again, the above configuration gives all access to any client on the "
288
"local network. For a more secure configuration see <xref linkend=\"samba-"
289
"fileprint-security\"/>."
290
msgstr ""
291
292
#: serverguide/C/windows-networking.xml:231(para)
293
msgid ""
294
"From a Windows client you should now be able to browse to the Ubuntu file "
295
"server and see the shared directory. To check that everything is working try "
296
"creating a directory from Windows."
297
msgstr ""
298
299
#: serverguide/C/windows-networking.xml:236(para)
300
msgid ""
301
"To create additional shares simply create new <emphasis>[dir]</emphasis> "
302
"sections in <filename>/etc/samba/smb.conf</filename>, and restart "
303
"<emphasis>Samba</emphasis>. Just make sure that the directory you want to "
304
"share actually exists and the permissions are correct."
305
msgstr ""
306
307
#: serverguide/C/windows-networking.xml:243(title) serverguide/C/windows-networking.xml:341(title) serverguide/C/windows-networking.xml:696(title) serverguide/C/windows-networking.xml:1066(title) serverguide/C/windows-networking.xml:1273(title) serverguide/C/virtualization.xml:366(title) serverguide/C/virtualization.xml:1168(title) serverguide/C/reporting-bugs.xml:304(title) serverguide/C/remote-administration.xml:491(title) serverguide/C/network-config.xml:569(title) serverguide/C/network-config.xml:824(title) serverguide/C/network-auth.xml:1531(title) serverguide/C/network-auth.xml:1975(title) serverguide/C/network-auth.xml:2579(title) serverguide/C/network-auth.xml:3087(title) serverguide/C/installation.xml:892(title) serverguide/C/installation.xml:1173(title) serverguide/C/databases.xml:122(title) serverguide/C/databases.xml:273(title) serverguide/C/backups.xml:855(title)
308
msgid "Resources"
309
msgstr ""
310
311
#: serverguide/C/windows-networking.xml:247(para) serverguide/C/windows-networking.xml:345(para) serverguide/C/windows-networking.xml:700(para) serverguide/C/windows-networking.xml:1070(para)
312
msgid ""
313
"For in depth Samba configurations see the <ulink "
314
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
315
"Collection</ulink>"
316
msgstr ""
317
318
#: serverguide/C/windows-networking.xml:253(para) serverguide/C/windows-networking.xml:351(para) serverguide/C/windows-networking.xml:706(para) serverguide/C/windows-networking.xml:1076(para)
319
msgid ""
320
"The guide is also available in <ulink "
321
"url=\"http://www.amazon.com/exec/obidos/tg/detail/-/0131882228\">printed "
322
"format</ulink>."
323
msgstr ""
324
325
#: serverguide/C/windows-networking.xml:259(para) serverguide/C/windows-networking.xml:357(para)
326
msgid ""
327
"O'Reilly's <ulink "
328
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
329
"another good reference."
330
msgstr ""
331
332
#: serverguide/C/windows-networking.xml:265(para) serverguide/C/windows-networking.xml:368(para) serverguide/C/windows-networking.xml:731(para) serverguide/C/windows-networking.xml:1100(para) serverguide/C/windows-networking.xml:1286(para)
333
msgid ""
334
"The <ulink url=\"https://help.ubuntu.com/community/Samba\">Ubuntu Wiki Samba "
335
"</ulink> page."
336
msgstr ""
337
338
#: serverguide/C/windows-networking.xml:274(title)
339
msgid "Samba Print Server"
340
msgstr ""
341
342
#: serverguide/C/windows-networking.xml:276(para)
343
msgid ""
344
"Another common use of Samba is to configure it to share printers installed, "
345
"either locally or over the network, on an Ubuntu server. Similar to <xref "
346
"linkend=\"samba-fileserver\"/> this section will configure Samba to allow "
347
"any client on the local network to use the installed printers without "
348
"prompting for a username and password."
349
msgstr ""
350
351
#: serverguide/C/windows-networking.xml:282(para)
352
msgid ""
353
"For a more secure configuration see <xref linkend=\"samba-fileprint-"
354
"security\"/>."
355
msgstr ""
356
357
#: serverguide/C/windows-networking.xml:289(para)
358
msgid ""
359
"Before installing and configuring Samba it is best to already have a working "
360
"<application>CUPS</application> installation. See <xref linkend=\"cups\"/> "
361
"for details."
362
msgstr ""
363
364
#: serverguide/C/windows-networking.xml:294(para)
365
msgid ""
366
"To install the <application>samba</application> package, from a terminal "
367
"enter:"
368
msgstr ""
369
370
#: serverguide/C/windows-networking.xml:305(para)
371
msgid ""
372
"After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change "
373
"the <emphasis>workgroup</emphasis> attribute to what is appropriate for your "
374
"network, and change <emphasis>security</emphasis> to <emphasis "
375
"role=\"italic\">share</emphasis>:"
376
msgstr ""
377
378
#: serverguide/C/windows-networking.xml:317(para)
379
msgid ""
380
"In the <emphasis>[printers]</emphasis> section change the <emphasis>guest "
381
"ok</emphasis> option to <emphasis role=\"italic\">yes</emphasis>:"
382
msgstr ""
383
384
#: serverguide/C/windows-networking.xml:321(programlisting)
385
#, no-wrap
386
msgid ""
387
"\n"
388
" browsable = yes\n"
389
" guest ok = yes\n"
390
msgstr ""
391
392
#: serverguide/C/windows-networking.xml:326(para)
393
msgid "After editing <filename>smb.conf</filename> restart Samba:"
394
msgstr ""
395
396
#: serverguide/C/windows-networking.xml:334(para)
397
msgid ""
398
"The default Samba configuration will automatically share any printers "
399
"installed. Simply install the printer locally on your Windows clients."
400
msgstr ""
401
402
#: serverguide/C/windows-networking.xml:363(para)
403
msgid ""
404
"Also, see the <ulink url=\"http://www.cups.org/\">CUPS Website</ulink> for "
405
"more information on configuring CUPS."
406
msgstr ""
407
408
#: serverguide/C/windows-networking.xml:377(title)
409
msgid "Securing a Samba File and Print Server"
410
msgstr ""
411
412
#: serverguide/C/windows-networking.xml:380(title)
413
msgid "Samba Security Modes"
414
msgstr ""
415
416
#: serverguide/C/windows-networking.xml:382(para)
417
msgid ""
418
"There are two security levels available to the Common Internet Filesystem "
419
"(CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-"
420
"level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation "
421
"allows more flexibility, providing four ways of implementing user-level "
422
"security and one way to implement share-level:"
423
msgstr ""
424
425
#: serverguide/C/windows-networking.xml:391(para)
426
msgid ""
427
"<emphasis>security = user:</emphasis> requires clients to supply a username "
428
"and password to connect to shares. Samba user accounts are separate from "
429
"system accounts, but the <application>libpam-smbpass</application> package "
430
"will sync system users and passwords with the Samba user database."
431
msgstr ""
432
433
#: serverguide/C/windows-networking.xml:398(para)
434
msgid ""
435
"<emphasis>security = domain:</emphasis> this mode allows the Samba server to "
436
"appear to Windows clients as a Primary Domain Controller (PDC), Backup "
437
"Domain Controller (BDC), or a Domain Member Server (DMS). See <xref "
438
"linkend=\"samba-dc\"/> for further information."
439
msgstr ""
440
441
#: serverguide/C/windows-networking.xml:405(para)
442
msgid ""
443
"<emphasis>security = ADS:</emphasis> allows the Samba server to join an "
444
"Active Directory domain as a native member. See <xref linkend=\"samba-ad-"
445
"integration\"/> for details."
446
msgstr ""
447
448
#: serverguide/C/windows-networking.xml:411(para)
449
msgid ""
450
"<emphasis>security = server:</emphasis> this mode is left over from before "
451
"Samba could become a member server, and due to some security issues should "
452
"not be used. See the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
453
"HOWTO-Collection/ServerType.html#id349531\">Server Security</ulink> section "
454
"of the Samba guide for more details."
455
msgstr ""
456
457
#: serverguide/C/windows-networking.xml:419(para)
458
msgid ""
459
"<emphasis>security = share:</emphasis> allows clients to connect to shares "
460
"without supplying a username and password."
461
msgstr ""
462
463
#: serverguide/C/windows-networking.xml:426(para)
464
msgid ""
465
"The security mode you choose will depend on your environment and what you "
466
"need the Samba server to accomplish."
467
msgstr ""
468
469
#: serverguide/C/windows-networking.xml:432(title)
470
msgid "Security = User"
471
msgstr ""
472
473
#: serverguide/C/windows-networking.xml:434(para)
474
msgid ""
475
"This section will reconfigure the Samba file and print server, from <xref "
476
"linkend=\"samba-fileserver\"/> and <xref linkend=\"samba-printserver\"/>, to "
477
"require authentication."
478
msgstr ""
479
480
#: serverguide/C/windows-networking.xml:439(para)
481
msgid ""
482
"First, install the <application>libpam-smbpass</application> package which "
483
"will sync the system users to the Samba user database:"
484
msgstr ""
485
486
#: serverguide/C/windows-networking.xml:445(command)
487
msgid "sudo apt-get install libpam-smbpass"
488
msgstr ""
489
490
#: serverguide/C/windows-networking.xml:449(para)
491
msgid ""
492
"If you chose the <emphasis>Samba Server</emphasis> task during installation "
493
"<application>libpam-smbpass</application> is already installed."
494
msgstr ""
495
496
#: serverguide/C/windows-networking.xml:455(para)
497
msgid ""
498
"Edit <filename>/etc/samba/smb.conf</filename>, and in the "
499
"<emphasis>[share]</emphasis> section change:"
500
msgstr ""
501
502
#: serverguide/C/windows-networking.xml:459(programlisting)
503
#, no-wrap
504
msgid ""
505
"\n"
506
" guest ok = no\n"
507
msgstr ""
508
509
#: serverguide/C/windows-networking.xml:463(para)
510
msgid "Finally, restart Samba for the new settings to take effect:"
511
msgstr ""
512
513
#: serverguide/C/windows-networking.xml:471(para)
514
msgid ""
515
"Now when connecting to the shared directories or printers you should be "
516
"prompted for a username and password."
517
msgstr ""
518
519
#: serverguide/C/windows-networking.xml:476(para)
520
msgid ""
521
"If you choose to map a network drive to the share you can check the "
522
"<quote>Reconnect at Logon</quote> check box, which will require you to only "
523
"enter the username and password once, at least until the password changes."
524
msgstr ""
525
526
#: serverguide/C/windows-networking.xml:484(title)
527
msgid "Share Security"
528
msgstr ""
529
530
#: serverguide/C/windows-networking.xml:486(para)
531
msgid ""
532
"There are several options available to increase the security for each "
533
"individual shared directory. Using the <emphasis>[share]</emphasis> example, "
534
"this section will cover some common options."
535
msgstr ""
536
537
#: serverguide/C/windows-networking.xml:492(title)
538
msgid "Groups"
539
msgstr ""
540
541
#: serverguide/C/windows-networking.xml:494(para)
542
msgid ""
543
"Groups define a collection of computers or users which have a common level "
544
"of access to particular network resources and offer a level of granularity "
545
"in controlling access to such resources. For example, if a group <emphasis "
546
"role=\"italic\">qa</emphasis> is defined and contains the users <emphasis "
547
"role=\"italic\">freda</emphasis>, <emphasis "
548
"role=\"italic\">danika</emphasis>, and <emphasis "
549
"role=\"italic\">rob</emphasis> and a second group <emphasis "
550
"role=\"italic\">support</emphasis> is defined and consists of users "
551
"<emphasis role=\"italic\">danika</emphasis>, <emphasis "
552
"role=\"italic\">jeremy</emphasis>, and <emphasis "
553
"role=\"italic\">vincent</emphasis> then certain network resources configured "
554
"to allow access by the <emphasis role=\"italic\">qa</emphasis> group will "
555
"subsequently enable access by freda, danika, and rob, but not jeremy or "
556
"vincent. Since the user <emphasis role=\"italic\">danika</emphasis> belongs "
557
"to both the <emphasis role=\"italic\">qa</emphasis> and <emphasis "
558
"role=\"italic\">support</emphasis> groups, she will be able to access "
559
"resources configured for access by both groups, whereas all other users will "
560
"have only access to resources explicitly allowing the group they are part of."
561
msgstr ""
562
563
#: serverguide/C/windows-networking.xml:508(para)
564
msgid ""
565
"By default Samba looks for the local system groups defined in "
566
"<filename>/etc/group</filename> to determine which users belong to which "
567
"groups. For more information on adding and removing users from groups see "
568
"<xref linkend=\"adding-deleting-users\"/>."
569
msgstr ""
570
571
#: serverguide/C/windows-networking.xml:514(para)
572
msgid ""
573
"When defining groups in the Samba configuration file, "
574
"<filename>/etc/samba/smb.conf</filename>, the recognized syntax is to "
575
"preface the group name with an \"@\" symbol. For example, if you wished to "
576
"define a group named <emphasis role=\"italic\">sysadmin</emphasis> in a "
577
"certain section of the <filename>/etc/samba/smb.conf</filename>, you would "
578
"do so by entering the group name as <emphasis "
579
"role=\"bold\">@sysadmin</emphasis>."
580
msgstr ""
581
582
#: serverguide/C/windows-networking.xml:523(title)
583
msgid "File Permissions"
584
msgstr "檔案權限"
585
586
#: serverguide/C/windows-networking.xml:525(para)
587
msgid ""
588
"File Permissions define the explicit rights a computer or user has to a "
589
"particular directory, file, or set of files. Such permissions may be defined "
590
"by editing the <filename>/etc/samba/smb.conf</filename> file and specifying "
591
"the explicit permissions of a defined file share."
592
msgstr ""
593
594
#: serverguide/C/windows-networking.xml:531(para)
595
msgid ""
596
"For example, if you have defined a Samba share called "
597
"<emphasis>share</emphasis> and wish to give <emphasis role=\"italic\">read-"
598
"only</emphasis> permissions to the group of users known as <emphasis "
599
"role=\"italic\">qa</emphasis>, but wanted to allow writing to the share by "
600
"the group called <emphasis role=\"italic\">sysadmin</emphasis> and the user "
601
"named <emphasis role=\"italic\">vincent</emphasis>, then you could edit the "
602
"<filename>/etc/samba/smb.conf</filename> file, and add the following entries "
603
"under the <emphasis>[share]</emphasis> entry:"
604
msgstr ""
605
606
#: serverguide/C/windows-networking.xml:540(programlisting)
607
#, no-wrap
608
msgid ""
609
"\n"
610
" read list = @qa\n"
611
" write list = @sysadmin, vincent\n"
612
msgstr ""
613
614
#: serverguide/C/windows-networking.xml:545(para)
615
msgid ""
616
"Another possible Samba permission is to declare "
617
"<emphasis>administrative</emphasis> permissions to a particular shared "
618
"resource. Users having administrative permissions may read, write, or modify "
619
"any information contained in the resource the user has been given explicit "
620
"administrative permissions to."
621
msgstr ""
622
623
#: serverguide/C/windows-networking.xml:551(para)
624
msgid ""
625
"For example, if you wanted to give the user <emphasis "
626
"role=\"italic\">melissa</emphasis> administrative permissions to the "
627
"<emphasis role=\"italic\">share</emphasis> example, you would edit the "
628
"<filename>/etc/samba/smb.conf</filename> file, and add the following line "
629
"under the <emphasis>[share]</emphasis> entry:"
630
msgstr ""
631
632
#: serverguide/C/windows-networking.xml:558(programlisting)
633
#, no-wrap
634
msgid ""
635
"\n"
636
" admin users = melissa\n"
637
msgstr ""
638
639
#: serverguide/C/windows-networking.xml:562(para)
640
msgid ""
641
"After editing <filename>/etc/samba/smb.conf</filename>, restart Samba for "
642
"the changes to take effect:"
643
msgstr ""
644
645
#: serverguide/C/windows-networking.xml:571(para)
646
msgid ""
647
"For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> "
648
"to work the Samba security mode must <emphasis>not</emphasis> be set to "
649
"<emphasis role=\"italic\">security = share</emphasis>"
650
msgstr ""
651
652
#: serverguide/C/windows-networking.xml:577(para)
653
msgid ""
654
"Now that Samba has been configured to limit which groups have access to the "
655
"shared directory, the filesystem permissions need to be updated."
656
msgstr ""
657
658
#: serverguide/C/windows-networking.xml:582(para)
659
msgid ""
660
"Traditional Linux file permissions do not map well to Windows NT Access "
661
"Control Lists (ACLs). Fortunately POSIX ACLs are available on Ubuntu servers "
662
"providing more fine grained control. For example, to enable ACLs on "
663
"<filename>/srv</filename> an EXT3 filesystem, edit "
664
"<filename>/etc/fstab</filename> adding the <emphasis>acl</emphasis> option:"
665
msgstr ""
666
667
#: serverguide/C/windows-networking.xml:589(programlisting)
668
#, no-wrap
669
msgid ""
670
"\n"
671
"UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl "
672
"0 1\n"
673
msgstr ""
674
675
#: serverguide/C/windows-networking.xml:593(para)
676
msgid "Then remount the partition:"
677
msgstr ""
678
679
#: serverguide/C/windows-networking.xml:598(command)
680
msgid "sudo mount -v -o remount /srv"
681
msgstr ""
682
683
#: serverguide/C/windows-networking.xml:602(para)
684
msgid ""
685
"The above example assumes <filename>/srv</filename> on a separate partition. "
686
"If <filename>/srv</filename>, or wherever you have configured your share "
687
"path, is part of the <filename>/</filename> partition a reboot may be "
688
"required."
689
msgstr ""
690
691
#: serverguide/C/windows-networking.xml:609(para)
692
msgid ""
693
"To match the Samba configuration above the <emphasis>sysadmin</emphasis> "
694
"group will be given read, write, and execute permissions to "
695
"<filename>/srv/samba/share</filename>, the <emphasis>qa</emphasis> group "
696
"will be given read and execute permissions, and the files will be owned by "
697
"the username <emphasis>melissa</emphasis>. Enter the following in a terminal:"
698
msgstr ""
699
700
#: serverguide/C/windows-networking.xml:617(command)
701
msgid "sudo chown -R melissa /srv/samba/share/"
702
msgstr ""
703
704
#: serverguide/C/windows-networking.xml:618(command)
705
msgid "sudo chgrp -R sysadmin /srv/samba/share/"
706
msgstr ""
707
708
#: serverguide/C/windows-networking.xml:619(command)
709
msgid "sudo setfacl -R -m g:qa:rx /srv/samba/share/"
710
msgstr ""
711
712
#: serverguide/C/windows-networking.xml:623(para)
713
msgid ""
714
"The <application>setfacl</application> command above gives "
715
"<emphasis>execute</emphasis> permissions to all files in the "
716
"<filename>/srv/samba/share</filename> directory, which you may or may not "
717
"want."
718
msgstr ""
719
720
#: serverguide/C/windows-networking.xml:629(para)
721
msgid ""
722
"Now from a Windows client you should notice the new file permissions are "
723
"implemented. See the <application>acl</application> and "
724
"<application>setfacl</application> man pages for more information on POSIX "
725
"ACLs."
726
msgstr ""
727
728
#: serverguide/C/windows-networking.xml:637(title)
729
msgid "Samba AppArmor Profile"
730
msgstr ""
731
732
#: serverguide/C/windows-networking.xml:639(para)
733
msgid ""
734
"Ubuntu comes with the <application>AppArmor</application> security module, "
735
"which provides mandatory access controls. The default AppArmor profile for "
736
"Samba will need to be adapted to your configuration. For more details on "
737
"using AppArmor see <xref linkend=\"apparmor\"/>."
738
msgstr ""
739
740
#: serverguide/C/windows-networking.xml:645(para)
741
msgid ""
742
"There are default AppArmor profiles for <filename>/usr/sbin/smbd</filename> "
743
"and <filename>/usr/sbin/nmbd</filename>, the Samba daemon binaries, as part "
744
"of the <application>apparmor-profiles</application> packages. To install the "
745
"package, from a terminal prompt enter:"
746
msgstr ""
747
748
#: serverguide/C/windows-networking.xml:652(command) serverguide/C/security.xml:925(command)
749
msgid "sudo apt-get install apparmor-profiles"
750
msgstr ""
751
752
#: serverguide/C/windows-networking.xml:656(para)
753
msgid "This package contains profiles for several other binaries."
754
msgstr ""
755
756
#: serverguide/C/windows-networking.xml:661(para)
757
msgid ""
758
"By default the profiles for <application>smbd</application> and "
759
"<application>nmbd</application> are in <emphasis>complain</emphasis> mode "
760
"allowing Samba to work without modifying the profile, and only logging "
761
"errors. To place the <application>smbd</application> profile into "
762
"<emphasis>enforce</emphasis> mode, and have Samba work as expected, the "
763
"profile will need to be modified to reflect any directories that are shared."
764
msgstr ""
765
766
#: serverguide/C/windows-networking.xml:668(para)
767
msgid ""
768
"Edit <filename>/etc/apparmor.d/usr.sbin.smbd</filename> adding information "
769
"for <emphasis>[share]</emphasis> from the file server example:"
770
msgstr ""
771
772
#: serverguide/C/windows-networking.xml:673(programlisting)
773
#, no-wrap
774
msgid ""
775
"\n"
776
" /srv/samba/share/ r,\n"
777
" /srv/samba/share/** rwkix,\n"
778
msgstr ""
779
780
#: serverguide/C/windows-networking.xml:678(para)
781
msgid ""
782
"Now place the profile into <emphasis>enforce</emphasis> and reload it:"
783
msgstr ""
784
785
#: serverguide/C/windows-networking.xml:683(command)
786
msgid "sudo aa-enforce /usr/sbin/smbd"
787
msgstr ""
788
789
#: serverguide/C/windows-networking.xml:684(command)
790
msgid "cat /etc/apparmor.d/usr.sbin.smbd | sudo apparmor_parser -r"
791
msgstr ""
792
793
#: serverguide/C/windows-networking.xml:687(para)
794
msgid ""
795
"You should now be able to read, write, and execute files in the shared "
796
"directory as normal, and the <application>smbd</application> binary will "
797
"have access to only the configured files and directories. Be sure to add "
798
"entries for each directory you configure Samba to share. Also, any errors "
799
"will be logged to <filename>/var/log/syslog</filename>."
800
msgstr ""
801
802
#: serverguide/C/windows-networking.xml:712(para) serverguide/C/windows-networking.xml:1082(para)
803
msgid ""
804
"O'Reilly's <ulink "
805
"url=\"http://www.oreilly.com/catalog/9780596007690/\">Using Samba</ulink> is "
806
"also a good reference."
807
msgstr ""
808
809
#: serverguide/C/windows-networking.xml:718(para)
810
msgid ""
811
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-"
812
"samba.html\">Chapter 18</ulink> of the Samba HOWTO Collection is devoted to "
813
"security."
814
msgstr ""
815
816
#: serverguide/C/windows-networking.xml:724(para)
817
msgid ""
818
"For more information on Samba and ACLs see the <ulink "
819
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-"
820
"Collection/AccessControls.html#id397568\">Samba ACLs page </ulink>."
821
msgstr ""
822
823
#: serverguide/C/windows-networking.xml:740(title)
824
msgid "Samba as a Domain Controller"
825
msgstr ""
826
827
#: serverguide/C/windows-networking.xml:742(para)
828
msgid ""
829
"Although it cannot act as an Active Directory Primary Domain Controller "
830
"(PDC), a Samba server can be configured to appear as a Windows NT4-style "
831
"domain controller. A major advantage of this configuration is the ability to "
832
"centralize user and machine credentials. Samba can also use multiple "
833
"backends to store the user information."
834
msgstr ""
835
836
#: serverguide/C/windows-networking.xml:749(title)
837
msgid "Primary Domain Controller"
838
msgstr ""
839
840
#: serverguide/C/windows-networking.xml:751(para)
841
msgid ""
842
"This section covers configuring Samba as a Primary Domain Controller (PDC) "
843
"using the default smbpasswd backend."
844
msgstr ""
845
846
#: serverguide/C/windows-networking.xml:758(para)
847
msgid ""
848
"First, install Samba, and <application>libpam-smbpass</application> to sync "
849
"the user accounts, by entering the following in a terminal prompt:"
850
msgstr ""
851
852
#: serverguide/C/windows-networking.xml:764(command) serverguide/C/windows-networking.xml:980(command)
853
msgid "sudo apt-get install samba libpam-smbpass"
854
msgstr ""
855
856
#: serverguide/C/windows-networking.xml:770(para)
857
msgid ""
858
"Next, configure Samba by editing <filename>/etc/samba/smb.conf</filename>. "
859
"The <emphasis>security</emphasis> mode should be set to <emphasis "
860
"role=\"italic\">user</emphasis>, and the <emphasis>workgroup</emphasis> "
861
"should relate to your organization:"
862
msgstr ""
863
864
#: serverguide/C/windows-networking.xml:785(para)
865
msgid ""
866
"In the commented <quote>Domains</quote> section add or uncomment the "
867
"following:"
868
msgstr ""
869
870
#: serverguide/C/windows-networking.xml:789(programlisting)
871
#, no-wrap
872
msgid ""
873
"\n"
874
" domain logons = yes\n"
875
" logon path = \\\\%N\\%U\\profile\n"
876
" logon drive = H:\n"
877
" logon home = \\\\%N\\%U\n"
878
" logon script = logon.cmd\n"
879
" add machine script = sudo /usr/sbin/useradd -N -g machines -c Machine -d "
880
"/var/lib/samba -s /bin/false %u\n"
881
msgstr ""
882
883
#: serverguide/C/windows-networking.xml:800(para)
884
msgid ""
885
"<emphasis>domain logons:</emphasis> provides the netlogon service causing "
886
"Samba to act as a domain controller."
887
msgstr ""
888
889
#: serverguide/C/windows-networking.xml:805(para)
890
msgid ""
891
"<emphasis>logon path:</emphasis> places the user's Windows profile into "
892
"their home directory. It is also possible to configure a "
893
"<emphasis>[profiles]</emphasis> share placing all profiles under a single "
894
"directory."
895
msgstr ""
896
897
#: serverguide/C/windows-networking.xml:811(para)
898
msgid ""
899
"<emphasis>logon drive:</emphasis> specifies the home directory local path."
900
msgstr ""
901
902
#: serverguide/C/windows-networking.xml:816(para)
903
msgid ""
904
"<emphasis>logon home:</emphasis> specifies the home directory location."
905
msgstr ""
906
907
#: serverguide/C/windows-networking.xml:821(para)
908
msgid ""
909
"<emphasis>logon script:</emphasis> determines the script to be run locally "
910
"once a user has logged in. The script needs to be placed in the "
911
"<emphasis>[netlogon]</emphasis> share."
912
msgstr ""
913
914
#: serverguide/C/windows-networking.xml:827(para)
915
msgid ""
916
"<emphasis>add machine script:</emphasis> a script that will automatically "
917
"create the <emphasis>Machine Trust Account</emphasis> needed for a "
918
"workstation to join the domain."
919
msgstr ""
920
921
#: serverguide/C/windows-networking.xml:831(para)
922
msgid ""
923
"In this example the <emphasis>machines</emphasis> group will need to be "
924
"created using the <application>addgroup</application> utility see <xref "
925
"linkend=\"adding-deleting-users\"/> for details."
926
msgstr ""
927
928
#: serverguide/C/windows-networking.xml:839(para)
929
msgid ""
930
"If you wish to not use <emphasis>Roaming Profiles</emphasis> leave the "
931
"<emphasis>logon home</emphasis> and <emphasis>logon path</emphasis> options "
932
"commented."
933
msgstr ""
934
935
#: serverguide/C/windows-networking.xml:848(para)
936
msgid ""
937
"Uncomment the <emphasis>[homes]</emphasis> share to allow the <emphasis "
938
"role=\"italic\">logon home</emphasis> to be mapped:"
939
msgstr ""
940
941
#: serverguide/C/windows-networking.xml:853(programlisting)
942
#, no-wrap
943
msgid ""
944
"\n"
945
"[homes]\n"
946
" comment = Home Directories\n"
947
" browseable = no\n"
948
" read only = no\n"
949
" create mask = 0700\n"
950
" directory mask = 0700\n"
951
" valid users = %S\n"
952
msgstr ""
953
954
#: serverguide/C/windows-networking.xml:866(para)
955
msgid ""
956
"When configured as a domain controller a <emphasis>[netlogon]</emphasis> "
957
"share needs to be configured. To enable the share, uncomment:"
958
msgstr ""
959
960
#: serverguide/C/windows-networking.xml:871(programlisting)
961
#, no-wrap
962
msgid ""
963
"\n"
964
"[netlogon]\n"
965
" comment = Network Logon Service\n"
966
" path = /srv/samba/netlogon\n"
967
" guest ok = yes\n"
968
" read only = yes\n"
969
" share modes = no\n"
970
msgstr ""
971
972
#: serverguide/C/windows-networking.xml:881(para)
973
msgid ""
974
"The original <emphasis>netlogon</emphasis> share path is "
975
"<filename>/home/samba/netlogon</filename>, but according to the Filesystem "
976
"Hierarchy Standard (FHS), <ulink url=\"http://www.pathname.com/fhs/pub/fhs-"
977
"2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM\">/srv</ulink> is the correct "
978
"location for site-specific data provided by the system."
979
msgstr ""
980
981
#: serverguide/C/windows-networking.xml:892(para)
982
msgid ""
983
"Now create the <filename role=\"directory\">netlogon</filename> directory, "
984
"and an empty (for now) <filename>logon.cmd</filename> script file:"
985
msgstr ""
986
987
#: serverguide/C/windows-networking.xml:898(command)
988
msgid "sudo mkdir -p /srv/samba/netlogon"
989
msgstr ""
990
991
#: serverguide/C/windows-networking.xml:899(command)
992
msgid "sudo touch /srv/samba/netlogon/logon.cmd"
993
msgstr ""
994
995
#: serverguide/C/windows-networking.xml:902(para)
996
msgid ""
997
"You can enter any normal Windows logon script commands in "
998
"<filename>logon.cmd</filename> to customize the client's environment."
999
msgstr ""
1000
1001
#: serverguide/C/windows-networking.xml:910(para)
1002
msgid ""
1003
"With <emphasis>root</emphasis> being disabled by default, in order to join a "
1004
"workstation to the domain, a system group needs to be mapped to the Windows "
1005
"<emphasis>Domain Admins</emphasis> group. Using the "
1006
"<application>net</application> utility, from a terminal enter:"
1007
msgstr ""
1008
1009
#: serverguide/C/windows-networking.xml:917(command)
1010
msgid ""
1011
"sudo net groupmap add ntgroup=\"Domain Admins\" unixgroup=sysadmin rid=512 "
1012
"type=d"
1013
msgstr ""
1014
1015
#: serverguide/C/windows-networking.xml:921(para)
1016
msgid ""
1017
"Change <emphasis role=\"italic\">sysadmin</emphasis> to whichever group you "
1018
"prefer. Also, the user used to join the domain needs to be a member of the "
1019
"<emphasis>sysadmin</emphasis> group, as well as a member of the system "
1020
"<emphasis>admin</emphasis> group. The <emphasis>admin</emphasis> group "
1021
"allows <application>sudo</application> use."
1022
msgstr ""
1023
1024
#: serverguide/C/windows-networking.xml:932(para)
1025
msgid "Finally, restart Samba to enable the new domain controller:"
1026
msgstr ""
1027
1028
#: serverguide/C/windows-networking.xml:943(para)
1029
msgid ""
1030
"You should now be able to join Windows clients to the Domain in the same "
1031
"manner as joining them to an NT4 domain running on a Windows server."
1032
msgstr ""
1033
1034
#: serverguide/C/windows-networking.xml:953(title)
1035
msgid "Backup Domain Controller"
1036
msgstr ""
1037
1038
#: serverguide/C/windows-networking.xml:955(para)
1039
msgid ""
1040
"With a Primary Domain Controller (PDC) on the network it is best to have a "
1041
"Backup Domain Controller (BDC) as well. This will allow clients to "
1042
"authenticate in case the PDC becomes unavailable."
1043
msgstr ""
1044
1045
#: serverguide/C/windows-networking.xml:960(para)
1046
msgid ""
1047
"When configuring Samba as a BDC you need a way to sync account information "
1048
"with the PDC. There are multiple ways of accomplishing this "
1049
"<application>scp</application>, <application>rsync</application>, or by "
1050
"using <application>LDAP</application> as the <emphasis>passdb "
1051
"backend</emphasis>."
1052
msgstr ""
1053
1054
#: serverguide/C/windows-networking.xml:966(para)
1055
msgid ""
1056
"Using LDAP is the most robust way to sync account information, because both "
1057
"domain controllers can use the same information in real time. However, "
1058
"setting up a LDAP server may be overly complicated for a small number of "
1059
"user and computer accounts. See <xref linkend=\"samba-ldap\"/> for details."
1060
msgstr ""
1061
1062
#: serverguide/C/windows-networking.xml:975(para)
1063
msgid ""
1064
"First, install <application>samba</application> and <application>libpam-"
1065
"smbpass</application>. From a terminal enter:"
1066
msgstr ""
1067
1068
#: serverguide/C/windows-networking.xml:986(para)
1069
msgid ""
1070
"Now, edit <filename>/etc/samba/smb.conf</filename> and uncomment the "
1071
"following in the <emphasis>[global]</emphasis>:"
1072
msgstr ""
1073
1074
#: serverguide/C/windows-networking.xml:999(para)
1075
msgid "In the commented <emphasis>Domains</emphasis> uncomment or add:"
1076
msgstr ""
1077
1078
#: serverguide/C/windows-networking.xml:1003(programlisting)
1079
#, no-wrap
1080
msgid ""
1081
"\n"
1082
" domain logons = yes\n"
1083
" domain master = no\n"
1084
msgstr ""
1085
1086
#: serverguide/C/windows-networking.xml:1011(para)
1087
msgid ""
1088
"Make sure a user has rights to read the files in "
1089
"<filename>/var/lib/samba</filename>. For example, to allow users in the "
1090
"<emphasis>admin</emphasis> group to <application>scp</application> the "
1091
"files, enter:"
1092
msgstr ""
1093
1094
#: serverguide/C/windows-networking.xml:1017(command)
1095
msgid "sudo chgrp -R admin /var/lib/samba"
1096
msgstr ""
1097
1098
#: serverguide/C/windows-networking.xml:1023(para)
1099
msgid ""
1100
"Next, sync the user accounts, using <application>scp</application> to copy "
1101
"the <filename>/var/lib/samba</filename> directory from the PDC:"
1102
msgstr ""
1103
1104
#: serverguide/C/windows-networking.xml:1029(command)
1105
msgid "sudo scp -r username@pdc:/var/lib/samba /var/lib"
1106
msgstr ""
1107
1108
#: serverguide/C/windows-networking.xml:1033(para)
1109
msgid ""
1110
"Replace <emphasis>username</emphasis> with a valid username and "
1111
"<emphasis>pdc</emphasis> with the hostname or IP Address of your actual PDC."
1112
msgstr ""
1113
1114
#: serverguide/C/windows-networking.xml:1042(para)
1115
msgid "Finally, restart <application>samba</application>:"
1116
msgstr ""
1117
1118
#: serverguide/C/windows-networking.xml:1053(para)
1119
msgid ""
1120
"You can test that your Backup Domain controller is working by stopping the "
1121
"Samba daemon on the PDC, then trying to login to a Windows client joined to "
1122
"the domain."
1123
msgstr ""
1124
1125
#: serverguide/C/windows-networking.xml:1058(para)
1126
msgid ""
1127
"Another thing to keep in mind is if you have configured the <emphasis>logon "
1128
"home</emphasis> option as a directory on the PDC, and the PDC becomes "
1129
"unavailable, access to the user's <emphasis>Home</emphasis> drive will also "
1130
"be unavailable. For this reason it is best to configure the <emphasis>logon "
1131
"home</emphasis> to reside on a separate file server from the PDC and BDC."
1132
msgstr ""
1133
1134
#: serverguide/C/windows-networking.xml:1088(para)
1135
msgid ""
1136
"<ulink url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/samba-"
1137
"pdc.html\">Chapter 4</ulink> of the Samba HOWTO Collection explains setting "
1138
"up a Primary Domain Controller."
1139
msgstr ""
1140
1141
#: serverguide/C/windows-networking.xml:1094(para)
1142
msgid ""
1143
"<ulink url=\"http://us3.samba.org/samba/docs/man/Samba-HOWTO-"
1144
"Collection/samba-bdc.html\">Chapter 5</ulink> of the Samba HOWTO Collection "
1145
"explains setting up a Backup Domain Controller."
1146
msgstr ""
1147
1148
#: serverguide/C/windows-networking.xml:1109(title)
1149
msgid "Samba Active Directory Integration"
1150
msgstr ""
1151
1152
#: serverguide/C/windows-networking.xml:1112(title)
1153
msgid "Accessing a Samba Share"
1154
msgstr ""
1155
1156
#: serverguide/C/windows-networking.xml:1114(para)
1157
msgid ""
1158
"Another, use for Samba is to integrate into an existing Windows network. "
1159
"Once part of an Active Directory domain, Samba can provide file and print "
1160
"services to AD users."
1161
msgstr ""
1162
1163
#: serverguide/C/windows-networking.xml:1119(para)
1164
msgid ""
1165
"The simplest way to join an AD domain is to use <application>Likewise-"
1166
"open</application>. For detailed instructions see <xref linkend=\"likewise-"
1167
"open\"/>."
1168
msgstr ""
1169
1170
#: serverguide/C/windows-networking.xml:1124(para)
1171
msgid ""
1172
"Once part of the domain, enter the following command in the terminal prompt:"
1173
msgstr ""
1174
1175
#: serverguide/C/windows-networking.xml:1129(command)
1176
msgid "sudo apt-get install samba smbfs smbclient"
1177
msgstr ""
1178
1179
#: serverguide/C/windows-networking.xml:1132(para)
1180
msgid ""
1181
"Since the <application>likewise-open</application> and "
1182
"<application>samba</application> packages use separate "
1183
"<filename>secrets.tdb</filename> files, a symlink will need to be created in "
1184
"<filename role=\"directory\">/var/lib/samba</filename>:"
1185
msgstr ""
1186
1187
#: serverguide/C/windows-networking.xml:1138(command)
1188
msgid "sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig"
1189
msgstr ""
1190
1191
#: serverguide/C/windows-networking.xml:1139(command)
1192
msgid "sudo ln -s /etc/samba/secrets.tdb /var/lib/samba"
1193
msgstr ""
1194
1195
#: serverguide/C/windows-networking.xml:1142(para)
1196
msgid "Next, edit <filename>/etc/samba/smb.conf</filename> changing:"
1197
msgstr ""
1198
1199
#: serverguide/C/windows-networking.xml:1146(programlisting)
1200
#, no-wrap
1201
msgid ""
1202
"\n"
1203
" workgroup = EXAMPLE\n"
1204
" ...\n"
1205
" security = ads\n"
1206
" realm = EXAMPLE.COM\n"
1207
" ...\n"
1208
" idmap backend = lwopen\n"
1209
" idmap uid = 50-9999999999\n"
1210
" idmap gid = 50-9999999999\n"
1211
msgstr ""
1212
1213
#: serverguide/C/windows-networking.xml:1157(para)
1214
msgid ""
1215
"Restart <application>samba</application> for the new settings to take effect:"
1216
msgstr ""
1217
1218
#: serverguide/C/windows-networking.xml:1165(para)
1219
msgid ""
1220
"You should now be able to access any <application>Samba</application> shares "
1221
"from a Windows client. However, be sure to give the appropriate AD users or "
1222
"groups access to the share directory. See <xref linkend=\"samba-fileprint-"
1223
"security\"/> for more details."
1224
msgstr ""
1225
1226
#: serverguide/C/windows-networking.xml:1173(title)
1227
msgid "Accessing a Windows Share"
1228
msgstr ""
1229
1230
#: serverguide/C/windows-networking.xml:1175(para)
1231
msgid ""
1232
"Now that the Samba server is part of the Active Directory domain you can "
1233
"access any Windows server shares:"
1234
msgstr ""
1235
1236
#: serverguide/C/windows-networking.xml:1182(para)
1237
msgid ""
1238
"To mount a Windows file share enter the following in a terminal prompt:"
1239
msgstr ""
1240
1241
#: serverguide/C/windows-networking.xml:1186(command)
1242
msgid "mount.cifs //fs01.example.com/share mount_point"
1243
msgstr ""
1244
1245
#: serverguide/C/windows-networking.xml:1189(para)
1246
msgid ""
1247
"It is also possible to access shares on computers not part of an AD domain, "
1248
"but a username and password will need to be provided."
1249
msgstr ""
1250
1251
#: serverguide/C/windows-networking.xml:1197(para)
1252
msgid ""
1253
"To mount the share during boot place an entry in "
1254
"<filename>/etc/fstab</filename>, for example:"
1255
msgstr ""
1256
1257
#: serverguide/C/windows-networking.xml:1201(programlisting)
1258
#, no-wrap
1259
msgid ""
1260
"\n"
1261
"//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw "
1262
"0 0\n"
1263
msgstr ""
1264
1265
#: serverguide/C/windows-networking.xml:1208(para)
1266
msgid ""
1267
"Another way to copy files from a Windows server is to use the "
1268
"<application>smbclient</application> utility. To list the files in a Windows "
1269
"share:"
1270
msgstr ""
1271
1272
#: serverguide/C/windows-networking.xml:1214(command)
1273
msgid "smbclient //fs01.example.com/share -k -c \"ls\""
1274
msgstr ""
1275
1276
#: serverguide/C/windows-networking.xml:1220(para)
1277
msgid "To copy a file from the share, enter:"
1278
msgstr ""
1279
1280
#: serverguide/C/windows-networking.xml:1225(command)
1281
msgid "smbclient //fs01.example.com/share -k -c \"get file.txt\""
1282
msgstr ""
1283
1284
#: serverguide/C/windows-networking.xml:1228(para)
1285
msgid ""
1286
"This will copy the <filename>file.txt</filename> into the current directory."
1287
msgstr ""
1288
1289
#: serverguide/C/windows-networking.xml:1235(para)
1290
msgid "And to copy a file to the share:"
1291
msgstr ""
1292
1293
#: serverguide/C/windows-networking.xml:1240(command)
1294
msgid "smbclient //fs01.example.com/share -k -c \"put /etc/hosts hosts\""
1295
msgstr ""
1296
1297
#: serverguide/C/windows-networking.xml:1243(para)
1298
msgid ""
1299
"This will copy the <filename>/etc/hosts</filename> to "
1300
"<filename>//fs01.example.com/share/hosts</filename>."
1301
msgstr ""
1302
1303
#: serverguide/C/windows-networking.xml:1250(para)
1304
msgid ""
1305
"The <emphasis>-c</emphasis> option used above allows you to execute the "
1306
"<application>smbclient</application> command all at once. This is useful for "
1307
"scripting and minor file operations. To enter the <emphasis>smb: \\"
1308
"></emphasis> prompt, a FTP like prompt where you can execute normal file "
1309
"and directory commands, simply execute:"
1310
msgstr ""
1311
1312
#: serverguide/C/windows-networking.xml:1257(command)
1313
msgid "smbclient //fs01.example.com/share -k"
1314
msgstr ""
1315
1316
#: serverguide/C/windows-networking.xml:1264(para)
1317
msgid ""
1318
"Replace all instances of <emphasis>fs01.example.com/share</emphasis>, "
1319
"<emphasis>//192.168.0.5/share</emphasis>, "
1320
"<emphasis>username=steve,password=secret</emphasis>, and "
1321
"<emphasis>file.txt</emphasis> with your server's IP, hostname, share name, "
1322
"file name, and an actual username and password with rights to the share."
1323
msgstr ""
1324
1325
#: serverguide/C/windows-networking.xml:1275(para)
1326
msgid ""
1327
"For more <application>smbclient</application> options see the man page: "
1328
"<command>man smbclient</command>, also available <ulink "
1329
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/smbclient.1.html\">on"
1330
"line</ulink>."
1331
msgstr ""
1332
1333
#: serverguide/C/windows-networking.xml:1280(para)
1334
msgid ""
1335
"The <application>mount.cifs</application><ulink "
1336
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/mount.cifs.8.html\">m"
1337
"an page</ulink> is also useful for more detailed information."
1338
msgstr ""
1339
1340
#: serverguide/C/windows-networking.xml:1293(title)
1341
msgid "Likewise Open"
1342
msgstr ""
1343
1344
#: serverguide/C/windows-networking.xml:1295(para)
1345
msgid ""
1346
"<application>Likewise Open</application> simplifies the necessary "
1347
"configuration needed to authenticate a Linux machine to an Active Directory "
1348
"domain. Based on <application>winbind</application>, the "
1349
"<application>likewise-open</application> package takes the pain out of "
1350
"integrating Ubuntu authentication into an existing Windows network."
1351
msgstr ""
1352
1353
#: serverguide/C/windows-networking.xml:1304(para)
1354
msgid ""
1355
"There are two ways to use Likewise Open, <application>likewise-"
1356
"open</application> the command line utility and <application>likewise-open-"
1357
"gui</application>. This section focuses on the command line utility."
1358
msgstr ""
1359
1360
#: serverguide/C/windows-networking.xml:1309(para)
1361
msgid ""
1362
"To install the <application>likewise-open</application> package, open a "
1363
"terminal prompt and enter:"
1364
msgstr ""
1365
1366
#: serverguide/C/windows-networking.xml:1314(command)
1367
msgid "sudo apt-get install likewise-open"
1368
msgstr ""
1369
1370
#: serverguide/C/windows-networking.xml:1319(title)
1371
msgid "Joining a Domain"
1372
msgstr ""
1373
1374
#: serverguide/C/windows-networking.xml:1321(para)
1375
msgid ""
1376
"The main executable file of the <application>likewise-open</application> "
1377
"package is <filename>/usr/bin/domainjoin-cli</filename>, which is used to "
1378
"join your computer to the domain. Before you join a domain you will need to "
1379
"make sure you have:"
1380
msgstr ""
1381
1382
#: serverguide/C/windows-networking.xml:1329(para)
1383
msgid ""
1384
"Access to an Active Directory user with appropriate rights to join the "
1385
"domain."
1386
msgstr ""
1387
1388
#: serverguide/C/windows-networking.xml:1334(para)
1389
msgid ""
1390
"The <emphasis>Fully Qualified Domain Name</emphasis> (FQDN) of the domain "
1391
"you want to join. If your AD domain does not match a valid domain such as "
1392
"<emphasis role=\"italic\">example.com</emphasis>, it is likely that it has "
1393
"the form of <emphasis>domainname.local</emphasis>."
1394
msgstr ""
1395
1396
#: serverguide/C/windows-networking.xml:1341(para)
1397
msgid ""
1398
"DNS for the domain setup properly. In a production AD environment this "
1399
"should be the case. Proper Microsoft DNS is needed so that client "
1400
"workstations can determine the Active Directory domain is available."
1401
msgstr ""
1402
1403
#: serverguide/C/windows-networking.xml:1345(para)
1404
msgid ""
1405
"If you don't have a Windows DNS server on your network, see <xref "
1406
"linkend=\"likewise-open-ms-dns\"/> for details."
1407
msgstr ""
1408
1409
#: serverguide/C/windows-networking.xml:1352(para)
1410
msgid "To join a domain, from a terminal prompt enter:"
1411
msgstr ""
1412
1413
#: serverguide/C/windows-networking.xml:1357(command)
1414
msgid "sudo domainjoin-cli join example.com Administrator"
1415
msgstr ""
1416
1417
#: serverguide/C/windows-networking.xml:1361(para)
1418
msgid ""
1419
"Replace <emphasis>example.com</emphasis> with your domain name, and "
1420
"<emphasis>Administrator</emphasis> with the appropriate user name."
1421
msgstr ""
1422
1423
#: serverguide/C/windows-networking.xml:1367(para)
1424
msgid ""
1425
"You will then be prompted for the user's password. If all goes well a "
1426
"<emphasis>SUCCESS</emphasis> message should be printed to the console."
1427
msgstr ""
1428
1429
#: serverguide/C/windows-networking.xml:1373(para)
1430
msgid ""
1431
"After joining the domain, it is necessary to reboot before attempting to "
1432
"authenticate against the domain."
1433
msgstr ""
1434
1435
#: serverguide/C/windows-networking.xml:1379(para)
1436
msgid ""
1437
"After successfully joining an Ubuntu machine to an Active Directory domain "
1438
"you can authenticate using any valid AD user. To login you will need to "
1439
"enter the user name as 'domain\\username'. For example to ssh to a server "
1440
"joined to the domain enter:"
1441
msgstr ""
1442
1443
#: serverguide/C/windows-networking.xml:1386(command)
1444
msgid "ssh 'example\\steve'@hostname"
1445
msgstr ""
1446
1447
#: serverguide/C/windows-networking.xml:1390(para)
1448
msgid ""
1449
"If configuring a Desktop the user name will need to be prefixed with "
1450
"<emphasis role=\"italic\">domain\\</emphasis> in the graphical logon as well."
1451
msgstr ""
1452
1453
#: serverguide/C/windows-networking.xml:1396(para)
1454
msgid ""
1455
"To make likewise-open use a default domain, you can add the following "
1456
"statement to <filename>/etc/samba/lwiauthd.conf</filename>:"
1457
msgstr ""
1458
1459
#: serverguide/C/windows-networking.xml:1400(programlisting)
1460
#, no-wrap
1461
msgid ""
1462
"\n"
1463
"winbind use default domain = yes\n"
1464
msgstr ""
1465
1466
#: serverguide/C/windows-networking.xml:1404(para)
1467
msgid "Then restart the <application>likewise-open</application> daemons:"
1468
msgstr ""
1469
1470
#: serverguide/C/windows-networking.xml:1409(command)
1471
msgid "sudo /etc/init.d/likewise-open restart"
1472
msgstr ""
1473
1474
#: serverguide/C/windows-networking.xml:1413(para)
1475
msgid ""
1476
"Once configured for a <emphasis>default domain</emphasis> the <emphasis "
1477
"role=\"italic\">'domain\\'</emphasis> is no longer required, users can login "
1478
"using only their username."
1479
msgstr ""
1480
1481
#: serverguide/C/windows-networking.xml:1419(para)
1482
msgid ""
1483
"The <application>domainjoin-cli</application> utility can also be used to "
1484
"leave the domain. From a terminal:"
1485
msgstr ""
1486
1487
#: serverguide/C/windows-networking.xml:1424(command)
1488
msgid "sudo domainjoin-cli leave"
1489
msgstr ""
1490
1491
#: serverguide/C/windows-networking.xml:1429(title) serverguide/C/security.xml:1777(title)
1492
msgid "Other Utilities"
1493
msgstr ""
1494
1495
#: serverguide/C/windows-networking.xml:1431(para)
1496
msgid ""
1497
"The <application>likewise-open</application> package comes with a few other "
1498
"utilities that may be useful for gathering information about the Active "
1499
"Directory environment. These utilities are used to join the machine to the "
1500
"domain, and are the same as those available in the <application>samba-"
1501
"common</application> and <application>winbind</application> packages:"
1502
msgstr ""
1503
1504
#: serverguide/C/windows-networking.xml:1440(para)
1505
msgid ""
1506
"<application>lwinet</application>: Returns information about the network and "
1507
"the domain."
1508
msgstr ""
1509
1510
#: serverguide/C/windows-networking.xml:1445(para)
1511
msgid ""
1512
"<application>lwimsg</application>: Allows interaction with the "
1513
"<application>likewise-winbindd</application> daemon."
1514
msgstr ""
1515
1516
#: serverguide/C/windows-networking.xml:1450(para)
1517
msgid ""
1518
"<application>lwiinfo</application>: Displays information about various parts "
1519
"of the Domain."
1520
msgstr ""
1521
1522
#: serverguide/C/windows-networking.xml:1456(para)
1523
msgid "Please refer to each utility's man page specific for details."
1524
msgstr ""
1525
1526
#: serverguide/C/windows-networking.xml:1462(title) serverguide/C/mail.xml:351(title) serverguide/C/mail.xml:1598(title) serverguide/C/dns.xml:338(title)
1527
msgid "Troubleshooting"
1528
msgstr ""
1529
1530
#: serverguide/C/windows-networking.xml:1466(para)
1531
msgid ""
1532
"If the client has trouble joining the domain, double check that the "
1533
"Microsoft DNS is listed first in <filename>/etc/resolv.conf</filename>. For "
1534
"example:"
1535
msgstr ""
1536
1537
#: serverguide/C/windows-networking.xml:1471(programlisting)
1538
#, no-wrap
1539
msgid ""
1540
"\n"
1541
"nameserver 192.168.0.1\n"
1542
msgstr ""
1543
1544
#: serverguide/C/windows-networking.xml:1476(para)
1545
msgid ""
1546
"For more information when joining a domain, use the <emphasis>--loglevel "
1547
"verbose</emphasis> or <emphasis>--advanced</emphasis> option of the "
1548
"<application>domainjoin-cli</application> utility:"
1549
msgstr ""
1550
1551
#: serverguide/C/windows-networking.xml:1482(command)
1552
msgid "sudo domainjoin-cli --loglevel verbose join example.com Administrator"
1553
msgstr ""
1554
1555
#: serverguide/C/windows-networking.xml:1486(para)
1556
msgid ""
1557
"If an Active Directory user has trouble logging in, check the "
1558
"<filename>/var/log/auth.log</filename> for details."
1559
msgstr ""
1560
1561
#: serverguide/C/windows-networking.xml:1491(para)
1562
msgid ""
1563
"When joining an Ubuntu Desktop workstation to a domain, you may need to edit "
1564
"<filename>/etc/nsswitch.conf</filename> if your AD domain uses the <emphasis "
1565
"role=\"italic\">.local</emphasis> syntax. In order to join the domain the "
1566
"<emphasis>\"mdns4\"</emphasis> entry should be removed from the "
1567
"<emphasis>hosts</emphasis> option. For example:"
1568
msgstr ""
1569
1570
#: serverguide/C/windows-networking.xml:1497(programlisting)
1571
#, no-wrap
1572
msgid ""
1573
"\n"
1574
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
1575
msgstr ""
1576
1577
#: serverguide/C/windows-networking.xml:1501(para)
1578
msgid "Change the above to:"
1579
msgstr ""
1580
1581
#: serverguide/C/windows-networking.xml:1505(programlisting)
1582
#, no-wrap
1583
msgid ""
1584
"\n"
1585
"hosts: files dns [NOTFOUND=return]\n"
1586
msgstr ""
1587
1588
#: serverguide/C/windows-networking.xml:1509(para)
1589
msgid "Then restart networking by entering:"
1590
msgstr ""
1591
1592
#: serverguide/C/windows-networking.xml:1514(command) serverguide/C/network-config.xml:559(command)
1593
msgid "sudo /etc/init.d/networking restart"
1594
msgstr ""
1595
1596
#: serverguide/C/windows-networking.xml:1517(para)
1597
msgid "You should now be able to join the Active Directory domain."
1598
msgstr ""
1599
1600
#: serverguide/C/windows-networking.xml:1525(title)
1601
msgid "Microsoft DNS"
1602
msgstr ""
1603
1604
#: serverguide/C/windows-networking.xml:1527(para)
1605
msgid ""
1606
"The following are instructions for installing DNS on an Active Directory "
1607
"domain controller running Windows Server 2003, but the instructions should "
1608
"be similar for other versions:"
1609
msgstr ""
1610
1611
#: serverguide/C/windows-networking.xml:1536(para)
1612
msgid ""
1613
"Click "
1614
"<menuchoice><guimenuitem>Start</guimenuitem><guimenuitem>Administrative Tools"
1615
"</guimenuitem><guimenuitem>Manage Your Server</guimenuitem></menuchoice>. "
1616
"This will open the <application>Server Role Mangement</application> utility."
1617
msgstr ""
1618
1619
#: serverguide/C/windows-networking.xml:1544(para)
1620
msgid "Click <guilabel>Add or remove a role</guilabel>"
1621
msgstr ""
1622
1623
#: serverguide/C/windows-networking.xml:1545(para) serverguide/C/windows-networking.xml:1547(para) serverguide/C/windows-networking.xml:1550(para)
1624
msgid "Click Next"
1625
msgstr ""
1626
1627
#: serverguide/C/windows-networking.xml:1546(para)
1628
msgid "Select \"DNS Server\""
1629
msgstr ""
1630
1631
#: serverguide/C/windows-networking.xml:1548(para)
1632
msgid "Click Next again to proceed"
1633
msgstr ""
1634
1635
#: serverguide/C/windows-networking.xml:1549(para)
1636
msgid "Select \"Create a forward lookup zone\" if it is not selected."
1637
msgstr ""
1638
1639
#: serverguide/C/windows-networking.xml:1551(para)
1640
msgid ""
1641
"Make sure \"This server maintains the zone\" is selected and click Next."
1642
msgstr ""
1643
1644
#: serverguide/C/windows-networking.xml:1552(para)
1645
msgid "Enter your domain name and click Next"
1646
msgstr ""
1647
1648
#: serverguide/C/windows-networking.xml:1553(para)
1649
msgid "Click Next to \"Allow only secure dynamic updates\""
1650
msgstr ""
1651
1652
#: serverguide/C/windows-networking.xml:1555(para)
1653
msgid ""
1654
"Enter the IP for DNS servers to forward queries to, or Select \"No, it "
1655
"should not forward queries\" and click Next."
1656
msgstr ""
1657
1658
#: serverguide/C/windows-networking.xml:1559(para) serverguide/C/windows-networking.xml:1560(para)
1659
msgid "Click Finish"
1660
msgstr ""
1661
1662
#: serverguide/C/windows-networking.xml:1562(para)
1663
msgid ""
1664
"DNS is now installed and can be further configured using the "
1665
"<application>Microsoft Management Console</application> DNS snap-in."
1666
msgstr ""
1667
1668
#: serverguide/C/windows-networking.xml:1570(para)
1669
msgid "Click Start"
1670
msgstr ""
1671
1672
#: serverguide/C/windows-networking.xml:1571(para)
1673
msgid "Control Panel"
1674
msgstr ""
1675
1676
#: serverguide/C/windows-networking.xml:1572(para)
1677
msgid "Network Connections"
1678
msgstr ""
1679
1680
#: serverguide/C/windows-networking.xml:1573(para)
1681
msgid "Right Click \"Local Area Connection\""
1682
msgstr ""
1683
1684
#: serverguide/C/windows-networking.xml:1574(para)
1685
msgid "Click Properties"
1686
msgstr ""
1687
1688
#: serverguide/C/windows-networking.xml:1575(para)
1689
msgid "Double click \"Internet Protocol (TCP/IP)\""
1690
msgstr ""
1691
1692
#: serverguide/C/windows-networking.xml:1576(para)
1693
msgid "Enter the Server's IP Address as the \"Preferred DNS server\""
1694
msgstr ""
1695
1696
#: serverguide/C/windows-networking.xml:1577(para)
1697
msgid "Click Ok"
1698
msgstr ""
1699
1700
#: serverguide/C/windows-networking.xml:1578(para)
1701
msgid "Click Ok again to save the settings"
1702
msgstr ""
1703
1704
#: serverguide/C/windows-networking.xml:1567(para)
1705
msgid ""
1706
"Next, configure the Server to use itself for DNS queries: <placeholder-1/>"
1707
msgstr ""
1708
1709
#: serverguide/C/windows-networking.xml:1585(title) serverguide/C/web-servers.xml:624(title) serverguide/C/web-servers.xml:772(title) serverguide/C/web-servers.xml:922(title) serverguide/C/web-servers.xml:1017(title) serverguide/C/web-servers.xml:1239(title) serverguide/C/vpn.xml:303(title) serverguide/C/virtualization.xml:1840(title) serverguide/C/virtualization.xml:2165(title) serverguide/C/vcs.xml:539(title) serverguide/C/security.xml:877(title) serverguide/C/security.xml:1211(title) serverguide/C/security.xml:1626(title) serverguide/C/security.xml:1817(title) serverguide/C/remote-administration.xml:203(title) serverguide/C/package-management.xml:454(title) serverguide/C/other-apps.xml:330(title) serverguide/C/network-config.xml:1006(title) serverguide/C/network-config.xml:1107(title) serverguide/C/monitoring.xml:391(title) serverguide/C/monitoring.xml:527(title) serverguide/C/mail.xml:459(title) serverguide/C/mail.xml:643(title) serverguide/C/mail.xml:795(title) serverguide/C/mail.xml:1217(title) serverguide/C/mail.xml:1646(title) serverguide/C/lamp-applications.xml:259(title) serverguide/C/lamp-applications.xml:388(title) serverguide/C/lamp-applications.xml:496(title) serverguide/C/file-server.xml:284(title) serverguide/C/file-server.xml:436(title) serverguide/C/file-server.xml:619(title) serverguide/C/dns.xml:572(title) serverguide/C/clustering.xml:234(title) serverguide/C/chat.xml:107(title) serverguide/C/chat.xml:221(title) serverguide/C/backups.xml:297(title)
1710
msgid "References"
1711
msgstr ""
1712
1713
#: serverguide/C/windows-networking.xml:1587(para)
1714
msgid ""
1715
"Please refer to the <ulink "
1716
"url=\"http://www.likewisesoftware.com/\">Likewise</ulink> home page for "
1717
"further information."
1718
msgstr ""
1719
1720
#: serverguide/C/windows-networking.xml:1591(para)
1721
msgid ""
1722
"For more <application>domainjoin-cli</application> options see the man page: "
1723
"<command>man domainjoin-cli</command>."
1724
msgstr ""
1725
1726
#: serverguide/C/windows-networking.xml:1595(para)
1727
msgid ""
1728
"Also, see the <ulink "
1729
"url=\"https://help.ubuntu.com/community/LikewiseOpen\">Ubuntu Wiki "
1730
"LikewiseOpen</ulink> page."
1731
msgstr ""
1732
1733
#: serverguide/C/web-servers.xml:13(title)
1734
msgid "Web Servers"
1735
msgstr ""
1736
1737
#: serverguide/C/web-servers.xml:14(para)
1738
msgid ""
1739
"A Web server is a software responsible for accepting HTTP requests from "
1740
"clients, which are known as Web browsers, and serving them HTTP responses "
1741
"along with optional data contents, which usually are Web pages such as HTML "
1742
"documents and linked objects (images, etc.)."
1743
msgstr ""
1744
1745
#: serverguide/C/web-servers.xml:19(title)
1746
msgid "HTTPD - Apache2 Web Server"
1747
msgstr ""
1748
1749
#: serverguide/C/web-servers.xml:20(para)
1750
msgid ""
1751
"Apache is the most commonly used Web Server on Linux systems. Web Servers "
1752
"are used to serve Web Pages requested by client computers. Clients typically "
1753
"request and view Web Pages using Web Browser applications such as "
1754
"<application>Firefox</application>, <application>Opera</application>, or "
1755
"<application>Mozilla</application>."
1756
msgstr ""
1757
1758
#: serverguide/C/web-servers.xml:24(para)
1759
msgid ""
1760
"Users enter a Uniform Resource Locator (URL) to point to a Web server by "
1761
"means of its Fully Qualified Domain Name (FQDN) and a path to the required "
1762
"resource. For example, to view the home page of the <ulink "
1763
"url=\"http://www.ubuntu.com\">Ubuntu Web site</ulink> a user will enter only "
1764
"the FQDN. To request specific information about <ulink "
1765
"url=\"http://www.ubuntu.com/support/paid\">paid support</ulink>, a user will "
1766
"enter the FQDN followed by a path."
1767
msgstr ""
1768
1769
#: serverguide/C/web-servers.xml:29(para)
1770
msgid ""
1771
"The most common protocol used to transfer Web pages is the Hyper Text "
1772
"Transfer Protocol (HTTP). Protocols such as Hyper Text Transfer Protocol "
1773
"over Secure Sockets Layer (HTTPS), and File Transfer Protocol (FTP), a "
1774
"protocol for uploading and downloading files, are also supported."
1775
msgstr ""
1776
1777
#: serverguide/C/web-servers.xml:33(para)
1778
msgid ""
1779
"Apache Web Servers are often used in combination with the "
1780
"<application>MySQL</application> database engine, the HyperText Preprocessor "
1781
"(<application>PHP</application>) scripting language, and other popular "
1782
"scripting languages such as <application>Python</application> and "
1783
"<application>Perl</application>. This configuration is termed LAMP (Linux, "
1784
"Apache, MySQL and Perl/Python/PHP) and forms a powerful and robust platform "
1785
"for the development and deployment of Web-based applications."
1786
msgstr ""
1787
1788
#: serverguide/C/web-servers.xml:42(para)
1789
msgid ""
1790
"The <application>Apache2</application> web server is available in Ubuntu "
1791
"Linux. To install Apache2:"
1792
msgstr ""
1793
1794
#: serverguide/C/web-servers.xml:48(para)
1795
msgid "At a terminal prompt enter the following command:"
1796
msgstr ""
1797
1798
#: serverguide/C/web-servers.xml:53(command)
1799
msgid "sudo apt-get install apache2"
1800
msgstr ""
1801
1802
#: serverguide/C/web-servers.xml:63(para)
1803
msgid ""
1804
"Apache2 is configured by placing <emphasis>directives</emphasis> in plain "
1805
"text configuration files. These <emphasis>directives</emphasis> are "
1806
"separated between the following files and directories:"
1807
msgstr ""
1808
1809
#: serverguide/C/web-servers.xml:71(para)
1810
msgid ""
1811
"<emphasis>apache2.conf:</emphasis> the main Apache2 configuration file. "
1812
"Contains settings that are <emphasis>global</emphasis> to Apache2."
1813
msgstr ""
1814
1815
#: serverguide/C/web-servers.xml:77(para)
1816
msgid ""
1817
"<emphasis>conf.d:</emphasis> contains configuration files which apply "
1818
"<emphasis>globally</emphasis> to Apache2. Other packages that use Apache2 to "
1819
"serve content may add files, or symlinks, to this directory."
1820
msgstr ""
1821
1822
#: serverguide/C/web-servers.xml:83(para)
1823
msgid ""
1824
"<emphasis>envvars:</emphasis> file where Apache2 "
1825
"<emphasis>environment</emphasis> variables are set."
1826
msgstr ""
1827
1828
#: serverguide/C/web-servers.xml:88(para)
1829
msgid ""
1830
"<emphasis>httpd.conf:</emphasis> historically the main Apache2 configuration "
1831
"file, named after the <application>httpd</application> daemon. The file can "
1832
"be used for <emphasis>user specific</emphasis> configuration options that "
1833
"globally effect Apache2."
1834
msgstr ""
1835
1836
#: serverguide/C/web-servers.xml:95(para)
1837
msgid ""
1838
"<emphasis>mods-available:</emphasis> this directory contains configuration "
1839
"files to both load <emphasis>modules</emphasis> and configure them. Not all "
1840
"modules will have specific configuration files, however."
1841
msgstr ""
1842
1843
#: serverguide/C/web-servers.xml:101(para)
1844
msgid ""
1845
"<emphasis>mods-enabled:</emphasis> holds <emphasis>symlinks</emphasis> to "
1846
"the files in <filename>/etc/apache2/mods-available</filename>. When a module "
1847
"configuration file is symlinked it will be enabled the next time "
1848
"<application>apache2</application> is restarted."
1849
msgstr ""
1850
1851
#: serverguide/C/web-servers.xml:108(para)
1852
msgid ""
1853
"<emphasis>ports.conf:</emphasis> houses the directives that determine which "
1854
"TCP ports Apache2 is listening on."
1855
msgstr ""
1856
1857
#: serverguide/C/web-servers.xml:113(para)
1858
msgid ""
1859
"<emphasis>sites-available:</emphasis> this directory has configuration files "
1860
"for Apache2 <emphasis>Virtual Hosts</emphasis>. Virtual Hosts allow Apache2 "
1861
"to be configured for multiple sites that have separate configurations."
1862
msgstr ""
1863
1864
#: serverguide/C/web-servers.xml:119(para)
1865
msgid ""
1866
"<emphasis>sites-enabled:</emphasis> like mods-enabled, <filename "
1867
"role=\"directory\">sites-enabled</filename> contains symlinks to the "
1868
"<filename>/etc/apache2/sites-available</filename> directory. Similarly when "
1869
"a configuration file in sites-available is symlinked, the site configured by "
1870
"it will be active once Apache2 is restarted."
1871
msgstr ""
1872
1873
#: serverguide/C/web-servers.xml:127(para)
1874
msgid ""
1875
"In addition, other configuration files may be added using the "
1876
"<emphasis>Include</emphasis> directive, and wildcards can be used to include "
1877
"many configuration files. Any directive may be placed in any of these "
1878
"configuration files. Changes to the main configuration files are only "
1879
"recognized by Apache2 when it is started or restarted."
1880
msgstr ""
1881
1882
#: serverguide/C/web-servers.xml:136(para)
1883
msgid ""
1884
"The server also reads a file containing mime document types; the filename is "
1885
"set by the <emphasis>TypesConfig</emphasis> directive, and is "
1886
"<filename>/etc/mime.types</filename> by default."
1887
msgstr ""
1888
1889
#: serverguide/C/web-servers.xml:141(title)
1890
msgid "Basic Settings"
1891
msgstr ""
1892
1893
#: serverguide/C/web-servers.xml:142(para)
1894
msgid ""
1895
"This section explains Apache2 server essential configuration parameters. "
1896
"Refer to the <ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
1897
"Documentation</ulink> for more details."
1898
msgstr ""
1899
1900
#: serverguide/C/web-servers.xml:150(para)
1901
msgid ""
1902
"Apache2 ships with a virtual-host-friendly default configuration. That is, "
1903
"it is configured with a single default virtual host (using the "
1904
"<emphasis>VirtualHost</emphasis> directive) which can modified or used as-is "
1905
"if you have a single site, or used as a template for additional virtual "
1906
"hosts if you have multiple sites. If left alone, the default virtual host "
1907
"will serve as your default site, or the site users will see if the URL they "
1908
"enter does not match the <emphasis>ServerName</emphasis> directive of any of "
1909
"your custom sites. To modify the default virtual host, edit the file "
1910
"<filename>/etc/apache2/sites-available/default</filename>."
1911
msgstr ""
1912
1913
#: serverguide/C/web-servers.xml:163(para)
1914
msgid ""
1915
"The directives set for a virtual host only apply to that particular virtual "
1916
"host. If a directive is set server-wide and not defined within the virtual "
1917
"host settings, the default setting is used. For example, you can define a "
1918
"Webmaster email address and not define individual email addresses for each "
1919
"virtual host."
1920
msgstr ""
1921
1922
#: serverguide/C/web-servers.xml:171(para)
1923
msgid ""
1924
"If you wish to configure a new virtual host or site, copy that file into the "
1925
"same directory with a name you choose. For example:"
1926
msgstr ""
1927
1928
#: serverguide/C/web-servers.xml:177(command)
1929
msgid ""
1930
"sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-"
1931
"available/mynewsite"
1932
msgstr ""
1933
1934
#: serverguide/C/web-servers.xml:180(para)
1935
msgid ""
1936
"Edit the new file to configure the new site using some of the directives "
1937
"described below."
1938
msgstr ""
1939
1940
#: serverguide/C/web-servers.xml:187(para)
1941
msgid ""
1942
"The <emphasis>ServerAdmin</emphasis> directive specifies the email address "
1943
"to be advertised for the server's administrator. The default value is "
1944
"webmaster@localhost. This should be changed to an email address that is "
1945
"delivered to you (if you are the server's administrator). If your website "
1946
"has a problem, Apache2 will display an error message containing this email "
1947
"address to report the problem to. Find this directive in your site's "
1948
"configuration file in /etc/apache2/sites-available."
1949
msgstr ""
1950
1951
#: serverguide/C/web-servers.xml:198(para)
1952
msgid ""
1953
"The <emphasis>Listen</emphasis> directive specifies the port, and optionally "
1954
"the IP address, Apache2 should listen on. If the IP address is not "
1955
"specified, Apache2 will listen on all IP addresses assigned to the machine "
1956
"it runs on. The default value for the Listen directive is 80. Change this to "
1957
"127.0.0.1:80 to cause Apache2 to listen only on your loopback interface so "
1958
"that it will not be available to the Internet, to (for example) 81 to change "
1959
"the port that it listens on, or leave it as is for normal operation. This "
1960
"directive can be found and changed in its own file, "
1961
"<filename>/etc/apache2/ports.conf</filename>"
1962
msgstr ""
1963
1964
#: serverguide/C/web-servers.xml:211(para)
1965
msgid ""
1966
"The <emphasis>ServerName</emphasis> directive is optional and specifies what "
1967
"FQDN your site should answer to. The default virtual host has no ServerName "
1968
"directive specified, so it will respond to all requests that do not match a "
1969
"ServerName directive in another virtual host. If you have just acquired the "
1970
"domain name ubunturocks.com and wish to host it on your Ubuntu server, the "
1971
"value of the ServerName directive in your virtual host configuration file "
1972
"should be ubunturocks.com. Add this directive to the new virtual host file "
1973
"you created earlier (<filename>/etc/apache2/sites-"
1974
"available/mynewsite</filename>)."
1975
msgstr ""
1976
1977
#: serverguide/C/web-servers.xml:223(para)
1978
msgid ""
1979
"You may also want your site to respond to www.ubunturocks.com, since many "
1980
"users will assume the www prefix is appropriate. Use the "
1981
"<emphasis>ServerAlias</emphasis> directive for this. You may also use "
1982
"wildcards in the ServerAlias directive."
1983
msgstr ""
1984
1985
#: serverguide/C/web-servers.xml:230(para)
1986
msgid ""
1987
"For example, the following configuration will cause your site to respond to "
1988
"any domain request ending in <emphasis>.ubunturocks.com</emphasis>."
1989
msgstr ""
1990
1991
#: serverguide/C/web-servers.xml:236(programlisting)
1992
#, no-wrap
1993
msgid ""
1994
"\n"
1995
"ServerAlias *.ubunturocks.com\n"
1996
msgstr ""
1997
1998
#: serverguide/C/web-servers.xml:242(para)
1999
msgid ""
2000
"The <emphasis>DocumentRoot</emphasis> directive specifies where Apache2 "
2001
"should look for the files that make up the site. The default value is "
2002
"/var/www. No site is configured there, but if you uncomment the "
2003
"<emphasis>RedirectMatch</emphasis> directive in "
2004
"<filename>/etc/apache2/apache2.conf</filename> requests will be redirected "
2005
"to /var/www/apache2-default where the default Apache2 site awaits. Change "
2006
"this value in your site's virtual host file, and remember to create that "
2007
"directory if necessary!"
2008
msgstr ""
2009
2010
#: serverguide/C/web-servers.xml:254(para)
2011
msgid ""
2012
"The /etc/apache2/sites-available directory is <emphasis role=\"bold\"> "
2013
"not</emphasis> parsed by Apache2. Symbolic links in /etc/apache2/sites-"
2014
"enabled point to \"available\" sites."
2015
msgstr ""
2016
2017
#: serverguide/C/web-servers.xml:260(para)
2018
msgid ""
2019
"Enable the new <emphasis>VirtualHost</emphasis> using the "
2020
"<application>a2ensite</application> utility and restart Apache2:"
2021
msgstr ""
2022
2023
#: serverguide/C/web-servers.xml:266(command)
2024
msgid "sudo a2ensite mynewsite"
2025
msgstr ""
2026
2027
#: serverguide/C/web-servers.xml:267(command) serverguide/C/web-servers.xml:285(command) serverguide/C/web-servers.xml:538(command) serverguide/C/web-servers.xml:547(command) serverguide/C/web-servers.xml:606(command) serverguide/C/mail.xml:932(command) serverguide/C/lamp-applications.xml:228(command)
2028
msgid "sudo /etc/init.d/apache2 restart"
2029
msgstr ""
2030
2031
#: serverguide/C/web-servers.xml:271(para)
2032
msgid ""
2033
"Be sure to replace <emphasis>mynewsite</emphasis> with a more descriptive "
2034
"name for the VirtualHost. One method is to name the file after the "
2035
"<emphasis>ServerName</emphasis> directive of the VirtualHost."
2036
msgstr ""
2037
2038
#: serverguide/C/web-servers.xml:278(para)
2039
msgid ""
2040
"Similarly, use the <application>a2dissite</application> utility to disable "
2041
"sites. This is can be useful when troubleshooting configuration problems "
2042
"with multiple VirtualHosts:"
2043
msgstr ""
2044
2045
#: serverguide/C/web-servers.xml:284(command)
2046
msgid "sudo a2dissite mynewsite"
2047
msgstr ""
2048
2049
#: serverguide/C/web-servers.xml:290(title)
2050
msgid "Default Settings"
2051
msgstr ""
2052
2053
#: serverguide/C/web-servers.xml:292(para)
2054
msgid ""
2055
"This section explains configuration of the Apache2 server default settings. "
2056
"For example, if you add a virtual host, the settings you configure for the "
2057
"virtual host take precedence for that virtual host. For a directive not "
2058
"defined within the virtual host settings, the default value is used."
2059
msgstr ""
2060
2061
#: serverguide/C/web-servers.xml:304(para)
2062
msgid ""
2063
"The <emphasis>DirectoryIndex</emphasis> is the default page served by the "
2064
"server when a user requests an index of a directory by specifying a forward "
2065
"slash (/) at the end of the directory name."
2066
msgstr ""
2067
2068
#: serverguide/C/web-servers.xml:311(para)
2069
msgid ""
2070
"For example, when a user requests the page "
2071
"http://www.example.com/this_directory/, he or she will get either the "
2072
"DirectoryIndex page if it exists, a server-generated directory list if it "
2073
"does not and the Indexes option is specified, or a Permission Denied page if "
2074
"neither is true. The server will try to find one of the files listed in the "
2075
"DirectoryIndex directive and will return the first one it finds. If it does "
2076
"not find any of these files and if <emphasis>Options Indexes</emphasis> is "
2077
"set for that directory, the server will generate and return a list, in HTML "
2078
"format, of the subdirectories and files in the directory. The default value, "
2079
"found in <filename>/etc/apache2/mods-available/dir.conf</filename> is "
2080
"\"index.html index.cgi index.pl index.php index.xhtml index.htm\". Thus, if "
2081
"Apache2 finds a file in a requested directory matching any of these names, "
2082
"the first will be displayed."
2083
msgstr ""
2084
2085
#: serverguide/C/web-servers.xml:332(para)
2086
msgid ""
2087
"The <emphasis>ErrorDocument</emphasis> directive allows you to specify a "
2088
"file for Apache2 to use for specific error events. For example, if a user "
2089
"requests a resource that does not exist, a 404 error will occur, and per "
2090
"Apache2's default configuration, the file "
2091
"<filename>/usr/share/apache2/error/HTTP_NOT_FOUND.html.var </filename> will "
2092
"be displayed. That file is not in the server's DocumentRoot, but there is an "
2093
"Alias directive in <filename>/etc/apache2/apache2.conf</filename> that "
2094
"redirects requests to the /error directory to "
2095
"<filename>/usr/share/apache2/error/</filename>."
2096
msgstr ""
2097
2098
#: serverguide/C/web-servers.xml:344(para)
2099
msgid ""
2100
"To see a list of the default ErrorDocument directives, use this command:"
2101
msgstr ""
2102
2103
#: serverguide/C/web-servers.xml:350(command)
2104
msgid "grep ErrorDocument /etc/apache2/apache2.conf"
2105
msgstr ""
2106
2107
#: serverguide/C/web-servers.xml:355(para)
2108
msgid ""
2109
"By default, the server writes the transfer log to the file "
2110
"<filename>/var/log/apache2/access.log</filename>. You can change this on a "
2111
"per-site basis in your virtual host configuration files with the "
2112
"<emphasis>CustomLog</emphasis> directive, or omit it to accept the default, "
2113
"specified in <filename> /etc/apache2/apache2.conf</filename>. You may also "
2114
"specify the file to which errors are logged, via the "
2115
"<emphasis>ErrorLog</emphasis> directive, whose default is "
2116
"<filename>/var/log/apache2/error.log</filename>. These are kept separate "
2117
"from the transfer logs to aid in troubleshooting problems with your Apache2 "
2118
"server. You may also specify the <emphasis>LogLevel</emphasis> (the default "
2119
"value is \"warn\") and the <emphasis>LogFormat</emphasis> (see <filename> "
2120
"/etc/apache2/apache2.conf</filename> for the default value)."
2121
msgstr ""
2122
2123
#: serverguide/C/web-servers.xml:370(para)
2124
msgid ""
2125
"Some options are specified on a per-directory basis rather than per-server. "
2126
"<emphasis>Options</emphasis> is one of these directives. A Directory stanza "
2127
"is enclosed in XML-like tags, like so:"
2128
msgstr ""
2129
2130
#: serverguide/C/web-servers.xml:376(programlisting)
2131
#, no-wrap
2132
msgid ""
2133
"\n"
2134
"<Directory /var/www/mynewsite>\n"
2135
"...\n"
2136
"</Directory>\n"
2137
msgstr ""
2138
2139
#: serverguide/C/web-servers.xml:382(para)
2140
msgid ""
2141
"The <emphasis>Options</emphasis> directive within a Directory stanza accepts "
2142
"one or more of the following values (among others), separated by spaces:"
2143
msgstr ""
2144
2145
#: serverguide/C/web-servers.xml:394(para)
2146
msgid ""
2147
"Most files should not be executed as CGI scripts. This would be very "
2148
"dangerous. CGI scripts should kept in a directory separate from and outside "
2149
"your DocumentRoot, and only this directory should have the ExecCGI option "
2150
"set. This is the default, and the default location for CGI scripts is "
2151
"<filename>/usr/lib/cgi-bin</filename>."
2152
msgstr ""
2153
2154
#: serverguide/C/web-servers.xml:389(para)
2155
msgid ""
2156
"<emphasis role=\"bold\">ExecCGI</emphasis> - Allow execution of CGI scripts. "
2157
"CGI scripts are not executed if this option is not chosen. <placeholder-1/>"
2158
msgstr ""
2159
2160
#: serverguide/C/web-servers.xml:405(para)
2161
msgid ""
2162
"<emphasis role=\"bold\">Includes</emphasis> - Allow server-side includes. "
2163
"Server-side includes allow an HTML file to <emphasis> include</emphasis> "
2164
"other files. This is not a common option. See <ulink "
2165
"url=\"http://httpd.apache.org/docs/2.2/howto/ssi.html\">the Apache2 SSI "
2166
"HOWTO</ulink> for more information."
2167
msgstr ""
2168
2169
#: serverguide/C/web-servers.xml:414(para)
2170
msgid ""
2171
"<emphasis role=\"bold\">IncludesNOEXEC</emphasis> - Allow server-side "
2172
"includes, but disable the <emphasis>#exec</emphasis> and "
2173
"<emphasis>#include</emphasis> commands in CGI scripts."
2174
msgstr ""
2175
2176
#: serverguide/C/web-servers.xml:426(para)
2177
msgid ""
2178
"For security reasons, this should usually not be set, and certainly should "
2179
"not be set on your DocumentRoot directory. Enable this option carefully on a "
2180
"per-directory basis only if you are certain you want users to see the entire "
2181
"contents of the directory."
2182
msgstr ""
2183
2184
#: serverguide/C/web-servers.xml:421(para)
2185
msgid ""
2186
"<emphasis role=\"bold\">Indexes</emphasis> - Display a formatted list of the "
2187
"directory's contents, if no <emphasis>DirectoryIndex</emphasis> (such as "
2188
"index.html) exists in the requested directory. <placeholder-1/>"
2189
msgstr ""
2190
2191
#: serverguide/C/web-servers.xml:436(para)
2192
msgid ""
2193
"<emphasis role=\"bold\">Multiview</emphasis> - Support content-negotiated "
2194
"multiviews; this option is disabled by default for security reasons. See the "
2195
"<ulink "
2196
"url=\"http://httpd.apache.org/docs/2.2/mod/mod_negotiation.html#multiviews\">"
2197
"Apache2 documentation on this option</ulink>."
2198
msgstr ""
2199
2200
#: serverguide/C/web-servers.xml:444(para)
2201
msgid ""
2202
"<emphasis role=\"bold\">SymLinksIfOwnerMatch</emphasis> - Only follow "
2203
"symbolic links if the target file or directory has the same owner as the "
2204
"link."
2205
msgstr ""
2206
2207
#: serverguide/C/web-servers.xml:456(title)
2208
msgid "httpd Settings"
2209
msgstr ""
2210
2211
#: serverguide/C/web-servers.xml:458(para)
2212
msgid ""
2213
"This section explains some basic <application>httpd</application> daemon "
2214
"configuration settings."
2215
msgstr ""
2216
2217
#: serverguide/C/web-servers.xml:462(para)
2218
msgid ""
2219
"<emphasis role=\"bold\">LockFile</emphasis> - The LockFile directive sets "
2220
"the path to the lockfile used when the server is compiled with either "
2221
"USE_FCNTL_SERIALIZED_ACCEPT or USE_FLOCK_SERIALIZED_ACCEPT. It must be "
2222
"stored on the local disk. It should be left to the default value unless the "
2223
"logs directory is located on an NFS share. If this is the case, the default "
2224
"value should be changed to a location on the local disk and to a directory "
2225
"that is readable only by root."
2226
msgstr ""
2227
2228
#: serverguide/C/web-servers.xml:471(para)
2229
msgid ""
2230
"<emphasis role=\"bold\">PidFile</emphasis> - The PidFile directive sets the "
2231
"file in which the server records its process ID (pid). This file should only "
2232
"be readable by root. In most cases, it should be left to the default value."
2233
msgstr ""
2234
2235
#: serverguide/C/web-servers.xml:477(para)
2236
msgid ""
2237
"<emphasis role=\"bold\">User</emphasis> - The User directive sets the userid "
2238
"used by the server to answer requests. This setting determines the server's "
2239
"access. Any files inaccessible to this user will also be inaccessible to "
2240
"your website's visitors. The default value for User is www-data."
2241
msgstr ""
2242
2243
#: serverguide/C/web-servers.xml:484(para)
2244
msgid ""
2245
"Unless you know exactly what you are doing, do not set the User directive to "
2246
"root. Using root as the User will create large security holes for your Web "
2247
"server."
2248
msgstr ""
2249
2250
#: serverguide/C/web-servers.xml:490(para)
2251
msgid ""
2252
"The Group directive is similar to the User directive. Group sets the group "
2253
"under which the server will answer requests. The default group is also www-"
2254
"data."
2255
msgstr ""
2256
2257
#: serverguide/C/web-servers.xml:496(title)
2258
msgid "Apache2 Modules"
2259
msgstr ""
2260
2261
#: serverguide/C/web-servers.xml:498(para)
2262
msgid ""
2263
"Apache2 is a modular server. This implies that only the most basic "
2264
"functionality is included in the core server. Extended features are "
2265
"available through modules which can be loaded into Apache2. By default, a "
2266
"base set of modules is included in the server at compile-time. If the server "
2267
"is compiled to use dynamically loaded modules, then modules can be compiled "
2268
"separately, and added at any time using the LoadModule directive. Otherwise, "
2269
"Apache2 must be recompiled to add or remove modules."
2270
msgstr ""
2271
2272
#: serverguide/C/web-servers.xml:510(para)
2273
msgid ""
2274
"Ubuntu compiles Apache2 to allow the dynamic loading of modules. "
2275
"Configuration directives may be conditionally included on the presence of a "
2276
"particular module by enclosing them in an "
2277
"<emphasis><IfModule></emphasis> block."
2278
msgstr ""
2279
2280
#: serverguide/C/web-servers.xml:517(para)
2281
msgid ""
2282
"You can install additional Apache2 modules and use them with your Web "
2283
"server. For example, run the following command from a terminal prompt to "
2284
"install the <emphasis>MySQL Authentication</emphasis> module:"
2285
msgstr ""
2286
2287
#: serverguide/C/web-servers.xml:524(command)
2288
msgid "sudo apt-get install libapache2-mod-auth-mysql"
2289
msgstr ""
2290
2291
#: serverguide/C/web-servers.xml:527(para)
2292
msgid ""
2293
"See the <filename>/etc/apache2/mods-available</filename> directory, for "
2294
"additional modules."
2295
msgstr ""
2296
2297
#: serverguide/C/web-servers.xml:531(para)
2298
msgid ""
2299
"Use the <application>a2enmod</application> utility to enable a module:"
2300
msgstr ""
2301
2302
#: serverguide/C/web-servers.xml:537(command)
2303
msgid "sudo a2enmod auth_mysql"
2304
msgstr ""
2305
2306
#: serverguide/C/web-servers.xml:541(para)
2307
msgid "Similarly, <application>a2dismod</application> will disable a module:"
2308
msgstr ""
2309
2310
#: serverguide/C/web-servers.xml:546(command)
2311
msgid "sudo a2dismod auth_mysql"
2312
msgstr ""
2313
2314
#: serverguide/C/web-servers.xml:553(title)
2315
msgid "HTTPS Configuration"
2316
msgstr ""
2317
2318
#: serverguide/C/web-servers.xml:555(para)
2319
msgid ""
2320
"The <application>mod_ssl</application> module adds an important feature to "
2321
"the Apache2 server - the ability to encrypt communications. Thus, when your "
2322
"browser is communicating using SSL, the https:// prefix is used at the "
2323
"beginning of the Uniform Resource Locator (URL) in the browser navigation "
2324
"bar."
2325
msgstr ""
2326
2327
#: serverguide/C/web-servers.xml:564(para)
2328
msgid ""
2329
"The <application>mod_ssl</application> module is available in "
2330
"<application>apache2-common</application> package. Execute the following "
2331
"command from a terminal prompt to enable the "
2332
"<application>mod_ssl</application> module:"
2333
msgstr ""
2334
2335
#: serverguide/C/web-servers.xml:571(command)
2336
msgid "sudo a2enmod ssl"
2337
msgstr ""
2338
2339
#: serverguide/C/web-servers.xml:574(para)
2340
msgid ""
2341
"There is a default HTTPS configuration file in <filename>/etc/apache2/sites-"
2342
"available/default-ssl</filename>. In order for "
2343
"<application>Apache2</application> to provide HTTPS, a "
2344
"<emphasis>certificate</emphasis> and <emphasis>key</emphasis> file are also "
2345
"needed. The default HTTPS configuration will use a certificate and key "
2346
"generated by the <application>ssl-cert</application> package. They are good "
2347
"for testing, but the auto-generated certificate and key should be replaced "
2348
"by a certificate specific to the site or server. For information on "
2349
"generating a key and obtaining a certificate see <xref "
2350
"linkend=\"certificates-and-security\"/>"
2351
msgstr ""
2352
2353
#: serverguide/C/web-servers.xml:584(para)
2354
msgid ""
2355
"To configure <application>Apache2</application> for HTTPS, enter the "
2356
"following:"
2357
msgstr ""
2358
2359
#: serverguide/C/web-servers.xml:589(command)
2360
msgid "sudo a2ensite default-ssl"
2361
msgstr ""
2362
2363
#: serverguide/C/web-servers.xml:593(para)
2364
msgid ""
2365
"The directories <filename>/etc/ssl/certs</filename> and "
2366
"<filename>/etc/ssl/private</filename> are the default locations. If you "
2367
"install the certificate and key in another directory make sure to change "
2368
"<emphasis>SSLCertificateFile</emphasis> and "
2369
"<emphasis>SSLCertificateKeyFile</emphasis> appropriately."
2370
msgstr ""
2371
2372
#: serverguide/C/web-servers.xml:600(para)
2373
msgid ""
2374
"With Apache2 now configured for HTTPS, restart the service to enable the new "
2375
"settings:"
2376
msgstr ""
2377
2378
#: serverguide/C/web-servers.xml:611(para)
2379
msgid ""
2380
"Depending on how you obtained your certificate you may need to enter a "
2381
"passphrase when <application>Apache2</application> starts."
2382
msgstr ""
2383
2384
#: serverguide/C/web-servers.xml:617(para)
2385
msgid ""
2386
"You can access the secure server pages by typing https://your_hostname/url/ "
2387
"in your browser address bar."
2388
msgstr ""
2389
2390
#: serverguide/C/web-servers.xml:628(para)
2391
msgid ""
2392
"<ulink url=\"http://httpd.apache.org/docs/2.2/\">Apache2 "
2393
"Documentation</ulink> contains in depth information on Apache2 configuration "
2394
"directives. Also, see the <application>apache2-doc</application> package for "
2395
"the official Apache2 docs."
2396
msgstr ""
2397
2398
#: serverguide/C/web-servers.xml:635(para)
2399
msgid ""
2400
"See the <ulink url=\"http://www.modssl.org/docs/\">Mod SSL "
2401
"Documentation</ulink> site for more SSL related information."
2402
msgstr ""
2403
2404
#: serverguide/C/web-servers.xml:641(para)
2405
msgid ""
2406
"O'Reilly's <ulink url=\"http://oreilly.com/catalog/9780596001919/\">Apache "
2407
"Cookbook</ulink> is a good resource for accomplishing specific Apache2 "
2408
"configurations."
2409
msgstr ""
2410
2411
#: serverguide/C/web-servers.xml:647(para)
2412
msgid ""
2413
"For Ubuntu specific Apache2 questions, ask in the <emphasis>#ubuntu-"
2414
"server</emphasis> IRC channel on <ulink "
2415
"url=\"http://freenode.net/\">freenode.net</ulink>."
2416
msgstr ""
2417
2418
#: serverguide/C/web-servers.xml:653(para)
2419
msgid ""
2420
"Usually integrated with PHP and MySQL the <ulink "
2421
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2422
"Ubuntu Wiki </ulink> page is a good resource."
2423
msgstr ""
2424
2425
#: serverguide/C/web-servers.xml:664(title)
2426
msgid "PHP5 - Scripting Language"
2427
msgstr ""
2428
2429
#: serverguide/C/web-servers.xml:665(para)
2430
msgid ""
2431
"PHP is a general-purpose scripting language suited for Web development. The "
2432
"PHP script can be embedded into HTML. This section explains how to install "
2433
"and configure PHP5 in Ubuntu System with Apache2 and MySQL."
2434
msgstr ""
2435
2436
#: serverguide/C/web-servers.xml:669(para)
2437
msgid ""
2438
"This section assumes you have installed and configured Apache2 Web Server "
2439
"and MySQL Database Server. You can refer to Apache2 section and MySQL "
2440
"sections in this document to install and configure Apache2 and MySQL "
2441
"respectively."
2442
msgstr ""
2443
2444
#: serverguide/C/web-servers.xml:676(para)
2445
msgid "The PHP5 is available in Ubuntu Linux."
2446
msgstr ""
2447
2448
#: serverguide/C/web-servers.xml:678(para)
2449
msgid ""
2450
"To install PHP5 you can enter the following command in the terminal prompt: "
2451
"<screen>\n"
2452
"<command>sudo apt-get install php5 libapache2-mod-php5</command>\n"
2453
"</screen>"
2454
msgstr ""
2455
2456
#: serverguide/C/web-servers.xml:687(para)
2457
msgid ""
2458
"You can run PHP5 scripts from command line. To run PHP5 scripts from command "
2459
"line you should install <application>php5-cli</application> package. To "
2460
"install <application>php5-cli</application> you can enter the following "
2461
"command in the terminal prompt: <screen>\n"
2462
"<command>sudo apt-get install php5-cli</command>\n"
2463
"</screen>"
2464
msgstr ""
2465
2466
#: serverguide/C/web-servers.xml:696(para)
2467
msgid ""
2468
"You can also execute PHP5 scripts without installing PHP5 Apache module. To "
2469
"accomplish this, you should install <application>php5-cgi</application> "
2470
"package. You can run the following command in a terminal prompt to install "
2471
"<application>php5-cgi</application> package: <screen>\n"
2472
"<command>sudo apt-get install php5-cgi</command>\n"
2473
"</screen>"
2474
msgstr ""
2475
2476
#: serverguide/C/web-servers.xml:706(para)
2477
msgid ""
2478
"To use <application>MySQL</application> with PHP5 you should install "
2479
"<application>php5-mysql</application> package. To install <application>php5-"
2480
"mysql</application> you can enter the following command in the terminal "
2481
"prompt: <screen>\n"
2482
"<command>sudo apt-get install php5-mysql</command>\n"
2483
"</screen>"
2484
msgstr ""
2485
2486
#: serverguide/C/web-servers.xml:714(para)
2487
msgid ""
2488
"Similarly, to use <application>PostgreSQL</application> with PHP5 you should "
2489
"install <application>php5-pgsql</application> package. To install "
2490
"<application>php5-pgsql</application> you can enter the following command in "
2491
"the terminal prompt: <screen>\n"
2492
"<command>sudo apt-get install php5-pgsql</command>\n"
2493
"</screen>"
2494
msgstr ""
2495
2496
#: serverguide/C/web-servers.xml:727(para)
2497
msgid ""
2498
"Once you install PHP5, you can run PHP5 scripts from your web browser. If "
2499
"you have installed <application>php5-cli</application> package, you can run "
2500
"PHP5 scripts from your command prompt."
2501
msgstr ""
2502
2503
#: serverguide/C/web-servers.xml:734(para)
2504
msgid ""
2505
"By default, the Apache 2 Web server is configured to run PHP5 scripts. In "
2506
"other words, the PHP5 module is enabled in Apache2 Web server automatically "
2507
"when you install the module. Please verify if the files "
2508
"<filename>/etc/apache2/mods-enabled/php5.conf</filename> and "
2509
"<filename>/etc/apache2/mods-enabled/php5.load</filename> exist. If they do "
2510
"not exists, you can enable the module using <command>a2enmod</command> "
2511
"command."
2512
msgstr ""
2513
2514
#: serverguide/C/web-servers.xml:745(para)
2515
msgid ""
2516
"Once you install PHP5 related packages and enabled PHP5 Apache 2 module, you "
2517
"should restart Apache2 Web server to run PHP5 scripts. You can run the "
2518
"following command at a terminal prompt to restart your web server: "
2519
"<screen><command>sudo /etc/init.d/apache2 restart</command> </screen>"
2520
msgstr ""
2521
2522
#: serverguide/C/web-servers.xml:753(title) serverguide/C/mail.xml:320(title) serverguide/C/mail.xml:1569(title) serverguide/C/dns.xml:343(title) serverguide/C/clustering.xml:184(title)
2523
msgid "Testing"
2524
msgstr ""
2525
2526
#: serverguide/C/web-servers.xml:754(para)
2527
msgid ""
2528
"To verify your installation, you can run following PHP5 phpinfo script:"
2529
msgstr ""
2530
2531
#: serverguide/C/web-servers.xml:757(programlisting)
2532
#, no-wrap
2533
msgid ""
2534
"\n"
2535
"<?php\n"
2536
" phpinfo();\n"
2537
"?>\n"
2538
msgstr ""
2539
2540
#: serverguide/C/web-servers.xml:762(para)
2541
msgid ""
2542
"You can save the content in a file <filename>phpinfo.php</filename> and "
2543
"place it under <command>DocumentRoot</command> directory of Apache2 Web "
2544
"server. When point your browser to "
2545
"<filename>http://hostname/phpinfo.php</filename>, it would display values of "
2546
"various PHP5 configuration parameters."
2547
msgstr ""
2548
2549
#: serverguide/C/web-servers.xml:776(para)
2550
msgid ""
2551
"For more in depth information see <ulink "
2552
"url=\"http://www.php.net/docs.php\">php.net</ulink> documentation."
2553
msgstr ""
2554
2555
#: serverguide/C/web-servers.xml:781(para)
2556
msgid ""
2557
"There are a plethora of books on PHP. Two good books from O'Reilly are "
2558
"<ulink url=\"http://oreilly.com/catalog/9780596005603/\">Learning PHP "
2559
"5</ulink> and the <ulink "
2560
"url=\"http://oreilly.com/catalog/9781565926813/\">PHP Cook Book</ulink>."
2561
msgstr ""
2562
2563
#: serverguide/C/web-servers.xml:788(para)
2564
msgid ""
2565
"Also, see the <ulink "
2566
"url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache MySQL PHP "
2567
"Ubuntu Wiki</ulink> page for more information."
2568
msgstr ""
2569
2570
#: serverguide/C/web-servers.xml:799(title)
2571
msgid "Squid - Proxy Server"
2572
msgstr ""
2573
2574
#: serverguide/C/web-servers.xml:800(para)
2575
msgid ""
2576
"Squid is a full-featured web proxy cache server application which provides "
2577
"proxy and cache services for Hyper Text Transport Protocol (HTTP), File "
2578
"Transfer Protocol (FTP), and other popular network protocols. Squid can "
2579
"implement caching and proxying of Secure Sockets Layer (SSL) requests and "
2580
"caching of Domain Name Server (DNS) lookups, and perform transparent "
2581
"caching. Squid also supports a wide variety of caching protocols, such as "
2582
"Internet Cache Protocol, (ICP) the Hyper Text Caching Protocol, (HTCP) the "
2583
"Cache Array Routing Protocol (CARP), and the Web Cache Coordination "
2584
"Protocol. (WCCP)"
2585
msgstr ""
2586
2587
#: serverguide/C/web-servers.xml:808(para)
2588
msgid ""
2589
"The Squid proxy cache server is an excellent solution to a variety of proxy "
2590
"and caching server needs, and scales from the branch office to enterprise "
2591
"level networks while providing extensive, granular access control mechanisms "
2592
"and monitoring of critical parameters via the Simple Network Management "
2593
"Protocol (SNMP). When selecting a computer system for use as a dedicated "
2594
"Squid proxy, or caching servers, ensure your system is configured with a "
2595
"large amount of physical memory, as Squid maintains an in-memory cache for "
2596
"increased performance."
2597
msgstr ""
2598
2599
#: serverguide/C/web-servers.xml:817(para)
2600
msgid ""
2601
"At a terminal prompt, enter the following command to install the Squid "
2602
"server:"
2603
msgstr ""
2604
2605
#: serverguide/C/web-servers.xml:822(command)
2606
msgid "sudo apt-get install squid"
2607
msgstr ""
2608
2609
#: serverguide/C/web-servers.xml:828(para)
2610
msgid ""
2611
"Squid is configured by editing the directives contained within the "
2612
"<filename>/etc/squid/squid.conf</filename> configuration file. The following "
2613
"examples illustrate some of the directives which may be modified to affect "
2614
"the behavior of the Squid server. For more in-depth configuration of Squid, "
2615
"see the References section."
2616
msgstr ""
2617
2618
#: serverguide/C/web-servers.xml:834(para)
2619
msgid ""
2620
"Prior to editing the configuration file, you should make a copy of the "
2621
"original file and protect it from writing so you will have the original "
2622
"settings as a reference, and to re-use as necessary."
2623
msgstr ""
2624
2625
#: serverguide/C/web-servers.xml:837(para)
2626
msgid ""
2627
"Copy the <filename>/etc/squid/squid.conf</filename> file and protect it from "
2628
"writing with the following commands entered at a terminal prompt:"
2629
msgstr ""
2630
2631
#: serverguide/C/web-servers.xml:842(command)
2632
msgid "sudo cp /etc/squid/squid.conf /etc/squid/squid.conf.original"
2633
msgstr ""
2634
2635
#: serverguide/C/web-servers.xml:843(command)
2636
msgid "sudo chmod a-w /etc/squid/squid.conf.original"
2637
msgstr ""
2638
2639
#: serverguide/C/web-servers.xml:849(para)
2640
msgid ""
2641
"To set your Squid server to listen on TCP port 8888 instead of the default "
2642
"TCP port 3128, change the http_port directive as such:"
2643
msgstr ""
2644
2645
#: serverguide/C/web-servers.xml:853(programlisting)
2646
#, no-wrap
2647
msgid ""
2648
"\n"
2649
"http_port 8888\n"
2650
msgstr ""
2651
2652
#: serverguide/C/web-servers.xml:858(para)
2653
msgid ""
2654
"Change the visible_hostname directive in order to give the Squid server a "
2655
"specific hostname. This hostname does not necessarily need to be the "
2656
"computer's hostname. In this example it is set to <emphasis>weezie</emphasis>"
2657
msgstr ""
2658
2659
#: serverguide/C/web-servers.xml:862(programlisting)
2660
#, no-wrap
2661
msgid ""
2662
"\n"
2663
"visible_hostname weezie\n"
2664
msgstr ""
2665
2666
#: serverguide/C/web-servers.xml:867(para)
2667
msgid ""
2668
"Using Squid's access control, you may configure use of Internet services "
2669
"proxied by Squid to be available only users with certain Internet Protocol "
2670
"(IP) addresses. For example, we will illustrate access by users of the "
2671
"192.168.42.0/24 subnetwork only:"
2672
msgstr ""
2673
2674
#: serverguide/C/web-servers.xml:872(para) serverguide/C/web-servers.xml:892(para)
2675
msgid ""
2676
"Add the following to the <emphasis role=\"bold\">bottom</emphasis> of the "
2677
"ACL section of your <filename>/etc/squid/squid.conf</filename> file:"
2678
msgstr ""
2679
2680
#: serverguide/C/web-servers.xml:875(programlisting)
2681
#, no-wrap
2682
msgid ""
2683
"\n"
2684
"acl fortytwo_network src 192.168.42.0/24\n"
2685
msgstr ""
2686
2687
#: serverguide/C/web-servers.xml:878(para) serverguide/C/web-servers.xml:899(para)
2688
msgid ""
2689
"Then, add the following to the <emphasis role=\"bold\">top</emphasis> of the "
2690
"http_access section of your <filename>/etc/squid/squid.conf</filename> file:"
2691
msgstr ""
2692
2693
#: serverguide/C/web-servers.xml:882(programlisting)
2694
#, no-wrap
2695
msgid ""
2696
"\n"
2697
"http_access allow fortytwo_network\n"
2698
msgstr ""
2699
2700
#: serverguide/C/web-servers.xml:887(para)
2701
msgid ""
2702
"Using the excellent access control features of Squid, you may configure use "
2703
"of Internet services proxied by Squid to be available only during normal "
2704
"business hours. For example, we'll illustrate access by employees of a "
2705
"business which is operating between 9:00AM and 5:00PM, Monday through "
2706
"Friday, and which uses the 10.1.42.0/42 subnetwork:"
2707
msgstr ""
2708
2709
#: serverguide/C/web-servers.xml:895(programlisting)
2710
#, no-wrap
2711
msgid ""
2712
"\n"
2713
"acl biz_network src 10.1.42.0/24\n"
2714
"acl biz_hours time M T W T F 9:00-17:00\n"
2715
msgstr ""
2716
2717
#: serverguide/C/web-servers.xml:903(programlisting)
2718
#, no-wrap
2719
msgid ""
2720
"\n"
2721
"http_access allow biz_network biz_hours\n"
2722
msgstr ""
2723
2724
#: serverguide/C/web-servers.xml:910(para)
2725
msgid ""
2726
"After making changes to the <filename>/etc/squid/squid.conf</filename> file, "
2727
"save the file and restart the <application>squid</application> server "
2728
"application to effect the changes using the following command entered at a "
2729
"terminal prompt:"
2730
msgstr ""
2731
2732
#: serverguide/C/web-servers.xml:917(command)
2733
msgid "sudo /etc/init.d/squid restart"
2734
msgstr ""
2735
2736
#: serverguide/C/web-servers.xml:924(ulink)
2737
msgid "Squid Website"
2738
msgstr ""
2739
2740
#: serverguide/C/web-servers.xml:926(para)
2741
msgid ""
2742
"<ulink url=\"https://help.ubuntu.com/community/Squid\">Ubuntu Wiki "
2743
"Squid</ulink> page."
2744
msgstr ""
2745
2746
#: serverguide/C/web-servers.xml:933(title)
2747
msgid "Ruby on Rails"
2748
msgstr ""
2749
2750
#: serverguide/C/web-servers.xml:934(para)
2751
msgid ""
2752
"Ruby on Rails is an open source web framework for developing database backed "
2753
"web applications. It is optimized for sustainable productivity of the "
2754
"programmer since it lets the programmer to write code by favouring "
2755
"convention over configuration."
2756
msgstr ""
2757
2758
#: serverguide/C/web-servers.xml:941(para)
2759
msgid ""
2760
"Before installing <application>Rails</application> you should install "
2761
"<application>Apache</application> and <application>MySQL</application>. To "
2762
"install the <application>Apache</application> package, please refer to <xref "
2763
"linkend=\"httpd\"/>. For instructions on installing "
2764
"<application>MySQL</application> refer to <xref linkend=\"mysql\"/>."
2765
msgstr ""
2766
2767
#: serverguide/C/web-servers.xml:949(para)
2768
msgid ""
2769
"Once you have <application>Apache</application> and "
2770
"<application>MySQL</application> packages installed, you are ready to "
2771
"install <application>Ruby on Rails</application> package."
2772
msgstr ""
2773
2774
#: serverguide/C/web-servers.xml:956(para)
2775
msgid ""
2776
"To install the <application>Ruby</application> base packages and "
2777
"<application>Ruby on Rails</application>, you can enter the following "
2778
"command in the terminal prompt:"
2779
msgstr ""
2780
2781
#: serverguide/C/web-servers.xml:962(command)
2782
msgid "sudo apt-get install rails"
2783
msgstr ""
2784
2785
#: serverguide/C/web-servers.xml:968(para)
2786
msgid ""
2787
"Modify the <filename>/etc/apache2/sites-available/default</filename> "
2788
"configuration file to setup your domains."
2789
msgstr ""
2790
2791
#: serverguide/C/web-servers.xml:972(para)
2792
msgid ""
2793
"The first thing to change is the <emphasis>DocumentRoot</emphasis> directive:"
2794
msgstr ""
2795
2796
#: serverguide/C/web-servers.xml:976(programlisting)
2797
#, no-wrap
2798
msgid ""
2799
"\n"
2800
"DocumentRoot /path/to/rails/application/public\n"
2801
msgstr ""
2802
2803
#: serverguide/C/web-servers.xml:979(para)
2804
msgid ""
2805
"Next, change the <Directory \"/path/to/rails/application/public\"> "
2806
"directive:"
2807
msgstr ""
2808
2809
#: serverguide/C/web-servers.xml:983(programlisting)
2810
#, no-wrap
2811
msgid ""
2812
"\n"
2813
"<Directory \"/path/to/rails/application/public\">\n"
2814
" Options Indexes FollowSymLinks MultiViews ExecCGI\n"
2815
" AllowOverride All\n"
2816
" Order allow,deny\n"
2817
" allow from all\n"
2818
" AddHandler cgi-script .cgi\n"
2819
"</Directory>\n"
2820
msgstr ""
2821
2822
#: serverguide/C/web-servers.xml:993(para)
2823
msgid ""
2824
"You should also enable the <application>mod_rewrite</application> module for "
2825
"Apache. To enable <application>mod_rewrite</application> module, please "
2826
"enter the following command in a terminal prompt:"
2827
msgstr ""
2828
2829
#: serverguide/C/web-servers.xml:999(command)
2830
msgid "sudo a2enmod rewrite"
2831
msgstr ""
2832
2833
#: serverguide/C/web-servers.xml:1002(para)
2834
msgid ""
2835
"Finally you will need to change the ownership of the "
2836
"<filename>/path/to/rails/application/public</filename> and "
2837
"<filename>/path/to/rails/application/tmp</filename> directories to the user "
2838
"used to run the <application>Apache</application> process:"
2839
msgstr ""
2840
2841
#: serverguide/C/web-servers.xml:1008(command)
2842
msgid "sudo chown -R www-data:www-data /path/to/rails/application/public"
2843
msgstr ""
2844
2845
#: serverguide/C/web-servers.xml:1009(command)
2846
msgid "sudo chown -R www-data:www-data /path/to/rails/application/tmp"
2847
msgstr ""
2848
2849
#: serverguide/C/web-servers.xml:1012(para)
2850
msgid ""
2851
"That's it! Now you have your Server ready for your <application>Ruby on "
2852
"Rails</application> applications."
2853
msgstr ""
2854
2855
#: serverguide/C/web-servers.xml:1021(para)
2856
msgid ""
2857
"See the <ulink url=\"http://rubyonrails.org/\">Ruby on Rails</ulink> website "
2858
"for more information."
2859
msgstr ""
2860
2861
#: serverguide/C/web-servers.xml:1026(para)
2862
msgid ""
2863
"Also <ulink url=\"http://pragprog.com/titles/rails3/agile-web-development-"
2864
"with-rails-third-edition\">Agile Development with Rails</ulink> is a great "
2865
"resource."
2866
msgstr ""
2867
2868
#: serverguide/C/web-servers.xml:1032(para)
2869
msgid ""
2870
"Another place for more information is the <ulink "
2871
"url=\"https://help.ubuntu.com/community/RubyOnRails\">Ruby on Rails Ubuntu "
2872
"Wiki</ulink> page."
2873
msgstr ""
2874
2875
#: serverguide/C/web-servers.xml:1043(title)
2876
msgid "Apache Tomcat"
2877
msgstr ""
2878
2879
#: serverguide/C/web-servers.xml:1044(para)
2880
msgid ""
2881
"Apache Tomcat is a web container that allows you to serve Java Servlets and "
2882
"JSP (Java Server Pages) web applications."
2883
msgstr ""
2884
2885
#: serverguide/C/web-servers.xml:1046(para)
2886
msgid ""
2887
"The <application>Tomcat 6.0</application> packages in Ubuntu support two "
2888
"different ways of running Tomcat. You can install them as a classic unique "
2889
"system-wide instance, that will be started at boot time and will run as the "
2890
"tomcat6 unpriviledged user. But you can also deploy private instances that "
2891
"will run with your own user rights, and that you should start and stop by "
2892
"yourself. This second way is particularly useful in a development server "
2893
"context where multiple users need to test on their own private Tomcat "
2894
"instances."
2895
msgstr ""
2896
2897
#: serverguide/C/web-servers.xml:1056(title)
2898
msgid "System-wide installation"
2899
msgstr ""
2900
2901
#: serverguide/C/web-servers.xml:1057(para)
2902
msgid ""
2903
"To install the <application>Tomcat</application> server, you can enter the "
2904
"following command in the terminal prompt:"
2905
msgstr ""
2906
2907
#: serverguide/C/web-servers.xml:1060(command)
2908
msgid "sudo apt-get install tomcat6"
2909
msgstr ""
2910
2911
#: serverguide/C/web-servers.xml:1062(para)
2912
msgid ""
2913
"This will install a Tomcat server with just a default ROOT webapp that "
2914
"displays a minimal \"It works\" page by default."
2915
msgstr ""
2916
2917
#: serverguide/C/web-servers.xml:1068(para)
2918
msgid ""
2919
"Tomcat configuration files can be found in "
2920
"<filename>/etc/tomcat6</filename>. Only a few common configuration tweaks "
2921
"will be described here, please see <ulink "
2922
"url=\"http://tomcat.apache.org/tomcat-6.0-doc/index.html\">Tomcat 6.0 "
2923
"documentation</ulink> for more."
2924
msgstr ""
2925
2926
#: serverguide/C/web-servers.xml:1074(title)
2927
msgid "Changing default ports"
2928
msgstr ""
2929
2930
#: serverguide/C/web-servers.xml:1075(para)
2931
msgid ""
2932
"By default Tomcat 6.0 runs a HTTP connector on port 8080 and an AJP "
2933
"connector on port 8009. You might want to change those default ports to "
2934
"avoid conflict with another server on the system. This is done by changing "
2935
"the following lines in <filename>/etc/tomcat6/server.xml</filename>:"
2936
msgstr ""
2937
2938
#: serverguide/C/web-servers.xml:1080(programlisting)
2939
#, no-wrap
2940
msgid ""
2941
"\n"
2942
"<Connector port=\"8080\" protocol=\"HTTP/1.1\" \n"
2943
" connectionTimeout=\"20000\" \n"
2944
" redirectPort=\"8443\" />\n"
2945
"...\n"
2946
"<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\" "
2947
"/>\n"
2948
msgstr ""
2949
2950
#: serverguide/C/web-servers.xml:1089(title)
2951
msgid "Changing JVM used"
2952
msgstr ""
2953
2954
#: serverguide/C/web-servers.xml:1090(para)
2955
msgid ""
2956
"By default Tomcat will run preferably with OpenJDK-6, then try Sun's JVM, "
2957
"then try some other JVMs. If you have various JVMs installed, you can set "
2958
"which should be used by setting JAVA_HOME in "
2959
"<filename>/etc/default/tomcat6</filename>:"
2960
msgstr ""
2961
2962
#: serverguide/C/web-servers.xml:1094(programlisting)
2963
#, no-wrap
2964
msgid ""
2965
"\n"
2966
"JAVA_HOME=/usr/lib/jvm/java-6-sun\n"
2967
msgstr ""
2968
2969
#: serverguide/C/web-servers.xml:1099(title)
2970
msgid "Declaring users and roles"
2971
msgstr ""
2972
2973
#: serverguide/C/web-servers.xml:1100(para)
2974
msgid ""
2975
"Usernames, passwords and roles (groups) can be defined centrally in a "
2976
"Servlet container. In Tomcat 6.0 this is done in the "
2977
"<filename>/etc/tomcat6/tomcat-users.xml</filename> file:"
2978
msgstr ""
2979
2980
#: serverguide/C/web-servers.xml:1103(programlisting)
2981
#, no-wrap
2982
msgid ""
2983
"\n"
2984
"<role rolename=\"admin\"/>\n"
2985
"<user username=\"tomcat\" password=\"s3cret\" roles=\"admin\"/>\n"
2986
msgstr ""
2987
2988
#: serverguide/C/web-servers.xml:1111(title)
2989
msgid "Using Tomcat standard webapps"
2990
msgstr ""
2991
2992
#: serverguide/C/web-servers.xml:1112(para)
2993
msgid ""
2994
"Tomcat is shipped with webapps that you can install for documentation, "
2995
"administration or demo purposes."
2996
msgstr ""
2997
2998
#: serverguide/C/web-servers.xml:1115(title)
2999
msgid "Tomcat documentation"
3000
msgstr ""
3001
3002
#: serverguide/C/web-servers.xml:1116(para)
3003
msgid ""
3004
"The <application>tomcat6-docs</application> package contains Tomcat 6.0 "
3005
"documentation, packaged as a webapp that you can access by default at "
3006
"http://yourserver:8080/docs. You can install it by entering the following "
3007
"command in the terminal prompt:"
3008
msgstr ""
3009
3010
#: serverguide/C/web-servers.xml:1121(command)
3011
msgid "sudo apt-get install tomcat6-docs"
3012
msgstr ""
3013
3014
#: serverguide/C/web-servers.xml:1125(title)
3015
msgid "Tomcat administration webapps"
3016
msgstr ""
3017
3018
#: serverguide/C/web-servers.xml:1126(para)
3019
msgid ""
3020
"The <application>tomcat6-admin</application> package contains two webapps "
3021
"that can be used to administer the Tomcat server using a web interface. You "
3022
"can install them by entering the following command in the terminal prompt:"
3023
msgstr ""
3024
3025
#: serverguide/C/web-servers.xml:1131(command)
3026
msgid "sudo apt-get install tomcat6-admin"
3027
msgstr ""
3028
3029
#: serverguide/C/web-servers.xml:1133(para)
3030
msgid ""
3031
"The first one is the <emphasis>manager</emphasis> webapp, which you can "
3032
"access by default at http://yourserver:8080/manager/html. It is primarily "
3033
"used to get server status and restart webapps."
3034
msgstr ""
3035
3036
#: serverguide/C/web-servers.xml:1136(para)
3037
msgid ""
3038
"Access to the <emphasis>manager</emphasis> application is protected by "
3039
"default: you need to define a user with the role \"manager\" in "
3040
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3041
msgstr ""
3042
3043
#: serverguide/C/web-servers.xml:1140(para)
3044
msgid ""
3045
"The second one is the <emphasis>host-manager</emphasis> webapp, which you "
3046
"can access by default at http://yourserver:8080/host-manager/html. It can be "
3047
"used to create virtual hosts dynamically."
3048
msgstr ""
3049
3050
#: serverguide/C/web-servers.xml:1144(para)
3051
msgid ""
3052
"Access to the <emphasis>host-manager</emphasis> application is also "
3053
"protected by default: you need to define a user with the role \"admin\" in "
3054
"<filename>/etc/tomcat6/tomcat-users.xml</filename> before you can access it."
3055
msgstr ""
3056
3057
#: serverguide/C/web-servers.xml:1149(para)
3058
msgid ""
3059
"For security reasons, the tomcat6 user cannot write to the "
3060
"<filename>/etc/tomcat6</filename> directory by default. Some features in "
3061
"these admin webapps (application deployment, virtual host creation) need "
3062
"write access to that directory. If you want to use these features execute "
3063
"the following, to give users in the tomcat6 group the necessary rights:"
3064
msgstr ""
3065
3066
#: serverguide/C/web-servers.xml:1156(command)
3067
msgid "sudo chgrp -R tomcat6 /etc/tomcat6"
3068
msgstr ""
3069
3070
#: serverguide/C/web-servers.xml:1157(command)
3071
msgid "sudo chmod -R g+w /etc/tomcat6"
3072
msgstr ""
3073
3074
#: serverguide/C/web-servers.xml:1162(title)
3075
msgid "Tomcat examples webapps"
3076
msgstr ""
3077
3078
#: serverguide/C/web-servers.xml:1163(para)
3079
msgid ""
3080
"The <application>tomcat6-examples</application> package contains two webapps "
3081
"that can be used to test or demonstrate Servlets and JSP features, which you "
3082
"can access them by default at http://yourserver:8080/examples. You can "
3083
"install them by entering the following command in the terminal prompt:"
3084
msgstr ""
3085
3086
#: serverguide/C/web-servers.xml:1169(command)
3087
msgid "sudo apt-get install tomcat6-examples"
3088
msgstr ""
3089
3090
#: serverguide/C/web-servers.xml:1175(title)
3091
msgid "Using private instances"
3092
msgstr ""
3093
3094
#: serverguide/C/web-servers.xml:1176(para)
3095
msgid ""
3096
"Tomcat is heavily used in development and testing scenarios where using a "
3097
"single system-wide instance doesn't meet the requirements of multiple users "
3098
"on a single system. The Tomcat 6.0 packages in Ubuntu come with tools to "
3099
"help deploy your own user-oriented instances, allowing every user on a "
3100
"system to run (without root rights) separate private instances while still "
3101
"using the system-installed libraries."
3102
msgstr ""
3103
3104
#: serverguide/C/web-servers.xml:1183(para)
3105
msgid ""
3106
"It is possible to run the system-wide instance and the private instances in "
3107
"parallel, as long as they do not use the same TCP ports."
3108
msgstr ""
3109
3110
#: serverguide/C/web-servers.xml:1187(title)
3111
msgid "Installing private instance support"
3112
msgstr ""
3113
3114
#: serverguide/C/web-servers.xml:1188(para)
3115
msgid ""
3116
"You can install everything necessary to run private instances by entering "
3117
"the following command in the terminal prompt:"
3118
msgstr ""
3119
3120
#: serverguide/C/web-servers.xml:1191(command)
3121
msgid "sudo apt-get install tomcat6-user"
3122
msgstr ""
3123
3124
#: serverguide/C/web-servers.xml:1195(title)
3125
msgid "Creating a private instance"
3126
msgstr ""
3127
3128
#: serverguide/C/web-servers.xml:1196(para)
3129
msgid ""
3130
"You can create a private instance directory by entering the following "
3131
"command in the terminal prompt:"
3132
msgstr ""
3133
3134
#: serverguide/C/web-servers.xml:1199(command)
3135
msgid "tomcat6-instance-create my-instance"
3136
msgstr ""
3137
3138
#: serverguide/C/web-servers.xml:1201(para)
3139
msgid ""
3140
"This will create a new <filename>my-instance</filename> directory with all "
3141
"the necessary subdirectories and scripts. You can for example install your "
3142
"common libraries in the <filename>lib/</filename> subdirectory and deploy "
3143
"your webapps in the <filename>webapps/</filename> subdirectory. No webapps "
3144
"are deployed by default."
3145
msgstr ""
3146
3147
#: serverguide/C/web-servers.xml:1209(title)
3148
msgid "Configuring your private instance"
3149
msgstr ""
3150
3151
#: serverguide/C/web-servers.xml:1210(para)
3152
msgid ""
3153
"You will find the classic Tomcat configuration files for your private "
3154
"instance in the <filename>conf/</filename> subdirectory. You should for "
3155
"example certainly edit the <filename>conf/server.xml</filename> file to "
3156
"change the default ports used by your private Tomcat instance to avoid "
3157
"conflict with other instances that might be running."
3158
msgstr ""
3159
3160
#: serverguide/C/web-servers.xml:1218(title)
3161
msgid "Starting/stopping your private instance"
3162
msgstr ""
3163
3164
#: serverguide/C/web-servers.xml:1219(para)
3165
msgid ""
3166
"You can start your private instance by entering the following command in the "
3167
"terminal prompt (supposing your instance is located in the <filename>my-"
3168
"instance</filename> directory):"
3169
msgstr ""
3170
3171
#: serverguide/C/web-servers.xml:1223(command)
3172
msgid "my-instance/bin/startup.sh"
3173
msgstr ""
3174
3175
#: serverguide/C/web-servers.xml:1225(para)
3176
msgid ""
3177
"You should check the <filename>logs/</filename> subdirectory for any error. "
3178
"If you have a <emphasis>java.net.BindException: Address already in "
3179
"use<null>:8080</emphasis> error, it means that the port you're using "
3180
"is already taken and that you should change it."
3181
msgstr ""
3182
3183
#: serverguide/C/web-servers.xml:1230(para)
3184
msgid ""
3185
"You can stop your instance by entering the following command in the terminal "
3186
"prompt (supposing your instance is located in the <filename>my-"
3187
"instance</filename> directory):"
3188
msgstr ""
3189
3190
#: serverguide/C/web-servers.xml:1234(command)
3191
msgid "my-instance/bin/shutdown.sh"
3192
msgstr ""
3193
3194
#: serverguide/C/web-servers.xml:1243(para)
3195
msgid ""
3196
"See the <ulink url=\"http://tomcat.apache.org/\">Apache Tomcat</ulink> "
3197
"website for more information."
3198
msgstr ""
3199
3200
#: serverguide/C/web-servers.xml:1248(para)
3201
msgid ""
3202
"<ulink url=\"http://oreilly.com/catalog/9780596003180/\">Tomcat: The "
3203
"Definitive Guide</ulink> is a good resource for building web applications "
3204
"with Tomcat."
3205
msgstr ""
3206
3207
#: serverguide/C/web-servers.xml:1254(para)
3208
msgid ""
3209
"For additional books see the <ulink "
3210
"url=\"http://wiki.apache.org/tomcat/Tomcat/Books\">Tomcat Books</ulink> list "
3211
"page."
3212
msgstr ""
3213
3214
#: serverguide/C/web-servers.xml:1259(para)
3215
msgid ""
3216
"Also, see the<ulink "
3217
"url=\"https://help.ubuntu.com/community/ApacheTomcat5\">Ubuntu Wiki Apache "
3218
"Tomcat</ulink> page."
3219
msgstr ""
3220
3221
#: serverguide/C/vpn.xml:13(title)
3222
msgid "VPN"
3223
msgstr ""
3224
3225
#: serverguide/C/vpn.xml:15(para)
3226
msgid ""
3227
"A Virtual Private Network, or <emphasis>VPN</emphasis>, is an encrypted "
3228
"network connection between two or more networks. There are several ways to "
3229
"create a VPN using software as well as dedicated hardware appliances. This "
3230
"chapter will cover installing and configuring "
3231
"<application>OpenVPN</application> to create a VPN between two servers."
3232
msgstr ""
3233
3234
#: serverguide/C/vpn.xml:23(title)
3235
msgid "OpenVPN"
3236
msgstr ""
3237
3238
#: serverguide/C/vpn.xml:25(para)
3239
msgid ""
3240
"OpenVPN uses Public Key Infrastructure (PKI) to encrypt VPN traffic between "
3241
"nodes. A simple way of setting up a VPN with OpenVPN is to connect the "
3242
"clients through a bridge interface on the VPN server. This guide will assume "
3243
"that one VPN node, the server in this case, has a bridge interface "
3244
"configured. For more information on setting up a bridge see <xref "
3245
"linkend=\"bridging\"/>."
3246
msgstr ""
3247
3248
#: serverguide/C/vpn.xml:35(para)
3249
msgid "To install <application>openvpn</application> in a terminal enter:"
3250
msgstr ""
3251
3252
#: serverguide/C/vpn.xml:41(command) serverguide/C/vpn.xml:257(command)
3253
msgid "sudo apt-get install openvpn"
3254
msgstr ""
3255
3256
#: serverguide/C/vpn.xml:45(title)
3257
msgid "Server Certificates"
3258
msgstr ""
3259
3260
#: serverguide/C/vpn.xml:47(para)
3261
msgid ""
3262
"Now that the <application>openvpn</application> package is installed, the "
3263
"certificates for the VPN server need to be created."
3264
msgstr ""
3265
3266
#: serverguide/C/vpn.xml:52(para)
3267
msgid ""
3268
"First, copy the <filename>easy-rsa</filename> directory to "
3269
"<filename>/etc/openvpn</filename>. This will ensure that any changes to the "
3270
"scripts will not be lost when the package is updated. You will also need to "
3271
"adjust permissions in the <filename>easy-rsa</filename> directory to allow "
3272
"the current user permission to create files. From a terminal enter:"
3273
msgstr ""
3274
3275
#: serverguide/C/vpn.xml:59(command)
3276
msgid "sudo mkdir /etc/openvpn/easy-rsa/"
3277
msgstr ""
3278
3279
#: serverguide/C/vpn.xml:60(command)
3280
msgid ""
3281
"sudo cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-"
3282
"rsa/"
3283
msgstr ""
3284
3285
#: serverguide/C/vpn.xml:61(command)
3286
msgid "sudo chown -R $USER /etc/openvpn/easy-rsa/"
3287
msgstr ""
3288
3289
#: serverguide/C/vpn.xml:64(para)
3290
msgid ""
3291
"Next, edit <filename>/etc/openvpn/easy-rsa/vars</filename> adjusting the "
3292
"following to your environment:"
3293
msgstr ""
3294
3295
#: serverguide/C/vpn.xml:68(programlisting)
3296
#, no-wrap
3297
msgid ""
3298
"\n"
3299
"export KEY_COUNTRY=\"US\"\n"
3300
"export KEY_PROVINCE=\"NC\"\n"
3301
"export KEY_CITY=\"Winston-Salem\"\n"
3302
"export KEY_ORG=\"Example Company\"\n"
3303
"export KEY_EMAIL=\"steve@example.com\"\n"
3304
msgstr ""
3305
3306
#: serverguide/C/vpn.xml:76(para)
3307
msgid "Enter the following to create the server certificates:"
3308
msgstr ""
3309
3310
#: serverguide/C/vpn.xml:81(command) serverguide/C/vpn.xml:102(command)
3311
msgid "cd /etc/openvpn/easy-rsa/"
3312
msgstr ""
3313
3314
#: serverguide/C/vpn.xml:82(command) serverguide/C/vpn.xml:103(command)
3315
msgid "source vars"
3316
msgstr ""
3317
3318
#: serverguide/C/vpn.xml:83(command)
3319
msgid "./clean-all"
3320
msgstr ""
3321
3322
#: serverguide/C/vpn.xml:84(command)
3323
msgid "./build-dh"
3324
msgstr ""
3325
3326
#: serverguide/C/vpn.xml:85(command)
3327
msgid "./pkitool --initca"
3328
msgstr ""
3329
3330
#: serverguide/C/vpn.xml:86(command)
3331
msgid "./pkitool --server server"
3332
msgstr ""
3333
3334
#: serverguide/C/vpn.xml:87(command)
3335
msgid "cd keys"
3336
msgstr ""
3337
3338
#: serverguide/C/vpn.xml:88(command)
3339
msgid "openvpn --genkey --secret ta.key"
3340
msgstr ""
3341
3342
#: serverguide/C/vpn.xml:89(command)
3343
msgid "sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/"
3344
msgstr ""
3345
3346
#: serverguide/C/vpn.xml:94(title)
3347
msgid "Client Certificates"
3348
msgstr ""
3349
3350
#: serverguide/C/vpn.xml:96(para)
3351
msgid ""
3352
"The VPN client will also need a certificate to authenticate itself to the "
3353
"server. To create the certificate, enter the following in a terminal:"
3354
msgstr ""
3355
3356
#: serverguide/C/vpn.xml:104(command)
3357
msgid "./pkitool hostname"
3358
msgstr ""
3359
3360
#: serverguide/C/vpn.xml:108(para)
3361
msgid ""
3362
"Replace <emphasis>hostname</emphasis> with the actual hostname of the "
3363
"machine connecting to the VPN."
3364
msgstr ""
3365
3366
#: serverguide/C/vpn.xml:113(para)
3367
msgid "Copy the following files to the client:"
3368
msgstr ""
3369
3370
#: serverguide/C/vpn.xml:118(para)
3371
msgid "/etc/openvpn/ca.crt"
3372
msgstr ""
3373
3374
#: serverguide/C/vpn.xml:119(para)
3375
msgid "/etc/openvpn/easy-rsa/keys/hostname.crt"
3376
msgstr ""
3377
3378
#: serverguide/C/vpn.xml:120(para)
3379
msgid "/etc/openvpn/easy-rsa/keys/hostname.key"
3380
msgstr ""
3381
3382
#: serverguide/C/vpn.xml:121(para)
3383
msgid "/etc/openvpn/ta.key"
3384
msgstr ""
3385
3386
#: serverguide/C/vpn.xml:125(para)
3387
msgid ""
3388
"Remember to adjust the above file names for your client machine's "
3389
"<emphasis>hostname</emphasis>."
3390
msgstr ""
3391
3392
#: serverguide/C/vpn.xml:130(para)
3393
msgid ""
3394
"It is best to use a secure method to copy the certificate and key files. The "
3395
"<application>scp</application> utility is a good choice, but copying the "
3396
"files to removable media then to the client, also works well."
3397
msgstr ""
3398
3399
#: serverguide/C/vpn.xml:141(title) serverguide/C/vcs.xml:107(title)
3400
msgid "Server Configuration"
3401
msgstr ""
3402
3403
#: serverguide/C/vpn.xml:143(para)
3404
msgid ""
3405
"Now configure the <application>openvpn</application> server by creating "
3406
"<filename>/etc/openvpn/server.conf</filename> from the example file. In a "
3407
"terminal enter:"
3408
msgstr ""
3409
3410
#: serverguide/C/vpn.xml:149(command)
3411
msgid ""
3412
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz "
3413
"/etc/openvpn/"
3414
msgstr ""
3415
3416
#: serverguide/C/vpn.xml:150(command)
3417
msgid "sudo gzip -d /etc/openvpn/server.conf.gz"
3418
msgstr ""
3419
3420
#: serverguide/C/vpn.xml:153(para)
3421
msgid ""
3422
"Edit <filename>/etc/openvpn/server.conf</filename> changing the following "
3423
"options to:"
3424
msgstr ""
3425
3426
#: serverguide/C/vpn.xml:157(programlisting)
3427
#, no-wrap
3428
msgid ""
3429
"\n"
3430
"local 172.18.100.101\n"
3431
"dev tap0\n"
3432
"up \"/etc/openvpn/up.sh br0\"\n"
3433
"down \"/etc/openvpn/down.sh br0\"\n"
3434
";server 10.8.0.0 255.255.255.0\n"
3435
"server-bridge 172.18.100.101 255.255.255.0 172.18.100.105 172.18.100.200\n"
3436
"push \"route 172.18.100.1 255.255.255.0\"\n"
3437
"push \"dhcp-option DNS 172.18.100.20\"\n"
3438
"push \"dhcp-option DOMAIN example.com\"\n"
3439
"tls-auth ta.key 0 # This file is secret\n"
3440
"user nobody\n"
3441
"group nogroup\n"
3442
msgstr ""
3443
3444
#: serverguide/C/vpn.xml:174(para)
3445
msgid ""
3446
"<emphasis>local</emphasis>: is the IP address of the bridge interface."
3447
msgstr ""
3448
3449
#: serverguide/C/vpn.xml:179(para)
3450
msgid ""
3451
"<emphasis>server-bridge</emphasis>: needed when the configuration uses "
3452
"bridging. The <emphasis>172.18.100.101 255.255.255.0</emphasis> portion is "
3453
"the bridge interface and mask. The IP range <emphasis>172.18.100.105 "
3454
"172.18.100.200</emphasis> is the range of IP addresses that will be assigned "
3455
"to clients."
3456
msgstr ""
3457
3458
#: serverguide/C/vpn.xml:186(para)
3459
msgid ""
3460
"<emphasis>push</emphasis>: are directives to add networking options for "
3461
"clients."
3462
msgstr ""
3463
3464
#: serverguide/C/vpn.xml:191(para)
3465
msgid ""
3466
"<emphasis>user and group</emphasis>: configure which user and group the "
3467
"<application>openvpn</application> daemon executes as."
3468
msgstr ""
3469
3470
#: serverguide/C/vpn.xml:198(para)
3471
msgid ""
3472
"Replace all IP addresses and domain names above with those of your network."
3473
msgstr ""
3474
3475
#: serverguide/C/vpn.xml:203(para)
3476
msgid ""
3477
"Next, create a couple of helper scripts to add the <emphasis>tap</emphasis> "
3478
"interface to the bridge. Create <filename>/etc/openvpn/up.sh</filename>:"
3479
msgstr ""
3480
3481
#: serverguide/C/vpn.xml:207(programlisting)
3482
#, no-wrap
3483
msgid ""
3484
"\n"
3485
"#!/bin/sh\n"
3486
"\n"
3487
"BR=$1\n"
3488
"DEV=$2\n"
3489
"MTU=$3\n"
3490
"/sbin/ifconfig $DEV mtu $MTU promisc up\n"
3491
"/usr/sbin/brctl addif $BR $DEV\n"
3492
msgstr ""
3493
3494
#: serverguide/C/vpn.xml:217(para)
3495
msgid "And <filename>/etc/openvpn/down.sh</filename>:"
3496
msgstr ""
3497
3498
#: serverguide/C/vpn.xml:221(programlisting)
3499
#, no-wrap
3500
msgid ""
3501
"\n"
3502
"#!/bin/sh\n"
3503
"\n"
3504
"BR=$1\n"
3505
"DEV=$2\n"
3506
"\n"
3507
"/usr/sbin/brctl delif $BR $DEV\n"
3508
"/sbin/ifconfig $DEV down\n"
3509
msgstr ""
3510
3511
#: serverguide/C/vpn.xml:231(para)
3512
msgid "Then make them executable:"
3513
msgstr ""
3514
3515
#: serverguide/C/vpn.xml:236(command)
3516
msgid "sudo chmod 755 /etc/openvpn/down.sh"
3517
msgstr ""
3518
3519
#: serverguide/C/vpn.xml:237(command)
3520
msgid "sudo chmod 755 /etc/openvpn/up.sh"
3521
msgstr ""
3522
3523
#: serverguide/C/vpn.xml:240(para)
3524
msgid ""
3525
"After configuring the server, restart <application>openvpn</application> by "
3526
"entering:"
3527
msgstr ""
3528
3529
#: serverguide/C/vpn.xml:245(command) serverguide/C/vpn.xml:293(command)
3530
msgid "sudo /etc/init.d/openvpn restart"
3531
msgstr ""
3532
3533
#: serverguide/C/vpn.xml:250(title)
3534
msgid "Client Configuration"
3535
msgstr ""
3536
3537
#: serverguide/C/vpn.xml:252(para)
3538
msgid "First, install <application>openvpn</application> on the client:"
3539
msgstr ""
3540
3541
#: serverguide/C/vpn.xml:260(para)
3542
msgid ""
3543
"Then with the server configured and the client certificates copied to the "
3544
"<filename>/etc/openvpn/</filename> directory, create a client configuration "
3545
"file by copying the example. In a terminal on the client machine enter:"
3546
msgstr ""
3547
3548
#: serverguide/C/vpn.xml:266(command)
3549
msgid ""
3550
"sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf "
3551
"/etc/openvpn"
3552
msgstr ""
3553
3554
#: serverguide/C/vpn.xml:269(para)
3555
msgid ""
3556
"Now edit <filename>/etc/openvpn/client.conf</filename> changing the "
3557
"following options:"
3558
msgstr ""
3559
3560
#: serverguide/C/vpn.xml:273(programlisting)
3561
#, no-wrap
3562
msgid ""
3563
"\n"
3564
"dev tap\n"
3565
"remote vpn.example.com 1194\n"
3566
"cert hostname.crt\n"
3567
"key hostname.key\n"
3568
"tls-auth ta.key 1\n"
3569
msgstr ""
3570
3571
#: serverguide/C/vpn.xml:282(para)
3572
msgid ""
3573
"Replace <emphasis>vpn.example.com</emphasis> with the hostname of your VPN "
3574
"server, and <emphasis>hostname.*</emphasis> with the actual certificate and "
3575
"key filenames."
3576
msgstr ""
3577
3578
#: serverguide/C/vpn.xml:288(para)
3579
msgid "Finally, restart <application>openvpn</application>:"
3580
msgstr ""
3581
3582
#: serverguide/C/vpn.xml:296(para)
3583
msgid "You should now be able to connect to the remote LAN through the VPN."
3584
msgstr ""
3585
3586
#: serverguide/C/vpn.xml:307(para)
3587
msgid ""
3588
"See the <ulink url=\"http://openvpn.net/\">OpenVPN</ulink> website for "
3589
"additional information."
3590
msgstr ""
3591
3592
#: serverguide/C/vpn.xml:312(para)
3593
msgid ""
3594
"Also, Pakt's <ulink url=\"http://www.packtpub.com/openvpn/book\">OpenVPN: "
3595
"Building and Integrating Virtual Private Networks</ulink> is a good resource."
3596
msgstr ""
3597
3598
#: serverguide/C/vpn.xml:318(para)
3599
msgid ""
3600
"Another source of further information is the <ulink "
3601
"url=\"https://help.ubuntu.com/community/OpenVPN\">Ubuntu Wiki "
3602
"OpenVPN</ulink> page."
3603
msgstr ""
3604
3605
#: serverguide/C/virtualization.xml:13(title)
3606
msgid "Virtualization"
3607
msgstr ""
3608
3609
#: serverguide/C/virtualization.xml:14(para)
3610
msgid ""
3611
"Virtualization is being adopted in many different environments and "
3612
"situations. If you are a developer, virtualization can provide you with a "
3613
"contained environment where you can safely do almost any sort of development "
3614
"safe from messing up your main working environment. If you are a systems "
3615
"administrator, you can use virtualization to more easily separate your "
3616
"services and move them around based on demand."
3617
msgstr ""
3618
3619
#: serverguide/C/virtualization.xml:20(para)
3620
msgid ""
3621
"The default virtualization technology supported in Ubuntu is "
3622
"<application>KVM</application>, a technology that takes advantage of "
3623
"virtualization extensions built into Intel and AMD hardware. For hardware "
3624
"without virtualization extensions <application>Xen</application> and "
3625
"<application>Qemu</application> are popular solutions."
3626
msgstr ""
3627
3628
#: serverguide/C/virtualization.xml:27(title)
3629
msgid "libvirt"
3630
msgstr ""
3631
3632
#: serverguide/C/virtualization.xml:28(para)
3633
msgid ""
3634
"The <application>libvirt</application> library is used to interface with "
3635
"different virtualization technologies. Before getting started with "
3636
"<application>libvirt</application> it is best to make sure your hardware "
3637
"supports the necessary virtualization extensions for "
3638
"<application>KVM</application>. Enter the following from a terminal prompt:"
3639
msgstr ""
3640
3641
#: serverguide/C/virtualization.xml:35(command)
3642
msgid "kvm-ok"
3643
msgstr ""
3644
3645
#: serverguide/C/virtualization.xml:37(para)
3646
msgid ""
3647
"A message will be printed informing you if your CPU "
3648
"<emphasis>does</emphasis> or <emphasis>does not</emphasis> support hardware "
3649
"virtualization."
3650
msgstr ""
3651
3652
#: serverguide/C/virtualization.xml:41(para)
3653
msgid ""
3654
"On most computer whose processor supports virtualization, it is necessary to "
3655
"activate an option in the BIOS to enable it."
3656
msgstr ""
3657
3658
#: serverguide/C/virtualization.xml:47(title)
3659
msgid "Virtual Networking"
3660
msgstr ""
3661
3662
#: serverguide/C/virtualization.xml:49(para)
3663
msgid ""
3664
"There are a few different ways to allow a virtual machine access to the "
3665
"external network. The default virtual network configuration is "
3666
"<emphasis>usermode</emphasis> networking, which uses the SLIRP protocol and "
3667
"traffic is NATed through the host interface to the outside network."
3668
msgstr ""
3669
3670
#: serverguide/C/virtualization.xml:54(para)
3671
msgid ""
3672
"To enable external hosts to directly access services on virtual machines a "
3673
"<emphasis>bridge</emphasis> needs to be configured. This allows the virtual "
3674
"interfaces to connect to the outside network through the physical interface, "
3675
"making them appear as normal hosts to the rest of the network. For "
3676
"information on setting up a bridge see <xref linkend=\"bridging\"/>."
3677
msgstr ""
3678
3679
#: serverguide/C/virtualization.xml:63(para)
3680
msgid "To install the necessary packages, from a terminal prompt enter:"
3681
msgstr ""
3682
3683
#: serverguide/C/virtualization.xml:67(command)
3684
msgid "sudo apt-get install kvm libvirt-bin"
3685
msgstr ""
3686
3687
#: serverguide/C/virtualization.xml:69(para)
3688
msgid ""
3689
"After installing <application>libvirt-bin</application>, the user used to "
3690
"manage virtual machines will need to be added to the "
3691
"<emphasis>libvirtd</emphasis> group. Doing so will grant the user access to "
3692
"the advanced networking options."
3693
msgstr ""
3694
3695
#: serverguide/C/virtualization.xml:73(para)
3696
msgid "In a terminal enter:"
3697
msgstr ""
3698
3699
#: serverguide/C/virtualization.xml:77(command)
3700
msgid "sudo adduser $USER libvirtd"
3701
msgstr ""
3702
3703
#: serverguide/C/virtualization.xml:80(para)
3704
msgid ""
3705
"If the user chosen is the current user, you will need to log out and back in "
3706
"for the new group membership to take effect."
3707
msgstr ""
3708
3709
#: serverguide/C/virtualization.xml:84(para)
3710
msgid ""
3711
"You are now ready to install a <emphasis>Guest</emphasis> operating system. "
3712
"Installing a virtual machine follows the same process as installing the "
3713
"operating system directly on the hardware. You either need a way to automate "
3714
"the installation, or a keyboard and monitor will need to be attached to the "
3715
"physical machine."
3716
msgstr ""
3717
3718
#: serverguide/C/virtualization.xml:89(para)
3719
msgid ""
3720
"In the case of virtual machines a Graphical User Interface (GUI) is "
3721
"analogous to using a physical keyboard and mouse. Instead of installing a "
3722
"GUI the <application>virt-viewer</application> application can be used to "
3723
"connect to a virtual machine's console using <application>VNC</application>. "
3724
"See <xref linkend=\"libvirt-virt-viewer\"/> for more information."
3725
msgstr ""
3726
3727
#: serverguide/C/virtualization.xml:94(para)
3728
msgid ""
3729
"There are several ways to automate the Ubuntu installation process, for "
3730
"example using preseeds, kickstart, etc. Refer to the <ulink "
3731
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
3732
"Installation Guide</ulink> for details."
3733
msgstr ""
3734
3735
#: serverguide/C/virtualization.xml:98(para)
3736
msgid ""
3737
"Yet another way to install an Ubuntu virtual machine is to use "
3738
"<application>ubuntu-vm-builder</application>. <application>ubuntu-vm-"
3739
"builder</application> allows you to setup advanced partitions, execute "
3740
"custom post-install scripts, etc. For details see <xref linkend=\"jeos-and-"
3741
"vmbuilder\"/>"
3742
msgstr ""
3743
3744
#: serverguide/C/virtualization.xml:104(title)
3745
msgid "virt-install"
3746
msgstr ""
3747
3748
#: serverguide/C/virtualization.xml:105(para)
3749
msgid ""
3750
"<application>virt-install</application> is part of the <application>python-"
3751
"virtinst</application> package. To install it, from a terminal prompt enter:"
3752
msgstr ""
3753
3754
#: serverguide/C/virtualization.xml:109(command)
3755
msgid "sudo apt-get install python-virtinst"
3756
msgstr ""
3757
3758
#: serverguide/C/virtualization.xml:111(para)
3759
msgid ""
3760
"There are several options available when using <application>virt-"
3761
"install</application>. For example:"
3762
msgstr ""
3763
3764
#: serverguide/C/virtualization.xml:115(command)
3765
msgid ""
3766
"sudo virt-install -n web_devel -r 256 -f web_devel.img \\ -s 4 -c jeos.iso --"
3767
"accelerate \\ --connect=qemu:///system --vnc \\ --noautoconsole -v"
3768
msgstr ""
3769
3770
#: serverguide/C/virtualization.xml:122(para)
3771
msgid ""
3772
"<emphasis>-n web_devel:</emphasis> the name of the new virtual machine will "
3773
"be <emphasis>web_devel</emphasis> in this example."
3774
msgstr ""
3775
3776
#: serverguide/C/virtualization.xml:127(para)
3777
msgid ""
3778
"<emphasis>-r 256:</emphasis> specifies the amount of memory the virtual "
3779
"machine will use."
3780
msgstr ""
3781
3782
#: serverguide/C/virtualization.xml:132(para)
3783
msgid ""
3784
"<emphasis>-f web_devel.img:</emphasis> indicates the path to the virtual "
3785
"disk which can be a file, partition, or logical volume. In this example a "
3786
"file named <filename>web_devel.img</filename>."
3787
msgstr ""
3788
3789
#: serverguide/C/virtualization.xml:138(para)
3790
msgid "<emphasis>-s 4:</emphasis> the size of the virtual disk."
3791
msgstr ""
3792
3793
#: serverguide/C/virtualization.xml:143(para)
3794
msgid ""
3795
"<emphasis>-c jeos.iso:</emphasis> file to be used as a virtual CDROM. The "
3796
"file can be either an ISO file or the path to the host's CDROM device."
3797
msgstr ""
3798
3799
#: serverguide/C/virtualization.xml:149(para)
3800
msgid ""
3801
"<emphasis>--accelerate:</emphasis> enables the kernel's acceleration "
3802
"technologies."
3803
msgstr ""
3804
3805
#: serverguide/C/virtualization.xml:154(para)
3806
msgid ""
3807
"<emphasis>--vnc:</emphasis> exports the guest's virtual console using VNC."
3808
msgstr ""
3809
3810
#: serverguide/C/virtualization.xml:159(para)
3811
msgid ""
3812
"<emphasis>--noautoconsole:</emphasis> will not automatically connect to the "
3813
"virtual machine's console."
3814
msgstr ""
3815
3816
#: serverguide/C/virtualization.xml:164(para)
3817
msgid "<emphasis>-v:</emphasis> creates a fully virtualized guest."
3818
msgstr ""
3819
3820
#: serverguide/C/virtualization.xml:169(para)
3821
msgid ""
3822
"After launching <application>virt-install</application> you can connect to "
3823
"the virtual machine's console either locally using a GUI or with the "
3824
"<application>virt-viewer</application> utility."
3825
msgstr ""
3826
3827
#: serverguide/C/virtualization.xml:175(title)
3828
msgid "virt-clone"
3829
msgstr ""
3830
3831
#: serverguide/C/virtualization.xml:176(para)
3832
msgid ""
3833
"The <application>virt-clone</application> application can be used to copy "
3834
"one virtual machine to another. For example:"
3835
msgstr ""
3836
3837
#: serverguide/C/virtualization.xml:180(command)
3838
msgid ""
3839
"sudo virt-clone -o web_devel -n database_devel -f "
3840
"/path/to/database_devel.img --connect=qemu:///system"
3841
msgstr ""
3842
3843
#: serverguide/C/virtualization.xml:184(para)
3844
msgid "<emphasis>-o:</emphasis> original virtual machine."
3845
msgstr ""
3846
3847
#: serverguide/C/virtualization.xml:189(para)
3848
msgid "<emphasis>-n:</emphasis> name of the new virtual machine."
3849
msgstr ""
3850
3851
#: serverguide/C/virtualization.xml:194(para)
3852
msgid ""
3853
"<emphasis>-f:</emphasis> path to the file, logical volume, or partition to "
3854
"be used by the new virtual machine."
3855
msgstr ""
3856
3857
#: serverguide/C/virtualization.xml:199(para)
3858
msgid ""
3859
"<emphasis>--connect:</emphasis> specifies which hypervisor to connect to."
3860
msgstr ""
3861
3862
#: serverguide/C/virtualization.xml:204(para)
3863
msgid ""
3864
"Also, use <emphasis>-d</emphasis> or <emphasis>--debug</emphasis> option to "
3865
"help troubleshoot problems with <application>virt-clone</application>."
3866
msgstr ""
3867
3868
#: serverguide/C/virtualization.xml:209(para)
3869
msgid ""
3870
"Replace <emphasis>web_devel</emphasis> and "
3871
"<emphasis>database_devel</emphasis> with appropriate virtual machine names."
3872
msgstr ""
3873
3874
#: serverguide/C/virtualization.xml:215(title)
3875
msgid "Virtual Machine Management"
3876
msgstr ""
3877
3878
#: serverguide/C/virtualization.xml:217(title)
3879
msgid "virsh"
3880
msgstr ""
3881
3882
#: serverguide/C/virtualization.xml:218(para)
3883
msgid ""
3884
"There are several utilities available to manage virtual machines and "
3885
"<application>libvirt</application>. The <application>virsh</application> "
3886
"utility can be used from the command line. Some examples:"
3887
msgstr ""
3888
3889
#: serverguide/C/virtualization.xml:224(para)
3890
msgid "To list running virtual machines:"
3891
msgstr ""
3892
3893
#: serverguide/C/virtualization.xml:228(command)
3894
msgid "virsh -c qemu:///system list"
3895
msgstr ""
3896
3897
#: serverguide/C/virtualization.xml:232(para)
3898
msgid "To start a virtual machine:"
3899
msgstr ""
3900
3901
#: serverguide/C/virtualization.xml:236(command)
3902
msgid "virsh -c qemu:///system start web_devel"
3903
msgstr ""
3904
3905
#: serverguide/C/virtualization.xml:240(para)
3906
msgid "Similarly, to start a virtual machine at boot:"
3907
msgstr ""
3908
3909
#: serverguide/C/virtualization.xml:244(command)
3910
msgid "virsh -c qemu:///system autostart web_devel"
3911
msgstr ""
3912
3913
#: serverguide/C/virtualization.xml:248(para)
3914
msgid "Reboot a virtual machine with:"
3915
msgstr ""
3916
3917
#: serverguide/C/virtualization.xml:252(command)
3918
msgid "virsh -c qemu:///system reboot web_devel"
3919
msgstr ""
3920
3921
#: serverguide/C/virtualization.xml:256(para)
3922
msgid ""
3923
"The <emphasis>state</emphasis> of virtual machines can be saved to a file in "
3924
"order to be restored later. The following will save the virtual machine "
3925
"state into a file named according to the date:"
3926
msgstr ""
3927
3928
#: serverguide/C/virtualization.xml:261(command)
3929
msgid "virsh -c qemu:///system save web_devel web_devel-022708.state"
3930
msgstr ""
3931
3932
#: serverguide/C/virtualization.xml:263(para)
3933
msgid "Once saved the virtual machine will no longer be running."
3934
msgstr ""
3935
3936
#: serverguide/C/virtualization.xml:268(para)
3937
msgid "A saved virtual machine can be restored using:"
3938
msgstr ""
3939
3940
#: serverguide/C/virtualization.xml:272(command)
3941
msgid "virsh -c qemu:///system restore web_devel-022708.state"
3942
msgstr ""
3943
3944
#: serverguide/C/virtualization.xml:276(para)
3945
msgid "To shutdown a virtual machine do:"
3946
msgstr ""
3947
3948
#: serverguide/C/virtualization.xml:280(command)
3949
msgid "virsh -c qemu:///system shutdown web_devel"
3950
msgstr ""
3951
3952
#: serverguide/C/virtualization.xml:284(para)
3953
msgid "A CDROM device can be mounted in a virtual machine by entering:"
3954
msgstr ""
3955
3956
#: serverguide/C/virtualization.xml:288(command)
3957
msgid "virsh -c qemu:///system attach-disk web_devel /dev/cdrom /media/cdrom"
3958
msgstr ""
3959
3960
#: serverguide/C/virtualization.xml:293(para)
3961
msgid ""
3962
"In the above examples replace <emphasis>web_devel</emphasis> with the "
3963
"appropriate virtual machine name, and <filename>web_devel-"
3964
"022708.state</filename> with a descriptive file name."
3965
msgstr ""
3966
3967
#: serverguide/C/virtualization.xml:300(title)
3968
msgid "Virtual Machine Manager"
3969
msgstr ""
3970
3971
#: serverguide/C/virtualization.xml:301(para)
3972
msgid ""
3973
"The <application>virt-manager</application> package contains a graphical "
3974
"utility to manage local and remote virtual machines. To install virt-manager "
3975
"enter:"
3976
msgstr ""
3977
3978
#: serverguide/C/virtualization.xml:306(command)
3979
msgid "sudo apt-get install virt-manager"
3980
msgstr ""
3981
3982
#: serverguide/C/virtualization.xml:308(para)
3983
msgid ""
3984
"Since <application>virt-manager</application> requires a Graphical User "
3985
"Interface (GUI) environment it is recommended to be installed on a "
3986
"workstation or test machine instead of a production server. To connect to "
3987
"the local <application>libvirt</application> service enter:"
3988
msgstr ""
3989
3990
#: serverguide/C/virtualization.xml:314(command)
3991
msgid "virt-manager -c qemu:///system"
3992
msgstr ""
3993
3994
#: serverguide/C/virtualization.xml:316(para)
3995
msgid ""
3996
"You can connect to the <application>libvirt</application> service running on "
3997
"another host by entering the following in a terminal prompt:"
3998
msgstr ""
3999
4000
#: serverguide/C/virtualization.xml:320(command)
4001
msgid "virt-manager -c qemu+ssh://virtnode1.mydomain.com/system"
4002
msgstr ""
4003
4004
#: serverguide/C/virtualization.xml:323(para)
4005
msgid ""
4006
"The above example assumes that <application>SSH</application> connectivity "
4007
"between the management system and virtnode1.mydomain.com has already been "
4008
"configured, and uses SSH keys for authentication. SSH "
4009
"<emphasis>keys</emphasis> are needed because "
4010
"<application>libvirt</application> sends the password prompt to another "
4011
"process. For details on configuring <application>SSH</application> see <xref "
4012
"linkend=\"openssh-server\"/>"
4013
msgstr ""
4014
4015
#: serverguide/C/virtualization.xml:333(title)
4016
msgid "Virtual Machine Viewer"
4017
msgstr ""
4018
4019
#: serverguide/C/virtualization.xml:334(para)
4020
msgid ""
4021
"The <application>virt-viewer</application> application allows you to connect "
4022
"to a virtual machine's console. <application>virt-viewer</application> does "
4023
"require a Graphical User Interface (GUI) to interface with the virtual "
4024
"machine."
4025
msgstr ""
4026
4027
#: serverguide/C/virtualization.xml:338(para)
4028
msgid ""
4029
"To install <application>virt-viewer</application> from a terminal enter:"
4030
msgstr ""
4031
4032
#: serverguide/C/virtualization.xml:342(command)
4033
msgid "sudo apt-get install virt-viewer"
4034
msgstr ""
4035
4036
#: serverguide/C/virtualization.xml:344(para)
4037
msgid ""
4038
"Once a virtual machine is installed and running you can connect to the "
4039
"virtual machine's console by using:"
4040
msgstr ""
4041
4042
#: serverguide/C/virtualization.xml:348(command)
4043
msgid "virt-viewer -c qemu:///system web_devel"
4044
msgstr ""
4045
4046
#: serverguide/C/virtualization.xml:350(para)
4047
msgid ""
4048
"Similar to <application>virt-manager</application>, <application>virt-"
4049
"viewer</application> can connect to a remote host using "
4050
"<emphasis>SSH</emphasis> with key authentication, as well:"
4051
msgstr ""
4052
4053
#: serverguide/C/virtualization.xml:355(command)
4054
msgid "virt-viewer -c qemu+ssh://virtnode1.mydomain.com/system web_devel"
4055
msgstr ""
4056
4057
#: serverguide/C/virtualization.xml:357(para)
4058
msgid ""
4059
"Be sure to replace <emphasis role=\"italic\">web_devel</emphasis> with the "
4060
"appropriate virtual machine name."
4061
msgstr ""
4062
4063
#: serverguide/C/virtualization.xml:360(para)
4064
msgid ""
4065
"If configured to use a <emphasis>bridged</emphasis> network interface you "
4066
"can also setup <application>SSH</application> access to the virtual machine. "
4067
"See <xref linkend=\"openssh-server\"/> and <xref linkend=\"bridging\"/> for "
4068
"more details."
4069
msgstr ""
4070
4071
#: serverguide/C/virtualization.xml:369(para)
4072
msgid ""
4073
"See the <ulink url=\"http://kvm.qumranet.com/kvmwiki\">KVM</ulink> home page "
4074
"for more details."
4075
msgstr ""
4076
4077
#: serverguide/C/virtualization.xml:374(para)
4078
msgid ""
4079
"For more information on <application>libvirt</application> see the <ulink "
4080
"url=\"http://libvirt.org/\">libvirt home page</ulink>"
4081
msgstr ""
4082
4083
#: serverguide/C/virtualization.xml:379(para)
4084
msgid ""
4085
"The <ulink url=\"http://virt-manager.et.redhat.com/\">Virtual Machine "
4086
"Manager</ulink> site has more information on <application>virt-"
4087
"manager</application> development."
4088
msgstr ""
4089
4090
#: serverguide/C/virtualization.xml:385(para)
4091
msgid ""
4092
"Also, stop by the <emphasis>#ubuntu-virt</emphasis> IRC channel on <ulink "
4093
"url=\"http://freenode.net/\">freenode</ulink> to discuss virtualization "
4094
"technology in Ubuntu."
4095
msgstr ""
4096
4097
#: serverguide/C/virtualization.xml:391(para)
4098
msgid ""
4099
"Another good resource is the <ulink "
4100
"url=\"https://help.ubuntu.com/community/KVM\">Ubuntu Wiki KVM</ulink> page."
4101
msgstr ""
4102
4103
#: serverguide/C/virtualization.xml:399(title)
4104
msgid "JeOS and vmbuilder"
4105
msgstr ""
4106
4107
#: serverguide/C/virtualization.xml:405(title)
4108
msgid "What is JeOS"
4109
msgstr ""
4110
4111
#: serverguide/C/virtualization.xml:407(para)
4112
msgid ""
4113
"Ubuntu <emphasis>JeOS</emphasis> (pronounced \"Juice\") is an efficient "
4114
"variant of the Ubuntu Server operating system, configured specifically for "
4115
"virtual appliances. No longer available as a CD-ROM ISO for download, but "
4116
"only as an option either:"
4117
msgstr ""
4118
4119
#: serverguide/C/virtualization.xml:414(para)
4120
msgid ""
4121
"While installing from the Server Edition ISO (pressing "
4122
"<emphasis>F4</emphasis> on the first screen will allow you to pick \"Minimal "
4123
"installation\", which is the package selection equivalent to JeOS)."
4124
msgstr ""
4125
4126
#: serverguide/C/virtualization.xml:420(para)
4127
msgid "Or to be built using Ubuntu's vmbuilder, which is described here."
4128
msgstr ""
4129
4130
#: serverguide/C/virtualization.xml:426(para)
4131
msgid ""
4132
"JeOS is a specialized installation of Ubuntu Server Edition with a tuned "
4133
"kernel that only contains the base elements needed to run within a "
4134
"virtualized environment."
4135
msgstr ""
4136
4137
#: serverguide/C/virtualization.xml:431(para)
4138
msgid ""
4139
"Ubuntu JeOS has been tuned to take advantage of key performance technologies "
4140
"in the latest virtualization products from VMware. This combination of "
4141
"reduced size and optimized performance ensures that Ubuntu JeOS Edition "
4142
"delivers a highly efficient use of server resources in large virtual "
4143
"deployments."
4144
msgstr ""
4145
4146
#: serverguide/C/virtualization.xml:437(para)
4147
msgid ""
4148
"Without unnecessary drivers, and only the minimal required packages, ISVs "
4149
"can configure their supporting OS exactly as they require. They have the "
4150
"peace of mind that updates, whether for security or enhancement reasons, "
4151
"will be limited to the bare minimum of what is required in their specific "
4152
"environment. In turn, users deploying virtual appliances built on top of "
4153
"JeOS will have to go through fewer updates and therefore less maintenance "
4154
"than they would have had to with a standard full installation of a server."
4155
msgstr ""
4156
4157
#: serverguide/C/virtualization.xml:446(title)
4158
msgid "What is vmbuilder"
4159
msgstr ""
4160
4161
#: serverguide/C/virtualization.xml:448(para)
4162
msgid ""
4163
"With vmbuilder, there is no need to download a JeOS ISO anymore. vmbuilder "
4164
"will fetch the various package and build a virtual machine tailored for your "
4165
"needs in about a minute. vmbuilder is a script that automates the process of "
4166
"creating a ready to use Linux based VM. The currently supported hypervisors "
4167
"are KVM and Xen."
4168
msgstr ""
4169
4170
#: serverguide/C/virtualization.xml:454(para)
4171
msgid ""
4172
"You can pass command line options to add extra packages, remove packages, "
4173
"choose which version of Ubuntu, which mirror etc. On recent hardware with "
4174
"plenty of RAM, tmpdir in <filename>/dev/shm</filename> or using a tmpfs, and "
4175
"a local mirror, you can bootstrap a VM in less than a minute."
4176
msgstr ""
4177
4178
#: serverguide/C/virtualization.xml:460(para)
4179
msgid ""
4180
"First introduced as a shell script in Ubuntu 8.04 LTS, <application>ubuntu-"
4181
"vm-builder</application> started with little emphasis as a hack to help "
4182
"developers test their new code in a virtual machine without having to "
4183
"restart from scratch each time. As a few Ubuntu administrators started to "
4184
"notice this script, a few of them went on improving it and adapting it for "
4185
"so many use case that Soren Hansen (the author of the script and Ubuntu "
4186
"virtualization specialist, not the golf player) decided to rewrite it from "
4187
"scratch for Intrepid as a python script with a few new design goals:"
4188
msgstr ""
4189
4190
#: serverguide/C/virtualization.xml:470(para)
4191
msgid "Develop it so that it can be reused by other distributions."
4192
msgstr ""
4193
4194
#: serverguide/C/virtualization.xml:475(para)
4195
msgid ""
4196
"Use a plugin mechanisms for all virtualization interactions so that others "
4197
"can easily add logic for other virtualization environments."
4198
msgstr ""
4199
4200
#: serverguide/C/virtualization.xml:480(para)
4201
msgid ""
4202
"Provide an easy to maintain web interface as an option to the command line "
4203
"interface."
4204
msgstr ""
4205
4206
#: serverguide/C/virtualization.xml:486(para)
4207
msgid "But the general principles and commands remain the same."
4208
msgstr ""
4209
4210
#: serverguide/C/virtualization.xml:493(title)
4211
msgid "Initial Setup"
4212
msgstr ""
4213
4214
#: serverguide/C/virtualization.xml:495(para)
4215
msgid ""
4216
"It is assumed that you have installed and configured "
4217
"<application>libvirt</application> and <application>KVM</application> "
4218
"locally on the machine you are using. For details on how to perform this, "
4219
"please refer to:"
4220
msgstr ""
4221
4222
#: serverguide/C/virtualization.xml:507(para)
4223
msgid ""
4224
"The <ulink url=\"https://help.ubuntu.com/community/KVM\">KVM</ulink> Wiki "
4225
"page."
4226
msgstr ""
4227
4228
#: serverguide/C/virtualization.xml:513(para)
4229
msgid ""
4230
"We also assume that you know how to use a text based text editor such as "
4231
"nano or vi. If you have not used any of them before, you can get an overview "
4232
"of the various text editors available by reading the <ulink "
4233
"url=\"https://help.ubuntu.com/community/PowerUsersTextEditors\">PowerUsersTex"
4234
"tEditors</ulink> page. This tutorial has been done on KVM, but the general "
4235
"principle should remain on other virtualization technologies."
4236
msgstr ""
4237
4238
#: serverguide/C/virtualization.xml:521(title)
4239
msgid "Install vmbuilder"
4240
msgstr ""
4241
4242
#: serverguide/C/virtualization.xml:523(para)
4243
msgid ""
4244
"The name of the package that we need to install is <application>python-vm-"
4245
"builder</application>. In a terminal prompt enter:"
4246
msgstr ""
4247
4248
#: serverguide/C/virtualization.xml:528(command)
4249
msgid "sudo apt-get install python-vm-builder"
4250
msgstr ""
4251
4252
#: serverguide/C/virtualization.xml:532(para)
4253
msgid ""
4254
"If you are running Hardy, you can still perform most of this using the older "
4255
"version of the package named <application>ubuntu-vm-builder</application>, "
4256
"there are only a few changes to the syntax of the tool."
4257
msgstr ""
4258
4259
#: serverguide/C/virtualization.xml:541(title)
4260
msgid "Defining Your Virtual Machine"
4261
msgstr ""
4262
4263
#: serverguide/C/virtualization.xml:543(para)
4264
msgid ""
4265
"Defining a virtual machine with Ubuntu's vmbuilder is quite simple, but here "
4266
"are a few thing to consider:"
4267
msgstr ""
4268
4269
#: serverguide/C/virtualization.xml:549(para)
4270
msgid ""
4271
"If you plan on shipping a virtual appliance, do not assume that the end-user "
4272
"will know how to extend disk size to fit their need, so either plan for a "
4273
"large virtual disk to allow for your appliance to grow, or explain fairly "
4274
"well in your documentation how to allocate more space. It might actually be "
4275
"a good idea to store data on some separate external storage."
4276
msgstr ""
4277
4278
#: serverguide/C/virtualization.xml:556(para)
4279
msgid ""
4280
"Given that RAM is much easier to allocate in a VM, RAM size should be set to "
4281
"whatever you think is a safe minimum for your appliance."
4282
msgstr ""
4283
4284
#: serverguide/C/virtualization.xml:562(para)
4285
msgid ""
4286
"The <application>vmbuilder</application> command has 2 main parameters: the "
4287
"<emphasis>virtualization technology (hypervisor)</emphasis> and the targeted "
4288
"<emphasis>distribution</emphasis>. Optional parameters are quite numerous "
4289
"and can be found using the following command:"
4290
msgstr ""
4291
4292
#: serverguide/C/virtualization.xml:568(command)
4293
msgid "vmbuilder --help"
4294
msgstr ""
4295
4296
#: serverguide/C/virtualization.xml:572(title)
4297
msgid "Base Parameters"
4298
msgstr ""
4299
4300
#: serverguide/C/virtualization.xml:574(para)
4301
msgid ""
4302
"As this example is based on <application>KVM</application> and Ubuntu 10.04 "
4303
"LTS (Lucid Lynx), and we are likely to rebuild the same virtual machine "
4304
"multiple time, we'll invoke vmbuilder with the following first parameters:"
4305
msgstr ""
4306
4307
#: serverguide/C/virtualization.xml:580(command)
4308
msgid ""
4309
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4310
"libvirt qemu:///system"
4311
msgstr ""
4312
4313
#: serverguide/C/virtualization.xml:583(para)
4314
msgid ""
4315
"The <emphasis>--suite</emphasis> defines the Ubuntu release, the <emphasis>--"
4316
"flavour</emphasis> specifies that we want to use the virtual kernel (that's "
4317
"the one used to build a JeOS image), the <emphasis>--arch</emphasis> tells "
4318
"that we want to use a 32 bit machine, the <emphasis>-o</emphasis> tells "
4319
"vmbuilder to overwrite the previous version of the VM and the <emphasis>--"
4320
"libvirt</emphasis> tells to inform the local virtualization environment to "
4321
"add the resulting VM to the list of available machines."
4322
msgstr ""
4323
4324
#: serverguide/C/virtualization.xml:591(para)
4325
msgid "Notes:"
4326
msgstr ""
4327
4328
#: serverguide/C/virtualization.xml:597(para)
4329
msgid ""
4330
"Because of the nature of operations performed by vmbuilder, it needs to have "
4331
"root privilege, hence the use of sudo."
4332
msgstr ""
4333
4334
#: serverguide/C/virtualization.xml:602(para)
4335
msgid ""
4336
"If your virtual machine needs to use more than 3Gb of ram, you should build "
4337
"a 64 bit machine (--arch amd64)."
4338
msgstr ""
4339
4340
#: serverguide/C/virtualization.xml:607(para)
4341
msgid ""
4342
"Until Ubuntu 8.10, the virtual kernel was only built for 32 bit "
4343
"architecture, so if you want to define an amd64 machine on Hardy, you should "
4344
"use <emphasis>--flavour</emphasis> server instead."
4345
msgstr ""
4346
4347
#: serverguide/C/virtualization.xml:615(title)
4348
msgid "JeOS Installation Parameters"
4349
msgstr ""
4350
4351
#: serverguide/C/virtualization.xml:618(title)
4352
msgid "JeOS Networking"
4353
msgstr ""
4354
4355
#: serverguide/C/virtualization.xml:621(title)
4356
msgid "Assigning a fixed IP address"
4357
msgstr ""
4358
4359
#: serverguide/C/virtualization.xml:623(para)
4360
msgid ""
4361
"As a virtual appliance that may be deployed on various very different "
4362
"networks, it is very difficult to know what the actual network will look "
4363
"like. In order to simplify configuration, it is a good idea to take an "
4364
"approach similar to what network hardware vendors usually do, namely "
4365
"assigning an initial fixed IP address to the appliance in a private class "
4366
"network that you will provide in your documentation. An address in the range "
4367
"192.168.0.0/255 is usually a good choice."
4368
msgstr ""
4369
4370
#: serverguide/C/virtualization.xml:630(para)
4371
msgid "To do this we'll use the following parameters:"
4372
msgstr ""
4373
4374
#: serverguide/C/virtualization.xml:636(para)
4375
msgid ""
4376
"<emphasis>--ip ADDRESS</emphasis>: IP address in dotted form (defaults to "
4377
"dhcp if not specified)"
4378
msgstr ""
4379
4380
#: serverguide/C/virtualization.xml:641(para)
4381
msgid ""
4382
"<emphasis>--mask VALUE</emphasis>: IP mask in dotted form (default: "
4383
"255.255.255.0)"
4384
msgstr ""
4385
4386
#: serverguide/C/virtualization.xml:646(para)
4387
msgid "<emphasis>--net VALUE</emphasis>: IP net address (default: X.X.X.0)"
4388
msgstr ""
4389
4390
#: serverguide/C/virtualization.xml:651(para)
4391
msgid "<emphasis>--bcast VALUE</emphasis>: IP broadcast (default: X.X.X.255)"
4392
msgstr ""
4393
4394
#: serverguide/C/virtualization.xml:656(para)
4395
msgid "<emphasis>--gw ADDRESS</emphasis>: Gateway address (default: X.X.X.1)"
4396
msgstr ""
4397
4398
#: serverguide/C/virtualization.xml:661(para)
4399
msgid ""
4400
"<emphasis>--dns ADDRESS</emphasis>: Name server address (default: X.X.X.1)"
4401
msgstr ""
4402
4403
#: serverguide/C/virtualization.xml:667(para)
4404
msgid ""
4405
"We assume for now that default values are good enough, so the resulting "
4406
"invocation becomes:"
4407
msgstr ""
4408
4409
#: serverguide/C/virtualization.xml:672(command)
4410
msgid ""
4411
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o --"
4412
"libvirt qemu:///system --ip 192.168.0.100"
4413
msgstr ""
4414
4415
#: serverguide/C/virtualization.xml:677(title)
4416
msgid "Modifying the libvirt Template to use Bridging"
4417
msgstr ""
4418
4419
#: serverguide/C/virtualization.xml:679(para)
4420
msgid ""
4421
"Because our appliance will be likely to need to be accessed by remote hosts, "
4422
"we need to configure libvirt so that the appliance uses bridge networking. "
4423
"To do this we use vmbuilder template mechanism to modify the default one."
4424
msgstr ""
4425
4426
#: serverguide/C/virtualization.xml:684(para)
4427
msgid ""
4428
"In our working directory we create the template hierarchy and copy the "
4429
"default template:"
4430
msgstr ""
4431
4432
#: serverguide/C/virtualization.xml:689(command)
4433
msgid "mkdir -p VMBuilder/plugins/libvirt/templates"
4434
msgstr ""
4435
4436
#: serverguide/C/virtualization.xml:690(command)
4437
msgid "cp /etc/vmbuilder/libvirt/* VMBuilder/plugins/libvirt/templates/"
4438
msgstr ""
4439
4440
#: serverguide/C/virtualization.xml:693(para)
4441
msgid ""
4442
"We can then edit "
4443
"<filename>VMBuilder/plugins/libvirt/templates/libvirtxml.tmpl</filename> to "
4444
"change:"
4445
msgstr ""
4446
4447
#: serverguide/C/virtualization.xml:697(programlisting)
4448
#, no-wrap
4449
msgid ""
4450
"\n"
4451
" <interface type='network'>\n"
4452
" <source network='default'/>\n"
4453
" </interface>\n"
4454
msgstr ""
4455
4456
#: serverguide/C/virtualization.xml:703(para)
4457
msgid "To:"
4458
msgstr ""
4459
4460
#: serverguide/C/virtualization.xml:707(programlisting)
4461
#, no-wrap
4462
msgid ""
4463
"\n"
4464
" <interface type='bridge'>\n"
4465
" <source bridge='br0'/>\n"
4466
" </interface>\n"
4467
msgstr ""
4468
4469
#: serverguide/C/virtualization.xml:717(title) serverguide/C/installation.xml:459(title)
4470
msgid "Partitioning"
4471
msgstr ""
4472
4473
#: serverguide/C/virtualization.xml:719(para)
4474
msgid ""
4475
"Partitioning of the virtual appliance will have to take into consideration "
4476
"what you are planning to do with is. Because most appliances want to have a "
4477
"separate storage for data, having a separate <filename>/var</filename> would "
4478
"make sense."
4479
msgstr ""
4480
4481
#: serverguide/C/virtualization.xml:724(para)
4482
msgid ""
4483
"In order to do this vmbuilder provides us with <emphasis>--part</emphasis>:"
4484
msgstr ""
4485
4486
#: serverguide/C/virtualization.xml:728(programlisting)
4487
#, no-wrap
4488
msgid ""
4489
"\n"
4490
"--part PATH\n"
4491
" Allows you to specify a partition table in a partition file, located at "
4492
"PATH. Each line of the partition file should specify\n"
4493
" (root first):\n"
4494
" mountpoint size\n"
4495
" where size is in megabytes. You can have up to 4 virtual disks, a new "
4496
"disk starts on a\n"
4497
" line with ’---’. ie :\n"
4498
" root 1000\n"
4499
" /opt 1000\n"
4500
" swap 256\n"
4501
" ---\n"
4502
" /var 2000\n"
4503
" /log 1500\n"
4504
msgstr ""
4505
4506
#: serverguide/C/virtualization.xml:743(para)
4507
msgid ""
4508
"In our case we will define a text file name "
4509
"<filename>vmbuilder.partition</filename> which will contain the following:"
4510
msgstr ""
4511
4512
#: serverguide/C/virtualization.xml:747(programlisting)
4513
#, no-wrap
4514
msgid ""
4515
"\n"
4516
"root 8000\n"
4517
"swap 4000\n"
4518
"---\n"
4519
"/var 20000\n"
4520
msgstr ""
4521
4522
#: serverguide/C/virtualization.xml:755(para)
4523
msgid ""
4524
"Note that as we are using virtual disk images, the actual sizes that we put "
4525
"here are maximum sizes for these volumes."
4526
msgstr ""
4527
4528
#: serverguide/C/virtualization.xml:760(para)
4529
msgid "Our command line now looks like:"
4530
msgstr ""
4531
4532
#: serverguide/C/virtualization.xml:765(command)
4533
msgid ""
4534
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4535
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition"
4536
msgstr ""
4537
4538
#: serverguide/C/virtualization.xml:770(para)
4539
msgid ""
4540
"Using a \"\\\" in a command will allow long command strings to wrap to the "
4541
"next line."
4542
msgstr ""
4543
4544
#: serverguide/C/virtualization.xml:777(title)
4545
msgid "User and Password"
4546
msgstr ""
4547
4548
#: serverguide/C/virtualization.xml:779(para)
4549
msgid ""
4550
"Again setting up a virtual appliance, you will need to provide a default "
4551
"user and password that is generic so that you can include it in your "
4552
"documentation. We will see later on in this tutorial how we will provide "
4553
"some security by defining a script that will be run the first time a user "
4554
"actually logs in the appliance, that will, among other things, ask him to "
4555
"change his password. In this example I will use <emphasis>'user'</emphasis> "
4556
"as my user name, and <emphasis>'default'</emphasis> as the password."
4557
msgstr ""
4558
4559
#: serverguide/C/virtualization.xml:787(para)
4560
msgid "To do this we use the following optional parameters:"
4561
msgstr ""
4562
4563
#: serverguide/C/virtualization.xml:793(para)
4564
msgid ""
4565
"<emphasis>--user USERNAME:</emphasis> Sets the name of the user to be added. "
4566
"Default: ubuntu."
4567
msgstr ""
4568
4569
#: serverguide/C/virtualization.xml:798(para)
4570
msgid ""
4571
"<emphasis>--name FULLNAME:</emphasis> Sets the full name of the user to be "
4572
"added. Default: Ubuntu."
4573
msgstr ""
4574
4575
#: serverguide/C/virtualization.xml:803(para)
4576
msgid ""
4577
"<emphasis>--pass PASSWORD:</emphasis> Sets the password for the user. "
4578
"Default: ubuntu."
4579
msgstr ""
4580
4581
#: serverguide/C/virtualization.xml:809(para)
4582
msgid "Our resulting command line becomes:"
4583
msgstr ""
4584
4585
#: serverguide/C/virtualization.xml:814(command)
4586
msgid ""
4587
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 \\ -o -"
4588
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition \\ --"
4589
"user user --name user --pass default"
4590
msgstr ""
4591
4592
#: serverguide/C/virtualization.xml:822(title)
4593
msgid "Installing Required Packages"
4594
msgstr ""
4595
4596
#: serverguide/C/virtualization.xml:824(para)
4597
msgid ""
4598
"In this example we will be installing a package "
4599
"<application>(Limesurvey)</application> that accesses a "
4600
"<application>MySQL</application> database and has a web interface. We will "
4601
"therefore require our OS to provide us with:"
4602
msgstr ""
4603
4604
#: serverguide/C/virtualization.xml:831(para)
4605
msgid "Apache"
4606
msgstr ""
4607
4608
#: serverguide/C/virtualization.xml:832(para)
4609
msgid "PHP"
4610
msgstr ""
4611
4612
#: serverguide/C/virtualization.xml:833(para) serverguide/C/databases.xml:19(trademark) serverguide/C/databases.xml:31(title)
4613
msgid "MySQL"
4614
msgstr ""
4615
4616
#: serverguide/C/virtualization.xml:834(para) serverguide/C/remote-administration.xml:20(title)
4617
msgid "OpenSSH Server"
4618
msgstr ""
4619
4620
#: serverguide/C/virtualization.xml:835(para)
4621
msgid "Limesurvey (as an example application that we have packaged)"
4622
msgstr ""
4623
4624
#: serverguide/C/virtualization.xml:838(para)
4625
msgid ""
4626
"This is done using vmbuilder by specifying the --addpkg option multiple "
4627
"times:"
4628
msgstr ""
4629
4630
#: serverguide/C/virtualization.xml:842(programlisting)
4631
#, no-wrap
4632
msgid ""
4633
"\n"
4634
"--addpkg PKG\n"
4635
" Install PKG into the guest (can be specfied multiple times)\n"
4636
msgstr ""
4637
4638
#: serverguide/C/virtualization.xml:847(para)
4639
msgid ""
4640
"However, due to the way vmbuilder operates, packages that have to ask "
4641
"questions to the user during the post install phase are not supported and "
4642
"should instead be installed while interactivity can occur. This is the case "
4643
"of Limesurvey, which we will have to install later, once the user logs in."
4644
msgstr ""
4645
4646
#: serverguide/C/virtualization.xml:853(para)
4647
msgid ""
4648
"Other packages that ask simple debconf question, such as <application>mysql-"
4649
"server</application> asking to set a password, the package can be installed "
4650
"immediately, but we will have to reconfigure it the first time the user logs "
4651
"in."
4652
msgstr ""
4653
4654
#: serverguide/C/virtualization.xml:859(para)
4655
msgid ""
4656
"If some packages that we need to install are not in main, we need to enable "
4657
"the additional repositories using --comp and --ppa:"
4658
msgstr ""
4659
4660
#: serverguide/C/virtualization.xml:863(programlisting)
4661
#, no-wrap
4662
msgid ""
4663
"\n"
4664
"--components COMP1,COMP2,...,COMPN\n"
4665
" A comma separated list of distro components to include (e.g. "
4666
"main,universe). This defaults\n"
4667
" to \"main\"\n"
4668
"--ppa=PPA Add ppa belonging to PPA to the vm's sources.list.\n"
4669
msgstr ""
4670
4671
#: serverguide/C/virtualization.xml:870(para)
4672
msgid ""
4673
"Limesurvey not being part of the archive at the moment, we'll specify it's "
4674
"PPA (personal package archive) address so that it is added to the VM "
4675
"<filename>/etc/apt/source.list</filename>, so we add the following options "
4676
"to the command line:"
4677
msgstr ""
4678
4679
#: serverguide/C/virtualization.xml:876(command)
4680
msgid ""
4681
"--addpkg apache2 --addpkg apache2-mpm-prefork --addpkg apache2-utils --"
4682
"addpkg apache2.2-common \\ --addpkg dbconfig-common --addpkg libapache2-mod-"
4683
"php5 --addpkg mysql-client --addpkg php5-cli \\ --addpkg php5-gd --addpkg "
4684
"php5-ldap --addpkg php5-mysql --addpkg wwwconfig-common \\ --addpkg mysql-"
4685
"server --ppa nijaba"
4686
msgstr ""
4687
4688
#: serverguide/C/virtualization.xml:883(title)
4689
msgid "OpenSSH"
4690
msgstr ""
4691
4692
#: serverguide/C/virtualization.xml:885(para)
4693
msgid ""
4694
"Another convenient tool that we want to have on our appliance is OpenSSH, as "
4695
"it will allow our admins to access the appliance remotely. However, pushing "
4696
"in the wild an appliance with a pre-installed OpenSSH server is a big "
4697
"security risk as all these server will share the same secret key, making it "
4698
"very easy for hackers to target our appliance with all the tools they need "
4699
"to crack it open in a breeze. As for the user password, we will instead rely "
4700
"on a script that will install OpenSSH the first time a user logs in so that "
4701
"the key generated will be different for each appliance. For this we'll use a "
4702
"<emphasis>--firstboot</emphasis> script, as it does not need any user "
4703
"interaction."
4704
msgstr ""
4705
4706
#: serverguide/C/virtualization.xml:897(title)
4707
msgid "Speed Considerations"
4708
msgstr ""
4709
4710
#: serverguide/C/virtualization.xml:900(title)
4711
msgid "Package Caching"
4712
msgstr ""
4713
4714
#: serverguide/C/virtualization.xml:902(para)
4715
msgid ""
4716
"When vmbuilder creates builds your system, it has to go fetch each one of "
4717
"the packages that composes it over the network to one of the official "
4718
"repositories, which, depending on your internet connection speed and the "
4719
"load of the mirror, can have a big impact on the actual build time. In order "
4720
"to reduce this, it is recommended to either have a local repository (which "
4721
"can be created using <application>apt-mirror</application>) or using a "
4722
"caching proxy such as <application>apt-proxy</application>. The later option "
4723
"being much simpler to implement and requiring less disk space, it is the one "
4724
"we will pick in this tutorial. To install it, simply type:"
4725
msgstr ""
4726
4727
#: serverguide/C/virtualization.xml:912(command)
4728
msgid "sudo apt-get install apt-proxy"
4729
msgstr ""
4730
4731
#: serverguide/C/virtualization.xml:915(para)
4732
msgid ""
4733
"Once this is complete, your (empty) proxy is ready for use on "
4734
"http://mirroraddress:9999 and will find ubuntu repository under /ubuntu. For "
4735
"vmbuilder to use it, we'll have to use the <emphasis>--mirror</emphasis> "
4736
"option:"
4737
msgstr ""
4738
4739
#: serverguide/C/virtualization.xml:920(programlisting)
4740
#, no-wrap
4741
msgid ""
4742
"\n"
4743
"--mirror=URL Use Ubuntu mirror at URL instead of the default, which\n"
4744
" is http://archive.ubuntu.com/ubuntu for official\n"
4745
" arches and http://ports.ubuntu.com/ubuntu-ports\n"
4746
" otherwise\n"
4747
msgstr ""
4748
4749
#: serverguide/C/virtualization.xml:927(para)
4750
msgid "So we add to the command line:"
4751
msgstr ""
4752
4753
#: serverguide/C/virtualization.xml:932(command)
4754
msgid "--mirror http://mirroraddress:9999/ubuntu"
4755
msgstr ""
4756
4757
#: serverguide/C/virtualization.xml:936(para)
4758
msgid ""
4759
"The mirror address specified here will also be used in the "
4760
"<filename>/etc/apt/sources.list</filename> of the newly created guest, so it "
4761
"is useful to specify here an address that can be resolved by the guest or to "
4762
"plan on reseting this address later on, such as in a <emphasis>--"
4763
"firstboot</emphasis> script."
4764
msgstr ""
4765
4766
#: serverguide/C/virtualization.xml:945(title)
4767
msgid "Install a Local Mirror"
4768
msgstr ""
4769
4770
#: serverguide/C/virtualization.xml:947(para)
4771
msgid ""
4772
"If we are in a larger environment, it may make sense to setup a local mirror "
4773
"of the Ubuntu repositories. The package apt-mirror provides you with a "
4774
"script that will handle the mirroring for you. You should plan on having "
4775
"about 20 gigabyte of free space per supported release and architecture."
4776
msgstr ""
4777
4778
#: serverguide/C/virtualization.xml:953(para)
4779
msgid ""
4780
"By default, <application>apt-mirror</application> uses the configuration "
4781
"file in <filename>/etc/apt/mirror.list</filename>. As it is set up, it will "
4782
"replicate only the architecture of the local machine. If you would like to "
4783
"support other architectures on your mirror, simply duplicate the lines "
4784
"starting with “deb”, replacing the deb keyword by /deb-{arch} where arch can "
4785
"be i386, amd64, etc... For example, on an amd64 machine, to have the i386 "
4786
"archives as well, you will have:"
4787
msgstr ""
4788
4789
#: serverguide/C/virtualization.xml:960(programlisting)
4790
#, no-wrap
4791
msgid ""
4792
"\n"
4793
"deb http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4794
"multiverse \n"
4795
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main restricted universe "
4796
"multiverse\n"
4797
"\n"
4798
"deb http://archive.ubuntu.com/ubuntu lucid-updates main restricted universe "
4799
"multiverse \n"
4800
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-updates main restricted "
4801
"universe multiverse \n"
4802
"\n"
4803
"deb http://archive.ubuntu.com/ubuntu/ lucid-backports main restricted "
4804
"universe multiverse \n"
4805
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid-backports main restricted "
4806
"universe multiverse \n"
4807
"\n"
4808
"deb http://security.ubuntu.com/ubuntu lucid-security main restricted "
4809
"universe multiverse \n"
4810
"/deb-i386 http://security.ubuntu.com/ubuntu lucid-security main restricted "
4811
"universe multiverse \n"
4812
"\n"
4813
"deb http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4814
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4815
"installer \n"
4816
"/deb-i386 http://archive.ubuntu.com/ubuntu lucid main/debian-installer "
4817
"restricted/debian-installer universe/debian-installer multiverse/debian-"
4818
"installer \n"
4819
msgstr ""
4820
4821
#: serverguide/C/virtualization.xml:977(para)
4822
msgid ""
4823
"Notice that the source packages are not mirrored as they are seldom used "
4824
"compared to the binaries and they do take a lot more space, but they can be "
4825
"easily added to the list."
4826
msgstr ""
4827
4828
#: serverguide/C/virtualization.xml:982(para)
4829
msgid ""
4830
"Once the mirror has finished replicating (and this can be quite long), you "
4831
"need to configure Apache so that your mirror files (in "
4832
"<filename>/var/spool/apt-mirror</filename> if you did not change the "
4833
"default), are published by your Apache server. For more information on "
4834
"Apache see <xref linkend=\"httpd\"/>."
4835
msgstr ""
4836
4837
#: serverguide/C/virtualization.xml:991(title)
4838
msgid "Installing in a RAM Disk"
4839
msgstr ""
4840
4841
#: serverguide/C/virtualization.xml:993(para)
4842
msgid ""
4843
"As you can easily imagine, writing to RAM is a <emphasis>LOT</emphasis> "
4844
"faster than writing to disk. If you have some free memory, letting vmbuilder "
4845
"perform its operation in a RAMdisk will help a lot and the option <emphasis>-"
4846
"-tmpfs</emphasis> will help you do just that:"
4847
msgstr ""
4848
4849
#: serverguide/C/virtualization.xml:999(programlisting)
4850
#, no-wrap
4851
msgid ""
4852
"\n"
4853
"--tmpfs OPTS Use a tmpfs as the working directory, specifying its\n"
4854
" size or \"-\" to use tmpfs default (suid,dev,size=1G).\n"
4855
msgstr ""
4856
4857
#: serverguide/C/virtualization.xml:1004(para)
4858
msgid ""
4859
"So adding <command>--tmpfs -</command> sounds like a very good idea if you "
4860
"have 1G of free ram."
4861
msgstr ""
4862
4863
#: serverguide/C/virtualization.xml:1011(title)
4864
msgid "Package the Application"
4865
msgstr ""
4866
4867
#: serverguide/C/virtualization.xml:1013(para)
4868
msgid "Two option are available to us:"
4869
msgstr ""
4870
4871
#: serverguide/C/virtualization.xml:1019(para)
4872
msgid ""
4873
"The recommended method to do so is to make a <emphasis>Debian</emphasis> "
4874
"package. Since this is outside of the scope of this tutorial, we will not "
4875
"perform this here and invite the reader to read the documentation on how to "
4876
"do this in the <ulink url=\"https://wiki.ubuntu.com/PackagingGuide\">Ubuntu "
4877
"Packaging Guide</ulink>. In this case it is also a good idea to setup a "
4878
"repository for your package so that updates can be conveniently pulled from "
4879
"it. See the <ulink url=\"http://www.debian-"
4880
"administration.org/articles/286\">Debian Administration</ulink> article for "
4881
"a tutorial on this."
4882
msgstr ""
4883
4884
#: serverguide/C/virtualization.xml:1028(para)
4885
msgid ""
4886
"Manually install the application under <filename>/opt</filename> as "
4887
"recommended by the <ulink url=\"http://www.pathname.com/fhs/\">FHS "
4888
"guidelines</ulink>."
4889
msgstr ""
4890
4891
#: serverguide/C/virtualization.xml:1035(para)
4892
msgid ""
4893
"In our case we'll use <application>Limesurvey</application> as example web "
4894
"application for which we wish to provide a virtual appliance. As noted "
4895
"before, we've made a version of the package available in a PPA (Personal "
4896
"Package Archive)."
4897
msgstr ""
4898
4899
#: serverguide/C/virtualization.xml:1042(title)
4900
msgid "Finishing Install"
4901
msgstr ""
4902
4903
#: serverguide/C/virtualization.xml:1045(title)
4904
msgid "First Boot"
4905
msgstr ""
4906
4907
#: serverguide/C/virtualization.xml:1047(para)
4908
msgid ""
4909
"As we mentioned earlier, the first time the machine boots we'll need to "
4910
"install <application>openssh-server</application> so that the key generated "
4911
"for it is unique for each machine. To do this, we'll write a script called "
4912
"<filename>boot.sh</filename> as follows:"
4913
msgstr ""
4914
4915
#: serverguide/C/virtualization.xml:1053(programlisting)
4916
#, no-wrap
4917
msgid ""
4918
"\n"
4919
"# This script will run the first time the virtual machine boots\n"
4920
"# It is ran as root.\n"
4921
"\n"
4922
"apt-get update\n"
4923
"apt-get install -qqy --force-yes openssh-server\n"
4924
msgstr ""
4925
4926
#: serverguide/C/virtualization.xml:1061(para)
4927
msgid ""
4928
"And we add the <command>--firstboot boot.sh</command> option to our command "
4929
"line."
4930
msgstr ""
4931
4932
#: serverguide/C/virtualization.xml:1067(title)
4933
msgid "First Login"
4934
msgstr ""
4935
4936
#: serverguide/C/virtualization.xml:1069(para)
4937
msgid ""
4938
"Mysql and Limesurvey needing some user interaction during their setup, we'll "
4939
"set them up the first time a user logs in using a script named login.sh. "
4940
"We'll also use this script to let the user specify:"
4941
msgstr ""
4942
4943
#: serverguide/C/virtualization.xml:1075(para)
4944
msgid "His own password"
4945
msgstr ""
4946
4947
#: serverguide/C/virtualization.xml:1076(para)
4948
msgid "Define the keyboard and other locale info he wants to use"
4949
msgstr ""
4950
4951
#: serverguide/C/virtualization.xml:1079(para)
4952
msgid "So we'll define <filename>login.sh</filename> as follows:"
4953
msgstr ""
4954
4955
#: serverguide/C/virtualization.xml:1083(programlisting)
4956
#, no-wrap
4957
msgid ""
4958
"\n"
4959
"# This script is ran the first time a user logs in\n"
4960
"\n"
4961
"echo \"Your appliance is about to be finished to be set up.\"\n"
4962
"echo \"In order to do it, we'll need to ask you a few questions,\"\n"
4963
"echo \"starting by changing your user password.\"\n"
4964
"\n"
4965
"passwd\n"
4966
"\n"
4967
"#give the opportunity to change the keyboard\n"
4968
"sudo dpkg-reconfigure console-setup\n"
4969
"\n"
4970
"#configure the mysql server root password\n"
4971
"sudo dpkg-reconfigure mysql-server-5.0\n"
4972
"\n"
4973
"#install limesurvey\n"
4974
"sudo apt-get install -qqy --force-yes limesurvey\n"
4975
"\n"
4976
"echo \"Your appliance is now configured. To use it point your\"\n"
4977
"echo \"browser to http://serverip/limesurvey/admin\"\n"
4978
msgstr ""
4979
4980
#: serverguide/C/virtualization.xml:1105(para)
4981
msgid ""
4982
"And we add the <command>--firstlogin login.sh</command> option to our "
4983
"command line."
4984
msgstr ""
4985
4986
#: serverguide/C/virtualization.xml:1112(title)
4987
msgid "Useful Additions"
4988
msgstr ""
4989
4990
#: serverguide/C/virtualization.xml:1115(title)
4991
msgid "Configuring Automatic Updates"
4992
msgstr ""
4993
4994
#: serverguide/C/virtualization.xml:1117(para)
4995
msgid ""
4996
"To have your system be configured to update itself on a regular basis, we "
4997
"will just install <application>unattended-upgrades</application>, so we add "
4998
"the following option to our command line:"
4999
msgstr ""
5000
5001
#: serverguide/C/virtualization.xml:1123(command)
5002
msgid "--addpkg unattended-upgrades"
5003
msgstr ""
5004
5005
#: serverguide/C/virtualization.xml:1126(para)
5006
msgid ""
5007
"As we have put our application package in a PPA, the process will update not "
5008
"only the system, but also the application each time we update the version in "
5009
"the PPA."
5010
msgstr ""
5011
5012
#: serverguide/C/virtualization.xml:1133(title)
5013
msgid "ACPI Event Handling"
5014
msgstr ""
5015
5016
#: serverguide/C/virtualization.xml:1135(para)
5017
msgid ""
5018
"For your virtual machine to be able to handle restart and shutdown events it "
5019
"is being sent, it is a good idea to install the acpid package as well. To do "
5020
"this we just add the following option:"
5021
msgstr ""
5022
5023
#: serverguide/C/virtualization.xml:1141(command)
5024
msgid "--addpkg acpid"
5025
msgstr ""
5026
5027
#: serverguide/C/virtualization.xml:1147(title)
5028
msgid "Final Command"
5029
msgstr ""
5030
5031
#: serverguide/C/virtualization.xml:1149(para)
5032
msgid "Here is the command with all the options discussed above:"
5033
msgstr ""
5034
5035
#: serverguide/C/virtualization.xml:1154(command)
5036
msgid ""
5037
"sudo vmbuilder kvm ubuntu --suite lucid --flavour virtual --arch i386 -o \\ -"
5038
"-libvirt qemu:///system --ip 192.168.0.100 --part vmbuilder.partition --user "
5039
"user \\ --name user --pass default --addpkg apache2 --addpkg apache2-mpm-"
5040
"prefork \\ --addpkg apache2-utils --addpkg apache2.2-common --addpkg "
5041
"dbconfig-common \\ --addpkg libapache2-mod-php5 --addpkg mysql-client --"
5042
"addpkg php5-cli \\ --addpkg php5-gd --addpkg php5-ldap --addpkg php5-mysql --"
5043
"addpkg wwwconfig-common \\ --addpkg mysql-server --addpkg unattended-"
5044
"upgrades --addpkg acpid --ppa nijaba \\ --mirror "
5045
"http://mirroraddress:9999/ubuntu --tmpfs - --firstboot boot.sh \\ --"
5046
"firstlogin login.sh es"
5047
msgstr ""
5048
5049
#: serverguide/C/virtualization.xml:1169(para)
5050
msgid ""
5051
"If you are interested in learning more, have questions or suggestions, "
5052
"please contact the Ubuntu Server Team at:"
5053
msgstr ""
5054
5055
#: serverguide/C/virtualization.xml:1174(para)
5056
msgid "IRC: #ubuntu-server on freenode"
5057
msgstr ""
5058
5059
#: serverguide/C/virtualization.xml:1179(para)
5060
msgid ""
5061
"Mailing list: <ulink url=\"https://lists.ubuntu.com/mailman/listinfo/ubuntu-"
5062
"server\">ubuntu-server at lists.ubuntu.com</ulink>"
5063
msgstr ""
5064
5065
#: serverguide/C/virtualization.xml:1184(para)
5066
msgid ""
5067
"Also, see the <ulink "
5068
"url=\"https://help.ubuntu.com/community/JeOSVMBuilder\">JeOSVMBuilder Ubuntu "
5069
"Wiki</ulink> page."
5070
msgstr ""
5071
5072
#: serverguide/C/virtualization.xml:1192(title)
5073
msgid "UEC"
5074
msgstr ""
5075
5076
#: serverguide/C/virtualization.xml:1195(title) serverguide/C/network-auth.xml:2026(title) serverguide/C/monitoring.xml:15(title) serverguide/C/lamp-applications.xml:17(title) serverguide/C/installation.xml:928(title) serverguide/C/dns.xml:64(title) serverguide/C/chat.xml:17(title) serverguide/C/backups.xml:541(title)
5077
msgid "Overview"
5078
msgstr ""
5079
5080
#: serverguide/C/virtualization.xml:1197(para)
5081
msgid ""
5082
"This tutorial covers <application>UEC</application> installation from the "
5083
"Ubuntu 10.04 LTS Server Edition CD, and assumes a basic network topology, "
5084
"with a single system serving as the <emphasis>\"all-in-one "
5085
"controller\"</emphasis>, and one or more nodes attached."
5086
msgstr ""
5087
5088
#: serverguide/C/virtualization.xml:1202(para)
5089
msgid ""
5090
"From this Tutorial you will learn how to install, configure, register and "
5091
"perform several operations on a basic <application>UEC</application> setup "
5092
"that results in a cloud with a one controller <emphasis>\"front-"
5093
"end\"</emphasis> and one or several node(s) for running Virtual Machine (VM) "
5094
"instances. You will also use examples to help get you started using your own "
5095
"private compute cloud."
5096
msgstr ""
5097
5098
#: serverguide/C/virtualization.xml:1210(title)
5099
msgid "Prerequisites"
5100
msgstr ""
5101
5102
#: serverguide/C/virtualization.xml:1212(para)
5103
msgid ""
5104
"To deploy a minimal cloud infrastructure, you’ll need at least "
5105
"<emphasis>two</emphasis> dedicated systems:"
5106
msgstr ""
5107
5108
#: serverguide/C/virtualization.xml:1218(para)
5109
msgid "A front end."
5110
msgstr ""
5111
5112
#: serverguide/C/virtualization.xml:1223(para)
5113
msgid "One or more node(s)."
5114
msgstr ""
5115
5116
#: serverguide/C/virtualization.xml:1229(para)
5117
msgid ""
5118
"The following are recommendations, rather than fixed requirements. However, "
5119
"our experience in developing this documentation indicated the following "
5120
"suggestions."
5121
msgstr ""
5122
5123
#: serverguide/C/virtualization.xml:1234(title)
5124
msgid "Front End Requirements"
5125
msgstr ""
5126
5127
#: serverguide/C/virtualization.xml:1236(para)
5128
msgid "Use the following table for a system that will run one or more of:"
5129
msgstr ""
5130
5131
#: serverguide/C/virtualization.xml:1241(para)
5132
msgid "Cloud Controller (CLC)"
5133
msgstr ""
5134
5135
#: serverguide/C/virtualization.xml:1242(para)
5136
msgid "Cluster Controller (CC)"
5137
msgstr ""
5138
5139
#: serverguide/C/virtualization.xml:1243(para)
5140
msgid "Walrus (the S3-like storage service)"
5141
msgstr ""
5142
5143
#: serverguide/C/virtualization.xml:1244(para)
5144
msgid "Storage Controller (SC)"
5145
msgstr ""
5146
5147
#: serverguide/C/virtualization.xml:1248(title)
5148
msgid "UEC Front End Requirements"
5149
msgstr ""
5150
5151
#: serverguide/C/virtualization.xml:1256(para) serverguide/C/virtualization.xml:1318(para)
5152
msgid "Hardware"
5153
msgstr ""
5154
5155
#: serverguide/C/virtualization.xml:1257(para) serverguide/C/virtualization.xml:1319(para)
5156
msgid "Minimum"
5157
msgstr ""
5158
5159
#: serverguide/C/virtualization.xml:1258(para) serverguide/C/virtualization.xml:1320(para)
5160
msgid "Suggested"
5161
msgstr ""
5162
5163
#: serverguide/C/virtualization.xml:1259(para) serverguide/C/virtualization.xml:1321(para)
5164
msgid "Notes"
5165
msgstr ""
5166
5167
#: serverguide/C/virtualization.xml:1264(para) serverguide/C/virtualization.xml:1326(para)
5168
msgid "CPU"
5169
msgstr ""
5170
5171
#: serverguide/C/virtualization.xml:1265(para)
5172
msgid "1 GHz"
5173
msgstr ""
5174
5175
#: serverguide/C/virtualization.xml:1266(para)
5176
msgid "2 x 2 GHz"
5177
msgstr ""
5178
5179
#: serverguide/C/virtualization.xml:1267(para)
5180
msgid ""
5181
"For an <emphasis>all-in-one</emphasis> front end, it helps to have at least "
5182
"a dual core processor."
5183
msgstr ""
5184
5185
#: serverguide/C/virtualization.xml:1270(para) serverguide/C/virtualization.xml:1332(para)
5186
msgid "Memory"
5187
msgstr ""
5188
5189
#: serverguide/C/virtualization.xml:1271(para)
5190
msgid "512 MB"
5191
msgstr ""
5192
5193
#: serverguide/C/virtualization.xml:1272(para)
5194
msgid "2 GB"
5195
msgstr ""
5196
5197
#: serverguide/C/virtualization.xml:1273(para)
5198
msgid "The Java web front end benefits from lots of available memory."
5199
msgstr ""
5200
5201
#: serverguide/C/virtualization.xml:1276(para) serverguide/C/virtualization.xml:1338(para)
5202
msgid "Disk"
5203
msgstr ""
5204
5205
#: serverguide/C/virtualization.xml:1277(para) serverguide/C/virtualization.xml:1339(para)
5206
msgid "5400 RPM IDE"
5207
msgstr ""
5208
5209
#: serverguide/C/virtualization.xml:1278(para)
5210
msgid "7200 RPM SATA"
5211
msgstr ""
5212
5213
#: serverguide/C/virtualization.xml:1279(para)
5214
msgid ""
5215
"Slower disks will work, but will yield much longer instance startup times."
5216
msgstr ""
5217
5218
#: serverguide/C/virtualization.xml:1282(para) serverguide/C/virtualization.xml:1344(para)
5219
msgid "Disk Space"
5220
msgstr ""
5221
5222
#: serverguide/C/virtualization.xml:1283(para) serverguide/C/virtualization.xml:1345(para)
5223
msgid "40 GB"
5224
msgstr ""
5225
5226
#: serverguide/C/virtualization.xml:1284(para)
5227
msgid "200 GB"
5228
msgstr ""
5229
5230
#: serverguide/C/virtualization.xml:1285(para)
5231
msgid ""
5232
"40GB is only enough space for only a single image, cache, etc., Eucalyptus "
5233
"does not like to run out of disk space."
5234
msgstr ""
5235
5236
#: serverguide/C/virtualization.xml:1288(para) serverguide/C/virtualization.xml:1350(para) serverguide/C/network-config.xml:13(title)
5237
msgid "Networking"
5238
msgstr ""
5239
5240
#: serverguide/C/virtualization.xml:1289(para) serverguide/C/virtualization.xml:1351(para)
5241
msgid "100 Mbps"
5242
msgstr ""
5243
5244
#: serverguide/C/virtualization.xml:1290(para) serverguide/C/virtualization.xml:1352(para)
5245
msgid "1000 Mbps"
5246
msgstr ""
5247
5248
#: serverguide/C/virtualization.xml:1291(para) serverguide/C/virtualization.xml:1353(para)
5249
msgid ""
5250
"Machine images are hundreds of MB, and need to be copied over the network to "
5251
"nodes."
5252
msgstr ""
5253
5254
#: serverguide/C/virtualization.xml:1299(title)
5255
msgid "Node Requirements"
5256
msgstr ""
5257
5258
#: serverguide/C/virtualization.xml:1301(para)
5259
msgid "The other system(s) are <emphasis>nodes</emphasis>, which will run::"
5260
msgstr ""
5261
5262
#: serverguide/C/virtualization.xml:1306(para)
5263
msgid "the Node Controller (NC)"
5264
msgstr ""
5265
5266
#: serverguide/C/virtualization.xml:1310(title)
5267
msgid "UEC Node Requirements"
5268
msgstr ""
5269
5270
#: serverguide/C/virtualization.xml:1327(para)
5271
msgid "VT Extensions"
5272
msgstr ""
5273
5274
#: serverguide/C/virtualization.xml:1328(para)
5275
msgid "VT, 64-bit, Multicore"
5276
msgstr ""
5277
5278
#: serverguide/C/virtualization.xml:1329(para)
5279
msgid ""
5280
"64-bit can run both i386, and amd64 instances; by default, Eucalyptus will "
5281
"only run 1 VM per CPU core on a Node."
5282
msgstr ""
5283
5284
#: serverguide/C/virtualization.xml:1333(para)
5285
msgid "1 GB"
5286
msgstr ""
5287
5288
#: serverguide/C/virtualization.xml:1334(para)
5289
msgid "4 GB"
5290
msgstr ""
5291
5292
#: serverguide/C/virtualization.xml:1335(para)
5293
msgid "Additional memory means more, and larger guests."
5294
msgstr ""
5295
5296
#: serverguide/C/virtualization.xml:1340(para)
5297
msgid "7200 RPM SATA or SCSI"
5298
msgstr ""
5299
5300
#: serverguide/C/virtualization.xml:1341(para)
5301
msgid ""
5302
"Eucalyptus nodes are disk-intensive; I/O wait will likely be the performance "
5303
"bottleneck."
5304
msgstr ""
5305
5306
#: serverguide/C/virtualization.xml:1346(para)
5307
msgid "100 GB"
5308
msgstr ""
5309
5310
#: serverguide/C/virtualization.xml:1347(para)
5311
msgid ""
5312
"Images will be cached locally, Eucalyptus does not like to run out of disk "
5313
"space."
5314
msgstr ""
5315
5316
#: serverguide/C/virtualization.xml:1363(title)
5317
msgid "Installing the Cloud/Cluster/Storage/Walrus Front End Server"
5318
msgstr ""
5319
5320
#: serverguide/C/virtualization.xml:1367(para)
5321
msgid "Download the Ubuntu 10.04 LTS Server ISO file, and burn it to a CD."
5322
msgstr ""
5323
5324
#: serverguide/C/virtualization.xml:1372(para) serverguide/C/virtualization.xml:1418(para)
5325
msgid ""
5326
"When you boot, select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5327
msgstr ""
5328
5329
#: serverguide/C/virtualization.xml:1377(para)
5330
msgid ""
5331
"When asked whether you want a <emphasis>“Cluster”</emphasis> or a "
5332
"<emphasis>“Node”</emphasis> install, select <emphasis>“Cluster”</emphasis>."
5333
msgstr ""
5334
5335
#: serverguide/C/virtualization.xml:1383(para)
5336
msgid ""
5337
"It will ask two other cloud-specific questions during the course of the "
5338
"install:"
5339
msgstr ""
5340
5341
#: serverguide/C/virtualization.xml:1388(para)
5342
msgid "Name of your cluster."
5343
msgstr ""
5344
5345
#: serverguide/C/virtualization.xml:1391(para)
5346
msgid "e.g. <emphasis>cluster1</emphasis>."
5347
msgstr ""
5348
5349
#: serverguide/C/virtualization.xml:1394(para)
5350
msgid ""
5351
"A range of public IP addresses on the LAN that the cloud can allocate to "
5352
"instances."
5353
msgstr ""
5354
5355
#: serverguide/C/virtualization.xml:1397(para)
5356
msgid "e.g. <emphasis>192.168.1.200-192.168.1.249</emphasis>."
5357
msgstr ""
5358
5359
#: serverguide/C/virtualization.xml:1405(title)
5360
msgid "Installing the Node Controller(s)"
5361
msgstr ""
5362
5363
#: serverguide/C/virtualization.xml:1407(para)
5364
msgid ""
5365
"The node controller install is even simpler. Just make sure that you are "
5366
"connected to the network on which the cloud/cluster controller is already "
5367
"running."
5368
msgstr ""
5369
5370
#: serverguide/C/virtualization.xml:1413(para)
5371
msgid "Boot from the same ISO on the node(s)."
5372
msgstr ""
5373
5374
#: serverguide/C/virtualization.xml:1423(para)
5375
msgid "Select <emphasis>“Install Ubuntu Enterprise Cloud”</emphasis>."
5376
msgstr ""
5377
5378
#: serverguide/C/virtualization.xml:1428(para)
5379
msgid ""
5380
"It should detect the Cluster and preselect <emphasis>“Node”</emphasis> "
5381
"install for you."
5382
msgstr ""
5383
5384
#: serverguide/C/virtualization.xml:1433(para)
5385
msgid "Confirm the partitioning scheme."
5386
msgstr ""
5387
5388
#: serverguide/C/virtualization.xml:1438(para)
5389
msgid ""
5390
"The rest of the installation should proceed uninterrupted; complete the "
5391
"installation and reboot the node."
5392
msgstr ""
5393
5394
#: serverguide/C/virtualization.xml:1446(title)
5395
msgid "Register the Node(s)"
5396
msgstr ""
5397
5398
#: serverguide/C/virtualization.xml:1448(para)
5399
msgid ""
5400
"Nodes are the physical systems within <application>UEC</application> that "
5401
"actually run the virtual machine instances of the cloud."
5402
msgstr ""
5403
5404
#: serverguide/C/virtualization.xml:1452(para)
5405
msgid ""
5406
"Once one or more Ubuntu Server node(s) are installed and running the "
5407
"<application>eucalyptus-nc</application> service, log onto the "
5408
"<emphasis>Cloud Controller (CLC)</emphasis> and run:"
5409
msgstr ""
5410
5411
#: serverguide/C/virtualization.xml:1458(command)
5412
msgid "sudo euca_conf --no-rsync --discover-nodes"
5413
msgstr ""
5414
5415
#: serverguide/C/virtualization.xml:1461(para)
5416
msgid ""
5417
"This will discover the systems on the network running the "
5418
"<application>eucalyptus-nc</application> service, and the administrator can "
5419
"confirm the registration of each node by its IP address."
5420
msgstr ""
5421
5422
#: serverguide/C/virtualization.xml:1467(para)
5423
msgid ""
5424
"If you get prompted for passwords, or receive errors from scp, you may need "
5425
"to revisit the key synchronization instructions at <ulink "
5426
"url=\"https://help.ubuntu.com/community/UEC/NodeInstallation\">UEC/NodeInstal"
5427
"lation</ulink>."
5428
msgstr ""
5429
5430
#: serverguide/C/virtualization.xml:1475(title)
5431
msgid "Obtain Credentials"
5432
msgstr ""
5433
5434
#: serverguide/C/virtualization.xml:1477(para)
5435
msgid ""
5436
"After installing and booting the <emphasis>Cloud Controller</emphasis>, "
5437
"users of the cloud will need to retrieve their credentials. This can be done "
5438
"either through a web browser, or at the command line."
5439
msgstr ""
5440
5441
#: serverguide/C/virtualization.xml:1483(title)
5442
msgid "From a Web Browser"
5443
msgstr ""
5444
5445
#: serverguide/C/virtualization.xml:1487(para)
5446
msgid ""
5447
"From your web browser (either remotely or on your Ubuntu server) access the "
5448
"following URL:"
5449
msgstr ""
5450
5451
#: serverguide/C/virtualization.xml:1490(programlisting) serverguide/C/virtualization.xml:1743(programlisting)
5452
#, no-wrap
5453
msgid ""
5454
"\n"
5455
"https://<cloud-controller-ip-address>:8443/\n"
5456
msgstr ""
5457
5458
#: serverguide/C/virtualization.xml:1495(para)
5459
msgid ""
5460
"You must use a secure connection, so make sure you use \"https\" not "
5461
"\"http\" in your URL. You will get a security certificate warning. You will "
5462
"have to add an exception to view the page. If you do not accept it you will "
5463
"not be able to view the Eucalyptus configuration page."
5464
msgstr ""
5465
5466
#: serverguide/C/virtualization.xml:1503(para)
5467
msgid ""
5468
"Use username <emphasis>'admin'</emphasis> and password "
5469
"<emphasis>'admin'</emphasis> for the first time login (you will be prompted "
5470
"to change your password)."
5471
msgstr ""
5472
5473
#: serverguide/C/virtualization.xml:1509(para)
5474
msgid ""
5475
"Then follow the on-screen instructions to update the admin password and "
5476
"email address."
5477
msgstr ""
5478
5479
#: serverguide/C/virtualization.xml:1514(para)
5480
msgid ""
5481
"Once the first time configuration process is completed, click the "
5482
"<emphasis>'credentials'</emphasis> tab located in the top-left portion of "
5483
"the screen."
5484
msgstr ""
5485
5486
#: serverguide/C/virtualization.xml:1520(para)
5487
msgid ""
5488
"Click the <emphasis>'Download Credentials'</emphasis> button to get your "
5489
"certificates."
5490
msgstr ""
5491
5492
#: serverguide/C/virtualization.xml:1525(para)
5493
msgid "Save them to <filename>~/.euca</filename>."
5494
msgstr ""
5495
5496
#: serverguide/C/virtualization.xml:1530(para)
5497
msgid ""
5498
"Unzip the downloaded zip file into a safe location "
5499
"(<filename>~/.euca</filename>)."
5500
msgstr ""
5501
5502
#: serverguide/C/virtualization.xml:1534(command)
5503
msgid "unzip -d ~/.euca mycreds.zip"
5504
msgstr ""
5505
5506
#: serverguide/C/virtualization.xml:1541(title)
5507
msgid "From a Command Line"
5508
msgstr ""
5509
5510
#: serverguide/C/virtualization.xml:1545(para)
5511
msgid ""
5512
"Alternatively, if you are on the command line of the <emphasis>Cloud "
5513
"Controller</emphasis>, you can run:"
5514
msgstr ""
5515
5516
#: serverguide/C/virtualization.xml:1549(command)
5517
msgid "mkdir -p ~/.euca"
5518
msgstr ""
5519
5520
#: serverguide/C/virtualization.xml:1550(command)
5521
msgid "chmod 700 ~/.euca"
5522
msgstr ""
5523
5524
#: serverguide/C/virtualization.xml:1551(command)
5525
msgid "cd ~/.euca"
5526
msgstr ""
5527
5528
#: serverguide/C/virtualization.xml:1552(command)
5529
msgid "sudo euca_conf --get-credentials mycreds.zip"
5530
msgstr ""
5531
5532
#: serverguide/C/virtualization.xml:1553(command)
5533
msgid "unzip mycreds.zip"
5534
msgstr ""
5535
5536
#: serverguide/C/virtualization.xml:1554(command)
5537
msgid "cd -"
5538
msgstr ""
5539
5540
#: serverguide/C/virtualization.xml:1561(title)
5541
msgid "Extracting and Using Your Credentials"
5542
msgstr ""
5543
5544
#: serverguide/C/virtualization.xml:1563(para)
5545
msgid ""
5546
"Now you will need to setup EC2 API and AMI tools on your server using X.509 "
5547
"certificates."
5548
msgstr ""
5549
5550
#: serverguide/C/virtualization.xml:1569(para)
5551
msgid ""
5552
"Source the included <emphasis>\"eucarc\"</emphasis> file to set up your "
5553
"Eucalyptus environment:"
5554
msgstr ""
5555
5556
#: serverguide/C/virtualization.xml:1573(command) serverguide/C/virtualization.xml:1600(command)
5557
msgid ". ~/.euca/eucarc"
5558
msgstr ""
5559
5560
#: serverguide/C/virtualization.xml:1577(para)
5561
msgid ""
5562
"You may additionally wish to add this command to your "
5563
"<filename>~/.bashrc</filename> file so that your Eucalyptus environment is "
5564
"set up automatically when you log in. Eucalyptus treats this set of "
5565
"credentials as <emphasis>'administrator'</emphasis> credentials that allow "
5566
"the holder global privileges across the cloud. As such, they should be "
5567
"protected in the same way that other elevated-priority access is protected "
5568
"(e.g. should not be made visible to the general user population)."
5569
msgstr ""
5570
5571
#: serverguide/C/virtualization.xml:1584(command)
5572
msgid ""
5573
"echo \"[ -r ~/.euca/eucarc ] && . ~/.euca/eucarc\" >> ~/.bashrc"
5574
msgstr ""
5575
5576
#: serverguide/C/virtualization.xml:1588(para)
5577
msgid "Install the required cloud user tools:"
5578
msgstr ""
5579
5580
#: serverguide/C/virtualization.xml:1592(command)
5581
msgid "sudo apt-get install euca2ools"
5582
msgstr ""
5583
5584
#: serverguide/C/virtualization.xml:1596(para)
5585
msgid ""
5586
"To validate that everything is working correctly, get the local cluster "
5587
"availability details:"
5588
msgstr ""
5589
5590
#: serverguide/C/virtualization.xml:1601(command)
5591
msgid "euca-describe-availability-zones verbose"
5592
msgstr ""
5593
5594
#: serverguide/C/virtualization.xml:1602(computeroutput)
5595
#, no-wrap
5596
msgid ""
5597
"AVAILABILITYZONE myowncloud 192.168.1.1\n"
5598
"AVAILABILITYZONE |- vm types free / max cpu ram disk\n"
5599
"AVAILABILITYZONE |- m1.small 0004 / 0004 1 128 2\n"
5600
"AVAILABILITYZONE |- c1.medium 0004 / 0004 1 256 5\n"
5601
"AVAILABILITYZONE |- m1.large 0002 / 0002 2 512 10\n"
5602
"AVAILABILITYZONE |- m1.xlarge 0002 / 0002 2 1024 20\n"
5603
"AVAILABILITYZONE |- c1.xlarge 0001 / 0001 4 2048 20"
5604
msgstr ""
5605
5606
#: serverguide/C/virtualization.xml:1612(para)
5607
msgid "Your output from the above command will vary."
5608
msgstr ""
5609
5610
#: serverguide/C/virtualization.xml:1622(title)
5611
msgid "Running an Image"
5612
msgstr ""
5613
5614
#: serverguide/C/virtualization.xml:1624(para)
5615
msgid "There are multiple ways to instantiate an image in UEC:"
5616
msgstr ""
5617
5618
#: serverguide/C/virtualization.xml:1629(para)
5619
msgid "Use the command line."
5620
msgstr ""
5621
5622
#: serverguide/C/virtualization.xml:1630(para)
5623
msgid ""
5624
"Use one of the UEC compatible management tools such as "
5625
"<emphasis>Landscape</emphasis>."
5626
msgstr ""
5627
5628
#: serverguide/C/virtualization.xml:1632(para)
5629
msgid ""
5630
"Use the <ulink "
5631
"url=\"https://help.ubuntu.com/community/UEC/ElasticFox\">ElasticFox</ulink> "
5632
"extension to Firefox."
5633
msgstr ""
5634
5635
#: serverguide/C/virtualization.xml:1638(para)
5636
msgid "Here we will describe the process from the command line:"
5637
msgstr ""
5638
5639
#: serverguide/C/virtualization.xml:1644(para)
5640
msgid ""
5641
"Before running an instance of your image, you should first create a "
5642
"<emphasis>keypair</emphasis> (ssh key) that you can use to log into your "
5643
"instance as root, once it boots. The key is stored, so you will only have to "
5644
"do this once."
5645
msgstr ""
5646
5647
#: serverguide/C/virtualization.xml:1648(para)
5648
msgid "Run the following command:"
5649
msgstr ""
5650
5651
#: serverguide/C/virtualization.xml:1651(programlisting)
5652
#, no-wrap
5653
msgid ""
5654
"\n"
5655
"if [ ! -e ~/.euca/mykey.priv ]; then\n"
5656
" touch ~/.euca/mykey.priv\n"
5657
" chmod 0600 ~/.euca/mykey.priv\n"
5658
" euca-add-keypair mykey > ~/.euca/mykey.priv\n"
5659
"fi\n"
5660
msgstr ""
5661
5662
#: serverguide/C/virtualization.xml:1659(para)
5663
msgid ""
5664
"You can call your key whatever you like (in this example, the key is called "
5665
"<emphasis>'mykey'</emphasis>), but remember what it is called. If you "
5666
"forget, you can always run <command>euca-describe-keypairs</command> to get "
5667
"a list of created keys stored in the system."
5668
msgstr ""
5669
5670
#: serverguide/C/virtualization.xml:1666(para)
5671
msgid "You must also allow access to port 22 in your instances:"
5672
msgstr ""
5673
5674
#: serverguide/C/virtualization.xml:1670(command)
5675
msgid "euca-describe-groups"
5676
msgstr ""
5677
5678
#: serverguide/C/virtualization.xml:1671(command)
5679
msgid "euca-authorize default -P tcp -p 22 -s 0.0.0.0/0"
5680
msgstr ""
5681
5682
#: serverguide/C/virtualization.xml:1675(para)
5683
msgid "Next, you can create instances of your registered image:"
5684
msgstr ""
5685
5686
#: serverguide/C/virtualization.xml:1679(command)
5687
msgid "euca-run-instances $EMI -k mykey -t c1.medium"
5688
msgstr ""
5689
5690
#: serverguide/C/virtualization.xml:1682(para)
5691
msgid ""
5692
"If you receive an error regarding <emphasis>image_id</emphasis>, you may "
5693
"find it by viewing Images page or click <emphasis>\"How to Run\"</emphasis> "
5694
"on the <emphasis>Store</emphasis> page to see the sample command."
5695
msgstr ""
5696
5697
#: serverguide/C/virtualization.xml:1689(para)
5698
msgid ""
5699
"The first time you run an instance, the system will be setting up caches for "
5700
"the image from which it will be created. This can often take some time the "
5701
"first time an instance is run given that VM images are usually quite large."
5702
msgstr ""
5703
5704
#: serverguide/C/virtualization.xml:1693(para)
5705
msgid "To monitor the state of your instance, run:"
5706
msgstr ""
5707
5708
#: serverguide/C/virtualization.xml:1697(command)
5709
msgid "watch -n5 euca-describe-instances"
5710
msgstr ""
5711
5712
#: serverguide/C/virtualization.xml:1699(para)
5713
msgid ""
5714
"In the output, you should see information about the instance, including its "
5715
"state. While first-time caching is being performed, the instance's state "
5716
"will be <emphasis>'pending'</emphasis>."
5717
msgstr ""
5718
5719
#: serverguide/C/virtualization.xml:1705(para)
5720
msgid ""
5721
"When the instance is fully started, the above state will become "
5722
"<emphasis>'running'</emphasis>. Look at the IP address assigned to your "
5723
"instance in the output, then connect to it:"
5724
msgstr ""
5725
5726
#: serverguide/C/virtualization.xml:1710(command)
5727
msgid ""
5728
"IPADDR=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | awk "
5729
"'{print $4}')"
5730
msgstr ""
5731
5732
#: serverguide/C/virtualization.xml:1711(command)
5733
msgid "ssh -i ~/.euca/mykey.priv ubuntu@$IPADDR"
5734
msgstr ""
5735
5736
#: serverguide/C/virtualization.xml:1715(para)
5737
msgid ""
5738
"And when you are done with this instance, exit your SSH connection, then "
5739
"terminate your instance:"
5740
msgstr ""
5741
5742
#: serverguide/C/virtualization.xml:1719(command)
5743
msgid ""
5744
"INSTANCEID=$(euca-describe-instances | grep $EMI | grep running | tail -n1 | "
5745
"awk '{print $2}')"
5746
msgstr ""
5747
5748
#: serverguide/C/virtualization.xml:1720(command)
5749
msgid "euca-terminate-instances $INSTANCEID"
5750
msgstr ""
5751
5752
#: serverguide/C/virtualization.xml:1727(title)
5753
msgid "Install an Image from the Store"
5754
msgstr ""
5755
5756
#: serverguide/C/virtualization.xml:1729(para)
5757
msgid ""
5758
"The following is by far the simplest way to install an image. However, "
5759
"advanced users may be interested in learning how to <ulink "
5760
"url=\"https://help.ubuntu.com/community/UEC/BundlingImages\">Bundle their "
5761
"own image</ulink>."
5762
msgstr ""
5763
5764
#: serverguide/C/virtualization.xml:1734(para)
5765
msgid ""
5766
"The simplest way to add an image to <application>UEC</application> is to "
5767
"install it from the Image Store on the UEC web interface."
5768
msgstr ""
5769
5770
#: serverguide/C/virtualization.xml:1740(para)
5771
msgid ""
5772
"Access the web interface at the following URL (Make sure you specify https):"
5773
msgstr ""
5774
5775
#: serverguide/C/virtualization.xml:1748(para)
5776
msgid ""
5777
"Enter your login and password (if requested, as you may still be logged in "
5778
"from earlier)."
5779
msgstr ""
5780
5781
#: serverguide/C/virtualization.xml:1753(para)
5782
msgid "Click on the <emphasis>Store</emphasis> tab."
5783
msgstr ""
5784
5785
#: serverguide/C/virtualization.xml:1758(para)
5786
msgid "Browse available images."
5787
msgstr ""
5788
5789
#: serverguide/C/virtualization.xml:1763(para)
5790
msgid "Click on <emphasis>install</emphasis> for the image you want."
5791
msgstr ""
5792
5793
#: serverguide/C/virtualization.xml:1769(para)
5794
msgid ""
5795
"Once the image has been downloaded and installed, you can click on "
5796
"<emphasis>\"How to run?\"</emphasis> that will be displayed below the image "
5797
"button to view the command to execute to instantiate (start) this image. The "
5798
"image will also appear on the list given on the <emphasis>Image</emphasis> "
5799
"tab."
5800
msgstr ""
5801
5802
#: serverguide/C/virtualization.xml:1777(title) serverguide/C/dns.xml:619(title)
5803
msgid "More Information"
5804
msgstr ""
5805
5806
#: serverguide/C/virtualization.xml:1779(para)
5807
msgid ""
5808
"How to use the <ulink "
5809
"url=\"https://help.ubuntu.com/community/UEC/StorageController\">Storage "
5810
"Controller</ulink>"
5811
msgstr ""
5812
5813
#: serverguide/C/virtualization.xml:1783(para)
5814
msgid "Controlling eucalyptus services:"
5815
msgstr ""
5816
5817
#: serverguide/C/virtualization.xml:1788(para)
5818
msgid ""
5819
"sudo service eucalyptus [start|stop|restart] (on the CLC/CC/SC/Walrus side)"
5820
msgstr ""
5821
5822
#: serverguide/C/virtualization.xml:1789(para)
5823
msgid "sudo service eucalyptus-nc [start|stop|restart] (on the Node side)"
5824
msgstr ""
5825
5826
#: serverguide/C/virtualization.xml:1792(para)
5827
msgid "Locations of some important files:"
5828
msgstr ""
5829
5830
#: serverguide/C/virtualization.xml:1799(emphasis)
5831
msgid "Log files:"
5832
msgstr ""
5833
5834
#: serverguide/C/virtualization.xml:1802(para)
5835
msgid "/var/log/eucalyptus"
5836
msgstr ""
5837
5838
#: serverguide/C/virtualization.xml:1807(emphasis)
5839
msgid "Configuration files:"
5840
msgstr ""
5841
5842
#: serverguide/C/virtualization.xml:1810(para)
5843
msgid "/etc/eucalyptus"
5844
msgstr ""
5845
5846
#: serverguide/C/virtualization.xml:1815(emphasis)
5847
msgid "Database:"
5848
msgstr ""
5849
5850
#: serverguide/C/virtualization.xml:1818(para)
5851
msgid "/var/lib/eucalyptus/db"
5852
msgstr ""
5853
5854
#: serverguide/C/virtualization.xml:1823(emphasis)
5855
msgid "Keys:"
5856
msgstr ""
5857
5858
#: serverguide/C/virtualization.xml:1826(para)
5859
msgid "/var/lib/eucalyptus"
5860
msgstr ""
5861
5862
#: serverguide/C/virtualization.xml:1827(para)
5863
msgid "/var/lib/eucalyptus/.ssh"
5864
msgstr ""
5865
5866
#: serverguide/C/virtualization.xml:1833(para)
5867
msgid ""
5868
"Don't forget to source your <filename>~/.euca/eucarc</filename> before "
5869
"running the client tools."
5870
msgstr ""
5871
5872
#: serverguide/C/virtualization.xml:1844(para)
5873
msgid ""
5874
"For information on loading instances see the <ulink "
5875
"url=\"https://help.ubuntu.com/community/Eucalyptus\">Eucalyptus Wiki</ulink> "
5876
"page."
5877
msgstr ""
5878
5879
#: serverguide/C/virtualization.xml:1849(para)
5880
msgid ""
5881
"<ulink url=\"http://open.eucalyptus.com/\">Eucalyptus Project Site (forums, "
5882
"documentation, downloads)</ulink>."
5883
msgstr ""
5884
5885
#: serverguide/C/virtualization.xml:1854(para)
5886
msgid ""
5887
"<ulink url=\"https://launchpad.net/eucalyptus/\">Eucalyptus on Launchpad "
5888
"(bugs, code)</ulink>."
5889
msgstr ""
5890
5891
#: serverguide/C/virtualization.xml:1859(para)
5892
msgid ""
5893
"<ulink "
5894
"url=\"http://open.eucalyptus.com/wiki/EucalyptusTroubleshooting_v1.5\">Eucaly"
5895
"ptus Troubleshooting (1.5)</ulink>."
5896
msgstr ""
5897
5898
#: serverguide/C/virtualization.xml:1864(para)
5899
msgid ""
5900
"<ulink url=\"http://support.rightscale.com/2._References/02-"
5901
"Cloud_Infrastructures/Eucalyptus/03-"
5902
"Administration_Guide/Register_with_RightScale\"> Register your cloud with "
5903
"RightScale</ulink>."
5904
msgstr ""
5905
5906
#: serverguide/C/virtualization.xml:1870(para)
5907
msgid ""
5908
"You can also find help in the <emphasis>#ubuntu-virt</emphasis>, "
5909
"<emphasis>#eucalyptus</emphasis>, and <emphasis>#ubuntu-server</emphasis> "
5910
"IRC channels on <ulink url=\"http://freenode.net\">Freenode</ulink>."
5911
msgstr ""
5912
5913
#: serverguide/C/virtualization.xml:1879(title)
5914
msgid "Glossary"
5915
msgstr ""
5916
5917
#: serverguide/C/virtualization.xml:1881(para)
5918
msgid ""
5919
"The Ubuntu Enterprise Cloud documentation uses terminology that might be "
5920
"unfamiliar to some readers. This page is intended to provide a glossary of "
5921
"such terms and acronyms."
5922
msgstr ""
5923
5924
#: serverguide/C/virtualization.xml:1888(para)
5925
msgid ""
5926
"<emphasis>Cloud</emphasis> - A federated set of physical machines that offer "
5927
"computing resources through virtual machines, provisioned and recollected "
5928
"dynamically."
5929
msgstr ""
5930
5931
#: serverguide/C/virtualization.xml:1894(para)
5932
msgid ""
5933
"<emphasis>Cloud Controller (CLC)</emphasis> - Eucalyptus component that "
5934
"provides the web UI (an https server on port 8443), and implements the "
5935
"Amazon EC2 API. There should be only one Cloud Controller in an installation "
5936
"of UEC. This service is provided by the Ubuntu <application>eucalyptus-"
5937
"cloud</application> package."
5938
msgstr ""
5939
5940
#: serverguide/C/virtualization.xml:1901(para)
5941
msgid ""
5942
"<emphasis>Cluster</emphasis> - A collection of nodes, associated with a "
5943
"Cluster Controller. There can be more than one Cluster in an installation of "
5944
"UEC. Clusters are sometimes physically separate sets of nodes. (e.g. floor1, "
5945
"floor2, floor2)."
5946
msgstr ""
5947
5948
#: serverguide/C/virtualization.xml:1907(para)
5949
msgid ""
5950
"<emphasis>Cluster Controller (CC)</emphasis> - Eucalyptus component that "
5951
"manages collections of node resources. This service is provided by the "
5952
"Ubuntu <application>eucalyptus-cc</application> package."
5953
msgstr ""
5954
5955
#: serverguide/C/virtualization.xml:1913(para)
5956
msgid "<emphasis>EBS</emphasis> - Elastic Block Storage."
5957
msgstr ""
5958
5959
#: serverguide/C/virtualization.xml:1918(para)
5960
msgid ""
5961
"<emphasis>EC2</emphasis> - Elastic Compute Cloud. Amazon's pay-by-the-hour, "
5962
"pay-by-the-gigabyte public cloud computing offering."
5963
msgstr ""
5964
5965
#: serverguide/C/virtualization.xml:1923(para)
5966
msgid "<emphasis>EKI</emphasis> - Eucalyptus Kernel Image."
5967
msgstr ""
5968
5969
#: serverguide/C/virtualization.xml:1928(para)
5970
msgid "<emphasis>EMI</emphasis> - Eucalyptus Machine Image."
5971
msgstr ""
5972
5973
#: serverguide/C/virtualization.xml:1933(para)
5974
msgid "<emphasis>ERI</emphasis> - Eucalyptus Ramdisk Image."
5975
msgstr ""
5976
5977
#: serverguide/C/virtualization.xml:1938(para)
5978
msgid ""
5979
"<emphasis>Eucalyptus</emphasis> - Elastic Utility Computing Architecture for "
5980
"Linking Your Programs To Useful Systems. An open source project originally "
5981
"from the University of California at Santa Barbara, now supported by "
5982
"Eucalyptus Systems, a Canonical Partner."
5983
msgstr ""
5984
5985
#: serverguide/C/virtualization.xml:1945(para)
5986
msgid ""
5987
"<emphasis>Front-end</emphasis> - Physical machine hosting one (or more) of "
5988
"the high level Eucalyptus components (cloud, walrus, storage controller, "
5989
"cluster controller)."
5990
msgstr ""
5991
5992
#: serverguide/C/virtualization.xml:1951(para)
5993
msgid ""
5994
"<emphasis>Node</emphasis> - A node is a physical machine that's capable of "
5995
"running virtual machines, running a node controller. Within Ubuntu, this "
5996
"generally means that the CPU has VT extensions, and can run the KVM "
5997
"hypervisor."
5998
msgstr ""
5999
6000
#: serverguide/C/virtualization.xml:1957(para)
6001
msgid ""
6002
"<emphasis>Node Controller (NC)</emphasis> - Eucalyptus component that runs "
6003
"on nodes which host the virtual machines that comprise the cloud. This "
6004
"service is provided by the Ubuntu package <application>eucalyptus-"
6005
"nc</application>."
6006
msgstr ""
6007
6008
#: serverguide/C/virtualization.xml:1963(para)
6009
msgid ""
6010
"<emphasis>S3</emphasis> - Simple Storage Service. Amazon's pay-by-the-"
6011
"gigabyte persistent storage solution for EC2."
6012
msgstr ""
6013
6014
#: serverguide/C/virtualization.xml:1968(para)
6015
msgid ""
6016
"<emphasis>Storage Controller (SC)</emphasis> - Eucalyptus component that "
6017
"manages dynamic block storage services (EBS). Each 'cluster' in a Eucalyptus "
6018
"installation can have its own Storage Controller. This component is provided "
6019
"by the <application>eucalyptus-sc</application> package."
6020
msgstr ""
6021
6022
#: serverguide/C/virtualization.xml:1975(para)
6023
msgid ""
6024
"<emphasis>UEC</emphasis> - Ubuntu Enterprise Cloud. Ubuntu's cloud computing "
6025
"solution, based on Eucalyptus."
6026
msgstr ""
6027
6028
#: serverguide/C/virtualization.xml:1980(para)
6029
msgid "<emphasis>VM</emphasis> - Virtual Machine."
6030
msgstr ""
6031
6032
#: serverguide/C/virtualization.xml:1985(para)
6033
msgid ""
6034
"<emphasis>VT</emphasis> - Virtualization Technology. An optional feature of "
6035
"some modern CPUs, allowing for accelerated virtual machine hosting."
6036
msgstr ""
6037
6038
#: serverguide/C/virtualization.xml:1990(para)
6039
msgid ""
6040
"<emphasis>Walrus</emphasis> - Eucalyptus component that implements the "
6041
"Amazon S3 API, used for storing VM images and user storage using S3 bucket "
6042
"put/get abstractions."
6043
msgstr ""
6044
6045
#: serverguide/C/virtualization.xml:2000(title)
6046
msgid "OpenNebula"
6047
msgstr ""
6048
6049
#: serverguide/C/virtualization.xml:2002(para)
6050
msgid ""
6051
"<application>OpenNebula</application> allows virtual machines to be placed "
6052
"and re-placed dynamically on a pool of physical resources. This allows a "
6053
"virtual machine to be hosted from any location available."
6054
msgstr ""
6055
6056
#: serverguide/C/virtualization.xml:2007(para)
6057
msgid ""
6058
"This section will detail configuring an OpenNebula cluster using three "
6059
"machines: one <emphasis>Front-End</emphasis> host, and two <emphasis>Compute "
6060
"Nodes</emphasis> used to run the virtual machines. The Compute Nodes will "
6061
"also need a bridge configured to allow the virtual machines access to the "
6062
"local network. For details see <xref linkend=\"bridging\"/>."
6063
msgstr ""
6064
6065
#: serverguide/C/virtualization.xml:2016(para)
6066
msgid "First, from a terminal on the Front-End enter:"
6067
msgstr ""
6068
6069
#: serverguide/C/virtualization.xml:2021(command)
6070
msgid "sudo apt-get install opennebula"
6071
msgstr ""
6072
6073
#: serverguide/C/virtualization.xml:2024(para)
6074
msgid "On each Compute Node install:"
6075
msgstr ""
6076
6077
#: serverguide/C/virtualization.xml:2029(command)
6078
msgid "sudo apt-get install opennebula-node"
6079
msgstr ""
6080
6081
#: serverguide/C/virtualization.xml:2032(para)
6082
msgid ""
6083
"In order to copy SSH keys, the <emphasis>oneadmin</emphasis> user will need "
6084
"to have a password. On each machine execute:"
6085
msgstr ""
6086
6087
#: serverguide/C/virtualization.xml:2037(command)
6088
msgid "sudo passwd oneadmin"
6089
msgstr ""
6090
6091
#: serverguide/C/virtualization.xml:2040(para)
6092
msgid ""
6093
"Next, copy the <emphasis>oneadmin</emphasis> user's SSH key to the Compute "
6094
"Nodes, and to the Front-End's <filename>authorized_keys</filename> file:"
6095
msgstr ""
6096
6097
#: serverguide/C/virtualization.xml:2045(command)
6098
msgid ""
6099
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6100
"oneadmin@node01:/var/lib/one/.ssh/authorized_keys"
6101
msgstr ""
6102
6103
#: serverguide/C/virtualization.xml:2046(command)
6104
msgid ""
6105
"sudo scp /var/lib/one/.ssh/id_rsa.pub "
6106
"oneadmin@node02:/var/lib/one/.ssh/authorized_keys"
6107
msgstr ""
6108
6109
#: serverguide/C/virtualization.xml:2047(command)
6110
msgid ""
6111
"sudo sh -c \"cat /var/lib/one/.ssh/id_rsa.pub >> "
6112
"/var/lib/one/.ssh/authorized_keys\""
6113
msgstr ""
6114
6115
#: serverguide/C/virtualization.xml:2050(para)
6116
msgid ""
6117
"The SSH key for the Compute Nodes needs to be added to the "
6118
"<filename>/etc/ssh/ssh_known_hosts</filename> file on the Front-End host. To "
6119
"accomplish this <application>ssh</application> to each Compute Node as a "
6120
"user other than <emphasis>oneadmin</emphasis>. Then exit from the SSH "
6121
"session, and execute the following to copy the SSH key from "
6122
"<filename>~/.ssh/known_hosts</filename> to "
6123
"<filename>/etc/ssh/ssh_known_hosts</filename>:"
6124
msgstr ""
6125
6126
#: serverguide/C/virtualization.xml:2057(command)
6127
msgid ""
6128
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node01 1>> "
6129
"/etc/ssh/ssh_known_hosts\""
6130
msgstr ""
6131
6132
#: serverguide/C/virtualization.xml:2058(command)
6133
msgid ""
6134
"sudo sh -c \"ssh-keygen -f .ssh/known_hosts -F node02 1>> "
6135
"/etc/ssh/ssh_known_hosts\""
6136
msgstr ""
6137
6138
#: serverguide/C/virtualization.xml:2062(para)
6139
msgid ""
6140
"Replace <emphasis>node01</emphasis> and <emphasis>node02</emphasis> with the "
6141
"appropriate host names."
6142
msgstr ""
6143
6144
#: serverguide/C/virtualization.xml:2067(para)
6145
msgid ""
6146
"This allows the <emphasis>oneadmin</emphasis> to use "
6147
"<application>scp</application>, without a password or manual intervention, "
6148
"to deploy an image to the Compute Nodes."
6149
msgstr ""
6150
6151
#: serverguide/C/virtualization.xml:2072(para)
6152
msgid ""
6153
"On the Front-End create a directory to store the VM images, giving the "
6154
"<emphasis>oneadmin</emphasis> user access to the directory:"
6155
msgstr ""
6156
6157
#: serverguide/C/virtualization.xml:2077(command)
6158
msgid "sudo mkdir /var/lib/one/images"
6159
msgstr ""
6160
6161
#: serverguide/C/virtualization.xml:2078(command)
6162
msgid "sudo chown oneadmin /var/lib/one/images/"
6163
msgstr ""
6164
6165
#: serverguide/C/virtualization.xml:2081(para)
6166
msgid ""
6167
"Finally, copy a virtual machine disk file into "
6168
"<filename>/var/lib/one/images</filename>. You can create an Ubuntu virtual "
6169
"machine using <application>vmbuilder</application>, see <xref linkend=\"jeos-"
6170
"and-vmbuilder\"/> for details."
6171
msgstr ""
6172
6173
#: serverguide/C/virtualization.xml:2090(para)
6174
msgid ""
6175
"The <emphasis>OpenNebula Cluster</emphasis> is now ready to be configured, "
6176
"and virtual machines added to the cluster."
6177
msgstr ""
6178
6179
#: serverguide/C/virtualization.xml:2094(para)
6180
msgid "From a terminal prompt enter:"
6181
msgstr ""
6182
6183
#: serverguide/C/virtualization.xml:2099(command)
6184
msgid "onehost create node01 im_kvm vmm_kvm tm_ssh"
6185
msgstr ""
6186
6187
#: serverguide/C/virtualization.xml:2100(command)
6188
msgid "onehost create node02 im_kvm vmm_kvm tm_ssh"
6189
msgstr ""
6190
6191
#: serverguide/C/virtualization.xml:2103(para)
6192
msgid ""
6193
"Next, create a <emphasis>Virtual Network</emphasis> template file named "
6194
"<filename>vnet01.template</filename>:"
6195
msgstr ""
6196
6197
#: serverguide/C/virtualization.xml:2107(programlisting)
6198
#, no-wrap
6199
msgid ""
6200
"\n"
6201
"NAME = \"LAN\"\n"
6202
"TYPE = RANGED\n"
6203
"BRIDGE = br0\n"
6204
"NETWORK_SIZE = C\n"
6205
"NETWORK_ADDRESS = 192.168.0.0\n"
6206
msgstr ""
6207
6208
#: serverguide/C/virtualization.xml:2116(para)
6209
msgid ""
6210
"Be sure to change <emphasis>192.168.0.0</emphasis> to your local network."
6211
msgstr ""
6212
6213
#: serverguide/C/virtualization.xml:2121(para)
6214
msgid ""
6215
"Using the <application>onevnet</application> utility, add the virtual "
6216
"network to OpenNebula:"
6217
msgstr ""
6218
6219
#: serverguide/C/virtualization.xml:2126(command)
6220
msgid "onevnet create vnet01.template"
6221
msgstr ""
6222
6223
#: serverguide/C/virtualization.xml:2129(para)
6224
msgid ""
6225
"Now create a <emphasis>VM Template</emphasis> file named "
6226
"<filename>vm01.template</filename>:"
6227
msgstr ""
6228
6229
#: serverguide/C/virtualization.xml:2133(programlisting)
6230
#, no-wrap
6231
msgid ""
6232
"\n"
6233
"NAME = vm01\n"
6234
"CPU = 0.5\n"
6235
"MEMORY = 512\n"
6236
"\n"
6237
"OS = [ BOOT = hd ]\n"
6238
"\n"
6239
"DISK = [\n"
6240
" source = \"/var/lib/one/images/vm01.qcow2\",\n"
6241
" target = \"hda\",\n"
6242
" readonly = \"no\" ]\n"
6243
"\n"
6244
"NIC = [ NETWORK=\"LAN\" ]\n"
6245
"\n"
6246
"GRAPHICS = [type=\"vnc\",listen=\"127.0.0.1\",port=\"-1\"]\n"
6247
msgstr ""
6248
6249
#: serverguide/C/virtualization.xml:2150(para)
6250
msgid "Start the virtual machine using <application>onevm</application>:"
6251
msgstr ""
6252
6253
#: serverguide/C/virtualization.xml:2155(command)
6254
msgid "onevm submit vm01.template"
6255
msgstr ""
6256
6257
#: serverguide/C/virtualization.xml:2158(para)
6258
msgid ""
6259
"Use the <application>onevm list</application> option to view information "
6260
"about virtual machines. Also, the <application>onevm show vm01</application> "
6261
"option will display more details about a specific virtual machine."
6262
msgstr ""
6263
6264
#: serverguide/C/virtualization.xml:2169(para)
6265
msgid ""
6266
"See the <ulink "
6267
"url=\"http://www.opennebula.org/doku.php?id=start\">OpenNebula website</ulink"
6268
"> for more information."
6269
msgstr ""
6270
6271
#: serverguide/C/virtualization.xml:2174(para)
6272
msgid ""
6273
"You can also find help in the <emphasis>#ubuntu-virt</emphasis> and "
6274
"<emphasis>#ubuntu-server</emphasis> IRC channels on <ulink "
6275
"url=\"http://freenode.net\">Freenode</ulink>."
6276
msgstr ""
6277
6278
#: serverguide/C/virtualization.xml:2180(para)
6279
msgid ""
6280
"Also, the <ulink "
6281
"url=\"https://help.ubuntu.com/community/OpenNebula\">OpenNebula Ubuntu "
6282
"Wiki</ulink> page has more details."
6283
msgstr ""
6284
6285
#: serverguide/C/vcs.xml:13(title)
6286
msgid "Version Control System"
6287
msgstr ""
6288
6289
#: serverguide/C/vcs.xml:14(para)
6290
msgid ""
6291
"Version control is the art of managing changes to information. It has long "
6292
"been a critical tool for programmers, who typically spend their time making "
6293
"small changes to software and then undoing those changes the next day. But "
6294
"the usefulness of version control software extends far beyond the bounds of "
6295
"the software development world. Anywhere you can find people using computers "
6296
"to manage information that changes often, there is room for version control."
6297
msgstr ""
6298
6299
#: serverguide/C/vcs.xml:17(title)
6300
msgid "Bazaar"
6301
msgstr ""
6302
6303
#: serverguide/C/vcs.xml:18(para)
6304
msgid ""
6305
"Bazaar is a new version control system sponsored by Canonical, the "
6306
"commercial company behind Ubuntu. Unlike Subversion and CVS that only "
6307
"support a central repository model, Bazaar also supports "
6308
"<emphasis>distributed version control</emphasis>, giving people the ability "
6309
"to collaborate more efficiently. In particular, Bazaar is designed to "
6310
"maximize the level of community participation in open source projects."
6311
msgstr ""
6312
6313
#: serverguide/C/vcs.xml:29(para)
6314
msgid ""
6315
"At a terminal prompt, enter the following command to install "
6316
"<application>bzr</application>: <screen>\n"
6317
"<command>sudo apt-get install bzr</command>\n"
6318
"</screen>"
6319
msgstr ""
6320
6321
#: serverguide/C/vcs.xml:40(para)
6322
msgid ""
6323
"To introduce yourself to <application>bzr</application>, use the "
6324
"<emphasis>whoami</emphasis> command like this: <screen>\n"
6325
"<command>$ bzr whoami 'Joe Doe <joe.doe@gmail.com>'</command>\n"
6326
"</screen>"
6327
msgstr ""
6328
6329
#: serverguide/C/vcs.xml:49(title)
6330
msgid "Learning Bazaar"
6331
msgstr ""
6332
6333
#: serverguide/C/vcs.xml:50(para)
6334
msgid ""
6335
"Bazaar comes with bundled documentation installed into "
6336
"<application>/usr/share/doc/bzr/html</application> by default. The tutorial "
6337
"is a good place to start. The <application>bzr</application> command also "
6338
"comes with built-in help: <screen>\n"
6339
"<command>$ bzr help</command>\n"
6340
"</screen>"
6341
msgstr ""
6342
6343
#: serverguide/C/vcs.xml:60(para)
6344
msgid ""
6345
"To learn more about the <emphasis>foo</emphasis> command: <screen>\n"
6346
"<command>$ bzr help foo</command>\n"
6347
"</screen>"
6348
msgstr ""
6349
6350
#: serverguide/C/vcs.xml:68(title)
6351
msgid "Launchpad Integration"
6352
msgstr ""
6353
6354
#: serverguide/C/vcs.xml:69(para)
6355
msgid ""
6356
"While highly useful as a stand-alone system, Bazaar has good, optional "
6357
"integration with <ulink url=\"https://launchpad.net/\">Launchpad</ulink>, "
6358
"the collaborative development system used by Canonical and the broader open "
6359
"source community to manage and extend Ubuntu itself. For information on how "
6360
"Bazaar can be used with Launchpad to collaborate on open source projects, "
6361
"see <ulink url=\"http://bazaar-vcs.org/LaunchpadIntegration/\"> "
6362
"http://bazaar-vcs.org/LaunchpadIntegration</ulink>."
6363
msgstr ""
6364
6365
#: serverguide/C/vcs.xml:81(title)
6366
msgid "Subversion"
6367
msgstr ""
6368
6369
#: serverguide/C/vcs.xml:82(para)
6370
msgid ""
6371
"Subversion is an open source version control system. Using Subversion, you "
6372
"can record the history of source files and documents. It manages files and "
6373
"directories over time. A tree of files is placed into a central repository. "
6374
"The repository is much like an ordinary file server, except that it "
6375
"remembers every change ever made to files and directories."
6376
msgstr ""
6377
6378
#: serverguide/C/vcs.xml:87(para)
6379
msgid ""
6380
"To access Subversion repository using the HTTP protocol, you must install "
6381
"and configure a web server. Apache2 is proven to work with Subversion. "
6382
"Please refer to the HTTP subsection in the Apache2 section to install and "
6383
"configure Apache2. To access the Subversion repository using the HTTPS "
6384
"protocol, you must install and configure a digital certificate in your "
6385
"Apache 2 web server. Please refer to the HTTPS subsection in the Apache2 "
6386
"section to install and configure the digital certificate."
6387
msgstr ""
6388
6389
#: serverguide/C/vcs.xml:96(para)
6390
msgid ""
6391
"To install Subversion, run the following command from a terminal prompt:"
6392
msgstr ""
6393
6394
#: serverguide/C/vcs.xml:101(command)
6395
msgid "sudo apt-get install subversion libapache2-svn"
6396
msgstr ""
6397
6398
#: serverguide/C/vcs.xml:108(para)
6399
msgid ""
6400
"This step assumes you have installed above mentioned packages on your "
6401
"system. This section explains how to create a Subversion repository and "
6402
"access the project."
6403
msgstr ""
6404
6405
#: serverguide/C/vcs.xml:111(title)
6406
msgid "Create Subversion Repository"
6407
msgstr "建立Subversion儲藏庫"
6408
6409
#: serverguide/C/vcs.xml:112(para)
6410
msgid ""
6411
"The Subversion repository can be created using the following command from a "
6412
"terminal prompt:"
6413
msgstr ""
6414
6415
#: serverguide/C/vcs.xml:116(command)
6416
msgid "svnadmin create /path/to/repos/project"
6417
msgstr ""
6418
6419
#: serverguide/C/vcs.xml:121(title)
6420
msgid "Importing Files"
6421
msgstr ""
6422
6423
#: serverguide/C/vcs.xml:122(para)
6424
msgid ""
6425
"Once you create the repository you can <emphasis>import</emphasis> files "
6426
"into the repository. To import a directory, enter the following from a "
6427
"terminal prompt: <screen>\n"
6428
"<command>svn import /path/to/import/directory "
6429
"file:///path/to/repos/project</command>\n"
6430
"</screen>"
6431
msgstr ""
6432
6433
#: serverguide/C/vcs.xml:134(title) serverguide/C/vcs.xml:139(title)
6434
msgid "Access Methods"
6435
msgstr ""
6436
6437
#: serverguide/C/vcs.xml:135(para)
6438
msgid ""
6439
"Subversion repositories can be accessed (checked out) through many different "
6440
"methods --on local disk, or through various network protocols. A repository "
6441
"location, however, is always a URL. The table describes how different URL "
6442
"schemes map to the available access methods."
6443
msgstr ""
6444
6445
#: serverguide/C/vcs.xml:146(para)
6446
msgid "Schema"
6447
msgstr ""
6448
6449
#: serverguide/C/vcs.xml:147(para)
6450
msgid "Access Method"
6451
msgstr ""
6452
6453
#: serverguide/C/vcs.xml:152(para)
6454
msgid "file://"
6455
msgstr ""
6456
6457
#: serverguide/C/vcs.xml:153(para)
6458
msgid "direct repository access (on local disk)"
6459
msgstr ""
6460
6461
#: serverguide/C/vcs.xml:156(para)
6462
msgid "http://"
6463
msgstr ""
6464
6465
#: serverguide/C/vcs.xml:157(para)
6466
msgid "Access via WebDAV protocol to Subversion-aware Apache2 web server"
6467
msgstr ""
6468
6469
#: serverguide/C/vcs.xml:160(para)
6470
msgid "https://"
6471
msgstr ""
6472
6473
#: serverguide/C/vcs.xml:161(para)
6474
msgid "Same as http://, but with SSL encryption"
6475
msgstr ""
6476
6477
#: serverguide/C/vcs.xml:164(para)
6478
msgid "svn://"
6479
msgstr ""
6480
6481
#: serverguide/C/vcs.xml:165(para)
6482
msgid "Access via custom protocol to an svnserve server"
6483
msgstr ""
6484
6485
#: serverguide/C/vcs.xml:168(para)
6486
msgid "svn+ssh://"
6487
msgstr ""
6488
6489
#: serverguide/C/vcs.xml:169(para)
6490
msgid "Same as svn://, but through an SSH tunnel"
6491
msgstr ""
6492
6493
#: serverguide/C/vcs.xml:175(para)
6494
msgid ""
6495
"In this section, we will see how to configure Subversion for all these "
6496
"access methods. Here, we cover the basics. For more advanced usage details, "
6497
"refer to the <ulink url=\"http://svnbook.red-bean.com/\">svn book</ulink>."
6498
msgstr ""
6499
6500
#: serverguide/C/vcs.xml:182(title)
6501
msgid "Direct repository access (file://)"
6502
msgstr ""
6503
6504
#: serverguide/C/vcs.xml:183(para)
6505
msgid ""
6506
"This is the simplest of all access methods. It does not require any "
6507
"Subversion server process to be running. This access method is used to "
6508
"access Subversion from the same machine. The syntax of the command, entered "
6509
"at a terminal prompt, is as follows:"
6510
msgstr ""
6511
6512
#: serverguide/C/vcs.xml:190(command)
6513
msgid "svn co file:///path/to/repos/project"
6514
msgstr ""
6515
6516
#: serverguide/C/vcs.xml:193(para)
6517
msgid "or"
6518
msgstr ""
6519
6520
#: serverguide/C/vcs.xml:196(command)
6521
msgid "svn co file://localhost/path/to/repos/project"
6522
msgstr ""
6523
6524
#: serverguide/C/vcs.xml:200(para)
6525
msgid ""
6526
"If you do not specify the hostname, there are three forward slashes (///) -- "
6527
"two for the protocol (file, in this case) plus the leading slash in the "
6528
"path. If you specify the hostname, you must use two forward slashes (//)."
6529
msgstr ""
6530
6531
#: serverguide/C/vcs.xml:202(para)
6532
msgid ""
6533
"The repository permissions depend on filesystem permissions. If the user has "
6534
"read/write permission, he can checkout from and commit to the repository."
6535
msgstr ""
6536
6537
#: serverguide/C/vcs.xml:205(title)
6538
msgid "Access via WebDAV protocol (http://)"
6539
msgstr ""
6540
6541
#: serverguide/C/vcs.xml:206(para)
6542
msgid ""
6543
"To access the Subversion repository via WebDAV protocol, you must configure "
6544
"your Apache 2 web server. Add the following snippet between the "
6545
"<emphasis><VirtualHost></emphasis> and "
6546
"<emphasis></VirtualHost></emphasis> elements in "
6547
"<filename>/etc/apache2/sites-available/default</filename>, or another "
6548
"VirtualHost file:"
6549
msgstr ""
6550
6551
#: serverguide/C/vcs.xml:212(programlisting)
6552
#, no-wrap
6553
msgid ""
6554
"\n"
6555
" <Location /svn>\n"
6556
" DAV svn\n"
6557
" SVNPath /home/svn\n"
6558
" AuthType Basic\n"
6559
" AuthName \"Your repository name\"\n"
6560
" AuthUserFile /etc/subversion/passwd\n"
6561
" Require valid-user\n"
6562
" </Location> \n"
6563
msgstr ""
6564
6565
#: serverguide/C/vcs.xml:223(para)
6566
msgid ""
6567
"The above configuration snippet assumes that Subversion repositories are "
6568
"created under <filename>/home/svn/</filename> directory using "
6569
"<command>svnadmin</command> command. They can be accessible using "
6570
"<command>http://hostname/svn/repos_name</command> url."
6571
msgstr ""
6572
6573
#: serverguide/C/vcs.xml:229(para)
6574
msgid ""
6575
"To import or commit files to your Subversion repository over HTTP, the "
6576
"repository should be owned by the HTTP user. In Ubuntu systems, normally the "
6577
"HTTP user is <command>www-data</command>. To change the ownership of the "
6578
"repository files enter the following command from terminal prompt:"
6579
msgstr ""
6580
6581
#: serverguide/C/vcs.xml:238(command)
6582
msgid "sudo chown -R www-data:www-data /path/to/repos"
6583
msgstr ""
6584
6585
#: serverguide/C/vcs.xml:241(para)
6586
msgid ""
6587
"By changing the ownership of repository as <command>www-data</command> you "
6588
"will not be able to import or commit files into the repository by running "
6589
"<command>svn import file:///</command> command as any user other than "
6590
"<command>www-data</command>."
6591
msgstr ""
6592
6593
#: serverguide/C/vcs.xml:250(para)
6594
msgid ""
6595
"Next, you must create the <filename>/etc/subversion/passwd</filename> file "
6596
"that will contain user authentication details. To create a file issue the "
6597
"following command at a command prompt (which will create the file and add "
6598
"the first user):"
6599
msgstr ""
6600
6601
#: serverguide/C/vcs.xml:256(command)
6602
msgid "sudo htpasswd -c /etc/subversion/passwd user_name"
6603
msgstr ""
6604
6605
#: serverguide/C/vcs.xml:259(para)
6606
msgid ""
6607
"To add additional users omit the <emphasis>\"-c\"</emphasis> option as this "
6608
"option replaces the old file. Instead use this form:"
6609
msgstr ""
6610
6611
#: serverguide/C/vcs.xml:264(command)
6612
msgid "sudo htpasswd /etc/subversion/password user_name"
6613
msgstr ""
6614
6615
#: serverguide/C/vcs.xml:268(para)
6616
msgid ""
6617
"This command will prompt you to enter the password. Once you enter the "
6618
"password, the user is added. Now, to access the repository you can run the "
6619
"following command:"
6620
msgstr ""
6621
6622
#: serverguide/C/vcs.xml:269(command)
6623
msgid "svn co http://servername/svn"
6624
msgstr ""
6625
6626
#: serverguide/C/vcs.xml:271(para)
6627
msgid ""
6628
"The password is transmitted as plain text. If you are worried about password "
6629
"snooping, you are advised to use SSL encryption. For details, please refer "
6630
"next section."
6631
msgstr ""
6632
6633
#: serverguide/C/vcs.xml:277(title)
6634
msgid "Access via WebDAV protocol with SSL encryption (https://)"
6635
msgstr ""
6636
6637
#: serverguide/C/vcs.xml:278(para)
6638
msgid ""
6639
"Accessing Subversion repository via WebDAV protocol with SSL encryption "
6640
"(https://) is similar to http:// except that you must install and configure "
6641
"the digital certificate in your Apache2 web server. To use SSL with "
6642
"Subversion add the above Apache2 configuration to "
6643
"<filename>/etc/apache2/sites-available/default-ssl</filename>. For more "
6644
"information on setting up Apache2 with SSL see <xref linkend=\"https-"
6645
"configuration\"/>."
6646
msgstr ""
6647
6648
#: serverguide/C/vcs.xml:287(para)
6649
msgid ""
6650
"You can install a digital certificate issued by a signing authority. "
6651
"Alternatively, you can install your own self-signed certificate."
6652
msgstr ""
6653
6654
#: serverguide/C/vcs.xml:292(para)
6655
msgid ""
6656
"This step assumes you have installed and configured a digital certificate in "
6657
"your Apache 2 web server. Now, to access the Subversion repository, please "
6658
"refer to the above section! The access methods are exactly the same, except "
6659
"the protocol. You must use https:// to access the Subversion repository."
6660
msgstr ""
6661
6662
#: serverguide/C/vcs.xml:302(title)
6663
msgid "Access via custom protocol (svn://)"
6664
msgstr ""
6665
6666
#: serverguide/C/vcs.xml:303(para)
6667
msgid ""
6668
"Once the Subversion repository is created, you can configure the access "
6669
"control. You can edit the <filename> "
6670
"/path/to/repos/project/conf/svnserve.conf</filename> file to configure the "
6671
"access control. For example, to set up authentication, you can uncomment the "
6672
"following lines in the configuration file:"
6673
msgstr ""
6674
6675
#: serverguide/C/vcs.xml:310(programlisting)
6676
#, no-wrap
6677
msgid ""
6678
"# [general]\n"
6679
"# password-db = passwd"
6680
msgstr ""
6681
6682
#: serverguide/C/vcs.xml:313(para)
6683
msgid ""
6684
"After uncommenting the above lines, you can maintain the user list in the "
6685
"passwd file. So, edit the file <filename>passwd </filename> in the same "
6686
"directory and add the new user. The syntax is as follows:"
6687
msgstr ""
6688
6689
#: serverguide/C/vcs.xml:319(programlisting)
6690
#, no-wrap
6691
msgid "username = password"
6692
msgstr ""
6693
6694
#: serverguide/C/vcs.xml:320(para)
6695
msgid "For more details, please refer to the file."
6696
msgstr ""
6697
6698
#: serverguide/C/vcs.xml:324(para)
6699
msgid ""
6700
"Now, to access Subversion via the svn:// custom protocol, either from the "
6701
"same machine or a different machine, you can run svnserver using svnserve "
6702
"command. The syntax is as follows:"
6703
msgstr ""
6704
6705
#: serverguide/C/vcs.xml:329(programlisting)
6706
#, no-wrap
6707
msgid ""
6708
"$ svnserve -d --foreground -r /path/to/repos\n"
6709
"# -d -- daemon mode\n"
6710
"# --foreground -- run in foreground (useful for debugging)\n"
6711
"# -r -- root of directory to serve\n"
6712
"\n"
6713
"For more usage details, please refer to:\n"
6714
"$ svnserve --help"
6715
msgstr ""
6716
6717
#: serverguide/C/vcs.xml:337(para)
6718
msgid ""
6719
"Once you run this command, Subversion starts listening on default port "
6720
"(3690). To access the project repository, you must run the following command "
6721
"from a terminal prompt:"
6722
msgstr ""
6723
6724
#: serverguide/C/vcs.xml:340(command)
6725
msgid "svn co svn://hostname/project project --username user_name"
6726
msgstr ""
6727
6728
#: serverguide/C/vcs.xml:343(para)
6729
msgid ""
6730
"Based on server configuration, it prompts for password. Once you are "
6731
"authenticated, it checks out the code from Subversion repository. To "
6732
"synchronize the project repository with the local copy, you can run the "
6733
"<command>update</command> sub-command. The syntax of the command, entered at "
6734
"a terminal prompt, is as follows:"
6735
msgstr ""
6736
6737
#: serverguide/C/vcs.xml:351(command)
6738
msgid "cd project_dir ; svn update"
6739
msgstr ""
6740
6741
#: serverguide/C/vcs.xml:354(para)
6742
msgid ""
6743
"For more details about using each Subversion sub-command, you can refer to "
6744
"the manual. For example, to learn more about the co (checkout) command, "
6745
"please run the following command from a terminal prompt:"
6746
msgstr ""
6747
6748
#: serverguide/C/vcs.xml:358(command)
6749
msgid "svn co help"
6750
msgstr ""
6751
6752
#: serverguide/C/vcs.xml:362(title)
6753
msgid "Access via custom protocol with SSL encryption (svn+ssh://)"
6754
msgstr ""
6755
6756
#: serverguide/C/vcs.xml:363(para)
6757
msgid ""
6758
"The configuration and server process is same as in the svn:// method. For "
6759
"details, please refer to the above section. This step assumes you have "
6760
"followed the above step and started the Subversion server using "
6761
"<application>svnserve</application> command."
6762
msgstr ""
6763
6764
#: serverguide/C/vcs.xml:369(para)
6765
msgid ""
6766
"It is also assumed that the ssh server is running on that machine and that "
6767
"it is allowing incoming connections. To confirm, please try to login to that "
6768
"machine using ssh. If you can login, everything is perfect. If you cannot "
6769
"login, please address it before continuing further."
6770
msgstr ""
6771
6772
#: serverguide/C/vcs.xml:375(para)
6773
msgid ""
6774
"The svn+ssh:// protocol is used to access the Subversion repository using "
6775
"SSL encryption. The data transfer is encrypted using this method. To access "
6776
"the project repository (for example with a checkout), you must use the "
6777
"following command syntax:"
6778
msgstr ""
6779
6780
#: serverguide/C/vcs.xml:382(command)
6781
msgid "svn co svn+ssh://hostname/var/svn/repos/project"
6782
msgstr ""
6783
6784
#: serverguide/C/vcs.xml:386(para)
6785
msgid ""
6786
"You must use the full path (/path/to/repos/project) to access the Subversion "
6787
"repository using this access method."
6788
msgstr ""
6789
6790
#: serverguide/C/vcs.xml:389(para)
6791
msgid ""
6792
"Based on server configuration, it prompts for password. You must enter the "
6793
"password you use to login via ssh. Once you are authenticated, it checks out "
6794
"the code from the Subversion repository."
6795
msgstr ""
6796
6797
#: serverguide/C/vcs.xml:399(title)
6798
msgid "CVS Server"
6799
msgstr ""
6800
6801
#: serverguide/C/vcs.xml:400(para)
6802
msgid ""
6803
"CVS is a version control system. You can use it to record the history of "
6804
"source files."
6805
msgstr ""
6806
6807
#: serverguide/C/vcs.xml:406(para)
6808
msgid ""
6809
"To install <application>CVS</application>, run the following command from a "
6810
"terminal prompt: <screen>\n"
6811
"<command>sudo apt-get install cvs</command>\n"
6812
"</screen> After you install <application>cvs</application>, you should "
6813
"install <application>xinetd</application> to start/stop the cvs server. At "
6814
"the prompt, enter the following command to install "
6815
"<application>xinetd</application>: <screen>\n"
6816
"<command>sudo apt-get install xinetd</command>\n"
6817
"</screen>"
6818
msgstr ""
6819
6820
#: serverguide/C/vcs.xml:439(programlisting)
6821
#, no-wrap
6822
msgid ""
6823
"\n"
6824
"service cvspserver\n"
6825
"{\n"
6826
" port = 2401\n"
6827
" socket_type = stream\n"
6828
" protocol = tcp\n"
6829
" user = root\n"
6830
" wait = no\n"
6831
" type = UNLISTED\n"
6832
" server = /usr/bin/cvs\n"
6833
" server_args = -f --allow-root /var/lib/cvs pserver\n"
6834
" disable = no\n"
6835
"}\n"
6836
msgstr ""
6837
6838
#: serverguide/C/vcs.xml:455(para)
6839
msgid ""
6840
"Be sure to edit the repository if you have changed the default repository "
6841
"(<application>/var/lib/cvs</application>) directory."
6842
msgstr ""
6843
6844
#: serverguide/C/vcs.xml:424(para)
6845
msgid ""
6846
"Once you install cvs, the repository will be automatically initialized. By "
6847
"default, the repository resides under the "
6848
"<application>/var/lib/cvs</application> directory. You can change this path "
6849
"by running following command: <screen>\n"
6850
"<command>cvs -d /your/new/cvs/repo init</command>\n"
6851
"</screen> Once the initial repository is set up, you can configure "
6852
"<application>xinetd</application> to start the CVS server. You can copy the "
6853
"following lines to the <filename> /etc/xinetd.d/cvspserver</filename> file. "
6854
"<placeholder-1/><placeholder-2/> Once you have configured "
6855
"<application>xinetd</application> you can start the cvs server by running "
6856
"following command: <screen>\n"
6857
"<command>sudo /etc/init.d/xinetd restart</command>\n"
6858
"</screen>"
6859
msgstr ""
6860
6861
#: serverguide/C/vcs.xml:468(para)
6862
msgid ""
6863
"You can confirm that the CVS server is running by issuing the following "
6864
"command:"
6865
msgstr ""
6866
6867
#: serverguide/C/vcs.xml:475(command)
6868
msgid "sudo netstat -tap | grep cvs"
6869
msgstr ""
6870
6871
#: serverguide/C/vcs.xml:479(para) serverguide/C/databases.xml:65(para)
6872
msgid ""
6873
"When you run this command, you should see the following line or something "
6874
"similar:"
6875
msgstr ""
6876
6877
#: serverguide/C/vcs.xml:484(programlisting)
6878
#, no-wrap
6879
msgid ""
6880
"\n"
6881
"tcp 0 0 *:cvspserver *:* LISTEN \n"
6882
msgstr ""
6883
6884
#: serverguide/C/vcs.xml:488(para)
6885
msgid ""
6886
"From here you can continue to add users, add new projects, and manage the "
6887
"CVS server."
6888
msgstr ""
6889
6890
#: serverguide/C/vcs.xml:493(para)
6891
msgid ""
6892
"CVS allows the user to add users independently of the underlying OS "
6893
"installation. Probably the easiest way is to use the Linux Users for CVS, "
6894
"although it has potential security issues. Please refer to the CVS manual "
6895
"for details."
6896
msgstr ""
6897
6898
#: serverguide/C/vcs.xml:503(title)
6899
msgid "Add Projects"
6900
msgstr ""
6901
6902
#: serverguide/C/vcs.xml:515(para)
6903
msgid ""
6904
"You can use the CVSROOT environment variable to store the CVS root "
6905
"directory. Once you export the CVSROOT environment variable, you can avoid "
6906
"using -d option in the above cvs command."
6907
msgstr ""
6908
6909
#: serverguide/C/vcs.xml:527(para)
6910
msgid ""
6911
"When you add a new project, the CVS user you use must have write access to "
6912
"the CVS repository (<application>/var/lib/cvs</application>). By default, "
6913
"the <application>src</application> group has write access to the CVS "
6914
"repository. So, you can add the user to this group, and he can then add and "
6915
"manage projects in the CVS repository."
6916
msgstr ""
6917
6918
#: serverguide/C/vcs.xml:504(para)
6919
msgid ""
6920
"This section explains how to add new project to the CVS repository. Create "
6921
"the directory and add necessary document and source files to the directory. "
6922
"Now, run the following command to add this project to CVS repository: "
6923
"<screen>\n"
6924
"<command>cd your/project</command>\n"
6925
"<command>cvs -d :pserver:username@hostname.com:/var/lib/cvs import -m "
6926
"\"Importing my project to CVS repository\" . new_project start</command>\n"
6927
"</screen><placeholder-1/> The string <emphasis>new_project</emphasis> is a "
6928
"vendor tag, and <emphasis>start</emphasis> is a release tag. They serve no "
6929
"purpose in this context, but since CVS requires them, they must be present. "
6930
"<placeholder-2/>"
6931
msgstr ""
6932
6933
#: serverguide/C/vcs.xml:540(ulink)
6934
msgid "Bazaar Home Page"
6935
msgstr ""
6936
6937
#: serverguide/C/vcs.xml:541(ulink)
6938
msgid "Launchpad"
6939
msgstr ""
6940
6941
#: serverguide/C/vcs.xml:542(ulink)
6942
msgid "Subversion Home Page"
6943
msgstr ""
6944
6945
#: serverguide/C/vcs.xml:543(ulink)
6946
msgid "Subversion Book"
6947
msgstr ""
6948
6949
#: serverguide/C/vcs.xml:545(ulink)
6950
msgid "CVS Manual"
6951
msgstr ""
6952
6953
#: serverguide/C/vcs.xml:546(ulink)
6954
msgid "Easy Bazaar Ubuntu Wiki page"
6955
msgstr ""
6956
6957
#: serverguide/C/vcs.xml:547(ulink)
6958
msgid "Ubuntu Wiki Subversion page"
6959
msgstr ""
6960
6961
#: serverguide/C/serverguide.xml:3(title) serverguide/C/bookinfo.xml:3(title)
6962
msgid "Credits and License"
6963
msgstr ""
6964
6965
#: serverguide/C/serverguide.xml:4(para) serverguide/C/bookinfo.xml:4(para)
6966
msgid ""
6967
"This document is maintained by the Ubuntu documentation team "
6968
"(https://wiki.ubuntu.com/DocumentationTeam). For a list of contributors, see "
6969
"the <ulink url=\"../../libs/C/contributors.xml\">contributors page</ulink>"
6970
msgstr ""
6971
6972
#: serverguide/C/serverguide.xml:5(para) serverguide/C/bookinfo.xml:5(para)
6973
msgid ""
6974
"This document is made available under the Creative Commons ShareAlike 2.5 "
6975
"License (CC-BY-SA)."
6976
msgstr ""
6977
6978
#: serverguide/C/serverguide.xml:6(para) serverguide/C/bookinfo.xml:6(para)
6979
msgid ""
6980
"You are free to modify, extend, and improve the Ubuntu documentation source "
6981
"code under the terms of this license. All derivative works must be released "
6982
"under this license."
6983
msgstr ""
6984
6985
#: serverguide/C/serverguide.xml:8(para) serverguide/C/bookinfo.xml:8(para)
6986
msgid ""
6987
"This documentation is distributed in the hope that it will be useful, but "
6988
"WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY "
6989
"or FITNESS FOR A PARTICULAR PURPOSE AS DESCRIBED IN THE DISCLAIMER."
6990
msgstr ""
6991
6992
#: serverguide/C/serverguide.xml:11(para) serverguide/C/bookinfo.xml:11(para)
6993
msgid ""
6994
"A copy of the license is available here: <ulink url=\"/usr/share/ubuntu-"
6995
"docs/libs/C/ccbysa.xml\">Creative Commons ShareAlike License</ulink>."
6996
msgstr ""
6997
6998
#: serverguide/C/serverguide.xml:14(year) serverguide/C/bookinfo.xml:14(year)
6999
msgid "2008"
7000
msgstr ""
7001
7002
#: serverguide/C/serverguide.xml:15(ulink) serverguide/C/bookinfo.xml:15(ulink)
7003
msgid "Ubuntu Documentation Project"
7004
msgstr ""
7005
7006
#: serverguide/C/serverguide.xml:15(holder) serverguide/C/bookinfo.xml:15(holder)
7007
msgid "Canonical Ltd. and members of the <placeholder-1/>"
7008
msgstr ""
7009
7010
#: serverguide/C/serverguide.xml:18(publishername) serverguide/C/bookinfo.xml:18(publishername)
7011
msgid "The Ubuntu Documentation Project"
7012
msgstr ""
7013
7014
#: serverguide/C/serverguide.xml:17(para)
7015
msgid ""
7016
"Welcome to the <emphasis>Ubuntu Server Guide</emphasis>! It contains "
7017
"information on how to install and configure various server applications on "
7018
"your Ubuntu system to fit your needs. It is a step-by-step, task-oriented "
7019
"guide for configuring and customizing your system."
7020
msgstr ""
7021
7022
#: serverguide/C/security.xml:13(title)
7023
msgid "Security"
7024
msgstr ""
7025
7026
#: serverguide/C/security.xml:14(para)
7027
msgid ""
7028
"Security should always be considered when installing, deploying, and using "
7029
"any type of computer system. Although a fresh installation of Ubuntu is "
7030
"relatively safe for immediate use on the Internet, it is important to have a "
7031
"balanced understanding of your systems security posture based on how it will "
7032
"be used after deployment."
7033
msgstr ""
7034
7035
#: serverguide/C/security.xml:17(para)
7036
msgid ""
7037
"This chapter provides an overview of security related topics as they pertain "
7038
"to Ubuntu 10.04 LTS Server Edition, and outlines simple measures you may use "
7039
"to protect your server and network from any number of potential security "
7040
"threats."
7041
msgstr ""
7042
7043
#: serverguide/C/security.xml:21(title)
7044
msgid "User Management"
7045
msgstr ""
7046
7047
#: serverguide/C/security.xml:22(para)
7048
msgid ""
7049
"User management is a critical part of maintaining a secure system. "
7050
"Ineffective user and privilege management often lead many systems into being "
7051
"compromised. Therefore, it is important that you understand how you can "
7052
"protect your server through simple and effective user account management "
7053
"techniques."
7054
msgstr ""
7055
7056
#: serverguide/C/security.xml:26(title)
7057
msgid "Where is root?"
7058
msgstr ""
7059
7060
#: serverguide/C/security.xml:27(para)
7061
msgid ""
7062
"Ubuntu developers made a conscientious decision to disable the "
7063
"administrative root account by default in all Ubuntu installations. This "
7064
"does not mean that the root account has been deleted or that it may not be "
7065
"accessed. It merely has been given a password which matches no possible "
7066
"encrypted value, therefore may not log in directly by itself."
7067
msgstr ""
7068
7069
#: serverguide/C/security.xml:30(para)
7070
msgid ""
7071
"Instead, users are encouraged to make use of a tool by the name of "
7072
"<application>sudo</application> to carry out system administrative duties. "
7073
"<application>Sudo</application> allows an authorized user to temporarily "
7074
"elevate their privileges using their own password instead of having to know "
7075
"the password belonging to the root account. This simple yet effective "
7076
"methodology provides accountability for all user actions, and gives the "
7077
"administrator granular control over which actions a user can perform with "
7078
"said privileges."
7079
msgstr ""
7080
7081
#: serverguide/C/security.xml:35(para)
7082
msgid ""
7083
"If for some reason you wish to enable the root account, simply give it a "
7084
"password:"
7085
msgstr ""
7086
7087
#: serverguide/C/security.xml:39(command)
7088
msgid "sudo passwd"
7089
msgstr ""
7090
7091
#: serverguide/C/security.xml:41(para)
7092
msgid ""
7093
"Sudo will prompt you for your password, and then ask you to supply a new "
7094
"password for root as shown below:"
7095
msgstr ""
7096
7097
#: serverguide/C/security.xml:44(userinput)
7098
#, no-wrap
7099
msgid "(enter your own password)"
7100
msgstr ""
7101
7102
#: serverguide/C/security.xml:45(userinput)
7103
#, no-wrap
7104
msgid "(enter a new password for root)"
7105
msgstr ""
7106
7107
#: serverguide/C/security.xml:46(userinput)
7108
#, no-wrap
7109
msgid "(repeat new password for root)"
7110
msgstr ""
7111
7112
#: serverguide/C/security.xml:44(computeroutput)
7113
#, no-wrap
7114
msgid ""
7115
"[sudo] password for username: <placeholder-1/>\n"
7116
"Enter new UNIX password: <placeholder-2/>\n"
7117
"Retype new UNIX password: <placeholder-3/>\n"
7118
"passwd: password updated successfully"
7119
msgstr ""
7120
7121
#: serverguide/C/security.xml:51(para)
7122
msgid "To disable the root account, use the following passwd syntax:"
7123
msgstr ""
7124
7125
#: serverguide/C/security.xml:55(command)
7126
msgid "sudo passwd -l root"
7127
msgstr ""
7128
7129
#: serverguide/C/security.xml:59(para)
7130
msgid ""
7131
"You should read more on <application>Sudo</application> by checking out it's "
7132
"man page:"
7133
msgstr ""
7134
7135
#: serverguide/C/security.xml:63(command)
7136
msgid "man sudo"
7137
msgstr ""
7138
7139
#: serverguide/C/security.xml:67(para)
7140
msgid ""
7141
"By default, the initial user created by the Ubuntu installer is a member of "
7142
"the group \"admin\" which is added to the file "
7143
"<filename>/etc/sudoers</filename> as an authorized sudo user. If you wish to "
7144
"give any other account full root access through "
7145
"<application>sudo</application>, simply add them to the admin group."
7146
msgstr ""
7147
7148
#: serverguide/C/security.xml:73(title)
7149
msgid "Adding and Deleting Users"
7150
msgstr ""
7151
7152
#: serverguide/C/security.xml:74(para)
7153
msgid ""
7154
"The process for managing local users and groups is straight forward and "
7155
"differs very little from most other GNU/Linux operating systems. Ubuntu and "
7156
"other Debian based distributions, encourage the use of the \"adduser\" "
7157
"package for account management."
7158
msgstr ""
7159
7160
#: serverguide/C/security.xml:79(para)
7161
msgid ""
7162
"To add a user account, use the following syntax, and follow the prompts to "
7163
"give the account a password and identifiable characteristics such as a full "
7164
"name, phone number, etc."
7165
msgstr ""
7166
7167
#: serverguide/C/security.xml:83(command)
7168
msgid "sudo adduser username"
7169
msgstr ""
7170
7171
#: serverguide/C/security.xml:87(para)
7172
msgid ""
7173
"To delete a user account and its primary group, use the following syntax:"
7174
msgstr ""
7175
7176
#: serverguide/C/security.xml:91(command)
7177
msgid "sudo deluser username"
7178
msgstr ""
7179
7180
#: serverguide/C/security.xml:93(para)
7181
msgid ""
7182
"Deleting an account does not remove their respective home folder. It is up "
7183
"to you whether or not you wish to delete the folder manually or keep it "
7184
"according to your desired retention policies."
7185
msgstr ""
7186
7187
#: serverguide/C/security.xml:96(para)
7188
msgid ""
7189
"Remember, any user added later on with the same UID/GID as the previous "
7190
"owner will now have access to this folder if you have not taken the "
7191
"necessary precautions."
7192
msgstr ""
7193
7194
#: serverguide/C/security.xml:99(para)
7195
msgid ""
7196
"You may want to change these UID/GID values to something more appropriate, "
7197
"such as the root account, and perhaps even relocate the folder to avoid "
7198
"future conflicts:"
7199
msgstr ""
7200
7201
#: serverguide/C/security.xml:103(command)
7202
msgid "sudo chown -R root:root /home/username/"
7203
msgstr ""
7204
7205
#: serverguide/C/security.xml:104(command)
7206
msgid "sudo mkdir /home/archived_users/"
7207
msgstr ""
7208
7209
#: serverguide/C/security.xml:105(command)
7210
msgid "sudo mv /home/username /home/archived_users/"
7211
msgstr ""
7212
7213
#: serverguide/C/security.xml:109(para)
7214
msgid ""
7215
"To temporarily lock or unlock a user account, use the following syntax, "
7216
"respectively:"
7217
msgstr ""
7218
7219
#: serverguide/C/security.xml:113(command)
7220
msgid "sudo passwd -l username"
7221
msgstr ""
7222
7223
#: serverguide/C/security.xml:114(command)
7224
msgid "sudo passwd -u username"
7225
msgstr ""
7226
7227
#: serverguide/C/security.xml:118(para)
7228
msgid ""
7229
"To add or delete a personalized group, use the following syntax, "
7230
"respectively:"
7231
msgstr ""
7232
7233
#: serverguide/C/security.xml:122(command)
7234
msgid "sudo addgroup groupname"
7235
msgstr ""
7236
7237
#: serverguide/C/security.xml:123(command)
7238
msgid "sudo delgroup groupname"
7239
msgstr ""
7240
7241
#: serverguide/C/security.xml:127(para)
7242
msgid "To add a user to a group, use the following syntax:"
7243
msgstr ""
7244
7245
#: serverguide/C/security.xml:131(command)
7246
msgid "sudo adduser username groupname"
7247
msgstr ""
7248
7249
#: serverguide/C/security.xml:138(title)
7250
msgid "User Profile Security"
7251
msgstr ""
7252
7253
#: serverguide/C/security.xml:139(para)
7254
msgid ""
7255
"When a new user is created, the adduser utility creates a brand new home "
7256
"directory named <filename class=\"directory\">/home/username</filename>, "
7257
"respectively. The default profile is modeled after the contents found in the "
7258
"directory of <filename class=\"directory\">/etc/skel</filename>, which "
7259
"includes all profile basics."
7260
msgstr ""
7261
7262
#: serverguide/C/security.xml:142(para)
7263
msgid ""
7264
"If your server will be home to multiple users, you should pay close "
7265
"attention to the user home directory permissions to ensure confidentiality. "
7266
"By default, user home directories in Ubuntu are created with world "
7267
"read/execute permissions. This means that all users can browse and access "
7268
"the contents of other users home directories. This may not be suitable for "
7269
"your environment."
7270
msgstr ""
7271
7272
#: serverguide/C/security.xml:147(para)
7273
msgid ""
7274
"To verify your current users home directory permissions, use the following "
7275
"syntax:"
7276
msgstr ""
7277
7278
#: serverguide/C/security.xml:151(command) serverguide/C/security.xml:183(command)
7279
msgid "ls -ld /home/username"
7280
msgstr ""
7281
7282
#: serverguide/C/security.xml:153(para)
7283
msgid ""
7284
"The following output shows that the directory <filename "
7285
"class=\"directory\">/home/username</filename> has world readable permissions:"
7286
msgstr ""
7287
7288
#: serverguide/C/security.xml:156(computeroutput)
7289
#, no-wrap
7290
msgid "drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username"
7291
msgstr ""
7292
7293
#: serverguide/C/security.xml:160(para)
7294
msgid ""
7295
"You can remove the world readable permissions using the following syntax:"
7296
msgstr ""
7297
7298
#: serverguide/C/security.xml:164(command)
7299
msgid "sudo chmod 0750 /home/username"
7300
msgstr ""
7301
7302
#: serverguide/C/security.xml:167(para)
7303
msgid ""
7304
"Some people tend to use the recursive option (-R) indiscriminately which "
7305
"modifies all child folders and files, but this is not necessary, and may "
7306
"yield other undesirable results. The parent directory alone is sufficient "
7307
"for preventing unauthorized access to anything below the parent."
7308
msgstr ""
7309
7310
#: serverguide/C/security.xml:171(para)
7311
msgid ""
7312
"A much more efficient approach to the matter would be to modify the "
7313
"<application>adduser</application> global default permissions when creating "
7314
"user home folders. Simply edit the file "
7315
"<filename>/etc/adduser.conf</filename> and modify the "
7316
"<varname>DIR_MODE</varname> variable to something appropriate, so that all "
7317
"new home directories will receive the correct permissions."
7318
msgstr ""
7319
7320
#: serverguide/C/security.xml:174(programlisting)
7321
#, no-wrap
7322
msgid ""
7323
"\n"
7324
"DIR_MODE=0750\n"
7325
msgstr ""
7326
7327
#: serverguide/C/security.xml:179(para)
7328
msgid ""
7329
"After correcting the directory permissions using any of the previously "
7330
"mentioned techniques, verify the results using the following syntax:"
7331
msgstr ""
7332
7333
#: serverguide/C/security.xml:185(para)
7334
msgid ""
7335
"The results below show that world readable permissions have been removed:"
7336
msgstr ""
7337
7338
#: serverguide/C/security.xml:188(computeroutput)
7339
#, no-wrap
7340
msgid "drwxr-x--- 2 username username 4096 2007-10-02 20:03 username"
7341
msgstr ""
7342
7343
#: serverguide/C/security.xml:195(title)
7344
msgid "Password Policy"
7345
msgstr ""
7346
7347
#: serverguide/C/security.xml:196(para)
7348
msgid ""
7349
"A strong password policy is one of the most important aspects of your "
7350
"security posture. Many successful security breaches involve simple brute "
7351
"force and dictionary attacks against weak passwords. If you intend to offer "
7352
"any form of remote access involving your local password system, make sure "
7353
"you adequately address minimum password complexity requirements, maximum "
7354
"password lifetimes, and frequent audits of your authentication systems."
7355
msgstr ""
7356
7357
#: serverguide/C/security.xml:200(title)
7358
msgid "Minimum Password Length"
7359
msgstr ""
7360
7361
#: serverguide/C/security.xml:201(para)
7362
msgid ""
7363
"By default, Ubuntu requires a minimum password length of 4 characters, as "
7364
"well as some basic entropy checks. These values are controlled in the file "
7365
"<filename>/etc/pam.d/common-password</filename>, which is outlined below."
7366
msgstr ""
7367
7368
#: serverguide/C/security.xml:204(programlisting)
7369
#, no-wrap
7370
msgid ""
7371
"\n"
7372
"password required pam_unix.so nullok obscure min=4 max=8 md5\n"
7373
msgstr ""
7374
7375
#: serverguide/C/security.xml:207(para)
7376
msgid ""
7377
"If you would like to adjust the minimum length to 6 characters, change the "
7378
"appropriate variable to min=6. The modification is outlined below."
7379
msgstr ""
7380
7381
#: serverguide/C/security.xml:210(programlisting)
7382
#, no-wrap
7383
msgid ""
7384
"\n"
7385
"password required pam_unix.so nullok obscure min=6 max=8 md5\n"
7386
msgstr ""
7387
7388
#: serverguide/C/security.xml:214(para)
7389
msgid ""
7390
"The <varname>max=8</varname> variable does not represent the maximum length "
7391
"of a password. It only means that complexity requirements will not be "
7392
"checked on passwords over 8 characters. You may want to look at the "
7393
"<application>libpam-cracklib</application> package for additional password "
7394
"entropy assistance."
7395
msgstr ""
7396
7397
#: serverguide/C/security.xml:220(title)
7398
msgid "Password Expiration"
7399
msgstr ""
7400
7401
#: serverguide/C/security.xml:221(para)
7402
msgid ""
7403
"When creating user accounts, you should make it a policy to have a minimum "
7404
"and maximum password age forcing users to change their passwords when they "
7405
"expire."
7406
msgstr ""
7407
7408
#: serverguide/C/security.xml:226(para)
7409
msgid ""
7410
"To easily view the current status of a user account, use the following "
7411
"syntax:"
7412
msgstr ""
7413
7414
#: serverguide/C/security.xml:230(command) serverguide/C/security.xml:263(command)
7415
msgid "sudo chage -l username"
7416
msgstr ""
7417
7418
#: serverguide/C/security.xml:232(para)
7419
msgid ""
7420
"The output below shows interesting facts about the user account, namely that "
7421
"there are no policies applied:"
7422
msgstr ""
7423
7424
#: serverguide/C/security.xml:235(computeroutput)
7425
#, no-wrap
7426
msgid ""
7427
"Last password change : Jan 20, 2008\n"
7428
"Password expires : never\n"
7429
"Password inactive : never\n"
7430
"Account expires : never\n"
7431
"Minimum number of days between password change : 0\n"
7432
"Maximum number of days between password change : 99999\n"
7433
"Number of days of warning before password expires : 7"
7434
msgstr ""
7435
7436
#: serverguide/C/security.xml:245(para)
7437
msgid ""
7438
"To set any of these values, simply use the following syntax, and follow the "
7439
"interactive prompts:"
7440
msgstr ""
7441
7442
#: serverguide/C/security.xml:249(command)
7443
msgid "sudo chage username"
7444
msgstr ""
7445
7446
#: serverguide/C/security.xml:251(para)
7447
msgid ""
7448
"The following is also an example of how you can manually change the explicit "
7449
"expiration date (-E) to 01/31/2008, minimum password age (-m) of 5 days, "
7450
"maximum password age (-M) of 90 days, inactivity period (-I) of 5 days after "
7451
"password expiration, and a warning time period (-W) of 14 days before "
7452
"password expiration."
7453
msgstr ""
7454
7455
#: serverguide/C/security.xml:255(command)
7456
msgid "sudo chage -E 01/31/2008 -m 5 -M 90 -I 30 -W 14 username"
7457
msgstr ""
7458
7459
#: serverguide/C/security.xml:259(para)
7460
msgid "To verify changes, use the same syntax as mentioned previously:"
7461
msgstr ""
7462
7463
#: serverguide/C/security.xml:265(para)
7464
msgid ""
7465
"The output below shows the new policies that have been established for the "
7466
"account:"
7467
msgstr ""
7468
7469
#: serverguide/C/security.xml:268(computeroutput)
7470
#, no-wrap
7471
msgid ""
7472
"Last password change : Jan 20, 2008\n"
7473
"Password expires : Apr 19, 2008\n"
7474
"Password inactive : May 19, 2008\n"
7475
"Account expires : Jan 31, 2008\n"
7476
"Minimum number of days between password change : 5\n"
7477
"Maximum number of days between password change : 90\n"
7478
"Number of days of warning before password expires : 14"
7479
msgstr ""
7480
7481
#: serverguide/C/security.xml:284(title)
7482
msgid "Other Security Considerations"
7483
msgstr ""
7484
7485
#: serverguide/C/security.xml:285(para)
7486
msgid ""
7487
"Many applications use alternate authentication mechanisms that can be easily "
7488
"overlooked by even experienced system administrators. Therefore, it is "
7489
"important to understand and control how users authenticate and gain access "
7490
"to services and applications on your server."
7491
msgstr ""
7492
7493
#: serverguide/C/security.xml:290(title)
7494
msgid "SSH Access by Disabled Users"
7495
msgstr ""
7496
7497
#: serverguide/C/security.xml:291(para)
7498
msgid ""
7499
"Simply disabling/locking a user account will not prevent a user from logging "
7500
"into your server remotely if they have previously set up RSA public key "
7501
"authentication. They will still be able to gain shell access to the server, "
7502
"without the need for any password. Remember to check the users home "
7503
"directory for files that will allow for this type of authenticated SSH "
7504
"access. e.g. <filename>/home/username/.ssh/authorized_keys</filename>."
7505
msgstr ""
7506
7507
#: serverguide/C/security.xml:294(para)
7508
msgid ""
7509
"Remove or rename the directory <filename "
7510
"class=\"directory\">.ssh/</filename> in the user's home folder to prevent "
7511
"further SSH authentication capabilities."
7512
msgstr ""
7513
7514
#: serverguide/C/security.xml:297(para)
7515
msgid ""
7516
"Be sure to check for any established SSH connections by the disabled user, "
7517
"as it is possible they may have existing inbound or outbound connections. "
7518
"Kill any that are found."
7519
msgstr ""
7520
7521
#: serverguide/C/security.xml:300(para)
7522
msgid ""
7523
"Restrict SSH access to only user accounts that should have it. For example, "
7524
"you may create a group called \"sshlogin\" and add the group name as the "
7525
"value associated with the <varname>AllowGroups</varname> variable located in "
7526
"the file <filename>/etc/ssh/sshd_config</filename>."
7527
msgstr ""
7528
7529
#: serverguide/C/security.xml:303(programlisting)
7530
#, no-wrap
7531
msgid ""
7532
"\n"
7533
"AllowGroups sshlogin\n"
7534
msgstr ""
7535
7536
#: serverguide/C/security.xml:306(para)
7537
msgid ""
7538
"Then add your permitted SSH users to the group \"sshlogin\", and restart the "
7539
"SSH service."
7540
msgstr ""
7541
7542
#: serverguide/C/security.xml:310(command)
7543
msgid "sudo adduser username sshlogin"
7544
msgstr ""
7545
7546
#: serverguide/C/security.xml:311(command) serverguide/C/remote-administration.xml:150(command)
7547
msgid "sudo /etc/init.d/ssh restart"
7548
msgstr ""
7549
7550
#: serverguide/C/security.xml:315(title)
7551
msgid "External User Database Authentication"
7552
msgstr ""
7553
7554
#: serverguide/C/security.xml:316(para)
7555
msgid ""
7556
"Most enterprise networks require centralized authentication and access "
7557
"controls for all system resources. If you have configured your server to "
7558
"authenticate users against external databases, be sure to disable the user "
7559
"accounts both externally and locally, this way you ensure that local "
7560
"fallback authentication is not possible."
7561
msgstr ""
7562
7563
#: serverguide/C/security.xml:325(title)
7564
msgid "Console Security"
7565
msgstr ""
7566
7567
#: serverguide/C/security.xml:326(para)
7568
msgid ""
7569
"As with any other security barrier you put in place to protect your server, "
7570
"it is pretty tough to defend against untold damage caused by someone with "
7571
"physical access to your environment, for example, theft of hard drives, "
7572
"power or service disruption and so on. Therefore, console security should be "
7573
"addressed merely as one component of your overall physical security "
7574
"strategy. A locked \"screen door\" may deter a casual criminal, or at the "
7575
"very least slow down a determined one, so it is still advisable to perform "
7576
"basic precautions with regard to console security."
7577
msgstr ""
7578
7579
#: serverguide/C/security.xml:329(para)
7580
msgid ""
7581
"The following instructions will help defend your server against issues that "
7582
"could otherwise yield very serious consequences."
7583
msgstr ""
7584
7585
#: serverguide/C/security.xml:334(title)
7586
msgid "Disable Ctrl+Alt+Delete"
7587
msgstr ""
7588
7589
#: serverguide/C/security.xml:335(para)
7590
msgid ""
7591
"First and foremost, anyone that has physical access to the keyboard can "
7592
"simply use the "
7593
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7594
"eycombo> key combination to reboot the server without having to log on. "
7595
"Sure, someone could simply unplug the power source, but you should still "
7596
"prevent the use of this key combination on a production server. This forces "
7597
"an attacker to take more drastic measures to reboot the server, and will "
7598
"prevent accidental reboots at the same time."
7599
msgstr ""
7600
7601
#: serverguide/C/security.xml:340(para)
7602
msgid ""
7603
"To disable the reboot action taken by pressing the "
7604
"<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Delete</keycap></k"
7605
"eycombo> key combination, comment out the following line in the file "
7606
"<filename>/etc/init/control-alt-delete.conf</filename>."
7607
msgstr ""
7608
7609
#: serverguide/C/security.xml:343(programlisting)
7610
#, no-wrap
7611
msgid ""
7612
"\n"
7613
"#exec shutdown -r now \"Control-Alt-Delete pressed\"\n"
7614
msgstr ""
7615
7616
#: serverguide/C/security.xml:352(title)
7617
msgid "Firewall"
7618
msgstr ""
7619
7620
#: serverguide/C/security.xml:355(para)
7621
msgid ""
7622
"The Linux kernel includes the <emphasis>Netfilter</emphasis> subsystem, "
7623
"which is used to manipulate or decide the fate of network traffic headed "
7624
"into or through your server. All modern Linux firewall solutions use this "
7625
"system for packet filtering."
7626
msgstr ""
7627
7628
#: serverguide/C/security.xml:360(para)
7629
msgid ""
7630
"The kernel's packet filtering system would be of little use to "
7631
"administrators without a userspace interface to manage it. This is the "
7632
"purpose of iptables. When a packet reaches your server, it will be handed "
7633
"off to the Netfilter subsystem for acceptance, manipulation, or rejection "
7634
"based on the rules supplied to it from userspace via iptables. Thus, "
7635
"iptables is all you need to manage your firewall if you're familiar with it, "
7636
"but many frontends are available to simplify the task."
7637
msgstr ""
7638
7639
#: serverguide/C/security.xml:370(title)
7640
msgid "ufw - Uncomplicated Firewall"
7641
msgstr ""
7642
7643
#: serverguide/C/security.xml:371(para)
7644
msgid ""
7645
"The default firewall configuration tool for Ubuntu is "
7646
"<application>ufw</application>. Developed to ease iptables firewall "
7647
"configuration, <application>ufw</application> provides a user friendly way "
7648
"to create an IPv4 or IPv6 host-based firewall."
7649
msgstr ""
7650
7651
#: serverguide/C/security.xml:375(para)
7652
msgid ""
7653
"<application>ufw</application> by default is initially disabled. From the "
7654
"<application>ufw</application> man page:"
7655
msgstr ""
7656
7657
#: serverguide/C/security.xml:379(quote)
7658
msgid ""
7659
"ufw is not intended to provide complete firewall functionality via its "
7660
"command interface, but instead provides an easy way to add or remove simple "
7661
"rules. It is currently mainly used for host-based firewalls."
7662
msgstr ""
7663
7664
#: serverguide/C/security.xml:383(para)
7665
msgid ""
7666
"The following are some examples of how to use <application>ufw</application>:"
7667
msgstr ""
7668
7669
#: serverguide/C/security.xml:388(para)
7670
msgid ""
7671
"First, <application>ufw</application> needs to be enabled. From a terminal "
7672
"prompt enter:"
7673
msgstr ""
7674
7675
#: serverguide/C/security.xml:392(command)
7676
msgid "sudo ufw enable"
7677
msgstr ""
7678
7679
#: serverguide/C/security.xml:396(para)
7680
msgid "To open a port (ssh in this example):"
7681
msgstr ""
7682
7683
#: serverguide/C/security.xml:400(command)
7684
msgid "sudo ufw allow 22"
7685
msgstr ""
7686
7687
#: serverguide/C/security.xml:404(para)
7688
msgid "Rules can also be added using a <emphasis>numbered</emphasis> format:"
7689
msgstr ""
7690
7691
#: serverguide/C/security.xml:408(command)
7692
msgid "sudo ufw insert 1 allow 80"
7693
msgstr ""
7694
7695
#: serverguide/C/security.xml:412(para)
7696
msgid "Similarly, to close an opened port:"
7697
msgstr ""
7698
7699
#: serverguide/C/security.xml:416(command)
7700
msgid "sudo ufw deny 22"
7701
msgstr ""
7702
7703
#: serverguide/C/security.xml:420(para)
7704
msgid "To remove a rule, use delete followed by the rule:"
7705
msgstr ""
7706
7707
#: serverguide/C/security.xml:424(command)
7708
msgid "sudo ufw delete deny 22"
7709
msgstr ""
7710
7711
#: serverguide/C/security.xml:428(para)
7712
msgid ""
7713
"It is also possible to allow access from specific hosts or networks to a "
7714
"port. The following example allows ssh access from host 192.168.0.2 to any "
7715
"ip address on this host:"
7716
msgstr ""
7717
7718
#: serverguide/C/security.xml:433(command)
7719
msgid "sudo ufw allow proto tcp from 192.168.0.2 to any port 22"
7720
msgstr ""
7721
7722
#: serverguide/C/security.xml:435(para)
7723
msgid ""
7724
"Replace 192.168.0.2 with 192.168.0.0/24 to allow ssh access from the entire "
7725
"subnet."
7726
msgstr ""
7727
7728
#: serverguide/C/security.xml:441(para)
7729
msgid ""
7730
"Adding the <emphasis>--dry-run</emphasis> option to a "
7731
"<emphasis>ufw</emphasis> command will output the resulting rules, but not "
7732
"apply them. For example, the following is what would be applied if opening "
7733
"the HTTP port:"
7734
msgstr ""
7735
7736
#: serverguide/C/security.xml:447(command)
7737
msgid "sudo ufw --dry-run allow http"
7738
msgstr ""
7739
7740
#: serverguide/C/security.xml:451(computeroutput)
7741
#, no-wrap
7742
msgid ""
7743
"*filter\n"
7744
":ufw-user-input - [0:0]\n"
7745
":ufw-user-output - [0:0]\n"
7746
":ufw-user-forward - [0:0]\n"
7747
":ufw-user-limit - [0:0]\n"
7748
":ufw-user-limit-accept - [0:0]\n"
7749
"### RULES ###\n"
7750
"\n"
7751
"### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0\n"
7752
"-A ufw-user-input -p tcp --dport 80 -j ACCEPT\n"
7753
"\n"
7754
"### END RULES ###\n"
7755
"-A ufw-user-input -j RETURN\n"
7756
"-A ufw-user-output -j RETURN\n"
7757
"-A ufw-user-forward -j RETURN\n"
7758
"-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix \"[UFW "
7759
"LIMIT]: \"\n"
7760
"-A ufw-user-limit -j REJECT\n"
7761
"-A ufw-user-limit-accept -j ACCEPT\n"
7762
"COMMIT\n"
7763
"Rules updated"
7764
msgstr ""
7765
7766
#: serverguide/C/security.xml:475(para)
7767
msgid "<application>ufw</application> can be disabled by:"
7768
msgstr ""
7769
7770
#: serverguide/C/security.xml:479(command)
7771
msgid "sudo ufw disable"
7772
msgstr ""
7773
7774
#: serverguide/C/security.xml:483(para)
7775
msgid "To see the firewall status, enter:"
7776
msgstr ""
7777
7778
#: serverguide/C/security.xml:487(command)
7779
msgid "sudo ufw status"
7780
msgstr ""
7781
7782
#: serverguide/C/security.xml:491(para)
7783
msgid "And for more verbose status information use:"
7784
msgstr ""
7785
7786
#: serverguide/C/security.xml:495(command)
7787
msgid "sudo ufw status verbose"
7788
msgstr ""
7789
7790
#: serverguide/C/security.xml:499(para)
7791
msgid "To view the <emphasis>numbered</emphasis> format:"
7792
msgstr ""
7793
7794
#: serverguide/C/security.xml:503(command)
7795
msgid "sudo ufw status numbered"
7796
msgstr ""
7797
7798
#: serverguide/C/security.xml:508(para)
7799
msgid ""
7800
"If the port you want to open or close is defined in "
7801
"<filename>/etc/services</filename>, you can use the port name instead of the "
7802
"number. In the above examples, replace <emphasis>22</emphasis> with "
7803
"<emphasis>ssh</emphasis>."
7804
msgstr ""
7805
7806
#: serverguide/C/security.xml:514(para)
7807
msgid ""
7808
"This is a quick introduction to using <application>ufw</application>. Please "
7809
"refer to the <application>ufw</application> man page for more information."
7810
msgstr ""
7811
7812
#: serverguide/C/security.xml:520(title)
7813
msgid "ufw Application Integration"
7814
msgstr ""
7815
7816
#: serverguide/C/security.xml:522(para)
7817
msgid ""
7818
"Applications that open ports can include an <application>ufw</application> "
7819
"profile, which details the ports needed for the application to function "
7820
"properly. The profiles are kept in <filename "
7821
"role=\"directory\">/etc/ufw/applications.d</filename>, and can be edited if "
7822
"the default ports have been changed."
7823
msgstr ""
7824
7825
#: serverguide/C/security.xml:531(para)
7826
msgid ""
7827
"To view which applications have installed a profile, enter the following in "
7828
"a terminal:"
7829
msgstr ""
7830
7831
#: serverguide/C/security.xml:536(command)
7832
msgid "sudo ufw app list"
7833
msgstr ""
7834
7835
#: serverguide/C/security.xml:542(para)
7836
msgid ""
7837
"Similar to allowing traffic to a port, using an application profile is "
7838
"accomplished by entering:"
7839
msgstr ""
7840
7841
#: serverguide/C/security.xml:547(command)
7842
msgid "sudo ufw allow Samba"
7843
msgstr ""
7844
7845
#: serverguide/C/security.xml:553(para)
7846
msgid "An extended syntax is available as well:"
7847
msgstr ""
7848
7849
#: serverguide/C/security.xml:558(command)
7850
msgid "ufw allow from 192.168.0.0/24 to any app Samba"
7851
msgstr ""
7852
7853
#: serverguide/C/security.xml:561(para)
7854
msgid ""
7855
"Replace <emphasis>Samba</emphasis> and <emphasis>192.168.0.0/24</emphasis> "
7856
"with the application profile you are using and the IP range for your network."
7857
msgstr ""
7858
7859
#: serverguide/C/security.xml:567(para)
7860
msgid ""
7861
"There is no need to specify the <emphasis>protocol</emphasis> for the "
7862
"application, because that information is detailed in the profile. Also, note "
7863
"that the <emphasis>app</emphasis> name replaces the "
7864
"<emphasis>port</emphasis> number."
7865
msgstr ""
7866
7867
#: serverguide/C/security.xml:576(para)
7868
msgid ""
7869
"To view details about which ports, protocols, etc are defined for an "
7870
"application, enter:"
7871
msgstr ""
7872
7873
#: serverguide/C/security.xml:581(command)
7874
msgid "sudo ufw app info Samba"
7875
msgstr ""
7876
7877
#: serverguide/C/security.xml:587(para)
7878
msgid ""
7879
"Not all applications that require opening a network port come with "
7880
"<application>ufw</application> profiles, but if you have profiled an "
7881
"application and want the file to be included with the package, please file a "
7882
"bug against the package in <ulink "
7883
"url=\"https://launchpad.net/\">Launchpad</ulink>."
7884
msgstr ""
7885
7886
#: serverguide/C/security.xml:596(title)
7887
msgid "IP Masquerading"
7888
msgstr ""
7889
7890
#: serverguide/C/security.xml:597(para)
7891
msgid ""
7892
"The purpose of IP Masquerading is to allow machines with private, non-"
7893
"routable IP addresses on your network to access the Internet through the "
7894
"machine doing the masquerading. Traffic from your private network destined "
7895
"for the Internet must be manipulated for replies to be routable back to the "
7896
"machine that made the request. To do this, the kernel must modify the "
7897
"<emphasis>source</emphasis> IP address of each packet so that replies will "
7898
"be routed back to it, rather than to the private IP address that made the "
7899
"request, which is impossible over the Internet. Linux uses "
7900
"<emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which "
7901
"connections belong to which machines and reroute each return packet "
7902
"accordingly. Traffic leaving your private network is thus \"masqueraded\" as "
7903
"having originated from your Ubuntu gateway machine. This process is referred "
7904
"to in Microsoft documentation as Internet Connection Sharing."
7905
msgstr ""
7906
"IP 偽裝的目的是為了允許您網路上那些有著私有的、不可路由的IP地址的機器可以通過做偽裝的機器訪問Internet。來自您私有網路並要訪問 "
7907
"Internet的傳輸必須是可以manipulated的，也就是說回復要可以被路由回來以送到發出請求的機器上。要做到這一點，內核必須修改<emphasis"
7908
">source</emphasis> IP地址以便回復能被路由回它這裡，而不是發出請求的私有IP地址，因為它們對於Internet來說是不存在的。 "
7909
"Linux使用<emphasis>Connection Tracking</emphasis> "
7910
"(conntrack)以掌握其中的連接屬於哪個機器和每一個新創公司的回報包。交通，讓你的專用網路，因此\" masqueraded \" "
7911
"，有來自你的Ubuntu gateway機器。這個過程是指在微軟的文件作為Internet連接共享。"
7912
7913
#: serverguide/C/security.xml:613(title)
7914
msgid "ufw Masquerading"
7915
msgstr ""
7916
7917
#: serverguide/C/security.xml:614(para)
7918
msgid ""
7919
"IP Masquerading can be achieved using custom <application>ufw</application> "
7920
"rules. This is possible because the current back-end for "
7921
"<application>ufw</application> is <application>iptables-"
7922
"restore</application> with the rules files located in "
7923
"<filename>/etc/ufw/*.rules</filename>. These files are a great place to add "
7924
"legacy iptables rules used without <application>ufw</application>, and rules "
7925
"that are more network gateway or bridge related."
7926
msgstr ""
7927
7928
#: serverguide/C/security.xml:620(para)
7929
msgid ""
7930
"The rules are split into two different files, rules that should be executed "
7931
"before <application>ufw</application> command line rules, and rules that are "
7932
"executed after <application>ufw</application> command line rules."
7933
msgstr ""
7934
7935
#: serverguide/C/security.xml:626(para)
7936
msgid ""
7937
"First, packet forwarding needs to be enabled in "
7938
"<application>ufw</application>. Two configuration files will need to be "
7939
"adjusted, in <filename>/etc/default/ufw</filename> change the "
7940
"<emphasis>DEFAULT_FORWARD_POLICY</emphasis> to <quote>ACCEPT</quote>:"
7941
msgstr ""
7942
7943
#: serverguide/C/security.xml:630(programlisting)
7944
#, no-wrap
7945
msgid ""
7946
"\n"
7947
"DEFAULT_FORWARD_POLICY=\"ACCEPT\"\n"
7948
msgstr ""
7949
7950
#: serverguide/C/security.xml:633(para)
7951
msgid "Then edit <filename>/etc/ufw/sysctl.conf</filename> and uncomment:"
7952
msgstr ""
7953
7954
#: serverguide/C/security.xml:636(programlisting)
7955
#, no-wrap
7956
msgid ""
7957
"\n"
7958
"net/ipv4/ip_forward=1\n"
7959
msgstr ""
7960
7961
#: serverguide/C/security.xml:639(para)
7962
msgid "Similarly, for IPv6 forwarding uncomment:"
7963
msgstr ""
7964
7965
#: serverguide/C/security.xml:642(programlisting)
7966
#, no-wrap
7967
msgid ""
7968
"\n"
7969
"net/ipv6/conf/default/forwarding=1\n"
7970
msgstr ""
7971
7972
#: serverguide/C/security.xml:647(para)
7973
msgid ""
7974
"Now we will add rules to the <filename>/etc/ufw/before.rules</filename> "
7975
"file. The default rules only configure the <emphasis>filter</emphasis> "
7976
"table, and to enable masquerading the <emphasis>nat</emphasis> table will "
7977
"need to be configured. Add the following to the top of the file just after "
7978
"the header comments:"
7979
msgstr ""
7980
7981
#: serverguide/C/security.xml:652(programlisting)
7982
#, no-wrap
7983
msgid ""
7984
"\n"
7985
"# nat Table rules\n"
7986
"*nat\n"
7987
":POSTROUTING ACCEPT [0:0]\n"
7988
"\n"
7989
"# Forward traffic from eth1 through eth0.\n"
7990
"-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE\n"
7991
"\n"
7992
"# don't delete the 'COMMIT' line or these nat table rules won't be "
7993
"processed\n"
7994
"COMMIT\n"
7995
msgstr ""
7996
7997
#: serverguide/C/security.xml:663(para)
7998
msgid ""
7999
"The comments are not strictly necessary, but it is considered good practice "
8000
"to document your configuration. Also, when modifying any of the "
8001
"<emphasis>rules</emphasis> files in <filename "
8002
"class=\"directory\">/etc/ufw</filename>, make sure these lines are the last "
8003
"line for each table modified:"
8004
msgstr ""
8005
8006
#: serverguide/C/security.xml:669(programlisting)
8007
#, no-wrap
8008
msgid ""
8009
"\n"
8010
"# don't delete the 'COMMIT' line or these rules won't be processed\n"
8011
"COMMIT\n"
8012
msgstr ""
8013
8014
#: serverguide/C/security.xml:674(para)
8015
msgid ""
8016
"For each <emphasis>Table</emphasis> a corresponding "
8017
"<emphasis>COMMIT</emphasis> statement is required. In these examples only "
8018
"the <emphasis>nat</emphasis> and <emphasis>filter</emphasis> tables are "
8019
"shown, but you can also add rules for the <emphasis>raw</emphasis> and "
8020
"<emphasis>mangle</emphasis> tables."
8021
msgstr ""
8022
8023
#: serverguide/C/security.xml:681(para)
8024
msgid ""
8025
"In the above example replace <emphasis>eth0</emphasis>, "
8026
"<emphasis>eth1</emphasis>, and <emphasis>192.168.0.0/24</emphasis> with the "
8027
"appropriate interfaces and IP range for your network."
8028
msgstr ""
8029
8030
#: serverguide/C/security.xml:689(para)
8031
msgid ""
8032
"Finally, disable and re-enable <application>ufw</application> to apply the "
8033
"changes:"
8034
msgstr ""
8035
8036
#: serverguide/C/security.xml:693(command)
8037
msgid "sudo ufw disable && sudo ufw enable"
8038
msgstr ""
8039
8040
#: serverguide/C/security.xml:697(para)
8041
msgid ""
8042
"IP Masquerading should now be enabled. You can also add any additional "
8043
"FORWARD rules to the <filename>/etc/ufw/before.rules</filename>. It is "
8044
"recommended that these additional rules be added to the <emphasis>ufw-before-"
8045
"forward</emphasis> chain."
8046
msgstr ""
8047
8048
#: serverguide/C/security.xml:704(title)
8049
msgid "iptables Masquerading"
8050
msgstr ""
8051
8052
#: serverguide/C/security.xml:705(para)
8053
msgid ""
8054
"<application>iptables</application> can also be used to enable masquerading."
8055
msgstr ""
8056
8057
#: serverguide/C/security.xml:710(para)
8058
msgid ""
8059
"Similar to <application>ufw</application>, the first step is to enable IPv4 "
8060
"packet forwarding by editing <filename>/etc/sysctl.conf</filename> and "
8061
"uncomment the following line"
8062
msgstr ""
8063
8064
#: serverguide/C/security.xml:714(programlisting)
8065
#, no-wrap
8066
msgid ""
8067
"\n"
8068
"net.ipv4.ip_forward=1\n"
8069
msgstr ""
8070
8071
#: serverguide/C/security.xml:717(para)
8072
msgid "If you wish to enable IPv6 forwarding also uncomment:"
8073
msgstr ""
8074
8075
#: serverguide/C/security.xml:720(programlisting)
8076
#, no-wrap
8077
msgid ""
8078
"\n"
8079
"net.ipv6.conf.default.forwarding=1\n"
8080
msgstr ""
8081
8082
#: serverguide/C/security.xml:725(para)
8083
msgid ""
8084
"Next, execute the <application>sysctl</application> command to enable the "
8085
"new settings in the configuration file:"
8086
msgstr ""
8087
8088
#: serverguide/C/security.xml:729(command)
8089
msgid "sudo sysctl -p"
8090
msgstr ""
8091
8092
#: serverguide/C/security.xml:733(para)
8093
msgid ""
8094
"IP Masquerading can now be accomplished with a single iptables rule, which "
8095
"may differ slightly based on your network configuration:"
8096
msgstr ""
8097
8098
#: serverguide/C/security.xml:736(screen)
8099
#, no-wrap
8100
msgid ""
8101
"\n"
8102
"sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8103
msgstr ""
8104
8105
#: serverguide/C/security.xml:739(para)
8106
msgid ""
8107
"The above command assumes that your private address space is 192.168.0.0/16 "
8108
"and that your Internet-facing device is ppp0. The syntax is broken down as "
8109
"follows:"
8110
msgstr ""
8111
8112
#: serverguide/C/security.xml:744(para)
8113
msgid "-t nat -- the rule is to go into the nat table"
8114
msgstr ""
8115
8116
#: serverguide/C/security.xml:745(para)
8117
msgid ""
8118
"-A POSTROUTING -- the rule is to be appended (-A) to the POSTROUTING chain"
8119
msgstr ""
8120
8121
#: serverguide/C/security.xml:746(para)
8122
msgid ""
8123
"-s 192.168.0.0/16 -- the rule applies to traffic originating from the "
8124
"specified address space"
8125
msgstr ""
8126
8127
#: serverguide/C/security.xml:747(para)
8128
msgid ""
8129
"-o ppp0 -- the rule applies to traffic scheduled to be routed through the "
8130
"specified network device"
8131
msgstr ""
8132
8133
#: serverguide/C/security.xml:749(para)
8134
msgid ""
8135
"-j MASQUERADE -- traffic matching this rule is to \"jump\" (-j) to the "
8136
"MASQUERADE target to be manipulated as described above"
8137
msgstr ""
8138
8139
#: serverguide/C/security.xml:757(para)
8140
msgid ""
8141
"Also, each chain in the filter table (the default table, and where most or "
8142
"all packet filtering occurs) has a default <emphasis>policy</emphasis> of "
8143
"ACCEPT, but if you are creating a firewall in addition to a gateway device, "
8144
"you may have set the policies to DROP or REJECT, in which case your "
8145
"masqueraded traffic needs to be allowed through the FORWARD chain for the "
8146
"above rule to work:"
8147
msgstr ""
8148
8149
#: serverguide/C/security.xml:764(screen)
8150
#, no-wrap
8151
msgid ""
8152
"\n"
8153
"sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT\n"
8154
"sudo iptables -A FORWARD -d 192.168.0.0/16 -m state --state "
8155
"ESTABLISHED,RELATED -i ppp0 -j ACCEPT\n"
8156
msgstr ""
8157
8158
#: serverguide/C/security.xml:768(para)
8159
msgid ""
8160
"The above commands will allow all connections from your local network to the "
8161
"Internet and all traffic related to those connections to return to the "
8162
"machine that initiated them."
8163
msgstr ""
8164
8165
#: serverguide/C/security.xml:775(para)
8166
msgid ""
8167
"If you want masquerading to be enabled on reboot, which you probably do, "
8168
"edit <filename>/etc/rc.local</filename> and add any commands used above. For "
8169
"example add the first command with no filtering:"
8170
msgstr ""
8171
8172
#: serverguide/C/security.xml:779(screen)
8173
#, no-wrap
8174
msgid ""
8175
"\n"
8176
"iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE\n"
8177
msgstr ""
8178
8179
#: serverguide/C/security.xml:787(title)
8180
msgid "Logs"
8181
msgstr ""
8182
8183
#: serverguide/C/security.xml:788(para)
8184
msgid ""
8185
"Firewall logs are essential for recognizing attacks, troubleshooting your "
8186
"firewall rules, and noticing unusual activity on your network. You must "
8187
"include logging rules in your firewall for them to be generated, though, and "
8188
"logging rules must come before any applicable terminating rule (a rule with "
8189
"a target that decides the fate of the packet, such as ACCEPT, DROP, or "
8190
"REJECT)."
8191
msgstr ""
8192
8193
#: serverguide/C/security.xml:795(para)
8194
msgid ""
8195
"If you are using <application>ufw</application>, you can turn on logging by "
8196
"entering the following in a terminal:"
8197
msgstr ""
8198
8199
#: serverguide/C/security.xml:799(command)
8200
msgid "sudo ufw logging on"
8201
msgstr ""
8202
8203
#: serverguide/C/security.xml:801(para)
8204
msgid ""
8205
"To turn logging off in <application>ufw</application>, simply replace "
8206
"<emphasis role=\"italic\">on</emphasis> with <emphasis "
8207
"role=\"italic\">off</emphasis> in the above command."
8208
msgstr ""
8209
8210
#: serverguide/C/security.xml:804(para)
8211
msgid ""
8212
"If using <application>iptables</application> instead of "
8213
"<application>ufw</application>, enter:"
8214
msgstr ""
8215
8216
#: serverguide/C/security.xml:807(screen)
8217
#, no-wrap
8218
msgid ""
8219
"\n"
8220
"sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j LOG --log-"
8221
"prefix \"NEW_HTTP_CONN: \"\n"
8222
msgstr ""
8223
8224
#: serverguide/C/security.xml:810(para)
8225
msgid ""
8226
"A request on port 80 from the local machine, then, would generate a log in "
8227
"dmesg that looks like this:"
8228
msgstr ""
8229
8230
#: serverguide/C/security.xml:815(programlisting)
8231
#, no-wrap
8232
msgid ""
8233
"[4304885.870000] NEW_HTTP_CONN: IN=lo OUT= "
8234
"MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 "
8235
"LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=58288 DF PROTO=TCP SPT=53981 DPT=80 "
8236
"WINDOW=32767 RES=0x00 SYN URGP=0"
8237
msgstr ""
8238
8239
#: serverguide/C/security.xml:817(para)
8240
msgid ""
8241
"The above log will also appear in <filename>/var/log/messages</filename>, "
8242
"<filename>/var/log/syslog</filename>, and "
8243
"<filename>/var/log/kern.log</filename>. This behavior can be modified by "
8244
"editing <filename>/etc/syslog.conf</filename> appropriately or by installing "
8245
"and configuring <application>ulogd</application> and using the ULOG target "
8246
"instead of LOG. The <application>ulogd</application> daemon is a userspace "
8247
"server that listens for logging instructions from the kernel specifically "
8248
"for firewalls, and can log to any file you like, or even to a "
8249
"<application>PostgreSQL</application> or <application>MySQL</application> "
8250
"database. Making sense of your firewall logs can be simplified by using a "
8251
"log analyzing tool such as <application>fwanalog</application>, "
8252
"<application> fwlogwatch</application>, or <application>lire</application>."
8253
msgstr ""
8254
8255
#: serverguide/C/security.xml:832(title)
8256
msgid "Other Tools"
8257
msgstr ""
8258
8259
#: serverguide/C/security.xml:833(para)
8260
msgid ""
8261
"There are many tools available to help you construct a complete firewall "
8262
"without intimate knowledge of iptables. For the GUI-inclined:"
8263
msgstr ""
8264
8265
#: serverguide/C/security.xml:839(para)
8266
msgid ""
8267
"<ulink url=\"http://www.fs-security.com/\">Firestarter</ulink> is quite "
8268
"popular and easy to use."
8269
msgstr ""
8270
8271
#: serverguide/C/security.xml:844(para)
8272
msgid ""
8273
"<ulink url=\"http://www.fwbuilder.org/\">fwbuilder</ulink> is very powerful "
8274
"and will look familiar to an administrator who has used a commercial "
8275
"firewall utility such as <application>Checkpoint FireWall-1</application>."
8276
msgstr ""
8277
8278
#: serverguide/C/security.xml:850(para)
8279
msgid ""
8280
"If you prefer a command-line tool with plain-text configuration files:"
8281
msgstr ""
8282
8283
#: serverguide/C/security.xml:855(para)
8284
msgid ""
8285
"<ulink url=\"http://www.shorewall.net/\">Shorewall</ulink> is a very "
8286
"powerful solution to help you configure an advanced firewall for any network."
8287
msgstr ""
8288
8289
#: serverguide/C/security.xml:861(para)
8290
msgid ""
8291
"<ulink url=\"http://www.linuxkungfu.org/\">ipkungfu</ulink> should give you "
8292
"a working firewall \"out of the box\" with zero configuration, and will "
8293
"allow you to easily set up a more advanced firewall by editing simple, well-"
8294
"documented configuration files."
8295
msgstr ""
8296
8297
#: serverguide/C/security.xml:868(para)
8298
msgid ""
8299
"<ulink url=\"http://fireflier.sourceforge.net/\">fireflier</ulink> is "
8300
"designed to be a desktop firewall application. It is made up of a server "
8301
"(fireflier-server) and your choice of GUI clients (GTK or QT), and behaves "
8302
"like many popular interactive firewall applications for Windows."
8303
msgstr ""
8304
8305
#: serverguide/C/security.xml:880(para)
8306
msgid ""
8307
"The <ulink url=\"https://wiki.ubuntu.com/UbuntuFirewall\">Ubuntu "
8308
"Firewall</ulink> wiki page contains information on the development of "
8309
"<application>ufw</application>."
8310
msgstr ""
8311
8312
#: serverguide/C/security.xml:886(para)
8313
msgid ""
8314
"Also, the <application>ufw</application> manual page contains some very "
8315
"useful information: <command>man ufw</command>."
8316
msgstr ""
8317
8318
#: serverguide/C/security.xml:891(para)
8319
msgid ""
8320
"See the <ulink url=\"http://www.netfilter.org/documentation/HOWTO/packet-"
8321
"filtering-HOWTO.html\">packet-filtering-HOWTO</ulink> for more information "
8322
"on using <application>iptables</application>."
8323
msgstr ""
8324
8325
#: serverguide/C/security.xml:897(para)
8326
msgid ""
8327
"The <ulink url=\"http://www.netfilter.org/documentation/HOWTO/NAT-"
8328
"HOWTO.html\">nat-HOWTO</ulink> contains further details on masquerading."
8329
msgstr ""
8330
8331
#: serverguide/C/security.xml:903(para)
8332
msgid ""
8333
"The <ulink url=\"https://help.ubuntu.com/community/IptablesHowTo\">IPTables "
8334
"HowTo</ulink> in the Ubuntu wiki is a great resource."
8335
msgstr ""
8336
8337
#: serverguide/C/security.xml:911(title)
8338
msgid "AppArmor"
8339
msgstr ""
8340
8341
#: serverguide/C/security.xml:912(para)
8342
msgid ""
8343
"<application>AppArmor</application> is a Linux Security Module "
8344
"implementation of name-based mandatory access controls. AppArmor confines "
8345
"individual programs to a set of listed files and posix 1003.1e draft "
8346
"capabilities."
8347
msgstr ""
8348
8349
#: serverguide/C/security.xml:916(para)
8350
msgid ""
8351
"<application>AppArmor</application> is installed and loaded by default. It "
8352
"uses <emphasis>profiles</emphasis> of an application to determine what files "
8353
"and permissions the application requires. Some packages will install their "
8354
"own profiles, and additional profiles can be found in the "
8355
"<application>apparmor-profiles</application> package."
8356
msgstr ""
8357
8358
#: serverguide/C/security.xml:921(para)
8359
msgid ""
8360
"To install the <application>apparmor-profiles</application> package from a "
8361
"terminal prompt:"
8362
msgstr ""
8363
8364
#: serverguide/C/security.xml:927(para)
8365
msgid "AppArmor profiles have two modes of execution:"
8366
msgstr ""
8367
8368
#: serverguide/C/security.xml:932(para)
8369
msgid ""
8370
"Complaining/Learning: profile violations are permitted and logged. Useful "
8371
"for testing and developing new profiles."
8372
msgstr ""
8373
8374
#: serverguide/C/security.xml:937(para)
8375
msgid ""
8376
"Enforced/Confined: enforces profile policy as well as logging the violation."
8377
msgstr ""
8378
8379
#: serverguide/C/security.xml:943(title)
8380
msgid "Using AppArmor"
8381
msgstr ""
8382
8383
#: serverguide/C/security.xml:944(para)
8384
msgid ""
8385
"The <application>apparmor-utils</application> package contains command line "
8386
"utilities that you can use to change the <application>AppArmor</application> "
8387
"execution mode, find the status of a profile, create new profiles, etc."
8388
msgstr ""
8389
8390
#: serverguide/C/security.xml:950(para)
8391
msgid ""
8392
"<application>apparmor_status</application> is used to view the current "
8393
"status of AppArmor profiles."
8394
msgstr ""
8395
8396
#: serverguide/C/security.xml:954(command)
8397
msgid "sudo apparmor_status"
8398
msgstr ""
8399
8400
#: serverguide/C/security.xml:958(para)
8401
msgid ""
8402
"<application>aa-complain</application> places a profile into "
8403
"<emphasis>complain</emphasis> mode."
8404
msgstr ""
8405
8406
#: serverguide/C/security.xml:962(command)
8407
msgid "sudo aa-complain /path/to/bin"
8408
msgstr ""
8409
8410
#: serverguide/C/security.xml:966(para)
8411
msgid ""
8412
"<application>aa-enforce</application> places a profile into "
8413
"<emphasis>enforce</emphasis> mode."
8414
msgstr ""
8415
8416
#: serverguide/C/security.xml:970(command)
8417
msgid "sudo aa-enforce /path/to/bin"
8418
msgstr ""
8419
8420
#: serverguide/C/security.xml:974(para)
8421
msgid ""
8422
"The <filename>/etc/apparmor.d</filename> directory is where the AppArmor "
8423
"profiles are located. It can be used to manipulate the "
8424
"<emphasis>mode</emphasis> of all profiles."
8425
msgstr ""
8426
8427
#: serverguide/C/security.xml:978(para)
8428
msgid "Enter the following to place all profiles into complain mode:"
8429
msgstr ""
8430
8431
#: serverguide/C/security.xml:982(command)
8432
msgid "sudo aa-complain /etc/apparmor.d/*"
8433
msgstr ""
8434
8435
#: serverguide/C/security.xml:984(para)
8436
msgid "To place all profiles in enforce mode:"
8437
msgstr ""
8438
8439
#: serverguide/C/security.xml:988(command)
8440
msgid "sudo aa-enforce /etc/apparmor.d/*"
8441
msgstr ""
8442
8443
#: serverguide/C/security.xml:992(para)
8444
msgid ""
8445
"<application>apparmor_parser</application> is used to load a profile into "
8446
"the kernel. It can also be used to reload a currently loaded profile using "
8447
"the <emphasis>-r</emphasis> option. To load a profile:"
8448
msgstr ""
8449
8450
#: serverguide/C/security.xml:997(command) serverguide/C/security.xml:1029(command)
8451
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -a"
8452
msgstr ""
8453
8454
#: serverguide/C/security.xml:999(para)
8455
msgid "To reload a profile:"
8456
msgstr ""
8457
8458
#: serverguide/C/security.xml:1003(command)
8459
msgid "cat /etc/apparmor.d/profile.name | sudo apparmor_parser -r"
8460
msgstr ""
8461
8462
#: serverguide/C/security.xml:1007(para)
8463
msgid ""
8464
"<filename>/etc/init.d/apparmor</filename> can be used to "
8465
"<emphasis>reload</emphasis> all profiles:"
8466
msgstr ""
8467
8468
#: serverguide/C/security.xml:1011(command) serverguide/C/network-auth.xml:632(command)
8469
msgid "sudo /etc/init.d/apparmor reload"
8470
msgstr ""
8471
8472
#: serverguide/C/security.xml:1015(para)
8473
msgid ""
8474
"The <filename>/etc/apparmor.d/disable</filename> directory can be used along "
8475
"with the <application>apparmor_parser -R</application> option to "
8476
"<emphasis>disable</emphasis> a profile."
8477
msgstr ""
8478
8479
#: serverguide/C/security.xml:1020(command)
8480
msgid "sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/"
8481
msgstr ""
8482
8483
#: serverguide/C/security.xml:1021(command)
8484
msgid "sudo apparmor_parser -R /etc/apparmor.d/profile.name"
8485
msgstr ""
8486
8487
#: serverguide/C/security.xml:1023(para)
8488
msgid ""
8489
"To <emphasis>re-enable</emphasis> a disabled profile remove the symbolic "
8490
"link to the profile in <filename>/etc/apparmor.d/disable/</filename>. Then "
8491
"load the profile using the <emphasis>-a</emphasis> option."
8492
msgstr ""
8493
8494
#: serverguide/C/security.xml:1028(command)
8495
msgid "sudo rm /etc/apparmor.d/disable/profile.name"
8496
msgstr ""
8497
8498
#: serverguide/C/security.xml:1033(para)
8499
msgid ""
8500
"<application>AppArmor</application> can be disabled, and the kernel module "
8501
"unloaded by entering the following:"
8502
msgstr ""
8503
8504
#: serverguide/C/security.xml:1037(command)
8505
msgid "sudo /etc/init.d/apparmor stop"
8506
msgstr ""
8507
8508
#: serverguide/C/security.xml:1038(command)
8509
msgid "sudo update-rc.d -f apparmor remove"
8510
msgstr ""
8511
8512
#: serverguide/C/security.xml:1042(para)
8513
msgid "To re-enable <application>AppArmor</application> enter:"
8514
msgstr ""
8515
8516
#: serverguide/C/security.xml:1046(command)
8517
msgid "sudo /etc/init.d/apparmor start"
8518
msgstr ""
8519
8520
#: serverguide/C/security.xml:1047(command)
8521
msgid "sudo update-rc.d apparmor defaults"
8522
msgstr ""
8523
8524
#: serverguide/C/security.xml:1052(para)
8525
msgid ""
8526
"Replace <emphasis>profile.name</emphasis> with the name of the profile you "
8527
"want to manipulate. Also, replace <filename>/path/to/bin/</filename> with "
8528
"the actual executable file path. For example for the "
8529
"<application>ping</application> command use <filename>/bin/ping</filename>"
8530
msgstr ""
8531
8532
#: serverguide/C/security.xml:1060(title)
8533
msgid "Profiles"
8534
msgstr ""
8535
8536
#: serverguide/C/security.xml:1061(para)
8537
msgid ""
8538
"<application>AppArmor</application> profiles are simple text files located "
8539
"in <filename>/etc/apparmor.d/</filename>. The files are named after the full "
8540
"path to the executable they profile replacing the \"/\" with \".\". For "
8541
"example <filename>/etc/apparmor.d/bin.ping</filename> is the AppArmor "
8542
"profile for the <filename>/bin/ping</filename> command."
8543
msgstr ""
8544
8545
#: serverguide/C/security.xml:1067(para)
8546
msgid "There are two main type of rules used in profiles:"
8547
msgstr ""
8548
8549
#: serverguide/C/security.xml:1072(para)
8550
msgid ""
8551
"<emphasis>Path entries:</emphasis> which detail which files an application "
8552
"can access in the file system."
8553
msgstr ""
8554
8555
#: serverguide/C/security.xml:1077(para)
8556
msgid ""
8557
"<emphasis>Capability entries:</emphasis> determine what privileges a "
8558
"confined process is allowed to use."
8559
msgstr ""
8560
8561
#: serverguide/C/security.xml:1082(para)
8562
msgid ""
8563
"As an example take a look at <filename>/etc/apparmor.d/bin.ping</filename>:"
8564
msgstr ""
8565
8566
#: serverguide/C/security.xml:1085(programlisting)
8567
#, no-wrap
8568
msgid ""
8569
"\n"
8570
"#include <tunables/global>\n"
8571
"/bin/ping flags=(complain) {\n"
8572
" #include <abstractions/base>\n"
8573
" #include <abstractions/consoles>\n"
8574
" #include <abstractions/nameservice>\n"
8575
"\n"
8576
" capability net_raw,\n"
8577
" capability setuid,\n"
8578
" network inet raw,\n"
8579
" \n"
8580
" /bin/ping mixr,\n"
8581
" /etc/modules.conf r,\n"
8582
"}\n"
8583
msgstr ""
8584
8585
#: serverguide/C/security.xml:1102(para)
8586
msgid ""
8587
"<emphasis>#include <tunables/global>:</emphasis> include statements "
8588
"from other files. This allows statements pertaining to multiple applications "
8589
"to be placed in a common file."
8590
msgstr ""
8591
8592
#: serverguide/C/security.xml:1108(para)
8593
msgid ""
8594
"<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled "
8595
"program, also setting the mode to <emphasis>complain</emphasis>."
8596
msgstr ""
8597
8598
#: serverguide/C/security.xml:1114(para)
8599
msgid ""
8600
"<emphasis>capability net_raw,:</emphasis> allows the application access to "
8601
"the CAP_NET_RAW Posix.1e capability."
8602
msgstr ""
8603
8604
#: serverguide/C/security.xml:1119(para)
8605
msgid ""
8606
"<emphasis>/bin/ping mixr,:</emphasis> allows the application read and "
8607
"execute access to the file."
8608
msgstr ""
8609
8610
#: serverguide/C/security.xml:1125(para)
8611
msgid ""
8612
"After editing a profile file the profile must be reloaded. See <xref "
8613
"linkend=\"apparmor-usage\"/> for details."
8614
msgstr ""
8615
8616
#: serverguide/C/security.xml:1130(title)
8617
msgid "Creating a Profile"
8618
msgstr ""
8619
8620
#: serverguide/C/security.xml:1133(para)
8621
msgid ""
8622
"<emphasis>Design a test plan:</emphasis> Try to think about how the "
8623
"application should be exercised. The test plan should be divided into small "
8624
"test cases. Each test case should have a small description and list the "
8625
"steps to follow."
8626
msgstr ""
8627
8628
#: serverguide/C/security.xml:1137(para)
8629
msgid "Some standard test cases are:"
8630
msgstr ""
8631
8632
#: serverguide/C/security.xml:1142(para)
8633
msgid "Starting the program."
8634
msgstr ""
8635
8636
#: serverguide/C/security.xml:1147(para)
8637
msgid "Stopping the program."
8638
msgstr ""
8639
8640
#: serverguide/C/security.xml:1152(para)
8641
msgid "Reloading the program."
8642
msgstr ""
8643
8644
#: serverguide/C/security.xml:1157(para)
8645
msgid "Testing all the commands supported by the init script."
8646
msgstr ""
8647
8648
#: serverguide/C/security.xml:1164(para)
8649
msgid ""
8650
"<emphasis>Generate the new profile:</emphasis> Use <application>aa-"
8651
"genprof</application> to generate a new profile. From a terminal:"
8652
msgstr ""
8653
8654
#: serverguide/C/security.xml:1169(command)
8655
msgid "sudo aa-genprof executable"
8656
msgstr ""
8657
8658
#: serverguide/C/security.xml:1171(para)
8659
msgid "For example:"
8660
msgstr ""
8661
8662
#: serverguide/C/security.xml:1175(command)
8663
msgid "sudo aa-genprof slapd"
8664
msgstr ""
8665
8666
#: serverguide/C/security.xml:1179(para)
8667
msgid ""
8668
"To get your new profile included in the <application>apparmor-"
8669
"profiles</application> package, file a bug in <emphasis>Launchpad</emphasis> "
8670
"against the <ulink "
8671
"url=\"https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug\">AppArmor<"
8672
"/ulink> package:"
8673
msgstr ""
8674
8675
#: serverguide/C/security.xml:1186(para)
8676
msgid "Include your test plan and test cases."
8677
msgstr ""
8678
8679
#: serverguide/C/security.xml:1191(para)
8680
msgid "Attach your new profile to the bug."
8681
msgstr ""
8682
8683
#: serverguide/C/security.xml:1200(title)
8684
msgid "Updating Profiles"
8685
msgstr ""
8686
8687
#: serverguide/C/security.xml:1201(para)
8688
msgid ""
8689
"When the program is misbehaving, audit messages are sent to the log files. "
8690
"The program <application>aa-logprof</application> can be used to scan log "
8691
"files for <application>AppArmor</application> audit messages, review them "
8692
"and update the profiles. From a terminal:"
8693
msgstr ""
8694
8695
#: serverguide/C/security.xml:1206(command)
8696
msgid "sudo aa-logprof"
8697
msgstr ""
8698
8699
#: serverguide/C/security.xml:1214(para)
8700
msgid ""
8701
"See the <ulink "
8702
"url=\"http://www.novell.com/documentation/apparmor/apparmor201_sp10_admin/ind"
8703
"ex.html?page=/documentation/apparmor/apparmor201_sp10_admin/data/book_apparmo"
8704
"r_admin.html\">AppArmor Administration Guide</ulink> for advanced "
8705
"configuration options."
8706
msgstr ""
8707
8708
#: serverguide/C/security.xml:1221(para)
8709
msgid ""
8710
"For details using AppArmor with other Ubuntu releases see the <ulink "
8711
"url=\"https://help.ubuntu.com/community/AppArmor\"> AppArmor Community "
8712
"Wiki</ulink> page."
8713
msgstr ""
8714
8715
#: serverguide/C/security.xml:1229(para)
8716
msgid ""
8717
"The <ulink url=\"http://en.opensuse.org/AppArmor\">OpenSUSE AppArmor</ulink> "
8718
"page is another introduction to AppArmor."
8719
msgstr ""
8720
8721
#: serverguide/C/security.xml:1236(para)
8722
msgid ""
8723
"A great place to ask for <application>AppArmor</application> assistance, and "
8724
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
8725
"server</emphasis> IRC channel on <ulink "
8726
"url=\"http://freenode.net\">freenode</ulink>."
8727
msgstr ""
8728
8729
#: serverguide/C/security.xml:1246(title)
8730
msgid "Certificates"
8731
msgstr ""
8732
8733
#: serverguide/C/security.xml:1247(para)
8734
msgid ""
8735
"One of the most common forms of cryptography today is <emphasis>public-"
8736
"key</emphasis> cryptography. Public-key cryptography utilizes a "
8737
"<emphasis>public key</emphasis> and a <emphasis>private key</emphasis>. The "
8738
"system works by <emphasis>encrypting</emphasis> information using the public "
8739
"key. The information can then only be <emphasis>decrypted</emphasis> using "
8740
"the private key."
8741
msgstr ""
8742
8743
#: serverguide/C/security.xml:1253(para)
8744
msgid ""
8745
"A common use for public-key cryptography is encrypting application traffic "
8746
"using a Secure Socket Layer (SSL) or Transport Layer Security (TLS) "
8747
"connection. For example, configuring Apache to provide "
8748
"<emphasis>HTTPS</emphasis>, the HTTP protocol over SSL. This allows a way to "
8749
"encrypt traffic using a protocol that does not itself provide encryption."
8750
msgstr ""
8751
8752
#: serverguide/C/security.xml:1258(para)
8753
msgid ""
8754
"A <emphasis>Certificate</emphasis> is a method used to distribute a "
8755
"<emphasis>public key</emphasis> and other information about a server and the "
8756
"organization who is responsible for it. Certificates can be digitally signed "
8757
"by a <emphasis>Certification Authority</emphasis> or CA. A CA is a trusted "
8758
"third party that has confirmed that the information contained in the "
8759
"certificate is accurate."
8760
msgstr ""
8761
8762
#: serverguide/C/security.xml:1265(title)
8763
msgid "Types of Certificates"
8764
msgstr ""
8765
8766
#: serverguide/C/security.xml:1266(para)
8767
msgid ""
8768
"To set up a secure server using public-key cryptography, in most cases, you "
8769
"send your certificate request (including your public key), proof of your "
8770
"company's identity, and payment to a CA. The CA verifies the certificate "
8771
"request and your identity, and then sends back a certificate for your secure "
8772
"server. Alternatively, you can create your own <emphasis>self-"
8773
"signed</emphasis> certificate."
8774
msgstr ""
8775
8776
#: serverguide/C/security.xml:1276(para)
8777
msgid ""
8778
"Note, that self-signed certificates should not be used in most production "
8779
"environments."
8780
msgstr ""
8781
8782
#: serverguide/C/security.xml:1280(para)
8783
msgid ""
8784
"Continuing the HTTPS example, a CA-signed certificate provides two important "
8785
"capabilities that a self-signed certificate does not:"
8786
msgstr ""
8787
8788
#: serverguide/C/security.xml:1287(para)
8789
msgid ""
8790
"Browsers (usually) automatically recognize the certificate and allow a "
8791
"secure connection to be made without prompting the user."
8792
msgstr ""
8793
8794
#: serverguide/C/security.xml:1294(para)
8795
msgid ""
8796
"When a CA issues a signed certificate, it is guaranteeing the identity of "
8797
"the organization that is providing the web pages to the browser."
8798
msgstr ""
8799
8800
#: serverguide/C/security.xml:1302(para)
8801
msgid ""
8802
"Most Web browsers, and computers, that support SSL have a list of CAs whose "
8803
"certificates they automatically accept. If a browser encounters a "
8804
"certificate whose authorizing CA is not in the list, the browser asks the "
8805
"user to either accept or decline the connection. Also, other applications "
8806
"may generate an error message when using a self-singed certificate."
8807
msgstr ""
8808
8809
#: serverguide/C/security.xml:1310(para)
8810
msgid ""
8811
"The process of getting a certificate from a CA is fairly easy. A quick "
8812
"overview is as follows:"
8813
msgstr ""
8814
8815
#: serverguide/C/security.xml:1317(para)
8816
msgid "Create a private and public encryption key pair."
8817
msgstr "創建一個私有和公共密鑰對"
8818
8819
#: serverguide/C/security.xml:1320(para)
8820
msgid ""
8821
"Create a certificate request based on the public key. The certificate "
8822
"request contains information about your server and the company hosting it."
8823
msgstr ""
8824
8825
#: serverguide/C/security.xml:1325(para)
8826
msgid ""
8827
"Send the certificate request, along with documents proving your identity, to "
8828
"a CA. We cannot tell you which certificate authority to choose. Your "
8829
"decision may be based on your past experiences, or on the experiences of "
8830
"your friends or colleagues, or purely on monetary factors."
8831
msgstr ""
8832
8833
#: serverguide/C/security.xml:1331(para)
8834
msgid ""
8835
"Once you have decided upon a CA, you need to follow the instructions they "
8836
"provide on how to obtain a certificate from them."
8837
msgstr ""
8838
8839
#: serverguide/C/security.xml:1336(para)
8840
msgid ""
8841
"When the CA is satisfied that you are indeed who you claim to be, they send "
8842
"you a digital certificate."
8843
msgstr ""
8844
8845
#: serverguide/C/security.xml:1340(para)
8846
msgid ""
8847
"Install this certificate on your secure server, and configure the "
8848
"appropriate applications to use the certificate."
8849
msgstr ""
8850
8851
#: serverguide/C/security.xml:1349(title)
8852
msgid "Generating a Certificate Signing Request (CSR)"
8853
msgstr ""
8854
8855
#: serverguide/C/security.xml:1351(para)
8856
msgid ""
8857
"Whether you are getting a certificate from a CA or generating your own self-"
8858
"signed certificate, the first step is to generate a key."
8859
msgstr "無論您是從一家CA那兒獲得證書或是生成您自己簽署的證書，第一步就是生成鑰匙。"
8860
8861
#: serverguide/C/security.xml:1356(para)
8862
msgid ""
8863
"If the certificate will be used by service daemons, such as Apache, Postfix, "
8864
"Dovecot, etc, a key without a passphrase is often appropriate. Not having a "
8865
"passphrase allows the services to start without manual intervention, usually "
8866
"the preferred way to start a daemon."
8867
msgstr ""
8868
8869
#: serverguide/C/security.xml:1362(para)
8870
msgid ""
8871
"This section will cover generating a key with a passphrase, and one without. "
8872
"The non-passphrase key will then be used to generate a certificate that can "
8873
"be used with various service daemons."
8874
msgstr ""
8875
8876
#: serverguide/C/security.xml:1368(para)
8877
msgid ""
8878
"Running your secure service without a passphrase is convenient because you "
8879
"will not need to enter the passphrase every time you start your secure "
8880
"service. But it is insecure and a compromise of the key means a compromise "
8881
"of the server as well."
8882
msgstr ""
8883
8884
#: serverguide/C/security.xml:1375(para)
8885
msgid ""
8886
"To generate the <emphasis>keys</emphasis> for the Certificate Signing "
8887
"Request (CSR) run the following command from a terminal prompt:"
8888
msgstr ""
8889
8890
#: serverguide/C/security.xml:1381(command)
8891
msgid "openssl genrsa -des3 -out server.key 1024"
8892
msgstr ""
8893
8894
#: serverguide/C/security.xml:1384(programlisting)
8895
#, no-wrap
8896
msgid ""
8897
"\n"
8898
"Generating RSA private key, 1024 bit long modulus\n"
8899
".....................++++++\n"
8900
".................++++++\n"
8901
"unable to write 'random state'\n"
8902
"e is 65537 (0x10001)\n"
8903
"Enter pass phrase for server.key:\n"
8904
msgstr ""
8905
8906
#: serverguide/C/security.xml:1393(para)
8907
msgid ""
8908
"You can now enter your passphrase. For best security, it should at least "
8909
"contain eight characters. The minimum length when specifying -des3 is four "
8910
"characters. It should include numbers and/or punctuation and not be a word "
8911
"in a dictionary. Also remember that your passphrase is case-sensitive."
8912
msgstr ""
8913
8914
#: serverguide/C/security.xml:1401(para)
8915
msgid ""
8916
"Re-type the passphrase to verify. Once you have re-typed it correctly, the "
8917
"server key is generated and stored in the <filename>server.key</filename> "
8918
"file."
8919
msgstr ""
8920
8921
#: serverguide/C/security.xml:1407(para)
8922
msgid ""
8923
"Now create the insecure key, the one without a passphrase, and shuffle the "
8924
"key names:"
8925
msgstr ""
8926
8927
#: serverguide/C/security.xml:1413(command)
8928
msgid "openssl rsa -in server.key -out server.key.insecure"
8929
msgstr ""
8930
8931
#: serverguide/C/security.xml:1414(command)
8932
msgid "mv server.key server.key.secure"
8933
msgstr ""
8934
8935
#: serverguide/C/security.xml:1415(command)
8936
msgid "mv server.key.insecure server.key"
8937
msgstr ""
8938
8939
#: serverguide/C/security.xml:1418(para)
8940
msgid ""
8941
"The insecure key is now named <filename>server.key</filename>, and you can "
8942
"use this file to generate the CSR without passphrase."
8943
msgstr ""
8944
8945
#: serverguide/C/security.xml:1423(para)
8946
msgid "To create the CSR, run the following command at a terminal prompt:"
8947
msgstr ""
8948
8949
#: serverguide/C/security.xml:1428(command)
8950
msgid "openssl req -new -key server.key -out server.csr"
8951
msgstr ""
8952
8953
#: serverguide/C/security.xml:1431(para)
8954
msgid ""
8955
"It will prompt you enter the passphrase. If you enter the correct "
8956
"passphrase, it will prompt you to enter Company Name, Site Name, Email Id, "
8957
"etc. Once you enter all these details, your CSR will be created and it will "
8958
"be stored in the <filename>server.csr</filename> file."
8959
msgstr ""
8960
8961
#: serverguide/C/security.xml:1439(para)
8962
msgid ""
8963
"You can now submit this CSR file to a CA for processing. The CA will use "
8964
"this CSR file and issue the certificate. On the other hand, you can create "
8965
"self-signed certificate using this CSR."
8966
msgstr ""
8967
8968
#: serverguide/C/security.xml:1447(title)
8969
msgid "Creating a Self-Signed Certificate"
8970
msgstr ""
8971
8972
#: serverguide/C/security.xml:1448(para)
8973
msgid ""
8974
"To create the self-signed certificate, run the following command at a "
8975
"terminal prompt:"
8976
msgstr ""
8977
8978
#: serverguide/C/security.xml:1453(command)
8979
msgid ""
8980
"openssl x509 -req -days 365 -in server.csr -signkey server.key -out "
8981
"server.crt"
8982
msgstr ""
8983
8984
#: serverguide/C/security.xml:1456(para)
8985
msgid ""
8986
"The above command will prompt you to enter the passphrase. Once you enter "
8987
"the correct passphrase, your certificate will be created and it will be "
8988
"stored in the <filename>server.crt</filename> file."
8989
msgstr ""
8990
8991
#: serverguide/C/security.xml:1461(para)
8992
msgid ""
8993
"If your secure server is to be used in a production environment, you "
8994
"probably need a CA-signed certificate. It is not recommended to use self-"
8995
"signed certificate."
8996
msgstr ""
8997
8998
#: serverguide/C/security.xml:1469(title)
8999
msgid "Installing the Certificate"
9000
msgstr ""
9001
9002
#: serverguide/C/security.xml:1471(para)
9003
msgid ""
9004
"You can install the key file <filename>server.key</filename> and certificate "
9005
"file <filename>server.crt</filename>, or the certificate file issued by your "
9006
"CA, by running following commands at a terminal prompt:"
9007
msgstr ""
9008
9009
#: serverguide/C/security.xml:1477(command)
9010
msgid "sudo cp server.crt /etc/ssl/certs"
9011
msgstr ""
9012
9013
#: serverguide/C/security.xml:1478(command)
9014
msgid "sudo cp server.key /etc/ssl/private"
9015
msgstr ""
9016
9017
#: serverguide/C/security.xml:1480(para)
9018
msgid ""
9019
"Now simply configure any applications, with the ability to use public-key "
9020
"cryptography, to use the <emphasis>certificate</emphasis> and "
9021
"<emphasis>key</emphasis> files. For example, "
9022
"<application>Apache</application> can provide HTTPS, "
9023
"<application>Dovecot</application> can provide IMAPS and POP3S, etc."
9024
msgstr ""
9025
9026
#: serverguide/C/security.xml:1487(title)
9027
msgid "Certification Authority"
9028
msgstr ""
9029
9030
#: serverguide/C/security.xml:1489(para)
9031
msgid ""
9032
"If the services on your network require more than a few self-signed "
9033
"certificates it may be worth the additional effort to setup your own "
9034
"internal <emphasis>Certification Authority (CA)</emphasis>. Using "
9035
"certificates signed by your own CA, allows the various services using the "
9036
"certificates to easily trust other services using certificates issued from "
9037
"the same CA."
9038
msgstr ""
9039
9040
#: serverguide/C/security.xml:1499(para)
9041
msgid ""
9042
"First, create the directories to hold the CA certificate and related files:"
9043
msgstr ""
9044
9045
#: serverguide/C/security.xml:1504(command)
9046
msgid "sudo mkdir /etc/ssl/CA"
9047
msgstr ""
9048
9049
#: serverguide/C/security.xml:1505(command)
9050
msgid "sudo mkdir /etc/ssl/newcerts"
9051
msgstr ""
9052
9053
#: serverguide/C/security.xml:1511(para)
9054
msgid ""
9055
"The CA needs a few additional files to operate, one to keep track of the "
9056
"last serial number used by the CA, each certificate must have a unique "
9057
"serial number, and another file to record which certificates have been "
9058
"issued:"
9059
msgstr ""
9060
9061
#: serverguide/C/security.xml:1518(command)
9062
msgid "sudo sh -c \"echo '01' > /etc/ssl/CA/serial\""
9063
msgstr ""
9064
9065
#: serverguide/C/security.xml:1519(command)
9066
msgid "sudo touch /etc/ssl/CA/index.txt"
9067
msgstr ""
9068
9069
#: serverguide/C/security.xml:1525(para)
9070
msgid ""
9071
"The third file is a CA configuration file. Though not strictly necessary, it "
9072
"is very convenient when issuing multiple certificates. Edit "
9073
"<filename>/etc/ssl/openssl.cnf</filename>, and in the <emphasis>[ CA_default "
9074
"]</emphasis> change:"
9075
msgstr ""
9076
9077
#: serverguide/C/security.xml:1531(programlisting)
9078
#, no-wrap
9079
msgid ""
9080
"\n"
9081
"dir = /etc/ssl/ # Where everything is kept\n"
9082
"database = $dir/CA/index.txt # database index file.\n"
9083
"certificate = $dir/certs/cacert.pem # The CA certificate\n"
9084
"serial = $dir/CA/serial # The current serial number\n"
9085
"private_key = $dir/private/cakey.pem# The private key\n"
9086
msgstr ""
9087
9088
#: serverguide/C/security.xml:1542(para)
9089
msgid "Next, create the self-singed root certificate:"
9090
msgstr ""
9091
9092
#: serverguide/C/security.xml:1547(command)
9093
msgid ""
9094
"openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -"
9095
"days 3650"
9096
msgstr ""
9097
9098
#: serverguide/C/security.xml:1550(para)
9099
msgid "You will then be asked to enter the details about the certificate."
9100
msgstr ""
9101
9102
#: serverguide/C/security.xml:1557(para)
9103
msgid "Now install the root certificate and key:"
9104
msgstr ""
9105
9106
#: serverguide/C/security.xml:1562(command)
9107
msgid "sudo mv cakey.pem /etc/ssl/private/"
9108
msgstr ""
9109
9110
#: serverguide/C/security.xml:1563(command)
9111
msgid "sudo mv cacert.pem /etc/ssl/certs/"
9112
msgstr ""
9113
9114
#: serverguide/C/security.xml:1569(para)
9115
msgid ""
9116
"You are now ready to start signing certificates. The first item needed is a "
9117
"Certificate Signing Request (CSR), see <xref linkend=\"generating-a-csr\"/> "
9118
"for details. Once you have a CSR, enter the following to generate a "
9119
"certificate signed by the CA:"
9120
msgstr ""
9121
9122
#: serverguide/C/security.xml:1576(command)
9123
msgid "sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf"
9124
msgstr ""
9125
9126
#: serverguide/C/security.xml:1579(para)
9127
msgid ""
9128
"After entering the password for the CA key, you will be prompted to sign the "
9129
"certificate, and again to commit the new certificate. You should then see a "
9130
"somewhat large amount of output related to the certificate creation."
9131
msgstr ""
9132
9133
#: serverguide/C/security.xml:1588(para)
9134
msgid ""
9135
"There should now be a new file, "
9136
"<filename>/etc/ssl/newcerts/01.pem</filename>, containing the same output. "
9137
"Copy and paste everything between the <emphasis>-----BEGIN CERTIFICATE-----"
9138
"</emphasis> and <emphasis>----END CERTIFICATE-----</emphasis> lines to a "
9139
"file named after the hostname of the server where the certificate will be "
9140
"installed. For example <filename>mail.example.com.crt</filename>, is a nice "
9141
"descriptive name."
9142
msgstr ""
9143
9144
#: serverguide/C/security.xml:1596(para)
9145
msgid ""
9146
"Subsequent certificates will be named <filename>02.pem</filename>, "
9147
"<filename>03.pem</filename>, etc."
9148
msgstr ""
9149
9150
#: serverguide/C/security.xml:1601(para)
9151
msgid ""
9152
"Replace <emphasis>mail.example.com.crt</emphasis> with your own descriptive "
9153
"name."
9154
msgstr ""
9155
9156
#: serverguide/C/security.xml:1609(para)
9157
msgid ""
9158
"Finally, copy the new certificate to the host that needs it, and configure "
9159
"the appropriate applications to use it. The default location to install "
9160
"certificates is <filename role=\"directory\">/etc/ssl/certs</filename>. This "
9161
"enables multiple services to use the same certificate without overly "
9162
"complicated file permissions."
9163
msgstr ""
9164
9165
#: serverguide/C/security.xml:1615(para)
9166
msgid ""
9167
"For applications that can be configured to use a CA certificate, you should "
9168
"also copy the <filename>/etc/ssl/certs/cacert.pem</filename> file to the "
9169
"<filename role=\"directory\">/etc/ssl/certs/</filename> directory on each "
9170
"server."
9171
msgstr ""
9172
9173
#: serverguide/C/security.xml:1629(para)
9174
msgid ""
9175
"For more detailed instructions on using cryptography see the <ulink "
9176
"url=\"http://tldp.org/HOWTO/SSL-Certificates-HOWTO/index.html\">SSL "
9177
"Certificates HOWTO</ulink> by tlpd.org"
9178
msgstr ""
9179
9180
#: serverguide/C/security.xml:1635(para)
9181
msgid ""
9182
"<ulink url=\"http://www.pki-page.org/\">The PKI Page</ulink> contains a list "
9183
"of Certificate Authorities."
9184
msgstr ""
9185
9186
#: serverguide/C/security.xml:1640(para)
9187
msgid ""
9188
"The Wikipedia <ulink "
9189
"url=\"http://en.wikipedia.org/wiki/Https\">HTTPS</ulink> page has more "
9190
"information regarding HTTPS."
9191
msgstr ""
9192
9193
#: serverguide/C/security.xml:1645(para)
9194
msgid ""
9195
"For more information on <emphasis>OpenSSL</emphasis> see the <ulink "
9196
"url=\"http://www.openssl.org/\">OpenSSL Home Page</ulink>."
9197
msgstr ""
9198
9199
#: serverguide/C/security.xml:1650(para)
9200
msgid ""
9201
"Also, O'Reilly's <ulink "
9202
"url=\"http://oreilly.com/catalog/9780596002701/\">Network Security with "
9203
"OpenSSL</ulink> is a good in depth reference."
9204
msgstr ""
9205
9206
#: serverguide/C/security.xml:1659(title)
9207
msgid "eCryptfs"
9208
msgstr ""
9209
9210
#: serverguide/C/security.xml:1661(para)
9211
msgid ""
9212
"<emphasis>eCryptfs</emphasis> is a POSIX-compliant enterprise-class stacked "
9213
"cryptographic filesystem for Linux. Layering on top of the filesystem layer "
9214
"<emphasis>eCryptfs</emphasis> protects files no matter the underlying "
9215
"filesystem, partition type, etc."
9216
msgstr ""
9217
9218
#: serverguide/C/security.xml:1667(para)
9219
msgid ""
9220
"During installation there is an option to encrypt the <filename "
9221
"role=\"directory\">/home</filename> partition. This will automatically "
9222
"configure everything needed to encrypt and mount the partition."
9223
msgstr ""
9224
9225
#: serverguide/C/security.xml:1672(para)
9226
msgid ""
9227
"As an example, this section will cover configuring <filename "
9228
"role=\"directory\">/srv</filename> to be encrypted using eCryptfs."
9229
msgstr ""
9230
9231
#: serverguide/C/security.xml:1677(title)
9232
msgid "Using eCryptfs"
9233
msgstr ""
9234
9235
#: serverguide/C/security.xml:1679(para)
9236
msgid "First, install the necessary packages. From a terminal prompt enter:"
9237
msgstr ""
9238
9239
#: serverguide/C/security.xml:1684(command)
9240
msgid "sudo apt-get install ecryptfs-utils"
9241
msgstr ""
9242
9243
#: serverguide/C/security.xml:1687(para)
9244
msgid "Now mount the partition to be encrypted:"
9245
msgstr ""
9246
9247
#: serverguide/C/security.xml:1692(command)
9248
msgid "sudo mount -t ecryptfs /srv /srv"
9249
msgstr ""
9250
9251
#: serverguide/C/security.xml:1695(para)
9252
msgid ""
9253
"You will then be prompted for some details on how "
9254
"<application>ecryptfs</application> should encrypt the data."
9255
msgstr ""
9256
9257
#: serverguide/C/security.xml:1699(para)
9258
msgid ""
9259
"To test that files placed in <filename>/srv</filename> are indeed encrypted "
9260
"copy the <filename>/etc/default</filename> folder to "
9261
"<filename>/srv</filename>:"
9262
msgstr ""
9263
9264
#: serverguide/C/security.xml:1705(command) serverguide/C/clustering.xml:192(command)
9265
msgid "sudo cp -r /etc/default /srv"
9266
msgstr ""
9267
9268
#: serverguide/C/security.xml:1708(para)
9269
msgid "Now unmount <filename>/srv</filename>, and try to view a file:"
9270
msgstr ""
9271
9272
#: serverguide/C/security.xml:1713(command) serverguide/C/installation.xml:1138(command) serverguide/C/clustering.xml:200(command)
9273
msgid "sudo umount /srv"
9274
msgstr ""
9275
9276
#: serverguide/C/security.xml:1714(command)
9277
msgid "cat /srv/default/cron"
9278
msgstr ""
9279
9280
#: serverguide/C/security.xml:1717(para)
9281
msgid ""
9282
"Remounting <filename>/srv</filename> using "
9283
"<application>ecryptfs</application> will make the data viewable once again."
9284
msgstr ""
9285
9286
#: serverguide/C/security.xml:1723(title)
9287
msgid "Automatically Mounting Encrypted Partitions"
9288
msgstr ""
9289
9290
#: serverguide/C/security.xml:1725(para)
9291
msgid ""
9292
"There are a couple of ways to automatically mount an "
9293
"<application>ecryptfs</application> encrypted filesystem at boot. This "
9294
"example will use a <filename>/root/.ecryptfsrc</filename> file containing "
9295
"mount options, along with a passphrase file residing on a USB key."
9296
msgstr ""
9297
9298
#: serverguide/C/security.xml:1731(para)
9299
msgid "First, create <filename>/root/.ecryptfsrc</filename> containing:"
9300
msgstr ""
9301
9302
#: serverguide/C/security.xml:1735(programlisting)
9303
#, no-wrap
9304
msgid ""
9305
"\n"
9306
"key=passphrase:passphrase_passwd_file=/mnt/usb/passwd_file.txt\n"
9307
"ecryptfs_sig=5826dd62cf81c615\n"
9308
"ecryptfs_cipher=aes\n"
9309
"ecryptfs_key_bytes=16\n"
9310
"ecryptfs_passthrough=n\n"
9311
"ecryptfs_enable_filename_crypto=n\n"
9312
msgstr ""
9313
9314
#: serverguide/C/security.xml:1745(para)
9315
msgid ""
9316
"Adjust the <emphasis>ecryptfs_sig</emphasis> to the signature in "
9317
"<filename>/root/.ecryptfs/sig-cache.txt</filename>."
9318
msgstr ""
9319
9320
#: serverguide/C/security.xml:1750(para)
9321
msgid ""
9322
"Next, create the <filename>/mnt/usb/passwd_file.txt</filename> passphrase "
9323
"file:"
9324
msgstr ""
9325
9326
#: serverguide/C/security.xml:1754(programlisting)
9327
#, no-wrap
9328
msgid ""
9329
"\n"
9330
"passphrase_passwd=[secrets]\n"
9331
msgstr ""
9332
9333
#: serverguide/C/security.xml:1758(para)
9334
msgid "Now add the necessary lines to <filename>/etc/fstab</filename>:"
9335
msgstr ""
9336
9337
#: serverguide/C/security.xml:1762(programlisting)
9338
#, no-wrap
9339
msgid ""
9340
"\n"
9341
"/dev/sdb1 /mnt/usb ext3 ro 0 0\n"
9342
"/srv /srv ecryptfs defaults 0 0\n"
9343
msgstr ""
9344
9345
#: serverguide/C/security.xml:1767(para)
9346
msgid "Make sure the USB drive is mounted before the encrypted partition."
9347
msgstr ""
9348
9349
#: serverguide/C/security.xml:1771(para)
9350
msgid ""
9351
"Finally, reboot and the <filename>/srv</filename> should be mounted using "
9352
"ecryptfs."
9353
msgstr ""
9354
9355
#: serverguide/C/security.xml:1779(para)
9356
msgid ""
9357
"The <application>ecryptfs-utils</application> package includes several other "
9358
"useful utilities:"
9359
msgstr ""
9360
9361
#: serverguide/C/security.xml:1785(para)
9362
msgid ""
9363
"<emphasis>ecryptfs-setup-private:</emphasis> creates a "
9364
"<filename>~/Private</filename> directory to contain encrypted information. "
9365
"This utility can be run by unprivileged users to keep data private from "
9366
"other users on the system."
9367
msgstr ""
9368
9369
#: serverguide/C/security.xml:1792(para)
9370
msgid ""
9371
"<emphasis>ecryptfs-mount-private and ecryptfs-umount-private:</emphasis> "
9372
"will mount and unmount respectively, a users <filename>~/Private</filename> "
9373
"directory."
9374
msgstr ""
9375
9376
#: serverguide/C/security.xml:1798(para)
9377
msgid ""
9378
"<emphasis>ecryptfs-add-passphrase:</emphasis> adds a new passphrase to the "
9379
"kernel keyring."
9380
msgstr ""
9381
9382
#: serverguide/C/security.xml:1803(para)
9383
msgid ""
9384
"<emphasis>ecryptfs-manager:</emphasis> manages "
9385
"<application>eCryptfs</application> objects such as keys."
9386
msgstr ""
9387
9388
#: serverguide/C/security.xml:1808(para)
9389
msgid ""
9390
"<emphasis>ecryptfs-stat:</emphasis> allows you to view the "
9391
"<application>ecryptfs</application> meta information for a file."
9392
msgstr ""
9393
9394
#: serverguide/C/security.xml:1821(para)
9395
msgid ""
9396
"For more information on eCryptfs see the <ulink "
9397
"url=\"https://launchpad.net/ecryptfs\">Launchpad project page</ulink>."
9398
msgstr ""
9399
9400
#: serverguide/C/security.xml:1826(para)
9401
msgid ""
9402
"There is also a <ulink "
9403
"url=\"http://www.linuxjournal.com/article/9400\">Linux Journal</ulink> "
9404
"article covering eCryptfs."
9405
msgstr ""
9406
9407
#: serverguide/C/security.xml:1831(para)
9408
msgid ""
9409
"Also, for more <application>ecryptfs</application> options see the <ulink "
9410
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/ecryptfs.7.html\">ecr"
9411
"yptfs man page</ulink>."
9412
msgstr ""
9413
9414
#: serverguide/C/security.xml:1837(para)
9415
msgid ""
9416
"The <ulink url=\"https://help.ubuntu.com/community/eCryptfs\">eCryptfs "
9417
"Ubuntu Wiki</ulink> page also has more details."
9418
msgstr ""
9419
9420
#: serverguide/C/reporting-bugs.xml:13(title)
9421
msgid "Appendix"
9422
msgstr ""
9423
9424
#: serverguide/C/reporting-bugs.xml:16(title)
9425
msgid "Reporting Bugs in Ubuntu Server Edition"
9426
msgstr ""
9427
9428
#: serverguide/C/reporting-bugs.xml:18(para)
9429
msgid ""
9430
"While the Ubuntu Project attempts to release software with as few bugs as "
9431
"possible, they do occur. You can help fix these bugs by reporting ones that "
9432
"you find to the project. The Ubuntu Project uses <ulink "
9433
"url=\"https://launchpad.net/\">Launchpad</ulink> to track its bug reports. "
9434
"In order to file a bug about Ubuntu Server on Launchpad, you will need to "
9435
"<ulink url=\"https://help.launchpad.net/YourAccount/NewAccount\">create an "
9436
"account</ulink>."
9437
msgstr ""
9438
9439
#: serverguide/C/reporting-bugs.xml:30(title)
9440
msgid "Reporting Bugs With ubuntu-bug"
9441
msgstr ""
9442
9443
#: serverguide/C/reporting-bugs.xml:32(para)
9444
msgid ""
9445
"The preferred way to report a bug is with the <application>ubuntu-"
9446
"bug</application> command. The ubuntu-bug tool gathers information about the "
9447
"system useful to developers in diagnosing the reported problem that will "
9448
"then be included in the bug report filed on Launchpad. Bug reports in Ubuntu "
9449
"need to be filed against a specific software package, thus the name of the "
9450
"package that the bug occurs in needs to be given to ubuntu-bug:"
9451
msgstr ""
9452
9453
#: serverguide/C/reporting-bugs.xml:43(command)
9454
msgid "ubuntu-bug PACKAGENAME"
9455
msgstr ""
9456
9457
#: serverguide/C/reporting-bugs.xml:46(para)
9458
msgid ""
9459
"For example, to file a bug against the openssh-server package, you would do:"
9460
msgstr ""
9461
9462
#: serverguide/C/reporting-bugs.xml:51(command)
9463
msgid "ubuntu-bug openssh-server"
9464
msgstr ""
9465
9466
#: serverguide/C/reporting-bugs.xml:54(para)
9467
msgid ""
9468
"You can specify either a binary package or the source package for ubuntu-"
9469
"bug. Again using openssh-server as an example, you could also generate the "
9470
"report against the source package for openssh-server, openssh:"
9471
msgstr ""
9472
9473
#: serverguide/C/reporting-bugs.xml:62(command)
9474
msgid "ubuntu-bug openssh"
9475
msgstr ""
9476
9477
#: serverguide/C/reporting-bugs.xml:66(para)
9478
msgid ""
9479
"See <xref linkend=\"package-management\"/> for more information about "
9480
"packages in Ubuntu."
9481
msgstr ""
9482
9483
#: serverguide/C/reporting-bugs.xml:72(para)
9484
msgid ""
9485
"The ubuntu-bug command will gather information about the system in question, "
9486
"possibly including information specific to the specified package, and then "
9487
"ask you what you would like to do with collected information:"
9488
msgstr ""
9489
9490
#: serverguide/C/reporting-bugs.xml:80(command)
9491
msgid "ubuntu-bug postgresql"
9492
msgstr ""
9493
9494
#: serverguide/C/reporting-bugs.xml:79(screen)
9495
#, no-wrap
9496
msgid ""
9497
"\n"
9498
"<placeholder-1/>\n"
9499
"\n"
9500
"*** Collecting problem information\n"
9501
"\n"
9502
"The collected information can be sent to the developers to improve the\n"
9503
"application. This might take a few minutes.\n"
9504
"..........\n"
9505
"\n"
9506
"*** Send problem report to the developers?\n"
9507
"\n"
9508
"After the problem report has been sent, please fill out the form in the\n"
9509
"automatically opened web browser.\n"
9510
"\n"
9511
"What would you like to do? Your options are:\n"
9512
" S: Send report (1.7 KiB)\n"
9513
" V: View report\n"
9514
" K: Keep report file for sending later or copying to somewhere else\n"
9515
" C: Cancel\n"
9516
"Please choose (S/V/K/C):\n"
9517
msgstr ""
9518
9519
#: serverguide/C/reporting-bugs.xml:101(para)
9520
msgid "The options available are:"
9521
msgstr ""
9522
9523
#: serverguide/C/reporting-bugs.xml:108(para)
9524
msgid ""
9525
"<emphasis role=\"bold\">Send Report</emphasis> Selecting Send Report submits "
9526
"the collected information to Launchpad as part of the the process of filing "
9527
"a bug report. You will be given the opportunity to describe the situation "
9528
"that led up to the occurrance of the bug."
9529
msgstr ""
9530
9531
#: serverguide/C/reporting-bugs.xml:115(screen)
9532
#, no-wrap
9533
msgid ""
9534
"\n"
9535
"*** Uploading problem information\n"
9536
"\n"
9537
"The collected information is being sent to the bug tracking system.\n"
9538
"This might take a few minutes.\n"
9539
"91%\n"
9540
"\n"
9541
"*** To continue, you must visit the following URL:\n"
9542
"\n"
9543
" https://bugs.launchpad.net/ubuntu/+source/postgresql-"
9544
"8.4/+filebug/kc6eSnTLnLxF8u0t3e56EukFeqJ?\n"
9545
"\n"
9546
"You can launch a browser now, or copy this URL into a browser on another\n"
9547
"computer.\n"
9548
"\n"
9549
"Choices:\n"
9550
" 1: Launch a browser now\n"
9551
" C: Cancel\n"
9552
"Please choose (1/C):\n"
9553
msgstr ""
9554
9555
#: serverguide/C/reporting-bugs.xml:135(para)
9556
msgid ""
9557
"If you choose to start a browser, by default the text based web browser "
9558
"<application>w3m</application> will be used to finish filing the bug report. "
9559
"Alternately, you can copy the given URL to a currently running web browser."
9560
msgstr ""
9561
9562
#: serverguide/C/reporting-bugs.xml:144(para)
9563
msgid ""
9564
"<emphasis role=\"bold\">View Report</emphasis> Selecting View Report causes "
9565
"the collected information to be displayed to the terminal for review."
9566
msgstr ""
9567
9568
#: serverguide/C/reporting-bugs.xml:150(screen)
9569
#, no-wrap
9570
msgid ""
9571
"\n"
9572
"Package: postgresql 8.4.2-2\n"
9573
"PackageArchitecture: all\n"
9574
"Tags: lucid\n"
9575
"ProblemType: Bug\n"
9576
"ProcEnviron:\n"
9577
" LANG=en_US.UTF-8\n"
9578
" SHELL=/bin/bash\n"
9579
"Uname: Linux 2.6.32-16-server x86_64\n"
9580
"Dependencies:\n"
9581
" adduser 3.112ubuntu1\n"
9582
" base-files 5.0.0ubuntu10\n"
9583
" base-passwd 3.5.22\n"
9584
" coreutils 7.4-2ubuntu2\n"
9585
"...\n"
9586
msgstr ""
9587
9588
#: serverguide/C/reporting-bugs.xml:167(para)
9589
msgid ""
9590
"After viewing the report, you will be brought back to the same menu asking "
9591
"what you would like to do with the report."
9592
msgstr ""
9593
9594
#: serverguide/C/reporting-bugs.xml:174(para)
9595
msgid ""
9596
"<emphasis role=\"bold\">Keep Report File</emphasis> Selecting Keep Report "
9597
"File causes the gathered information to be written to a file. This file can "
9598
"then be used to later file a bug report or transferred to a different Ubuntu "
9599
"system for reporting. To submit the report file, simply give it as an "
9600
"argument to the ubuntu-bug command:"
9601
msgstr ""
9602
9603
#: serverguide/C/reporting-bugs.xml:189(userinput)
9604
#, no-wrap
9605
msgid "k"
9606
msgstr ""
9607
9608
#: serverguide/C/reporting-bugs.xml:192(command)
9609
msgid "ubuntu-bug /tmp/apport.postgresql.v4MQas.apport"
9610
msgstr ""
9611
9612
#: serverguide/C/reporting-bugs.xml:183(screen)
9613
#, no-wrap
9614
msgid ""
9615
"\n"
9616
"What would you like to do? Your options are:\n"
9617
" S: Send report (1.7 KiB)\n"
9618
" V: View report\n"
9619
" K: Keep report file for sending later or copying to somewhere else\n"
9620
" C: Cancel\n"
9621
"Please choose (S/V/K/C): <placeholder-1/>\n"
9622
"Problem report file: /tmp/apport.postgresql.v4MQas.apport\n"
9623
"\n"
9624
"<placeholder-2/>\n"
9625
"\n"
9626
"*** Send problem report to the developers?\n"
9627
"...\n"
9628
msgstr ""
9629
9630
#: serverguide/C/reporting-bugs.xml:200(para)
9631
msgid ""
9632
"<emphasis role=\"bold\">Cancel</emphasis> Selecting Cancel causes the "
9633
"collected information to be discarded."
9634
msgstr ""
9635
9636
#: serverguide/C/reporting-bugs.xml:210(title)
9637
msgid "Reporting Application Crashes"
9638
msgstr ""
9639
9640
#: serverguide/C/reporting-bugs.xml:212(para)
9641
msgid ""
9642
"The software package that provides the ubuntu-bug utility, "
9643
"<application>apport</application>, can be configured to trigger when "
9644
"applications crash. This is disabled by default, as capturing a crash can be "
9645
"resource intensive depending on how much memory the application that crashed "
9646
"was using as apport captures and processes the core dump."
9647
msgstr ""
9648
9649
#: serverguide/C/reporting-bugs.xml:221(para)
9650
msgid ""
9651
"Configuring apport to capture information about crashing applications "
9652
"requires a couple of steps. First, <application>gdb</application> needs to "
9653
"be installed; it is not installed by default in Ubuntu Server Edition."
9654
msgstr ""
9655
9656
#: serverguide/C/reporting-bugs.xml:229(command)
9657
msgid "sudo apt-get install gdb"
9658
msgstr ""
9659
9660
#: serverguide/C/reporting-bugs.xml:232(para)
9661
msgid ""
9662
"See <xref linkend=\"package-management\"/> for more information about "
9663
"managing packages in Ubuntu."
9664
msgstr ""
9665
9666
#: serverguide/C/reporting-bugs.xml:237(para)
9667
msgid ""
9668
"Once you have ensured that gdb is installed, open the file "
9669
"<filename>/etc/default/apport</filename> in your text editor, and change the "
9670
"<emphasis>enabled</emphasis> setting to be <emphasis "
9671
"role=\"bold\">1</emphasis> like so:"
9672
msgstr ""
9673
9674
#: serverguide/C/reporting-bugs.xml:244(programlisting)
9675
#, no-wrap
9676
msgid ""
9677
"\n"
9678
"# set this to 0 to disable apport, or to 1 to enable it\n"
9679
"# you can temporarily override this with\n"
9680
"# sudo service apport start force_start=1\n"
9681
"enabled=<userinput>1</userinput>\n"
9682
"\n"
9683
"# set maximum core dump file size (default: 209715200 bytes == 200 MB)\n"
9684
"maxsize=209715200\n"
9685
msgstr ""
9686
9687
#: serverguide/C/reporting-bugs.xml:254(para)
9688
msgid ""
9689
"Once you have completed editing <filename>/etc/default/apport</filename>, "
9690
"start the apport service:"
9691
msgstr ""
9692
9693
#: serverguide/C/reporting-bugs.xml:261(command)
9694
msgid "sudo start apport"
9695
msgstr ""
9696
9697
#: serverguide/C/reporting-bugs.xml:264(para)
9698
msgid ""
9699
"After an application crashes, use the <application>apport-cli</application> "
9700
"command to search for the existing saved crash report information:"
9701
msgstr ""
9702
9703
#: serverguide/C/reporting-bugs.xml:271(command)
9704
msgid "apport-cli"
9705
msgstr ""
9706
9707
#: serverguide/C/reporting-bugs.xml:270(screen)
9708
#, no-wrap
9709
msgid ""
9710
"\n"
9711
"<placeholder-1/>\n"
9712
"\n"
9713
"*** dash closed unexpectedly on 2010-03-11 at 21:40:59.\n"
9714
"\n"
9715
"If you were not doing anything confidential (entering passwords or other\n"
9716
"private information), you can help to improve the application by\n"
9717
"reporting\n"
9718
"the problem.\n"
9719
"\n"
9720
"What would you like to do? Your options are:\n"
9721
" R: Report Problem...\n"
9722
" I: Cancel and ignore future crashes of this program version\n"
9723
" C: Cancel\n"
9724
"Please choose (R/I/C):\n"
9725
msgstr ""
9726
9727
#: serverguide/C/reporting-bugs.xml:287(para)
9728
msgid ""
9729
"Selecting <emphasis>Report Problem</emphasis> will walk you through similar "
9730
"steps as when using ubuntu-bug. One important difference is that a crash "
9731
"report will be marked as private when filed on Launchpad, meaning that it "
9732
"will be visible to only a limited set of bug triagers. These triagers will "
9733
"review the gathered data for private information before making the bug "
9734
"report publicly visible."
9735
msgstr ""
9736
9737
#: serverguide/C/reporting-bugs.xml:307(para)
9738
msgid ""
9739
"See the <ulink "
9740
"url=\"https://help.ubuntu.com/community/ReportingBugs\">Reporting "
9741
"Bugs</ulink> Ubuntu wiki page."
9742
msgstr ""
9743
9744
#: serverguide/C/reporting-bugs.xml:313(para)
9745
msgid ""
9746
"Also, the <ulink url=\"https://wiki.ubuntu.com/Apport\">Apport</ulink> page "
9747
"has some useful information. Though some of it pertains to using a GUI."
9748
msgstr ""
9749
9750
#: serverguide/C/remote-administration.xml:13(title)
9751
msgid "Remote Administration"
9752
msgstr ""
9753
9754
#: serverguide/C/remote-administration.xml:14(para)
9755
msgid ""
9756
"There are many ways to remotely administer a Linux server. This chapter will "
9757
"cover one of the most popular <application>SSH</application> as well as "
9758
"<application>eBox</application>, a web based administration framework."
9759
msgstr ""
9760
9761
#: serverguide/C/remote-administration.xml:23(para)
9762
msgid ""
9763
"This section of the Ubuntu Server Guide introduces a powerful collection of "
9764
"tools for the remote control of networked computers and transfer of data "
9765
"between networked computers, called <emphasis>OpenSSH</emphasis>. You will "
9766
"also learn about some of the configuration settings possible with the "
9767
"OpenSSH server application and how to change them on your Ubuntu system."
9768
msgstr ""
9769
9770
#: serverguide/C/remote-administration.xml:30(para)
9771
msgid ""
9772
"OpenSSH is a freely available version of the Secure Shell (SSH) protocol "
9773
"family of tools for remotely controlling a computer or transferring files "
9774
"between computers. Traditional tools used to accomplish these functions, "
9775
"such as <application>telnet</application> or <application>rcp</application>, "
9776
"are insecure and transmit the user's password in cleartext when used. "
9777
"OpenSSH provides a server daemon and client tools to facilitate secure, "
9778
"encrypted remote control and file transfer operations, effectively replacing "
9779
"the legacy tools."
9780
msgstr ""
9781
9782
#: serverguide/C/remote-administration.xml:39(para)
9783
msgid ""
9784
"The OpenSSH server component, <application>sshd</application>, listens "
9785
"continuously for client connections from any of the client tools. When a "
9786
"connection request occurs, <application>sshd</application> sets up the "
9787
"correct connection depending on the type of client tool connecting. For "
9788
"example, if the remote computer is connecting with the "
9789
"<application>ssh</application> client application, the OpenSSH server sets "
9790
"up a remote control session after authentication. If a remote user connects "
9791
"to an OpenSSH server with <application>scp</application>, the OpenSSH server "
9792
"daemon initiates a secure copy of files between the server and client after "
9793
"authentication. OpenSSH can use many authentication methods, including plain "
9794
"password, public key, and <application>Kerberos</application> tickets."
9795
msgstr ""
9796
9797
#: serverguide/C/remote-administration.xml:53(para)
9798
msgid ""
9799
"Installation of the OpenSSH client and server applications is simple. To "
9800
"install the OpenSSH client applications on your Ubuntu system, use this "
9801
"command at a terminal prompt:"
9802
msgstr ""
9803
9804
#: serverguide/C/remote-administration.xml:59(command)
9805
msgid "sudo apt-get install openssh-client"
9806
msgstr ""
9807
9808
#: serverguide/C/remote-administration.xml:61(para)
9809
msgid ""
9810
"To install the OpenSSH server application, and related support files, use "
9811
"this command at a terminal prompt:"
9812
msgstr ""
9813
9814
#: serverguide/C/remote-administration.xml:66(command)
9815
msgid "sudo apt-get install openssh-server"
9816
msgstr ""
9817
9818
#: serverguide/C/remote-administration.xml:68(para)
9819
msgid ""
9820
"The <application>openssh-server</application> package can also be selected "
9821
"to install during the Server Edition installation process."
9822
msgstr ""
9823
9824
#: serverguide/C/remote-administration.xml:75(para)
9825
msgid ""
9826
"You may configure the default behavior of the OpenSSH server application, "
9827
"<application>sshd</application>, by editing the file "
9828
"<filename>/etc/ssh/sshd_config</filename>. For information about the "
9829
"configuration directives used in this file, you may view the appropriate "
9830
"manual page with the following command, issued at a terminal prompt:"
9831
msgstr ""
9832
9833
#: serverguide/C/remote-administration.xml:83(command)
9834
msgid "man sshd_config"
9835
msgstr ""
9836
9837
#: serverguide/C/remote-administration.xml:85(para)
9838
msgid ""
9839
"There are many directives in the <application>sshd</application> "
9840
"configuration file controlling such things as communication settings and "
9841
"authentication modes. The following are examples of configuration directives "
9842
"that can be changed by editing the <filename>/etc/ssh/sshd_config</filename> "
9843
"file."
9844
msgstr ""
9845
9846
#: serverguide/C/remote-administration.xml:92(para)
9847
msgid ""
9848
"Prior to editing the configuration file, you should make a copy of the "
9849
"original file and protect it from writing so you will have the original "
9850
"settings as a reference and to reuse as necessary."
9851
msgstr ""
9852
9853
#: serverguide/C/remote-administration.xml:96(para)
9854
msgid ""
9855
"Copy the <filename>/etc/ssh/sshd_config</filename> file and protect it from "
9856
"writing with the following commands, issued at a terminal prompt:"
9857
msgstr ""
9858
9859
#: serverguide/C/remote-administration.xml:101(command)
9860
msgid "sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original"
9861
msgstr ""
9862
9863
#: serverguide/C/remote-administration.xml:102(command)
9864
msgid "sudo chmod a-w /etc/ssh/sshd_config.original"
9865
msgstr ""
9866
9867
#: serverguide/C/remote-administration.xml:104(para)
9868
msgid ""
9869
"The following are examples of configuration directives you may change:"
9870
msgstr ""
9871
9872
#: serverguide/C/remote-administration.xml:109(para)
9873
msgid ""
9874
"To set your OpenSSH to listen on TCP port 2222 instead of the default TCP "
9875
"port 22, change the Port directive as such:"
9876
msgstr ""
9877
9878
#: serverguide/C/remote-administration.xml:113(para)
9879
msgid "Port 2222"
9880
msgstr ""
9881
9882
#: serverguide/C/remote-administration.xml:118(para)
9883
msgid ""
9884
"To have <application>sshd</application> allow public key-based login "
9885
"credentials, simply add or modify the line:"
9886
msgstr ""
9887
9888
#: serverguide/C/remote-administration.xml:122(para)
9889
msgid "PubkeyAuthentication yes"
9890
msgstr ""
9891
9892
#: serverguide/C/remote-administration.xml:125(para)
9893
msgid ""
9894
"In the <filename>/etc/ssh/sshd_config</filename> file, or if already "
9895
"present, ensure the line is not commented out."
9896
msgstr ""
9897
9898
#: serverguide/C/remote-administration.xml:131(para)
9899
msgid ""
9900
"To make your OpenSSH server display the contents of the "
9901
"<filename>/etc/issue.net</filename> file as a pre-login banner, simply add "
9902
"or modify the line:"
9903
msgstr ""
9904
9905
#: serverguide/C/remote-administration.xml:136(para)
9906
msgid "Banner /etc/issue.net"
9907
msgstr ""
9908
9909
#: serverguide/C/remote-administration.xml:139(para)
9910
msgid "In the <filename>/etc/ssh/sshd_config</filename> file."
9911
msgstr ""
9912
9913
#: serverguide/C/remote-administration.xml:144(para)
9914
msgid ""
9915
"After making changes to the <filename>/etc/ssh/sshd_config</filename> file, "
9916
"save the file, and restart the <application>sshd</application> server "
9917
"application to effect the changes using the following command at a terminal "
9918
"prompt:"
9919
msgstr ""
9920
9921
#: serverguide/C/remote-administration.xml:153(para)
9922
msgid ""
9923
"Many other configuration directives for <application>sshd</application> are "
9924
"available for changing the server application's behavior to fit your needs. "
9925
"Be advised, however, if your only method of access to a server is "
9926
"<application>ssh</application>, and you make a mistake in configuring "
9927
"<application>sshd</application> via the "
9928
"<filename>/etc/ssh/sshd_config</filename> file, you may find you are locked "
9929
"out of the server upon restarting it, or that the "
9930
"<application>sshd</application> server refuses to start due to an incorrect "
9931
"configuration directive, so be extra careful when editing this file on a "
9932
"remote server."
9933
msgstr ""
9934
9935
#: serverguide/C/remote-administration.xml:168(title)
9936
msgid "SSH Keys"
9937
msgstr ""
9938
9939
#: serverguide/C/remote-administration.xml:169(para)
9940
msgid ""
9941
"SSH <emphasis>keys</emphasis> allow authentication between two hosts without "
9942
"the need of a password. SSH key authentication uses two keys a "
9943
"<emphasis>private</emphasis> key and a <emphasis>public</emphasis> key."
9944
msgstr ""
9945
9946
#: serverguide/C/remote-administration.xml:173(para)
9947
msgid "To generate the keys, from a terminal prompt enter:"
9948
msgstr ""
9949
9950
#: serverguide/C/remote-administration.xml:177(command)
9951
msgid "ssh-keygen -t dsa"
9952
msgstr ""
9953
9954
#: serverguide/C/remote-administration.xml:179(para)
9955
msgid ""
9956
"This will generate the keys using a <emphasis>DSA</emphasis> authentication "
9957
"identity of the user. During the process you will be prompted for a "
9958
"password. Simply hit <emphasis>Enter</emphasis> when prompted to create the "
9959
"key."
9960
msgstr ""
9961
9962
#: serverguide/C/remote-administration.xml:183(para)
9963
msgid ""
9964
"By default the <emphasis>public</emphasis> key is saved in the file "
9965
"<filename>~/.ssh/id_dsa.pub</filename>, while "
9966
"<filename>~/.ssh/id_dsa</filename> is the <emphasis>private</emphasis> key. "
9967
"Now copy the <filename>id_dsa.pub</filename> file to the remote host and "
9968
"append it to <filename>~/.ssh/authorized_keys</filename> by entering:"
9969
msgstr ""
9970
9971
#: serverguide/C/remote-administration.xml:189(command)
9972
msgid "ssh-copy-id username@remotehost"
9973
msgstr ""
9974
9975
#: serverguide/C/remote-administration.xml:191(para)
9976
msgid ""
9977
"Finally, double check the permissions on the "
9978
"<filename>authorized_keys</filename> file, only the authenticated user "
9979
"should have read and write permissions. If the permissions are not correct "
9980
"change them by:"
9981
msgstr ""
9982
9983
#: serverguide/C/remote-administration.xml:196(command)
9984
msgid "chmod 600 .ssh/authorized_keys"
9985
msgstr ""
9986
9987
#: serverguide/C/remote-administration.xml:198(para)
9988
msgid ""
9989
"You should now be able to SSH to the host without being prompted for a "
9990
"password."
9991
msgstr ""
9992
9993
#: serverguide/C/remote-administration.xml:207(para)
9994
msgid ""
9995
"<ulink url=\"https://help.ubuntu.com/community/SSH\">Ubuntu Wiki SSH</ulink> "
9996
"page."
9997
msgstr ""
9998
9999
#: serverguide/C/remote-administration.xml:213(ulink)
10000
msgid "OpenSSH Website"
10001
msgstr ""
10002
10003
#: serverguide/C/remote-administration.xml:218(ulink)
10004
msgid "Advanced OpenSSH Wiki Page"
10005
msgstr "進階OpenSSH Wiki Page"
10006
10007
#: serverguide/C/remote-administration.xml:226(title)
10008
msgid "eBox"
10009
msgstr ""
10010
10011
#: serverguide/C/remote-administration.xml:227(para)
10012
msgid ""
10013
"<application>eBox</application> is a web framework used to manage server "
10014
"application configuration. The modular design of eBox allows you to pick and "
10015
"choose which services you want to configure using eBox."
10016
msgstr ""
10017
10018
#: serverguide/C/remote-administration.xml:234(para)
10019
msgid ""
10020
"The different <application>eBox</application> modules are split into "
10021
"different packages, allowing you to only install those necessary. One way to "
10022
"view the available packages is to enter the following from a terminal:"
10023
msgstr ""
10024
10025
#: serverguide/C/remote-administration.xml:240(command)
10026
msgid "apt-cache rdepends ebox | uniq"
10027
msgstr ""
10028
10029
#: serverguide/C/remote-administration.xml:242(para)
10030
msgid ""
10031
"To install the <application>ebox</application> package, which contains the "
10032
"default modules, enter the following:"
10033
msgstr ""
10034
10035
#: serverguide/C/remote-administration.xml:247(command)
10036
msgid "sudo apt-get install ebox"
10037
msgstr ""
10038
10039
#: serverguide/C/remote-administration.xml:250(para)
10040
msgid ""
10041
"During the installation you will be asked to supply a password for the ebox "
10042
"user. After installing eBox the web interface can be accessed from: "
10043
"<emphasis>https://yourserver/ebox</emphasis>."
10044
msgstr ""
10045
10046
#: serverguide/C/remote-administration.xml:259(para)
10047
msgid ""
10048
"An important thing to remember when using <application>eBox</application> is "
10049
"that when configuring most modules there is a <emphasis>Change</emphasis> "
10050
"button that implements the new configuration. After clicking the Change "
10051
"button most, but not all, modules will then need to be "
10052
"<emphasis>Saved</emphasis>. To save the new configuration click on the "
10053
"<quote>Save changes</quote> link in the top right hand corner."
10054
msgstr ""
10055
10056
#: serverguide/C/remote-administration.xml:267(para)
10057
msgid ""
10058
"Once you make a change that requires a Save, the link will change from green "
10059
"to red."
10060
msgstr ""
10061
10062
#: serverguide/C/remote-administration.xml:273(title)
10063
msgid "eBox Modules"
10064
msgstr ""
10065
10066
#: serverguide/C/remote-administration.xml:274(para)
10067
msgid ""
10068
"By default all eBox <emphasis>Modules</emphasis> are not enabled, and when a "
10069
"new module is installed it will not be automatically enabled."
10070
msgstr ""
10071
10072
#: serverguide/C/remote-administration.xml:278(para)
10073
msgid ""
10074
"To enable a disabled module click on the <emphasis>Module status</emphasis> "
10075
"link in the left hand menu. Then <emphasis role=\"italic\">check</emphasis> "
10076
"which modules you would like to enable and click the <quote>Save</quote> "
10077
"link."
10078
msgstr ""
10079
10080
#: serverguide/C/remote-administration.xml:284(title)
10081
msgid "Default Modules"
10082
msgstr ""
10083
10084
#: serverguide/C/remote-administration.xml:285(para)
10085
msgid ""
10086
"This section provides a quick summary of the default "
10087
"<application>eBox</application> modules."
10088
msgstr ""
10089
10090
#: serverguide/C/remote-administration.xml:291(para)
10091
msgid ""
10092
"<emphasis>System:</emphasis> contains options allowing configuration of "
10093
"general eBox items."
10094
msgstr ""
10095
10096
#: serverguide/C/remote-administration.xml:297(para)
10097
msgid ""
10098
"<emphasis>General:</emphasis> allows you to set the language, port number, "
10099
"and contains a change password form."
10100
msgstr ""
10101
10102
#: serverguide/C/remote-administration.xml:303(para)
10103
msgid ""
10104
"<emphasis>Disk Usage:</emphasis> displays a graph detailing information "
10105
"about disk usage."
10106
msgstr ""
10107
10108
#: serverguide/C/remote-administration.xml:309(para)
10109
msgid ""
10110
"<emphasis>Backup:</emphasis> is used to backup "
10111
"<application>eBox</application> configuration information, and the "
10112
"<emphasis>Full Backup</emphasis> option allows you to save all eBox "
10113
"information not included in the <emphasis>Configuration</emphasis> option "
10114
"such as log files."
10115
msgstr ""
10116
10117
#: serverguide/C/remote-administration.xml:317(para)
10118
msgid ""
10119
"<emphasis>Halt/Reboot:</emphasis> will shutdown the system or reboot it."
10120
msgstr ""
10121
10122
#: serverguide/C/remote-administration.xml:322(para)
10123
msgid ""
10124
"<emphasis>Bug Report:</emphasis> creates a file containing details helpful "
10125
"when reporting bugs to the eBox developers."
10126
msgstr ""
10127
10128
#: serverguide/C/remote-administration.xml:330(para)
10129
msgid ""
10130
"<emphasis>Logs:</emphasis> allows <application>eBox</application> logs to be "
10131
"queried depending on the purge time configured."
10132
msgstr ""
10133
10134
#: serverguide/C/remote-administration.xml:336(para)
10135
msgid ""
10136
"<emphasis>Events:</emphasis> this module has the ability to send alerts "
10137
"through rss, jabber, and log file."
10138
msgstr ""
10139
10140
#: serverguide/C/remote-administration.xml:343(emphasis)
10141
msgid "Available Events:"
10142
msgstr ""
10143
10144
#: serverguide/C/remote-administration.xml:347(para)
10145
msgid ""
10146
"<emphasis>Free Storage Space:</emphasis> will send alert if free disk space "
10147
"drops below a configured percentage, 10% by default."
10148
msgstr ""
10149
10150
#: serverguide/C/remote-administration.xml:353(para)
10151
msgid ""
10152
"<emphasis>Log Observer:</emphasis> sends an alert when a configured logger "
10153
"has logged something."
10154
msgstr ""
10155
10156
#: serverguide/C/remote-administration.xml:359(para)
10157
msgid ""
10158
"<emphasis>RAID:</emphasis> will monitor the RAID system and send alerts if "
10159
"any issues arise."
10160
msgstr ""
10161
10162
#: serverguide/C/remote-administration.xml:365(para)
10163
msgid ""
10164
"<emphasis>Service:</emphasis> sends alerts if a service restarts multiple "
10165
"times in a short time period."
10166
msgstr ""
10167
10168
#: serverguide/C/remote-administration.xml:371(para)
10169
msgid ""
10170
"<emphasis>State:</emphasis> alerts on the state of "
10171
"<application>eBox</application>, either up or down."
10172
msgstr ""
10173
10174
#: serverguide/C/remote-administration.xml:380(emphasis)
10175
msgid "Dispatchers:"
10176
msgstr ""
10177
10178
#: serverguide/C/remote-administration.xml:384(para)
10179
msgid ""
10180
"<emphasis>Log:</emphasis> this dispatcher will send event messages to the "
10181
"<application>eBox</application> log file "
10182
"<filename>/var/log/ebox/ebox.log</filename>."
10183
msgstr ""
10184
10185
#: serverguide/C/remote-administration.xml:391(para)
10186
msgid ""
10187
"<emphasis>Jabber:</emphasis> before enabling this dispatcher you must first "
10188
"configure it by clicking on the <quote>Configure</quote> icon."
10189
msgstr ""
10190
10191
#: serverguide/C/remote-administration.xml:397(para)
10192
msgid ""
10193
"<emphasis>RSS:</emphasis> once this dispatcher is configured you can "
10194
"subscribe to the link in order to view event alerts."
10195
msgstr ""
10196
10197
#: serverguide/C/remote-administration.xml:410(title)
10198
msgid "Additional Modules"
10199
msgstr ""
10200
10201
#: serverguide/C/remote-administration.xml:411(para)
10202
msgid ""
10203
"Here is a quick description of other available "
10204
"<application>eBox</application> modules:"
10205
msgstr ""
10206
10207
#: serverguide/C/remote-administration.xml:416(para)
10208
msgid ""
10209
"<emphasis>Network:</emphasis> allows configuration of the server's network "
10210
"options through eBox."
10211
msgstr ""
10212
10213
#: serverguide/C/remote-administration.xml:422(para)
10214
msgid ""
10215
"<emphasis>Firewall:</emphasis> configures firewall options for the eBox host."
10216
msgstr ""
10217
10218
#: serverguide/C/remote-administration.xml:427(para)
10219
msgid ""
10220
"<emphasis>UsersandGroups:</emphasis> this module will manage users and "
10221
"groups contained in an <application>OpenLDAP</application> LDAP directory."
10222
msgstr ""
10223
10224
#: serverguide/C/remote-administration.xml:433(para)
10225
msgid ""
10226
"<emphasis>DHCP:</emphasis> provides an interface for configuring a DHCP "
10227
"server."
10228
msgstr ""
10229
10230
#: serverguide/C/remote-administration.xml:438(para)
10231
msgid ""
10232
"<emphasis>DNS:</emphasis> provides <application>BIND9</application> DNS "
10233
"server configuration options."
10234
msgstr ""
10235
10236
#: serverguide/C/remote-administration.xml:444(para)
10237
msgid ""
10238
"<emphasis>Objects:</emphasis> allow configuration of eBox <emphasis>Network "
10239
"Objects</emphasis>, which allow you to assign a name to an IP address or "
10240
"group of IPs."
10241
msgstr ""
10242
10243
#: serverguide/C/remote-administration.xml:451(para)
10244
msgid ""
10245
"<emphasis>Services:</emphasis> displays configuration information for "
10246
"services that are available to the network."
10247
msgstr ""
10248
10249
#: serverguide/C/remote-administration.xml:457(para)
10250
msgid ""
10251
"<emphasis>Squid:</emphasis> configuration options for the "
10252
"<application>Squid</application> proxy server."
10253
msgstr ""
10254
10255
#: serverguide/C/remote-administration.xml:463(para)
10256
msgid ""
10257
"<emphasis>CA:</emphasis> configures a Certificate Authority for the server."
10258
msgstr ""
10259
10260
#: serverguide/C/remote-administration.xml:468(para)
10261
msgid "<emphasis>NTP:</emphasis> set Network Time Protocol options."
10262
msgstr ""
10263
10264
#: serverguide/C/remote-administration.xml:473(para)
10265
msgid "<emphasis>Printers:</emphasis> allows the configuration of printers."
10266
msgstr ""
10267
10268
#: serverguide/C/remote-administration.xml:478(para)
10269
msgid "<emphasis>Samba:</emphasis> configuration options for Samba."
10270
msgstr ""
10271
10272
#: serverguide/C/remote-administration.xml:483(para)
10273
msgid ""
10274
"<emphasis>OpenVPN:</emphasis> setup options for OpenVPN Virtual Private "
10275
"Network application."
10276
msgstr ""
10277
10278
#: serverguide/C/remote-administration.xml:494(para)
10279
msgid ""
10280
"The <ulink url=\"https://help.ubuntu.com/community/eBox\">eBox Ubuntu "
10281
"Wiki</ulink> page has more details."
10282
msgstr ""
10283
10284
#: serverguide/C/remote-administration.xml:499(para)
10285
msgid ""
10286
"For more information also see the <ulink url=\"http://ebox-"
10287
"platform.com/\">eBox Home Page</ulink>."
10288
msgstr ""
10289
10290
#: serverguide/C/package-management.xml:13(title)
10291
msgid "Package Management"
10292
msgstr ""
10293
10294
#: serverguide/C/package-management.xml:14(para)
10295
msgid ""
10296
"Ubuntu features a comprehensive package management system for the "
10297
"installation, upgrade, configuration, and removal of software. In addition "
10298
"to providing access to an organized base of over 24,000 software packages "
10299
"for your Ubuntu computer, the package management facilities also feature "
10300
"dependency resolution capabilities and software update checking."
10301
msgstr ""
10302
10303
#: serverguide/C/package-management.xml:16(para)
10304
msgid ""
10305
"Several tools are available for interacting with Ubuntu's package management "
10306
"system, from simple command-line utilities which may be easily automated by "
10307
"system administrators, to a simple graphical interface which is easy to use "
10308
"by those new to Ubuntu."
10309
msgstr ""
10310
10311
#: serverguide/C/package-management.xml:21(para)
10312
msgid ""
10313
"Ubuntu's package management system is derived from the same system used by "
10314
"the Debian GNU/Linux distribution. The package files contain all of the "
10315
"necessary files, meta-data, and instructions to implement a particular "
10316
"functionality or software application on your Ubuntu computer."
10317
msgstr ""
10318
10319
#: serverguide/C/package-management.xml:24(para)
10320
msgid ""
10321
"Debian package files typically have the extension '.deb', and typically "
10322
"exist in <emphasis role=\"italics\">repositories</emphasis> which are "
10323
"collections of packages found on various media, such as CD-ROM discs, or "
10324
"online. Packages are normally of the pre-compiled binary format; thus "
10325
"installation is quick and requires no compiling of software."
10326
msgstr ""
10327
10328
#: serverguide/C/package-management.xml:27(para)
10329
msgid ""
10330
"Many complex packages use the concept of <emphasis "
10331
"role=\"italics\">dependencies</emphasis>. Dependencies are additional "
10332
"packages required by the principal package in order to function properly. "
10333
"For example, the speech synthesis package "
10334
"<application>Festival</application> depends upon the package "
10335
"<application>libasound2</application>, which is a package supplying the "
10336
"<application>ALSA</application> sound library needed for audio playback. In "
10337
"order for <application>Festival</application> to function, it and all of its "
10338
"dependencies must be installed. The software management tools in Ubuntu will "
10339
"do this automatically."
10340
msgstr ""
10341
10342
#: serverguide/C/package-management.xml:32(title)
10343
msgid "dpkg"
10344
msgstr ""
10345
10346
#: serverguide/C/package-management.xml:34(para)
10347
msgid ""
10348
"<application>dpkg</application> is a package manager for "
10349
"<emphasis>Debian</emphasis> based systems. It can install, remove, and build "
10350
"packages, but unlike other package management system's it can not "
10351
"automatically download and install packages and their dependencies. This "
10352
"section covers using <application>dpkg</application> to manage locally "
10353
"installed packages:"
10354
msgstr ""
10355
10356
#: serverguide/C/package-management.xml:43(para)
10357
msgid ""
10358
"To list all packages installed on the system, from a terminal prompt enter:"
10359
msgstr ""
10360
10361
#: serverguide/C/package-management.xml:48(command)
10362
msgid "dpkg -l"
10363
msgstr ""
10364
10365
#: serverguide/C/package-management.xml:54(para)
10366
msgid ""
10367
"Depending on the amount of packages on your system, this can generate a "
10368
"large amount of output. Pipe the output through "
10369
"<application>grep</application> to see if a specific package is installed:"
10370
msgstr ""
10371
10372
#: serverguide/C/package-management.xml:60(command)
10373
msgid "dpkg -l | grep apache2"
10374
msgstr ""
10375
10376
#: serverguide/C/package-management.xml:63(para)
10377
msgid ""
10378
"Replace <emphasis>apache2</emphasis> with any package name, part of a "
10379
"package name, or other regular expression."
10380
msgstr ""
10381
10382
#: serverguide/C/package-management.xml:70(para)
10383
msgid ""
10384
"To list the files installed by a package, in this case the "
10385
"<application>ufw</application> package, enter:"
10386
msgstr ""
10387
10388
#: serverguide/C/package-management.xml:75(command)
10389
msgid "dpkg -L ufw"
10390
msgstr ""
10391
10392
#: serverguide/C/package-management.xml:81(para)
10393
msgid ""
10394
"If you are not sure which package installed a file, <application>dpkg -"
10395
"S</application> may be able to tell you. For example:"
10396
msgstr ""
10397
10398
#: serverguide/C/package-management.xml:87(command)
10399
msgid "dpkg -S /etc/host.conf"
10400
msgstr ""
10401
10402
#: serverguide/C/package-management.xml:88(computeroutput)
10403
#, no-wrap
10404
msgid "base-files: /etc/host.conf"
10405
msgstr ""
10406
10407
#: serverguide/C/package-management.xml:91(para)
10408
msgid ""
10409
"The output shows that the <filename>/etc/host.conf</filename> belongs to the "
10410
"<application>base-files</application> package."
10411
msgstr ""
10412
10413
#: serverguide/C/package-management.xml:96(para)
10414
msgid ""
10415
"Many files are automatically generated during the package install process, "
10416
"and even though they are on the filesystem <command>dpkg -S</command> may "
10417
"not know which package they belong to."
10418
msgstr ""
10419
10420
#: serverguide/C/package-management.xml:105(para)
10421
msgid "You can install a local <emphasis>.deb</emphasis> file by entering:"
10422
msgstr ""
10423
10424
#: serverguide/C/package-management.xml:110(command)
10425
msgid "sudo dpkg -i zip_2.32-1_i386.deb"
10426
msgstr ""
10427
10428
#: serverguide/C/package-management.xml:113(para)
10429
msgid ""
10430
"Change <filename>zip_2.32-1_i386.deb</filename> to the actual file name of "
10431
"the local .deb file."
10432
msgstr ""
10433
10434
#: serverguide/C/package-management.xml:120(para)
10435
msgid "Uninstalling a package can be accomplished by:"
10436
msgstr ""
10437
10438
#: serverguide/C/package-management.xml:125(command)
10439
msgid "sudo dpkg -r zip"
10440
msgstr ""
10441
10442
#: serverguide/C/package-management.xml:129(para)
10443
msgid ""
10444
"Uninstalling packages using <application>dpkg</application>, in most cases, "
10445
"is <emphasis>NOT</emphasis> recommended. It is better to use a package "
10446
"manager that handles dependencies, to ensure that the system is in a "
10447
"consistent state. For example using <command>dpkg -r</command> you can "
10448
"remove the <application>zip</application> package, but any packages that "
10449
"depend on it will still be installed and may no longer function correctly."
10450
msgstr ""
10451
10452
#: serverguide/C/package-management.xml:140(para)
10453
msgid ""
10454
"For more <application>dpkg</application> options see the man page: "
10455
"<command>man dpkg</command>."
10456
msgstr ""
10457
10458
#: serverguide/C/package-management.xml:146(title)
10459
msgid "Apt-Get"
10460
msgstr ""
10461
10462
#: serverguide/C/package-management.xml:147(para)
10463
msgid ""
10464
"The <application>apt-get</application> command is a powerful command-line "
10465
"tool used to work with Ubuntu's <emphasis>Advanced Packaging Tool</emphasis> "
10466
"(APT) performing such functions as installation of new software packages, "
10467
"upgrade of existing software packages, updating of the package list index, "
10468
"and even upgrading the entire Ubuntu system."
10469
msgstr ""
10470
10471
#: serverguide/C/package-management.xml:150(para)
10472
msgid ""
10473
"Being a simple command-line tool, <application>apt-get</application> has "
10474
"numerous advantages over other package management tools available in Ubuntu "
10475
"for server administrators. Some of these advantages include ease of use over "
10476
"simple terminal connections (SSH) and the ability to be used in system "
10477
"administration scripts, which can in turn be automated by the "
10478
"<application>cron</application> scheduling utility."
10479
msgstr ""
10480
10481
#: serverguide/C/package-management.xml:157(para)
10482
msgid ""
10483
"<emphasis role=\"bold\">Install a Package</emphasis>: Installation of "
10484
"packages using the <application>apt-get</application> tool is quite simple. "
10485
"For example, to install the network scanner <emphasis "
10486
"role=\"italics\">nmap</emphasis>, type the following: <screen>\n"
10487
"<command>sudo apt-get install nmap</command>\n"
10488
"</screen>"
10489
msgstr ""
10490
10491
#: serverguide/C/package-management.xml:165(para)
10492
msgid ""
10493
"<emphasis role=\"bold\">Remove a Package</emphasis>: Removal of a package or "
10494
"packages is also a straightforward and simple process. To remove the nmap "
10495
"package installed in the previous example, type the following: <screen>\n"
10496
"<command>sudo apt-get remove nmap</command>\n"
10497
"</screen>"
10498
msgstr ""
10499
10500
#: serverguide/C/package-management.xml:172(para)
10501
msgid ""
10502
"<emphasis role=\"bold\">Multiple Packages</emphasis>: You may specify "
10503
"multiple packages to be installed or removed, separated by spaces."
10504
msgstr ""
10505
10506
#: serverguide/C/package-management.xml:175(para)
10507
msgid ""
10508
"Also, adding the <emphasis>--purge</emphasis> options to <command>apt-get "
10509
"remove</command> will remove the package configuration files as well. This "
10510
"may or may not be the desired effect so use with caution."
10511
msgstr ""
10512
10513
#: serverguide/C/package-management.xml:181(para)
10514
msgid ""
10515
"<emphasis role=\"bold\">Update the Package Index</emphasis>: The APT package "
10516
"index is essentially a database of available packages from the repositories "
10517
"defined in the <filename>/etc/apt/sources.list</filename> file. To update "
10518
"the local package index with the latest changes made in repositories, type "
10519
"the following: <screen>\n"
10520
"<command>sudo apt-get update</command>\n"
10521
"</screen>"
10522
msgstr ""
10523
10524
#: serverguide/C/package-management.xml:189(para)
10525
msgid ""
10526
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: Over time, updated "
10527
"versions of packages currently installed on your computer may become "
10528
"available from the package repositories (for example security updates). To "
10529
"upgrade your system, first update your package index as outlined above, and "
10530
"then type: <screen>\n"
10531
"<command>sudo apt-get upgrade</command>\n"
10532
"</screen>"
10533
msgstr ""
10534
10535
#: serverguide/C/package-management.xml:195(para)
10536
msgid ""
10537
"For information on upgrading to a new Ubuntu release see <xref "
10538
"linkend=\"installing-upgrading\"/>."
10539
msgstr ""
10540
10541
#: serverguide/C/package-management.xml:153(para)
10542
msgid ""
10543
"Some examples of popular uses for the <application>apt-get</application> "
10544
"utility: <placeholder-1/>"
10545
msgstr ""
10546
10547
#: serverguide/C/package-management.xml:201(para)
10548
msgid ""
10549
"Actions of the <application>apt-get</application> command, such as "
10550
"installation and removal of packages, are logged in the /var/log/dpkg.log "
10551
"log file."
10552
msgstr ""
10553
10554
#: serverguide/C/package-management.xml:204(para)
10555
msgid ""
10556
"For further information about the use of <application>APT</application>, "
10557
"read the comprehensive <ulink url=\"http://www.debian.org/doc/user-"
10558
"manuals#apt-howto\">Debian APT User Manual</ulink> or type: <screen>apt-get "
10559
"help</screen>"
10560
msgstr ""
10561
10562
#: serverguide/C/package-management.xml:208(title)
10563
msgid "Aptitude"
10564
msgstr ""
10565
10566
#: serverguide/C/package-management.xml:209(para)
10567
msgid ""
10568
"<application>Aptitude</application> is a menu-driven, text-based front-end "
10569
"to the <emphasis>Advanced Packaging Tool</emphasis> (APT) system. Many of "
10570
"the common package management functions, such as installation, removal, and "
10571
"upgrade, are performed in <application>Aptitude</application> with single-"
10572
"key commands, which are typically lowercase letters."
10573
msgstr ""
10574
10575
#: serverguide/C/package-management.xml:212(para)
10576
msgid ""
10577
"<application>Aptitude</application> is best suited for use in a non-"
10578
"graphical terminal environment to ensure proper functioning of the command "
10579
"keys. You may start <application>Aptitude</application> as a normal user "
10580
"with the following command at a terminal prompt: <screen>\n"
10581
"<command>sudo aptitude</command>\n"
10582
"</screen>"
10583
msgstr ""
10584
10585
#: serverguide/C/package-management.xml:219(para)
10586
msgid ""
10587
"When <application>Aptitude</application> starts, you will see a menu bar at "
10588
"the top of the screen and two panes below the menu bar. The top pane "
10589
"contains package categories, such as <emphasis role=\"italics\">New "
10590
"Packages</emphasis> and <emphasis role=\"italics\">Not Installed "
10591
"Packages</emphasis>. The bottom pane contains information related to the "
10592
"packages and package categories."
10593
msgstr ""
10594
10595
#: serverguide/C/package-management.xml:222(para)
10596
msgid ""
10597
"Using <application>Aptitude</application> for package management is "
10598
"relatively straightforward, and the user interface makes common tasks simple "
10599
"to perform. The following are examples of common package management "
10600
"functions as performed in <application>Aptitude</application>:"
10601
msgstr ""
10602
10603
#: serverguide/C/package-management.xml:226(para)
10604
msgid ""
10605
"<emphasis role=\"bold\">Install Packages</emphasis>: To install a package, "
10606
"locate the package via the Not Installed Packages package category, for "
10607
"example, by using the keyboard arrow keys and the <keycap>ENTER</keycap> "
10608
"key, and highlight the package you wish to install. After highlighting the "
10609
"package you wish to install, press the <keycap>+</keycap> key, and the "
10610
"package entry should turn <emphasis role=\"italics\">green</emphasis>, "
10611
"indicating it has been marked for installation. Now press <keycap>g</keycap> "
10612
"to be presented with a summary of package actions. Press <keycap>g</keycap> "
10613
"again, and you will be prompted to become root to complete the installation. "
10614
"Press <keycap>ENTER</keycap> which will result in a Password: prompt. Enter "
10615
"your user password to become root. Finally, press <keycap>g</keycap> once "
10616
"more and you'll be prompted to download the package. Press "
10617
"<keycap>ENTER</keycap> on the <emphasis role=\"italics\">Continue</emphasis> "
10618
"prompt, and downloading and installation of the package will commence."
10619
msgstr ""
10620
10621
#: serverguide/C/package-management.xml:230(para)
10622
msgid ""
10623
"<emphasis role=\"bold\">Remove Packages</emphasis>: To remove a package, "
10624
"locate the package via the Installed Packages package category, for example, "
10625
"by using the keyboard arrow keys and the <keycap>ENTER</keycap> key, and "
10626
"highlight the package you wish to remove. After highlighting the package you "
10627
"wish to install, press the <keycap>-</keycap> key, and the package entry "
10628
"should turn <emphasis role=\"italics\">pink</emphasis>, indicating it has "
10629
"been marked for removal. Now press <keycap>g</keycap> to be presented with a "
10630
"summary of package actions. Press <keycap>g</keycap> again, and you will be "
10631
"prompted to become root to complete the installation. Press "
10632
"<keycap>ENTER</keycap> which will result in a Password: prompt. Enter your "
10633
"user password to become root. Finally, press <keycap>g</keycap> once more, "
10634
"and you'll be prompted to download the package. Press <keycap>ENTER</keycap> "
10635
"on the <emphasis role=\"italics\">Continue</emphasis> prompt, and removal of "
10636
"the package will commence."
10637
msgstr ""
10638
10639
#: serverguide/C/package-management.xml:234(para)
10640
msgid ""
10641
"<emphasis role=\"bold\">Update Package Index</emphasis>: To update the "
10642
"package index, simply press the <keycap>u</keycap> key and you will be "
10643
"prompted to become root to complete the update. Press <keycap>ENTER</keycap> "
10644
"which will result in a Password: prompt. Enter your user password to become "
10645
"root. Updating of the package index will commence. Press "
10646
"<keycap>ENTER</keycap> on the OK prompt when the download dialog is "
10647
"presented to complete the process."
10648
msgstr ""
10649
10650
#: serverguide/C/package-management.xml:238(para)
10651
msgid ""
10652
"<emphasis role=\"bold\">Upgrade Packages</emphasis>: To upgrade packages, "
10653
"perform the update of the package index as detailed above, and then press "
10654
"the <keycap>U</keycap> key to mark all packages with updates. Now press "
10655
"<keycap>g</keycap> whereby you'll be presented with a summary of package "
10656
"actions. Press <keycap>g</keycap> again, and you will be prompted to become "
10657
"root to complete the installation. Press <keycap>ENTER</keycap> which will "
10658
"result in a Password: prompt. Enter your user password to become root. "
10659
"Finally, press <keycap>g</keycap> once more, and you'll be prompted to "
10660
"download the packages. Press <keycap>ENTER</keycap> on the <emphasis "
10661
"role=\"italics\">Continue</emphasis> prompt, and upgrade of the packages "
10662
"will commence."
10663
msgstr ""
10664
10665
#: serverguide/C/package-management.xml:245(para)
10666
msgid "<emphasis role=\"bold\">i</emphasis>: Installed package"
10667
msgstr ""
10668
10669
#: serverguide/C/package-management.xml:250(para)
10670
msgid ""
10671
"<emphasis role=\"bold\">c</emphasis>: Package not installed, but package "
10672
"configuration remains on system"
10673
msgstr ""
10674
10675
#: serverguide/C/package-management.xml:254(para)
10676
msgid "<emphasis role=\"bold\">p</emphasis>: Purged from system"
10677
msgstr ""
10678
10679
#: serverguide/C/package-management.xml:258(para)
10680
msgid "<emphasis role=\"bold\">v</emphasis>: Virtual package"
10681
msgstr ""
10682
10683
#: serverguide/C/package-management.xml:262(para)
10684
msgid "<emphasis role=\"bold\">B</emphasis>: Broken package"
10685
msgstr ""
10686
10687
#: serverguide/C/package-management.xml:266(para)
10688
msgid ""
10689
"<emphasis role=\"bold\">u</emphasis>: Unpacked files, but package not yet "
10690
"configured"
10691
msgstr ""
10692
10693
#: serverguide/C/package-management.xml:270(para)
10694
msgid ""
10695
"<emphasis role=\"bold\">C</emphasis>: Half-configured - Configuration failed "
10696
"and requires fix"
10697
msgstr ""
10698
10699
#: serverguide/C/package-management.xml:274(para)
10700
msgid ""
10701
"<emphasis role=\"bold\">H</emphasis>: Half-installed - Removal failed and "
10702
"requires fix"
10703
msgstr ""
10704
10705
#: serverguide/C/package-management.xml:242(para)
10706
msgid ""
10707
"The first column of information displayed in the package list in the top "
10708
"pane, when actually viewing packages lists the current state of the package, "
10709
"and uses the following key to describe the state of the package: "
10710
"<placeholder-1/>"
10711
msgstr ""
10712
10713
#: serverguide/C/package-management.xml:280(para)
10714
msgid ""
10715
"To exit Aptitude, simply press the <keycap>q</keycap> key and confirm you "
10716
"wish to exit. Many other functions are available from the Aptitude menu by "
10717
"pressing the <keycap>F10</keycap> key."
10718
msgstr ""
10719
10720
#: serverguide/C/package-management.xml:285(title)
10721
msgid "Automatic Updates"
10722
msgstr ""
10723
10724
#: serverguide/C/package-management.xml:287(para)
10725
msgid ""
10726
"The <application>unattended-upgrades</application> package can be used to "
10727
"automatically install updated packages, and can be configured to update all "
10728
"packages or just install security updates. First, install the package by "
10729
"entering the following in a terminal:"
10730
msgstr ""
10731
10732
#: serverguide/C/package-management.xml:293(command)
10733
msgid "sudo apt-get install unattended-upgrades"
10734
msgstr ""
10735
10736
#: serverguide/C/package-management.xml:296(para)
10737
msgid ""
10738
"To configure <application>unattended-upgrades</application>, edit "
10739
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> and adjust "
10740
"the following to fit your needs:"
10741
msgstr ""
10742
10743
#: serverguide/C/package-management.xml:301(programlisting)
10744
#, no-wrap
10745
msgid ""
10746
"\n"
10747
"Unattended-Upgrade::Allowed-Origins {\n"
10748
" \"Ubuntu lucid-security\";\n"
10749
"// \"Ubuntu lucid-updates\";\n"
10750
"};\n"
10751
msgstr ""
10752
10753
#: serverguide/C/package-management.xml:308(para)
10754
msgid ""
10755
"Certain packages can also be <emphasis>blacklisted</emphasis> and therefore "
10756
"will not be automatically updated. To blacklist a package, add it to the "
10757
"list:"
10758
msgstr ""
10759
10760
#: serverguide/C/package-management.xml:313(programlisting)
10761
#, no-wrap
10762
msgid ""
10763
"\n"
10764
"Unattended-Upgrade::Package-Blacklist {\n"
10765
"// \"vim\";\n"
10766
"// \"libc6\";\n"
10767
"// \"libc6-dev\";\n"
10768
"// \"libc6-i686\";\n"
10769
"};\n"
10770
msgstr ""
10771
10772
#: serverguide/C/package-management.xml:323(para)
10773
msgid ""
10774
"The double <emphasis><quote>//</quote></emphasis> serve as comments, so "
10775
"whatever follows \"//\" will not be evaluated."
10776
msgstr ""
10777
10778
#: serverguide/C/package-management.xml:328(para)
10779
msgid ""
10780
"To enable automatic updates, edit "
10781
"<filename>/etc/apt/apt.conf.d/10periodic</filename> and set the appropriate "
10782
"<application>apt</application> configuration options:"
10783
msgstr ""
10784
10785
#: serverguide/C/package-management.xml:332(programlisting)
10786
#, no-wrap
10787
msgid ""
10788
"\n"
10789
"APT::Periodic::Update-Package-Lists \"1\";\n"
10790
"APT::Periodic::Download-Upgradeable-Packages \"1\";\n"
10791
"APT::Periodic::AutocleanInterval \"7\";\n"
10792
"APT::Periodic::Unattended-Upgrade \"1\";\n"
10793
msgstr ""
10794
10795
#: serverguide/C/package-management.xml:339(para)
10796
msgid ""
10797
"The above configuration updates the package list, downloads, and installs "
10798
"available upgrades every day. The local download archive is cleaned every "
10799
"week."
10800
msgstr ""
10801
10802
#: serverguide/C/package-management.xml:345(para)
10803
msgid ""
10804
"You can read more about <application>apt</application> Periodic "
10805
"configuration options in the <filename>/etc/cron.daily/apt</filename> script "
10806
"header."
10807
msgstr ""
10808
10809
#: serverguide/C/package-management.xml:350(para)
10810
msgid ""
10811
"The results of <application>unattended-upgrades</application> will be logged "
10812
"to <filename>/var/log/unattended-upgrades</filename>."
10813
msgstr ""
10814
10815
#: serverguide/C/package-management.xml:355(title)
10816
msgid "Notifications"
10817
msgstr ""
10818
10819
#: serverguide/C/package-management.xml:357(para)
10820
msgid ""
10821
"Configuring <emphasis>Unattended-Upgrade::Mail</emphasis> in "
10822
"<filename>/etc/apt/apt.conf.d/50unattended-upgrades</filename> will enable "
10823
"<application>unattended-upgrades</application> to email an administrator "
10824
"detailing any packages that need upgrading or have problems."
10825
msgstr ""
10826
10827
#: serverguide/C/package-management.xml:362(para)
10828
msgid ""
10829
"Another useful package is <application>apticron</application>. "
10830
"<application>apticron</application> will configure a "
10831
"<application>cron</application> job to email an administrator information "
10832
"about any packages on the system that have updates available, as well as a "
10833
"summary of changes in each package."
10834
msgstr ""
10835
10836
#: serverguide/C/package-management.xml:368(para)
10837
msgid ""
10838
"To install the <application>apticron</application> package, in a terminal "
10839
"enter:"
10840
msgstr ""
10841
10842
#: serverguide/C/package-management.xml:373(command)
10843
msgid "sudo apt-get install apticron"
10844
msgstr ""
10845
10846
#: serverguide/C/package-management.xml:376(para)
10847
msgid ""
10848
"Once the package is installed edit "
10849
"<filename>/etc/apticron/apticron.conf</filename>, to set the email address "
10850
"and other options:"
10851
msgstr ""
10852
10853
#: serverguide/C/package-management.xml:380(programlisting)
10854
#, no-wrap
10855
msgid ""
10856
"\n"
10857
"EMAIL=\"root@example.com\"\n"
10858
msgstr ""
10859
10860
#: serverguide/C/package-management.xml:389(para)
10861
msgid ""
10862
"Configuration of the <emphasis>Advanced Packaging Tool</emphasis> (APT) "
10863
"system repositories is stored in the /etc/apt/sources.list configuration "
10864
"file. An example of this file is referenced here, along with information on "
10865
"adding or removing repository references from the file."
10866
msgstr ""
10867
10868
#: serverguide/C/package-management.xml:395(para)
10869
msgid ""
10870
"<ulink url=\"../sample/sources.list\">Here</ulink> is a simple example of a "
10871
"typical <filename>/etc/apt/sources.list</filename> file."
10872
msgstr ""
10873
10874
#: serverguide/C/package-management.xml:399(para)
10875
msgid ""
10876
"You may edit the file to enable repositories or disable them. For example, "
10877
"to disable the requirement of inserting the Ubuntu CD-ROM whenever package "
10878
"operations occur, simply comment out the appropriate line for the CD-ROM, "
10879
"which appears at the top of the file:"
10880
msgstr ""
10881
10882
#: serverguide/C/package-management.xml:404(screen)
10883
#, no-wrap
10884
msgid ""
10885
"\n"
10886
"# no more prompting for CD-ROM please\n"
10887
"# deb cdrom:[Ubuntu 10.04_Lucid_Lynx - Release i386 (20070419.1)]/ lucid "
10888
"main restricted\n"
10889
msgstr ""
10890
10891
#: serverguide/C/package-management.xml:410(title)
10892
msgid "Extra Repositories"
10893
msgstr ""
10894
10895
#: serverguide/C/package-management.xml:411(para)
10896
msgid ""
10897
"In addition to the officially supported package repositories available for "
10898
"Ubuntu, there exist additional community-maintained repositories which add "
10899
"thousands more potential packages for installation. Two of the most popular "
10900
"are the <emphasis>Universe</emphasis> and <emphasis>Multiverse</emphasis> "
10901
"repositories. These repositories are not officially supported by Ubuntu, but "
10902
"because they are maintained by the community they generally provide packages "
10903
"which are safe for use with your Ubuntu computer."
10904
msgstr ""
10905
10906
#: serverguide/C/package-management.xml:414(para)
10907
msgid ""
10908
"Packages in the <emphasis>Multiverse</emphasis> repository often have "
10909
"licensing issues that prevent them from being distributed with a free "
10910
"operating system, and they may be illegal in your locality."
10911
msgstr ""
10912
10913
#: serverguide/C/package-management.xml:416(para)
10914
msgid ""
10915
"Be advised that neither the <emphasis>Universe</emphasis> or "
10916
"<emphasis>Multiverse</emphasis> repositories contain officially supported "
10917
"packages. In particular, there may not be security updates for these "
10918
"packages."
10919
msgstr ""
10920
10921
#: serverguide/C/package-management.xml:420(para)
10922
msgid ""
10923
"Many other package sources are available, sometimes even offering only one "
10924
"package, as in the case of package sources provided by the developer of a "
10925
"single application. You should always be very careful and cautious when "
10926
"using non-standard package sources, however. Research the source and "
10927
"packages carefully before performing any installation, as some package "
10928
"sources and their packages could render your system unstable or non-"
10929
"functional in some respects."
10930
msgstr ""
10931
10932
#: serverguide/C/package-management.xml:423(para)
10933
msgid ""
10934
"By default, the <emphasis>Universe</emphasis> and "
10935
"<emphasis>Multiverse</emphasis> repositories are enabled but if you would "
10936
"like to disable them edit <filename>/etc/apt/sources.list</filename> and "
10937
"comment the following lines:"
10938
msgstr ""
10939
10940
#: serverguide/C/package-management.xml:430(programlisting)
10941
#, no-wrap
10942
msgid ""
10943
"\n"
10944
"deb http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
10945
"deb-src http://archive.ubuntu.com/ubuntu lucid universe multiverse\n"
10946
"\n"
10947
"deb http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
10948
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid universe\n"
10949
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
10950
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates universe\n"
10951
"\n"
10952
"deb http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
10953
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid multiverse\n"
10954
"deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
10955
"deb-src http://us.archive.ubuntu.com/ubuntu/ lucid-updates multiverse\n"
10956
"\n"
10957
"deb http://security.ubuntu.com/ubuntu lucid-security universe\n"
10958
"deb-src http://security.ubuntu.com/ubuntu lucid-security universe\n"
10959
"deb http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
10960
"deb-src http://security.ubuntu.com/ubuntu lucid-security multiverse\n"
10961
msgstr ""
10962
10963
#: serverguide/C/package-management.xml:456(para)
10964
msgid ""
10965
"Most of the material covered in this chapter is available in "
10966
"<application>man</application> pages, many of which are available online."
10967
msgstr ""
10968
10969
#: serverguide/C/package-management.xml:463(para)
10970
msgid ""
10971
"The <ulink "
10972
"url=\"https://help.ubuntu.com/community/InstallingSoftware\">InstallingSoftwa"
10973
"re</ulink> Ubuntu wiki page has more information."
10974
msgstr ""
10975
10976
#: serverguide/C/package-management.xml:468(para)
10977
msgid ""
10978
"For more <application>dpkg</application> details see the <ulink "
10979
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/dpkg.1.html\">dpkg "
10980
"man page</ulink>."
10981
msgstr ""
10982
10983
#: serverguide/C/package-management.xml:474(para)
10984
msgid ""
10985
"The <ulink url=\"http://www.debian.org/doc/manuals/apt-howto/\">APT "
10986
"HOWTO</ulink> and <ulink "
10987
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/apt-get.8.html\">apt-"
10988
"get man page</ulink> contain useful information regarding <application>apt-"
10989
"get</application> usage."
10990
msgstr ""
10991
10992
#: serverguide/C/package-management.xml:481(para)
10993
msgid ""
10994
"See the <ulink "
10995
"url=\"http://manpages.ubuntu.com/manpages/lucid/man8/aptitude.8.html\">aptitu"
10996
"de man page</ulink> for more <application>aptitude</application> options."
10997
msgstr ""
10998
10999
#: serverguide/C/package-management.xml:487(para)
11000
msgid ""
11001
"The <ulink "
11002
"url=\"https://help.ubuntu.com/community/Repositories/Ubuntu\">Adding "
11003
"Repositories HOWTO (Ubuntu Wiki)</ulink> page contains more details on "
11004
"adding repositories."
11005
msgstr ""
11006
11007
#: serverguide/C/other-apps.xml:13(title)
11008
msgid "Other Useful Applications"
11009
msgstr ""
11010
11011
#: serverguide/C/other-apps.xml:15(para)
11012
msgid ""
11013
"There are many very useful applications developed by the Ubuntu Server Team, "
11014
"and others that are well integrated with Ubuntu Server Edition, that might "
11015
"not be well known. This chapter will showcase some useful applications that "
11016
"can make administering an Ubuntu server, or many Ubuntu servers, that much "
11017
"easier."
11018
msgstr ""
11019
11020
#: serverguide/C/other-apps.xml:23(title)
11021
msgid "pam_motd"
11022
msgstr ""
11023
11024
#: serverguide/C/other-apps.xml:25(para)
11025
msgid ""
11026
"When logging into an Ubuntu server you may have noticed the informative "
11027
"Message Of The Day (MOTD). This information is obtained and displayed using "
11028
"a couple of packages:"
11029
msgstr ""
11030
11031
#: serverguide/C/other-apps.xml:32(para)
11032
msgid ""
11033
"<emphasis>landscape-common:</emphasis> provides the core libraries of "
11034
"<application>landscape-client</application>, which can be used to manage "
11035
"systems using the web based <emphasis>Landscape</emphasis> application. The "
11036
"package includes the <application>/usr/bin/landscape-sysinfo</application> "
11037
"utility which is used to gather the information displayed in the MOTD."
11038
msgstr ""
11039
11040
#: serverguide/C/other-apps.xml:40(para)
11041
msgid ""
11042
"<emphasis>update-notifier-common:</emphasis> is used to automatically update "
11043
"the MOTD via <application>pam_motd</application> module."
11044
msgstr ""
11045
11046
#: serverguide/C/other-apps.xml:46(para)
11047
msgid ""
11048
"<application>pam_motd</application> executes the scripts in "
11049
"<filename>/etc/update-motd.d</filename> in order based on the number "
11050
"prepended to the script. The output of the scripts is written to "
11051
"<filename>/var/run/motd</filename>, keeping the numerical order, then "
11052
"concatenated with <filename>/etc/motd.tail</filename>."
11053
msgstr ""
11054
11055
#: serverguide/C/other-apps.xml:52(para)
11056
msgid ""
11057
"You can add your own dynamic information to the MOTD. For example, to add "
11058
"local weather information:"
11059
msgstr ""
11060
11061
#: serverguide/C/other-apps.xml:58(para)
11062
msgid "First, install the <application>weather-util</application> package:"
11063
msgstr ""
11064
11065
#: serverguide/C/other-apps.xml:63(command)
11066
msgid "sudo apt-get install weather-util"
11067
msgstr ""
11068
11069
#: serverguide/C/other-apps.xml:68(para)
11070
msgid ""
11071
"The <application>weather</application> utility uses METAR data from the "
11072
"National Oceanic and Atmospheric Administration and forecasts from the "
11073
"National Weather Service. In order to find local information you will need "
11074
"the 4-character ICAO location indicator. This can be determined by browsing "
11075
"to the <ulink url=\"http://www.weather.gov/tg/siteloc.shtml\">National "
11076
"Weather Service</ulink> site."
11077
msgstr ""
11078
11079
#: serverguide/C/other-apps.xml:75(para)
11080
msgid ""
11081
"Although the National Weather Service is a United States government agency "
11082
"there are weather stations available world wide. However, local weather "
11083
"information for all locations outside the U.S. may not be available."
11084
msgstr ""
11085
11086
#: serverguide/C/other-apps.xml:81(para)
11087
msgid ""
11088
"Create <filename>/usr/local/bin/local-weather</filename>, a simple shell "
11089
"script to use <application>weather</application> with your local ICAO "
11090
"indicator:"
11091
msgstr ""
11092
11093
#: serverguide/C/other-apps.xml:86(programlisting)
11094
#, no-wrap
11095
msgid ""
11096
"\n"
11097
"#!/bin/sh\n"
11098
"#\n"
11099
"#\n"
11100
"# Prints the local weather information for the MOTD.\n"
11101
"#\n"
11102
"#\n"
11103
"\n"
11104
"# Replace KINT with your local weather station.\n"
11105
"# Local stations can be found here: http://www.weather.gov/tg/siteloc.shtml\n"
11106
"\n"
11107
"echo\n"
11108
"weather -i KINT\n"
11109
"echo\n"
11110
"\n"
11111
msgstr ""
11112
11113
#: serverguide/C/other-apps.xml:104(para)
11114
msgid "Make the script executable:"
11115
msgstr ""
11116
11117
#: serverguide/C/other-apps.xml:109(command)
11118
msgid "sudo chmod 755 /usr/local/bin/local-weather"
11119
msgstr ""
11120
11121
#: serverguide/C/other-apps.xml:113(para)
11122
msgid ""
11123
"Next, create a symlink to <filename>/etc/update-motd.d/98-local-"
11124
"weather</filename>:"
11125
msgstr ""
11126
11127
#: serverguide/C/other-apps.xml:118(command)
11128
msgid ""
11129
"sudo ln -s /usr/local/bin/local-weather /etc/update-motd.d/98-local-weather"
11130
msgstr ""
11131
11132
#: serverguide/C/other-apps.xml:122(para)
11133
msgid "Finally, exit the server and re-login to view the new MOTD."
11134
msgstr ""
11135
11136
#: serverguide/C/other-apps.xml:128(para)
11137
msgid ""
11138
"You should now be greeted with some useful information, and some information "
11139
"about the local weather that may not be quite so useful. Hopefully the "
11140
"<application>local-weather</application> example demonstrates the "
11141
"flexibility of <application>pam_motd</application>."
11142
msgstr ""
11143
11144
#: serverguide/C/other-apps.xml:136(title)
11145
msgid "etckeeper"
11146
msgstr ""
11147
11148
#: serverguide/C/other-apps.xml:138(para)
11149
msgid ""
11150
"<application>etckeeper</application> allows the contents of <filename "
11151
"role=\"directory\">/etc</filename> be easily stored in Version Control "
11152
"System (VCS) repository. It hooks into <application>apt</application> to "
11153
"automatically commit changes to <filename>/etc</filename> when packages are "
11154
"installed or upgraded. Placing <filename>/etc</filename> under version "
11155
"control is considered an industry best practice, and the goal of "
11156
"<application>etckeeper</application> is to make this process as painless as "
11157
"possible."
11158
msgstr ""
11159
11160
#: serverguide/C/other-apps.xml:146(para)
11161
msgid ""
11162
"Install <application>etckeeper</application> by entering the following in a "
11163
"terminal:"
11164
msgstr ""
11165
11166
#: serverguide/C/other-apps.xml:151(command)
11167
msgid "sudo apt-get install etckeeper"
11168
msgstr ""
11169
11170
#: serverguide/C/other-apps.xml:154(para)
11171
msgid ""
11172
"The main configuration file, "
11173
"<filename>/etc/etckeeper/etckeeper.conf</filename>, is fairly simple. The "
11174
"main option is which VCS to use. By default "
11175
"<application>etckeeper</application> is configured to use "
11176
"<application>bzr</application> for version control. The repository is "
11177
"automatically initialized (and committed for the first time) during package "
11178
"installation. It is possible to undo this by entering the following command:"
11179
msgstr ""
11180
11181
#: serverguide/C/other-apps.xml:164(command)
11182
msgid "sudo etckeeper uninit"
11183
msgstr ""
11184
11185
#: serverguide/C/other-apps.xml:167(para)
11186
msgid ""
11187
"By default, etckeeper will commit uncommitted changes made to /etc daily. "
11188
"This can be disabled using the AVOID_DAILY_AUTOCOMMITS configuration option. "
11189
"It will also automatically commit changes before and after package "
11190
"installation. For a more precise tracking of changes, it is recommended to "
11191
"commit your changes manually, together with a commit message, using:"
11192
msgstr ""
11193
11194
#: serverguide/C/other-apps.xml:176(command)
11195
msgid "sudo etckeeper commit \"..Reason for configuration change..\""
11196
msgstr ""
11197
11198
#: serverguide/C/other-apps.xml:179(para)
11199
msgid ""
11200
"Using the VCS commands you can view log information about files in "
11201
"<filename>/etc</filename>:"
11202
msgstr ""
11203
11204
#: serverguide/C/other-apps.xml:184(command)
11205
msgid "sudo bzr log /etc/passwd"
11206
msgstr ""
11207
11208
#: serverguide/C/other-apps.xml:187(para)
11209
msgid ""
11210
"To demonstrate the integration with the package management system, install "
11211
"<application>postfix</application>:"
11212
msgstr ""
11213
11214
#: serverguide/C/other-apps.xml:192(command) serverguide/C/mail.xml:45(command)
11215
msgid "sudo apt-get install postfix"
11216
msgstr ""
11217
11218
#: serverguide/C/other-apps.xml:195(para)
11219
msgid ""
11220
"When the installation is finished, all the "
11221
"<application>postfix</application> configuration files should be committed "
11222
"to the repository:"
11223
msgstr ""
11224
11225
#: serverguide/C/other-apps.xml:201(computeroutput)
11226
#, no-wrap
11227
msgid ""
11228
"Committing to: /etc/\n"
11229
"added aliases.db\n"
11230
"modified group\n"
11231
"modified group-\n"
11232
"modified gshadow\n"
11233
"modified gshadow-\n"
11234
"modified passwd\n"
11235
"modified passwd-\n"
11236
"added postfix\n"
11237
"added resolvconf\n"
11238
"added rsyslog.d\n"
11239
"modified shadow\n"
11240
"modified shadow-\n"
11241
"added init.d/postfix\n"
11242
"added network/if-down.d/postfix\n"
11243
"added network/if-up.d/postfix\n"
11244
"added postfix/dynamicmaps.cf\n"
11245
"added postfix/main.cf\n"
11246
"added postfix/master.cf\n"
11247
"added postfix/post-install\n"
11248
"added postfix/postfix-files\n"
11249
"added postfix/postfix-script\n"
11250
"added postfix/sasl\n"
11251
"added ppp/ip-down.d\n"
11252
"added ppp/ip-down.d/postfix\n"
11253
"added ppp/ip-up.d/postfix\n"
11254
"added rc0.d/K20postfix\n"
11255
"added rc1.d/K20postfix\n"
11256
"added rc2.d/S20postfix\n"
11257
"added rc3.d/S20postfix\n"
11258
"added rc4.d/S20postfix\n"
11259
"added rc5.d/S20postfix\n"
11260
"added rc6.d/K20postfix\n"
11261
"added resolvconf/update-libc.d\n"
11262
"added resolvconf/update-libc.d/postfix\n"
11263
"added rsyslog.d/postfix.conf\n"
11264
"added ufw/applications.d/postfix\n"
11265
"Committed revision 2."
11266
msgstr ""
11267
11268
#: serverguide/C/other-apps.xml:241(para)
11269
msgid ""
11270
"For an example of how <application>etckeeper</application> tracks manual "
11271
"changes, add new a host to <filename>/etc/hosts</filename>. Using "
11272
"<application>bzr</application> you can see which files have been modified:"
11273
msgstr ""
11274
11275
#: serverguide/C/other-apps.xml:247(command)
11276
msgid "sudo bzr status /etc/"
11277
msgstr ""
11278
11279
#: serverguide/C/other-apps.xml:248(computeroutput)
11280
#, no-wrap
11281
msgid ""
11282
"modified:\n"
11283
" hosts"
11284
msgstr ""
11285
11286
#: serverguide/C/other-apps.xml:252(para)
11287
msgid "Now commit the changes:"
11288
msgstr ""
11289
11290
#: serverguide/C/other-apps.xml:257(command)
11291
msgid "sudo etckeeper commit \"new host\""
11292
msgstr ""
11293
11294
#: serverguide/C/other-apps.xml:260(para)
11295
msgid ""
11296
"For more information on <application>bzr</application> see <xref "
11297
"linkend=\"bazaar\"/>."
11298
msgstr ""
11299
11300
#: serverguide/C/other-apps.xml:266(title)
11301
msgid "Byobu"
11302
msgstr ""
11303
11304
#: serverguide/C/other-apps.xml:268(para)
11305
msgid ""
11306
"One of the most useful applications for any system administrator is "
11307
"<application>screen</application>. It allows the execution of multiple "
11308
"shells in one terminal. To make some of the advanced "
11309
"<application>screen</application> features more user friendly, and provide "
11310
"some useful information about the system, the "
11311
"<application>byobu</application> package was created."
11312
msgstr ""
11313
11314
#: serverguide/C/other-apps.xml:275(para)
11315
msgid ""
11316
"When executing <application>byobu</application> pressing the "
11317
"<emphasis>F9</emphasis> key will bring up the "
11318
"<application>Configuration</application> menu. This menu will allow you to:"
11319
msgstr ""
11320
11321
#: serverguide/C/other-apps.xml:281(para)
11322
msgid "View the Help menu"
11323
msgstr ""
11324
11325
#: serverguide/C/other-apps.xml:282(para)
11326
msgid "Change Byobu's background color"
11327
msgstr ""
11328
11329
#: serverguide/C/other-apps.xml:283(para)
11330
msgid "Change Byobu's foreground color"
11331
msgstr ""
11332
11333
#: serverguide/C/other-apps.xml:284(para)
11334
msgid "Toggle status notifications"
11335
msgstr ""
11336
11337
#: serverguide/C/other-apps.xml:285(para)
11338
msgid "Change the key binding set"
11339
msgstr ""
11340
11341
#: serverguide/C/other-apps.xml:286(para)
11342
msgid "Change the escape sequence"
11343
msgstr ""
11344
11345
#: serverguide/C/other-apps.xml:287(para)
11346
msgid "Create new windows"
11347
msgstr ""
11348
11349
#: serverguide/C/other-apps.xml:288(para)
11350
msgid "Manage the default windows"
11351
msgstr ""
11352
11353
#: serverguide/C/other-apps.xml:289(para)
11354
msgid "Byobu currently does not launch at login (toggle on)"
11355
msgstr ""
11356
11357
#: serverguide/C/other-apps.xml:292(para)
11358
msgid ""
11359
"The <emphasis>key bindings</emphasis> determine such things as the escape "
11360
"sequence, new window, change window, etc. There are two key binding sets to "
11361
"choose from <emphasis>f-keys</emphasis> and <emphasis>screen-escape-"
11362
"keys</emphasis>. If you wish to use the original key bindings choose the "
11363
"<emphasis>none</emphasis> set."
11364
msgstr ""
11365
11366
#: serverguide/C/other-apps.xml:298(para)
11367
msgid ""
11368
"<application>byobu</application> provides a menu which displays the Ubuntu "
11369
"release, processor information, memory information, and the time and date. "
11370
"The effect is similar to a desktop menu."
11371
msgstr ""
11372
11373
#: serverguide/C/other-apps.xml:303(para)
11374
msgid ""
11375
"Using the <emphasis>\"Byobu currently does not launch at login (toggle "
11376
"on)\"</emphasis> option will cause <application>byobu</application> to be "
11377
"executed any time a terminal is opened. Changes made to "
11378
"<application>byobu</application> are on a per user basis, and will not "
11379
"affect other users on the system."
11380
msgstr ""
11381
11382
#: serverguide/C/other-apps.xml:309(para)
11383
msgid ""
11384
"One difference when using byobu is the <emphasis>scrollback</emphasis> mode. "
11385
"Press the <emphasis>F7</emphasis> key to enter scrollback mode. Scrollback "
11386
"mode allows you to navigate past output using <emphasis>vi</emphasis> like "
11387
"commands. Here is a quick list of movement commands:"
11388
msgstr ""
11389
11390
#: serverguide/C/other-apps.xml:316(para)
11391
msgid "<emphasis>h</emphasis> - Move the cursor left by one character"
11392
msgstr ""
11393
11394
#: serverguide/C/other-apps.xml:317(para)
11395
msgid "<emphasis>j</emphasis> - Move the cursor down by one line"
11396
msgstr ""
11397
11398
#: serverguide/C/other-apps.xml:318(para)
11399
msgid "<emphasis>k</emphasis> - Move the cursor up by one line"
11400
msgstr ""
11401
11402
#: serverguide/C/other-apps.xml:319(para)
11403
msgid "<emphasis>l</emphasis> - Move the cursor right by one character"
11404
msgstr ""
11405
11406
#: serverguide/C/other-apps.xml:320(para)
11407
msgid "<emphasis>0</emphasis> - Move to the beginning of the current line"
11408
msgstr ""
11409
11410
#: serverguide/C/other-apps.xml:321(para)
11411
msgid "<emphasis>$</emphasis> - Move to the end of the current line"
11412
msgstr ""
11413
11414
#: serverguide/C/other-apps.xml:322(para)
11415
msgid ""
11416
"<emphasis>G</emphasis> - Moves to the specified line (defaults to the end of "
11417
"the buffer)"
11418
msgstr ""
11419
11420
#: serverguide/C/other-apps.xml:323(para)
11421
msgid "<emphasis>/</emphasis> - Search forward"
11422
msgstr ""
11423
11424
#: serverguide/C/other-apps.xml:324(para)
11425
msgid "<emphasis>?</emphasis> - Search backward"
11426
msgstr ""
11427
11428
#: serverguide/C/other-apps.xml:325(para)
11429
msgid ""
11430
"<emphasis>n</emphasis> - Moves to the next match, either forward or backword"
11431
msgstr ""
11432
11433
#: serverguide/C/other-apps.xml:334(para)
11434
msgid ""
11435
"See the <ulink "
11436
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man1/update-motd.1.html\">"
11437
"update-motd man page</ulink> for more options available to "
11438
"<application>update-motd</application>."
11439
msgstr ""
11440
11441
#: serverguide/C/other-apps.xml:340(para)
11442
msgid ""
11443
"The Debian Package of the Day <ulink "
11444
"url=\"http://debaday.debian.net/2007/10/04/weather-check-weather-conditions-"
11445
"and-forecasts-on-the-command-line/\">weather</ulink> article has more "
11446
"details about using the <application>weather</application>utility."
11447
msgstr ""
11448
11449
#: serverguide/C/other-apps.xml:347(para)
11450
msgid ""
11451
"See the <ulink "
11452
"url=\"http://kitenet.net/~joey/code/etckeeper/\">etckeeper</ulink> site for "
11453
"more details on using <application>etckeeper</application>."
11454
msgstr ""
11455
11456
#: serverguide/C/other-apps.xml:353(para)
11457
msgid ""
11458
"The <ulink url=\"https://help.ubuntu.com/community/etckeeper\">etckeeper "
11459
"Ubuntu Wiki</ulink> page."
11460
msgstr ""
11461
11462
#: serverguide/C/other-apps.xml:358(para)
11463
msgid ""
11464
"For the latest news and information about <application>bzr</application> see "
11465
"the <ulink url=\"http://bazaar-vcs.org/\">bzr</ulink> web site."
11466
msgstr ""
11467
11468
#: serverguide/C/other-apps.xml:363(para)
11469
msgid ""
11470
"For more information on <application>screen</application> see the <ulink "
11471
"url=\"http://www.gnu.org/software/screen/\">screen web site</ulink>."
11472
msgstr ""
11473
11474
#: serverguide/C/other-apps.xml:368(para)
11475
msgid ""
11476
"And the <ulink url=\"https://help.ubuntu.com/community/Screen\">Ubuntu Wiki "
11477
"screen</ulink> page."
11478
msgstr ""
11479
11480
#: serverguide/C/other-apps.xml:373(para)
11481
msgid ""
11482
"Also, see the <application>byobu</application><ulink "
11483
"url=\"https://launchpad.net/byobu\">project page</ulink> for more "
11484
"information."
11485
msgstr ""
11486
11487
#: serverguide/C/network-config.xml:14(para)
11488
msgid ""
11489
"Networks consist of two or more devices, such as computer systems, printers, "
11490
"and related equipment which are connected by either physical cabling or "
11491
"wireless links for the purpose of sharing and distributing information among "
11492
"the connected devices."
11493
msgstr ""
11494
11495
#: serverguide/C/network-config.xml:20(para)
11496
msgid ""
11497
"This section provides general and specific information pertaining to "
11498
"networking, including an overview of network concepts and detailed "
11499
"discussion of popular network protocols."
11500
msgstr ""
11501
11502
#: serverguide/C/network-config.xml:27(title)
11503
msgid "Network Configuration"
11504
msgstr ""
11505
11506
#: serverguide/C/network-config.xml:28(para)
11507
msgid ""
11508
"Ubuntu ships with a number of graphical utilities to configure your network "
11509
"devices. This document is geared toward server administrators and will focus "
11510
"on managing your network on the command line."
11511
msgstr "Ubuntu提供了許多圖形化工具來配製您的網路設備。本文適用於服務器管理員並聚焦在命令行中管理您的網路。"
11512
11513
#: serverguide/C/network-config.xml:35(title)
11514
msgid "Ethernet Interfaces"
11515
msgstr ""
11516
11517
#: serverguide/C/network-config.xml:36(para)
11518
msgid ""
11519
"Ethernet interfaces are identified by the system using the naming convention "
11520
"of <emphasis role=\"italix\">ethX</emphasis>, where <emphasis "
11521
"role=\"italic\">X</emphasis> represents a numeric value. The first Ethernet "
11522
"interface is typically identified as <emphasis "
11523
"role=\"italic\">eth0</emphasis>, the second as <emphasis "
11524
"role=\"italic\">eth1</emphasis>, and all others should move up in numerical "
11525
"order."
11526
msgstr ""
11527
11528
#: serverguide/C/network-config.xml:46(title)
11529
msgid "Identify Ethernet Interfaces"
11530
msgstr ""
11531
11532
#: serverguide/C/network-config.xml:47(para)
11533
msgid ""
11534
"To quickly identify all available Ethernet interfaces, you can use the "
11535
"<application>ifconfig</application> command as shown below."
11536
msgstr ""
11537
11538
#: serverguide/C/network-config.xml:52(userinput)
11539
#, no-wrap
11540
msgid "ifconfig -a | grep eth"
11541
msgstr ""
11542
11543
#: serverguide/C/network-config.xml:51(screen)
11544
#, no-wrap
11545
msgid ""
11546
"\n"
11547
"<placeholder-1/>\n"
11548
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a\n"
11549
msgstr ""
11550
11551
#: serverguide/C/network-config.xml:55(para)
11552
msgid ""
11553
"Another application that can help identify all network interfaces available "
11554
"to your system is the <application>lshw</application> command. In the "
11555
"example below, <application>lshw</application> shows a single Ethernet "
11556
"interface with the logical name of <emphasis role=\"italic\">eth0</emphasis> "
11557
"along with bus information, driver details and all supported capabilities."
11558
msgstr ""
11559
11560
#: serverguide/C/network-config.xml:62(userinput)
11561
#, no-wrap
11562
msgid "sudo lshw -class network"
11563
msgstr ""
11564
11565
#: serverguide/C/network-config.xml:61(screen)
11566
#, no-wrap
11567
msgid ""
11568
"\n"
11569
"<placeholder-1/>\n"
11570
" *-network\n"
11571
" description: Ethernet interface\n"
11572
" product: BCM4401-B0 100Base-TX\n"
11573
" vendor: Broadcom Corporation\n"
11574
" physical id: 0\n"
11575
" bus info: pci@0000:03:00.0\n"
11576
" logical name: eth0\n"
11577
" version: 02\n"
11578
" serial: 00:15:c5:4a:16:5a\n"
11579
" size: 10MB/s\n"
11580
" capacity: 100MB/s\n"
11581
" width: 32 bits\n"
11582
" clock: 33MHz\n"
11583
" capabilities: (snipped for brevity)\n"
11584
" configuration: (snipped for brevity)\n"
11585
" resources: irq:17 memory:ef9fe000-ef9fffff\n"
11586
msgstr ""
11587
11588
#: serverguide/C/network-config.xml:83(title)
11589
msgid "Ethernet Interface Logical Names"
11590
msgstr ""
11591
11592
#: serverguide/C/network-config.xml:84(para)
11593
msgid ""
11594
"Interface logical names are configured in the file "
11595
"<filename>/etc/udev/rules.d/70-persistent-net.rules.</filename> If you would "
11596
"like control which interface receives a particular logical name, find the "
11597
"line matching the interfaces physical MAC address and modify the value of "
11598
"<emphasis role=\"italic\">NAME=ethX</emphasis> to the desired logical name. "
11599
"Reboot the system to commit your changes."
11600
msgstr ""
11601
11602
#: serverguide/C/network-config.xml:92(programlisting)
11603
#, no-wrap
11604
msgid ""
11605
"\n"
11606
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11607
"ATTR{address}==\"00:15:c5:4a:16:5a\", ATTR{dev_id}==\"0x0\", "
11608
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth0\"\n"
11609
"SUBSYSTEM==\"net\", ACTION==\"add\", DRIVERS==\"?*\", "
11610
"ATTR{address}==\"00:15:c5:4a:16:5b\", ATTR{dev_id}==\"0x0\", "
11611
"ATTR{type}==\"1\", KERNEL==\"eth*\", NAME=\"eth1\"\n"
11612
msgstr ""
11613
11614
#: serverguide/C/network-config.xml:99(title)
11615
msgid "Ethernet Interface Settings"
11616
msgstr ""
11617
11618
#: serverguide/C/network-config.xml:100(para)
11619
msgid ""
11620
"<application>ethtool</application> is a program that displays and changes "
11621
"Ethernet card settings such as auto-negotiation, port speed, duplex mode, "
11622
"and Wake-on-LAN. It is not installed by default, but is available for "
11623
"installation in the repositories."
11624
msgstr ""
11625
11626
#: serverguide/C/network-config.xml:106(userinput)
11627
#, no-wrap
11628
msgid "sudo apt-get install ethtool"
11629
msgstr ""
11630
11631
#: serverguide/C/network-config.xml:108(para)
11632
msgid ""
11633
"The following is an example of how to view supported features and configured "
11634
"settings of an Ethernet interface."
11635
msgstr ""
11636
11637
#: serverguide/C/network-config.xml:113(userinput)
11638
#, no-wrap
11639
msgid "sudo ethtool eth0"
11640
msgstr ""
11641
11642
#: serverguide/C/network-config.xml:112(screen)
11643
#, no-wrap
11644
msgid ""
11645
"\n"
11646
"<placeholder-1/>\n"
11647
"Settings for eth0:\n"
11648
" Supported ports: [ TP ]\n"
11649
" Supported link modes: 10baseT/Half 10baseT/Full \n"
11650
" 100baseT/Half 100baseT/Full \n"
11651
" 1000baseT/Half 1000baseT/Full \n"
11652
" Supports auto-negotiation: Yes\n"
11653
" Advertised link modes: 10baseT/Half 10baseT/Full \n"
11654
" 100baseT/Half 100baseT/Full \n"
11655
" 1000baseT/Half 1000baseT/Full \n"
11656
" Advertised auto-negotiation: Yes\n"
11657
" Speed: 1000Mb/s\n"
11658
" Duplex: Full\n"
11659
" Port: Twisted Pair\n"
11660
" PHYAD: 1\n"
11661
" Transceiver: internal\n"
11662
" Auto-negotiation: on\n"
11663
" Supports Wake-on: g\n"
11664
" Wake-on: d\n"
11665
" Current message level: 0x000000ff (255)\n"
11666
" Link detected: yes\n"
11667
msgstr ""
11668
11669
#: serverguide/C/network-config.xml:135(para)
11670
msgid ""
11671
"Changes made with the <application>ethtool</application> command are "
11672
"temporary and will be lost after a reboot. If you would like to retain "
11673
"settings, simply add the desired <application>ethtool</application> command "
11674
"to a <emphasis role=\"italic\">pre-up</emphasis> statement in the interface "
11675
"configuration file <filename>/etc/network/interfaces</filename>."
11676
msgstr ""
11677
11678
#: serverguide/C/network-config.xml:141(para)
11679
msgid ""
11680
"The following is an example of how the interface identified as <emphasis "
11681
"role=\"italic\">eth0</emphasis> could be permanently configured with a port "
11682
"speed of 1000Mb/s running in full duplex mode."
11683
msgstr ""
11684
11685
#: serverguide/C/network-config.xml:145(programlisting)
11686
#, no-wrap
11687
msgid ""
11688
"\n"
11689
"auto eth0\n"
11690
"iface eth0 inet static\n"
11691
"pre-up /usr/sbin/ethtool -s eth0 speed 1000 duplex full\n"
11692
msgstr ""
11693
11694
#: serverguide/C/network-config.xml:151(para)
11695
msgid ""
11696
"Although the example above shows the interface configured to use the "
11697
"<emphasis role=\"italic\">static</emphasis> method, it actually works with "
11698
"other methods as well, such as DHCP. The example is meant to demonstrate "
11699
"only proper placement of the <emphasis role=\"italic\">pre-up</emphasis> "
11700
"statement in relation to the rest of the interface configuration."
11701
msgstr ""
11702
11703
#: serverguide/C/network-config.xml:163(title)
11704
msgid "IP Addressing"
11705
msgstr ""
11706
11707
#: serverguide/C/network-config.xml:164(para)
11708
msgid ""
11709
"The following section describes the process of configuring your systems IP "
11710
"address and default gateway needed for communicating on a local area network "
11711
"and the Internet."
11712
msgstr ""
11713
11714
#: serverguide/C/network-config.xml:171(title)
11715
msgid "Temporary IP Address Assignment"
11716
msgstr ""
11717
11718
#: serverguide/C/network-config.xml:172(para)
11719
msgid ""
11720
"For temporary network configurations, you can use standard commands such as "
11721
"<application>ip</application>, <application>ifconfig</application> and "
11722
"<application>route</application>, which are also found on most other "
11723
"GNU/Linux operating systems. These commands allow you to configure settings "
11724
"which take effect immediately, however they are not persistent and will be "
11725
"lost after a reboot."
11726
msgstr ""
11727
11728
#: serverguide/C/network-config.xml:180(para)
11729
msgid ""
11730
"To temporarily configure an IP address, you can use the "
11731
"<application>ifconfig</application> command in the following manner. Just "
11732
"modify the IP address and subnet mask to match your network requirements."
11733
msgstr ""
11734
11735
#: serverguide/C/network-config.xml:186(userinput)
11736
#, no-wrap
11737
msgid "sudo ifconfig eth0 10.0.0.100 netmask 255.255.255.0"
11738
msgstr ""
11739
11740
#: serverguide/C/network-config.xml:188(para)
11741
msgid ""
11742
"To verify the IP address configuration of <application>eth0</application>, "
11743
"you can use the <application>ifconfig</application> command in the following "
11744
"manner."
11745
msgstr ""
11746
11747
#: serverguide/C/network-config.xml:193(userinput)
11748
#, no-wrap
11749
msgid "ifconfig eth0"
11750
msgstr ""
11751
11752
#: serverguide/C/network-config.xml:192(screen)
11753
#, no-wrap
11754
msgid ""
11755
"\n"
11756
"<placeholder-1/>\n"
11757
"eth0 Link encap:Ethernet HWaddr 00:15:c5:4a:16:5a \n"
11758
" inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0\n"
11759
" inet6 addr: fe80::215:c5ff:fe4a:165a/64 Scope:Link\n"
11760
" UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1\n"
11761
" RX packets:466475604 errors:0 dropped:0 overruns:0 frame:0\n"
11762
" TX packets:403172654 errors:0 dropped:0 overruns:0 carrier:0\n"
11763
" collisions:0 txqueuelen:1000 \n"
11764
" RX bytes:2574778386 (2.5 GB) TX bytes:1618367329 (1.6 GB)\n"
11765
" Interrupt:16 \n"
11766
msgstr ""
11767
11768
#: serverguide/C/network-config.xml:204(para)
11769
msgid ""
11770
"To configure a default gateway, you can use the "
11771
"<application>route</application> command in the following manner. Modify the "
11772
"default gateway address to match your network requirements."
11773
msgstr ""
11774
11775
#: serverguide/C/network-config.xml:210(userinput)
11776
#, no-wrap
11777
msgid "sudo route add default gw 10.0.0.1 eth0"
11778
msgstr ""
11779
11780
#: serverguide/C/network-config.xml:212(para)
11781
msgid ""
11782
"To verify your default gateway configuration, you can use the "
11783
"<application>route</application> command in the following manner."
11784
msgstr ""
11785
11786
#: serverguide/C/network-config.xml:217(userinput)
11787
#, no-wrap
11788
msgid "route -n"
11789
msgstr ""
11790
11791
#: serverguide/C/network-config.xml:216(screen)
11792
#, no-wrap
11793
msgid ""
11794
"\n"
11795
"<placeholder-1/>\n"
11796
"Kernel IP routing table\n"
11797
"Destination Gateway Genmask Flags Metric Ref Use "
11798
"Iface\n"
11799
"10.0.0.0 0.0.0.0 255.255.255.0 U 1 0 0 "
11800
"eth0\n"
11801
"0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 "
11802
"eth0\n"
11803
msgstr ""
11804
11805
#: serverguide/C/network-config.xml:223(para)
11806
msgid ""
11807
"If you require DNS for your temporary network configuration, you can add DNS "
11808
"server IP addresses in the file <filename>/etc/resolv.conf</filename>. The "
11809
"example below shows how to enter two DNS servers to "
11810
"<filename>/etc/resolv.conf</filename>, which should be changed to servers "
11811
"appropriate for your network. A more lengthy description of DNS client "
11812
"configuration is in a following section."
11813
msgstr ""
11814
11815
#: serverguide/C/network-config.xml:230(programlisting)
11816
#, no-wrap
11817
msgid ""
11818
"\n"
11819
"nameserver 8.8.8.8\n"
11820
"nameserver 8.8.4.4\n"
11821
msgstr ""
11822
11823
#: serverguide/C/network-config.xml:234(para)
11824
msgid ""
11825
"If you no longer need this configuration and wish to purge all IP "
11826
"configuration from an interface, you can use the "
11827
"<application>ip</application> command with the flush option as shown below."
11828
msgstr ""
11829
11830
#: serverguide/C/network-config.xml:240(userinput)
11831
#, no-wrap
11832
msgid "ip addr flush eth0"
11833
msgstr ""
11834
11835
#: serverguide/C/network-config.xml:243(para)
11836
msgid ""
11837
"Flushing the IP configuration using the <application>ip</application> "
11838
"command does not clear the contents of "
11839
"<filename>/etc/resolv.conf</filename>. You must remove or modify those "
11840
"entries manually."
11841
msgstr ""
11842
11843
#: serverguide/C/network-config.xml:251(title)
11844
msgid "Dynamic IP Address Assignment (DHCP Client)"
11845
msgstr ""
11846
11847
#: serverguide/C/network-config.xml:252(para)
11848
msgid ""
11849
"To configure your server to use DHCP for dynamic address assignment, add the "
11850
"<emphasis role=\"italic\">dhcp</emphasis> method to the inet address family "
11851
"statement for the appropriate interface in the file "
11852
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
11853
"are configuring your first Ethernet interface identified as <emphasis "
11854
"role=\"italic\">eth0</emphasis>."
11855
msgstr ""
11856
11857
#: serverguide/C/network-config.xml:259(programlisting)
11858
#, no-wrap
11859
msgid ""
11860
"\n"
11861
"auto eth0\n"
11862
"iface eth0 inet dhcp\n"
11863
msgstr ""
11864
11865
#: serverguide/C/network-config.xml:263(para)
11866
msgid ""
11867
"By adding an interface configuration as shown above, you can manually enable "
11868
"the interface through the <application>ifup</application> command which "
11869
"initiates the DHCP process via <application>dhclient</application>."
11870
msgstr ""
11871
11872
#: serverguide/C/network-config.xml:269(userinput) serverguide/C/network-config.xml:304(userinput)
11873
#, no-wrap
11874
msgid "sudo ifup eth0"
11875
msgstr ""
11876
11877
#: serverguide/C/network-config.xml:271(para)
11878
msgid ""
11879
"To manually disable the interface, you can use the "
11880
"<application>ifdown</application> command, which in turn will initiate the "
11881
"DHCP release process and shut down the interface."
11882
msgstr ""
11883
11884
#: serverguide/C/network-config.xml:277(userinput) serverguide/C/network-config.xml:311(userinput)
11885
#, no-wrap
11886
msgid "sudo ifdown eth0"
11887
msgstr ""
11888
11889
#: serverguide/C/network-config.xml:282(title)
11890
msgid "Static IP Address Assignment"
11891
msgstr ""
11892
11893
#: serverguide/C/network-config.xml:283(para)
11894
msgid ""
11895
"To configure your system to use a static IP address assignment, add the "
11896
"<emphasis role=\"italic\">static</emphasis> method to the inet address "
11897
"family statement for the appropriate interface in the file "
11898
"<filename>/etc/network/interfaces</filename>. The example below assumes you "
11899
"are configuring your first Ethernet interface identified as <emphasis "
11900
"role=\"italic\">eth0</emphasis>. Change the <emphasis "
11901
"role=\"italic\">address</emphasis>, <emphasis "
11902
"role=\"italic\">netmask</emphasis>, and <emphasis "
11903
"role=\"italic\">gateway</emphasis> values to meet the requirements of your "
11904
"network."
11905
msgstr ""
11906
11907
#: serverguide/C/network-config.xml:292(programlisting)
11908
#, no-wrap
11909
msgid ""
11910
"\n"
11911
"auto eth0\n"
11912
"iface eth0 inet static\n"
11913
"address 10.0.0.100\n"
11914
"netmask 255.255.255.0\n"
11915
"gateway 10.0.0.1\n"
11916
msgstr ""
11917
11918
#: serverguide/C/network-config.xml:299(para)
11919
msgid ""
11920
"By adding an interface configuration as shown above, you can manually enable "
11921
"the interface through the <application>ifup</application> command."
11922
msgstr ""
11923
11924
#: serverguide/C/network-config.xml:306(para)
11925
msgid ""
11926
"To manually disable the interface, you can use the "
11927
"<application>ifdown</application> command."
11928
msgstr ""
11929
11930
#: serverguide/C/network-config.xml:316(title)
11931
msgid "Loopback Interface"
11932
msgstr ""
11933
11934
#: serverguide/C/network-config.xml:317(para)
11935
msgid ""
11936
"The loopback interface is identified by the system as <emphasis "
11937
"role=\"italic\">lo</emphasis> and has a default IP address of 127.0.0.1. It "
11938
"can be viewed using the ifconfig command."
11939
msgstr ""
11940
11941
#: serverguide/C/network-config.xml:322(userinput)
11942
#, no-wrap
11943
msgid "ifconfig lo"
11944
msgstr ""
11945
11946
#: serverguide/C/network-config.xml:321(screen)
11947
#, no-wrap
11948
msgid ""
11949
"\n"
11950
"<placeholder-1/>\n"
11951
"lo Link encap:Local Loopback \n"
11952
" inet addr:127.0.0.1 Mask:255.0.0.0\n"
11953
" inet6 addr: ::1/128 Scope:Host\n"
11954
" UP LOOPBACK RUNNING MTU:16436 Metric:1\n"
11955
" RX packets:2718 errors:0 dropped:0 overruns:0 frame:0\n"
11956
" TX packets:2718 errors:0 dropped:0 overruns:0 carrier:0\n"
11957
" collisions:0 txqueuelen:0 \n"
11958
" RX bytes:183308 (183.3 KB) TX bytes:183308 (183.3 KB)\n"
11959
msgstr ""
11960
11961
#: serverguide/C/network-config.xml:332(para)
11962
msgid ""
11963
"By default, there should be two lines in "
11964
"<filename>/etc/network/interfaces</filename> responsible for automatically "
11965
"configuring your loopback interface. It is recommended that you keep the "
11966
"default settings unless you have a specific purpose for changing them. An "
11967
"example of the two default lines are shown below."
11968
msgstr ""
11969
11970
#: serverguide/C/network-config.xml:338(programlisting)
11971
#, no-wrap
11972
msgid ""
11973
"\n"
11974
"auto lo\n"
11975
"iface lo inet loopback\n"
11976
msgstr ""
11977
11978
#: serverguide/C/network-config.xml:347(title)
11979
msgid "Name Resolution"
11980
msgstr ""
11981
11982
#: serverguide/C/network-config.xml:348(para)
11983
msgid ""
11984
"Name resolution as it relates to IP networking is the process of mapping IP "
11985
"addresses to hostnames, making it easier to identify resources on a network. "
11986
"The following section will explain how to properly configure your system for "
11987
"name resolution using DNS and static hostname records."
11988
msgstr ""
11989
11990
#: serverguide/C/network-config.xml:356(title)
11991
msgid "DNS Client Configuration"
11992
msgstr ""
11993
11994
#: serverguide/C/network-config.xml:357(para)
11995
msgid ""
11996
"To configure your system to use DNS for name resolution, add the IP "
11997
"addresses of the DNS servers that are appropriate for your network in the "
11998
"file <filename>/etc/resolv.conf</filename>. You can also add an optional DNS "
11999
"suffix search-lists to match your network domain names."
12000
msgstr ""
12001
12002
#: serverguide/C/network-config.xml:362(para)
12003
msgid ""
12004
"Below is an example of a typical configuration of "
12005
"<filename>/etc/resolv.conf</filename> for a server on the domain \"<emphasis "
12006
"role=\"italic\">example.com</emphasis>\" and using two public DNS servers."
12007
msgstr ""
12008
12009
#: serverguide/C/network-config.xml:367(programlisting)
12010
#, no-wrap
12011
msgid ""
12012
"\n"
12013
"search example.com\n"
12014
"nameserver 8.8.8.8\n"
12015
"nameserver 8.8.4.4\n"
12016
msgstr ""
12017
12018
#: serverguide/C/network-config.xml:372(para)
12019
msgid ""
12020
"The <emphasis role=\"italic\">search</emphasis> option can also be used with "
12021
"multiple domain names so that DNS queries will be appended in the order in "
12022
"which they are entered. For example, your network may have multiple sub-"
12023
"domains to search; a parent domain of <emphasis "
12024
"role=\"italic\">example.com</emphasis>, and two sub-domains, <emphasis "
12025
"role=\"italic\">sales.example.com</emphasis> and <emphasis "
12026
"role=\"italic\">dev.example.com</emphasis>."
12027
msgstr ""
12028
12029
#: serverguide/C/network-config.xml:380(para)
12030
msgid ""
12031
"If you have multiple domains you wish to search, your configuration might "
12032
"look like the following."
12033
msgstr ""
12034
12035
#: serverguide/C/network-config.xml:383(programlisting)
12036
#, no-wrap
12037
msgid ""
12038
"\n"
12039
"search example.com sales.example.com dev.example.com\n"
12040
"nameserver 8.8.8.8\n"
12041
"nameserver 8.8.4.4\n"
12042
msgstr ""
12043
12044
#: serverguide/C/network-config.xml:388(para)
12045
msgid ""
12046
"If you try to ping a host with the name of <emphasis "
12047
"role=\"italic\">server1</emphasis>, your system will automatically query DNS "
12048
"for its Fully Qualified Domain Name (FQDN) in the following order:"
12049
msgstr ""
12050
12051
#: serverguide/C/network-config.xml:394(para)
12052
msgid "server1<emphasis role=\"bold\">.example.com</emphasis>"
12053
msgstr ""
12054
12055
#: serverguide/C/network-config.xml:399(para)
12056
msgid "server1<emphasis role=\"bold\">.sales.example.com</emphasis>"
12057
msgstr ""
12058
12059
#: serverguide/C/network-config.xml:404(para)
12060
msgid "server1<emphasis role=\"bold\">.dev.example.com</emphasis>"
12061
msgstr ""
12062
12063
#: serverguide/C/network-config.xml:409(para)
12064
msgid ""
12065
"If no matches are found, the DNS server will provide a result of <emphasis "
12066
"role=\"italic\">notfound</emphasis> and the DNS query will fail."
12067
msgstr ""
12068
12069
#: serverguide/C/network-config.xml:416(title)
12070
msgid "Static Hostnames"
12071
msgstr ""
12072
12073
#: serverguide/C/network-config.xml:417(para)
12074
msgid ""
12075
"Static hostnames are locally defined hostname-to-IP mappings located in the "
12076
"file <filename>/etc/hosts</filename>. Entries in the "
12077
"<filename>hosts</filename> file will have precedence over DNS by default. "
12078
"This means that if your system tries to resolve a hostname and it matches an "
12079
"entry in /etc/hosts, it will not attempt to look up the record in DNS. In "
12080
"some configurations, especially when Internet access is not required, "
12081
"servers that communicate with a limited number of resources can be "
12082
"conveniently set to use static hostnames instead of DNS."
12083
msgstr ""
12084
12085
#: serverguide/C/network-config.xml:424(para)
12086
msgid ""
12087
"The following is an example of a <filename>hosts</filename> file where a "
12088
"number of local servers have been identified by simple hostnames, aliases "
12089
"and their equivalent Fully Qualified Domain Names (FQDN's)."
12090
msgstr ""
12091
12092
#: serverguide/C/network-config.xml:428(programlisting)
12093
#, no-wrap
12094
msgid ""
12095
"\n"
12096
"127.0.0.1\tlocalhost\n"
12097
"127.0.1.1\tubuntu-server\n"
12098
"10.0.0.11\tserver1 vpn server1.example.com\n"
12099
"10.0.0.12\tserver2 mail server2.example.com\n"
12100
"10.0.0.13\tserver3 www server3.example.com\n"
12101
"10.0.0.14\tserver4 file server4.example.com\n"
12102
msgstr ""
12103
12104
#: serverguide/C/network-config.xml:437(para)
12105
msgid ""
12106
"In the above example, notice that each of the servers have been given "
12107
"aliases in addition to their proper names and FQDN's. <emphasis "
12108
"role=\"italic\">Server1</emphasis> has been mapped to the name <emphasis "
12109
"role=\"italic\">vpn</emphasis>, <emphasis role=\"italic\">server2</emphasis> "
12110
"is referred to as <emphasis role=\"italic\">mail</emphasis>, <emphasis "
12111
"role=\"italic\">server3</emphasis> as <emphasis "
12112
"role=\"italic\">www</emphasis>, and <emphasis "
12113
"role=\"italic\">server4</emphasis> as <emphasis "
12114
"role=\"italic\">file</emphasis>."
12115
msgstr ""
12116
12117
#: serverguide/C/network-config.xml:449(title)
12118
msgid "Name Service Switch Configuration"
12119
msgstr ""
12120
12121
#: serverguide/C/network-config.xml:450(para)
12122
msgid ""
12123
"The order in which your system selects a method of resolving hostnames to IP "
12124
"addresses is controlled by the Name Service Switch (NSS) configuration file "
12125
"<filename>/etc/nsswitch.conf</filename>. As mentioned in the previous "
12126
"section, typically static hostnames defined in the systems "
12127
"<filename>/etc/hosts</filename> file have precedence over names resolved "
12128
"from DNS. The following is an example of the line responsible for this order "
12129
"of hostname lookups in the file <filename>/etc/nsswitch.conf</filename>."
12130
msgstr ""
12131
12132
#: serverguide/C/network-config.xml:458(programlisting)
12133
#, no-wrap
12134
msgid ""
12135
"\n"
12136
"hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4\n"
12137
msgstr ""
12138
12139
#: serverguide/C/network-config.xml:464(para)
12140
msgid ""
12141
"<emphasis role=\"bold\">files</emphasis> first tries to resolve static "
12142
"hostnames located in <filename>/etc/hosts</filename>."
12143
msgstr ""
12144
12145
#: serverguide/C/network-config.xml:470(para)
12146
msgid ""
12147
"<emphasis role=\"bold\">mdns4_minimal</emphasis> attempts to resolve the "
12148
"name using Multicast DNS."
12149
msgstr ""
12150
12151
#: serverguide/C/network-config.xml:475(para)
12152
msgid ""
12153
"<emphasis role=\"bold\">[NOTFOUND=return]</emphasis> means that any response "
12154
"of <emphasis role=\"italic\">notfound</emphasis> by the preceeding <emphasis "
12155
"role=\"italic\">mdns4_minimal</emphasis> process should be treated as "
12156
"authoritative and that the system should not try to continue hunting for an "
12157
"answer."
12158
msgstr ""
12159
12160
#: serverguide/C/network-config.xml:483(para)
12161
msgid ""
12162
"<emphasis role=\"bold\">dns</emphasis> represents a legacy unicast DNS query."
12163
msgstr ""
12164
12165
#: serverguide/C/network-config.xml:488(para)
12166
msgid ""
12167
"<emphasis role=\"bold\">mdns4</emphasis> represents a Multicast DNS query."
12168
msgstr ""
12169
12170
#: serverguide/C/network-config.xml:494(para)
12171
msgid ""
12172
"To modify the order of the above mentioned name resolution methods, you can "
12173
"simply change the <emphasis role=\"italic\">hosts:</emphasis> string to the "
12174
"value of your choosing. For example, if you prefer to use legacy Unicast DNS "
12175
"versus Multicast DNS, you can change the string in "
12176
"<filename>/etc/nsswitch.conf</filename> as shown below."
12177
msgstr ""
12178
12179
#: serverguide/C/network-config.xml:501(programlisting)
12180
#, no-wrap
12181
msgid ""
12182
"\n"
12183
"hosts: files dns [NOTFOUND=return] mdns4_minimal mdns4\n"
12184
msgstr ""
12185
12186
#: serverguide/C/network-config.xml:508(title)
12187
msgid "Bridging"
12188
msgstr ""
12189
12190
#: serverguide/C/network-config.xml:510(para)
12191
msgid ""
12192
"Bridging multiple interfaces is a more advanced configuration, but is very "
12193
"useful in multiple scenarios. One scenario is setting up a bridge with "
12194
"multiple network interfaces, then using a firewall to filter traffic between "
12195
"two network segments. Another scenario is using bridge on a system with one "
12196
"interface to allow virtual machines direct access to the outside network. "
12197
"The following example covers the latter scenario."
12198
msgstr ""
12199
12200
#: serverguide/C/network-config.xml:517(para)
12201
msgid ""
12202
"Before configuring a bridge you will need to install the <application>bridge-"
12203
"utils</application> package. To install the package, in a terminal enter:"
12204
msgstr ""
12205
12206
#: serverguide/C/network-config.xml:523(command)
12207
msgid "sudo apt-get install bridge-utils"
12208
msgstr ""
12209
12210
#: serverguide/C/network-config.xml:526(para)
12211
msgid ""
12212
"Next, configure the bridge by editing "
12213
"<filename>/etc/network/interfaces</filename>:"
12214
msgstr ""
12215
12216
#: serverguide/C/network-config.xml:530(programlisting)
12217
#, no-wrap
12218
msgid ""
12219
"\n"
12220
"auto lo\n"
12221
"iface lo inet loopback\n"
12222
"\n"
12223
"auto br0\n"
12224
"iface br0 inet static\n"
12225
" address 192.168.0.10\n"
12226
" network 192.168.0.0\n"
12227
" netmask 255.255.255.0\n"
12228
" broadcast 192.168.0.255\n"
12229
" gateway 192.168.0.1\n"
12230
" bridge_ports eth0\n"
12231
" bridge_fd 9\n"
12232
" bridge_hello 2\n"
12233
" bridge_maxage 12\n"
12234
" bridge_stp off\n"
12235
msgstr ""
12236
12237
#: serverguide/C/network-config.xml:549(para)
12238
msgid "Enter the appropriate values for your physical interface and network."
12239
msgstr ""
12240
12241
#: serverguide/C/network-config.xml:554(para)
12242
msgid "Now restart networking to enable the bridge interface:"
12243
msgstr ""
12244
12245
#: serverguide/C/network-config.xml:561(para)
12246
msgid ""
12247
"The new bridge interface should now be up and running. The "
12248
"<application>brctl</application> provides useful information about the state "
12249
"of the bridge, controls which interfaces are part of the bridge, etc. See "
12250
"<command>man brctl</command> for more information."
12251
msgstr ""
12252
12253
#: serverguide/C/network-config.xml:577(para)
12254
msgid ""
12255
"The <ulink url=\"https://help.ubuntu.com/community/Network\">Ubuntu Wiki "
12256
"Network page</ulink> has links to articles covering more advanced network "
12257
"configuration."
12258
msgstr ""
12259
12260
#: serverguide/C/network-config.xml:583(para)
12261
msgid ""
12262
"The <ulink "
12263
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/interfaces.5.html\">i"
12264
"nterfaces man page</ulink> has details on more options for "
12265
"<filename>/etc/network/interfaces</filename>."
12266
msgstr ""
12267
12268
#: serverguide/C/network-config.xml:589(para)
12269
msgid ""
12270
"The <ulink "
12271
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/dhclient.8.html\">dhc"
12272
"lient man page</ulink> has details on more options for configuring DHCP "
12273
"client settings."
12274
msgstr ""
12275
12276
#: serverguide/C/network-config.xml:595(para)
12277
msgid ""
12278
"For more information on DNS client configuration see the <ulink "
12279
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/resolver.5.html\">res"
12280
"olver man page</ulink>. Also, Chapter 6 of O'Reilly's <ulink "
12281
"url=\"http://oreilly.com/catalog/linag2/book/ch06.html\">Linux Network "
12282
"Administrator's Guide</ulink> is a good source of resolver and name service "
12283
"configuration information."
12284
msgstr ""
12285
12286
#: serverguide/C/network-config.xml:603(para)
12287
msgid ""
12288
"For more information on <emphasis>bridging</emphasis> see the <ulink "
12289
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/brctl.8.html\">brctl "
12290
"man page</ulink> and the Linux Foundation's <ulink "
12291
"url=\"http://www.linuxfoundation.org/en/Net:Bridge\">Net:Bridge</ulink> page."
12292
msgstr ""
12293
12294
#: serverguide/C/network-config.xml:614(title)
12295
msgid "TCP/IP"
12296
msgstr ""
12297
12298
#: serverguide/C/network-config.xml:615(para)
12299
msgid ""
12300
"The Transmission Control Protocol and Internet Protocol (TCP/IP) is a "
12301
"standard set of protocols developed in the late 1970s by the Defense "
12302
"Advanced Research Projects Agency (DARPA) as a means of communication "
12303
"between different types of computers and computer networks. TCP/IP is the "
12304
"driving force of the Internet, and thus it is the most popular set of "
12305
"network protocols on Earth."
12306
msgstr ""
12307
12308
#: serverguide/C/network-config.xml:623(title)
12309
msgid "TCP/IP Introduction"
12310
msgstr ""
12311
12312
#: serverguide/C/network-config.xml:624(para)
12313
msgid ""
12314
"The two protocol components of TCP/IP deal with different aspects of "
12315
"computer networking. <emphasis>Internet Protocol</emphasis>, the \"IP\" of "
12316
"TCP/IP is a connectionless protocol which deals only with network packet "
12317
"routing using the <emphasis role=\"italics\">IP Datagram</emphasis> as the "
12318
"basic unit of networking information. The IP Datagram consists of a header "
12319
"followed by a message. The <emphasis> Transmission Control "
12320
"Protocol</emphasis> is the \"TCP\" of TCP/IP and enables network hosts to "
12321
"establish connections which may be used to exchange data streams. TCP also "
12322
"guarantees that the data between connections is delivered and that it "
12323
"arrives at one network host in the same order as sent from another network "
12324
"host."
12325
msgstr ""
12326
12327
#: serverguide/C/network-config.xml:637(title)
12328
msgid "TCP/IP Configuration"
12329
msgstr ""
12330
12331
#: serverguide/C/network-config.xml:638(para)
12332
msgid ""
12333
"The TCP/IP protocol configuration consists of several elements which must be "
12334
"set by editing the appropriate configuration files, or deploying solutions "
12335
"such as the Dynamic Host Configuration Protocol (DHCP) server which in turn, "
12336
"can be configured to provide the proper TCP/IP configuration settings to "
12337
"network clients automatically. These configuration values must be set "
12338
"correctly in order to facilitate the proper network operation of your Ubuntu "
12339
"system."
12340
msgstr ""
12341
12342
#: serverguide/C/network-config.xml:650(para)
12343
msgid ""
12344
"<emphasis role=\"bold\">IP address</emphasis> The IP address is a unique "
12345
"identifying string expressed as four decimal numbers ranging from zero (0) "
12346
"to two-hundred and fifty-five (255), separated by periods, with each of the "
12347
"four numbers representing eight (8) bits of the address for a total length "
12348
"of thirty-two (32) bits for the whole address. This format is called "
12349
"<emphasis>dotted quad notation</emphasis>."
12350
msgstr ""
12351
12352
#: serverguide/C/network-config.xml:660(para)
12353
msgid ""
12354
"<emphasis role=\"bold\">Netmask</emphasis> The Subnet Mask (or simply, "
12355
"<emphasis>netmask</emphasis>) is a local bit mask, or set of flags which "
12356
"separate the portions of an IP address significant to the network from the "
12357
"bits significant to the <emphasis>subnetwork</emphasis>. For example, in a "
12358
"Class C network, the standard netmask is 255.255.255.0 which masks the first "
12359
"three bytes of the IP address and allows the last byte of the IP address to "
12360
"remain available for specifying hosts on the subnetwork."
12361
msgstr ""
12362
12363
#: serverguide/C/network-config.xml:671(para)
12364
msgid ""
12365
"<emphasis role=\"bold\">Network Address</emphasis> The Network Address "
12366
"represents the bytes comprising the network portion of an IP address. For "
12367
"example, the host 12.128.1.2 in a Class A network would use 12.0.0.0 as the "
12368
"network address, where twelve (12) represents the first byte of the IP "
12369
"address, (the network part) and zeroes (0) in all of the remaining three "
12370
"bytes to represent the potential host values. A network host using the "
12371
"private IP address 192.168.1.100 would in turn use a Network Address of "
12372
"192.168.1.0, which specifies the first three bytes of the Class C 192.168.1 "
12373
"network and a zero (0) for all the possible hosts on the network."
12374
msgstr ""
12375
12376
#: serverguide/C/network-config.xml:684(para)
12377
msgid ""
12378
"<emphasis role=\"bold\">Broadcast Address</emphasis> The Broadcast Address "
12379
"is an IP address which allows network data to be sent simultaneously to all "
12380
"hosts on a given subnetwork rather than specifying a particular host. The "
12381
"standard general broadcast address for IP networks is 255.255.255.255, but "
12382
"this broadcast address cannot be used to send a broadcast message to every "
12383
"host on the Internet because routers block it. A more appropriate broadcast "
12384
"address is set to match a specific subnetwork. For example, on the private "
12385
"Class C IP network, 192.168.1.0, the broadcast address is 192.168.1.255. "
12386
"Broadcast messages are typically produced by network protocols such as the "
12387
"Address Resolution Protocol (ARP) and the Routing Information Protocol (RIP)."
12388
msgstr ""
12389
12390
#: serverguide/C/network-config.xml:697(para)
12391
msgid ""
12392
"<emphasis role=\"bold\">Gateway Address</emphasis> A Gateway Address is the "
12393
"IP address through which a particular network, or host on a network, may be "
12394
"reached. If one network host wishes to communicate with another network "
12395
"host, and that host is not located on the same network, then a "
12396
"<emphasis>gateway</emphasis> must be used. In many cases, the Gateway "
12397
"Address will be that of a router on the same network, which will in turn "
12398
"pass traffic on to other networks or hosts, such as Internet hosts. The "
12399
"value of the Gateway Address setting must be correct, or your system will "
12400
"not be able to reach any hosts beyond those on the same network."
12401
msgstr ""
12402
12403
#: serverguide/C/network-config.xml:708(para)
12404
msgid ""
12405
"<emphasis role=\"bold\">Nameserver Address</emphasis> Nameserver Addresses "
12406
"represent the IP addresses of Domain Name Service (DNS) systems, which "
12407
"resolve network hostnames into IP addresses. There are three levels of "
12408
"Nameserver Addresses, which may be specified in order of precedence: The "
12409
"<emphasis>Primary</emphasis> Nameserver, the <emphasis>Secondary</emphasis> "
12410
"Nameserver, and the <emphasis>Tertiary</emphasis> Nameserver. In order for "
12411
"your system to be able to resolve network hostnames into their corresponding "
12412
"IP addresses, you must specify valid Nameserver Addresses which you are "
12413
"authorized to use in your system's TCP/IP configuration. In many cases these "
12414
"addresses can and will be provided by your network service provider, but "
12415
"many free and publicly accessible nameservers are available for use, such as "
12416
"the Level3 (Verizon) servers with IP addresses from 4.2.2.1 to 4.2.2.6."
12417
msgstr ""
12418
12419
#: serverguide/C/network-config.xml:722(para)
12420
msgid ""
12421
"The IP address, Netmask, Network Address, Broadcast Address, and Gateway "
12422
"Address are typically specified via the appropriate directives in the file "
12423
"<filename>/etc/network/interfaces</filename>. The Nameserver Addresses are "
12424
"typically specified via <emphasis>nameserver</emphasis> directives in the "
12425
"file <filename>/etc/resolv.conf</filename>. For more information, view the "
12426
"system manual page for <filename>interfaces</filename> or "
12427
"<filename>resolv.conf</filename> respectively, with the following commands "
12428
"typed at a terminal prompt:"
12429
msgstr ""
12430
12431
#: serverguide/C/network-config.xml:729(para)
12432
msgid ""
12433
"Access the system manual page for <filename>interfaces</filename> with the "
12434
"following command:"
12435
msgstr ""
12436
12437
#: serverguide/C/network-config.xml:734(command)
12438
msgid "man interfaces"
12439
msgstr ""
12440
12441
#: serverguide/C/network-config.xml:737(para)
12442
msgid ""
12443
"Access the system manual page for <filename>resolv.conf</filename> with the "
12444
"following command:"
12445
msgstr ""
12446
12447
#: serverguide/C/network-config.xml:741(command)
12448
msgid "man resolv.conf"
12449
msgstr ""
12450
12451
#: serverguide/C/network-config.xml:646(para)
12452
msgid ""
12453
"The common configuration elements of TCP/IP and their purposes are as "
12454
"follows: <placeholder-1/>"
12455
msgstr ""
12456
12457
#: serverguide/C/network-config.xml:748(title)
12458
msgid "IP Routing"
12459
msgstr ""
12460
12461
#: serverguide/C/network-config.xml:749(para)
12462
msgid ""
12463
"IP routing is a means of specifying and discovering paths in a TCP/IP "
12464
"network along which network data may be sent. Routing uses a set of "
12465
"<emphasis>routing tables</emphasis> to direct the forwarding of network data "
12466
"packets from their source to the destination, often via many intermediary "
12467
"network nodes known as <emphasis>routers</emphasis>. There are two primary "
12468
"forms of IP routing: <emphasis>Static Routing</emphasis> and "
12469
"<emphasis>Dynamic Routing.</emphasis>"
12470
msgstr ""
12471
12472
#: serverguide/C/network-config.xml:758(para)
12473
msgid ""
12474
"Static routing involves manually adding IP routes to the system's routing "
12475
"table, and this is usually done by manipulating the routing table with the "
12476
"<application>route</application> command. Static routing enjoys many "
12477
"advantages over dynamic routing, such as simplicity of implementation on "
12478
"smaller networks, predictability (the routing table is always computed in "
12479
"advance, and thus the route is precisely the same each time it is used), and "
12480
"low overhead on other routers and network links due to the lack of a dynamic "
12481
"routing protocol. However, static routing does present some disadvantages as "
12482
"well. For example, static routing is limited to small networks and does not "
12483
"scale well. Static routing also fails completely to adapt to network outages "
12484
"and failures along the route due to the fixed nature of the route."
12485
msgstr ""
12486
12487
#: serverguide/C/network-config.xml:768(para)
12488
msgid ""
12489
"Dynamic routing depends on large networks with multiple possible IP routes "
12490
"from a source to a destination and makes use of special routing protocols, "
12491
"such as the Router Information Protocol (RIP), which handle the automatic "
12492
"adjustments in routing tables that make dynamic routing possible. Dynamic "
12493
"routing has several advantages over static routing, such as superior "
12494
"scalability and the ability to adapt to failures and outages along network "
12495
"routes. Additionally, there is less manual configuration of the routing "
12496
"tables, since routers learn from one another about their existence and "
12497
"available routes. This trait also eliminates the possibility of introducing "
12498
"mistakes in the routing tables via human error. Dynamic routing is not "
12499
"perfect, however, and presents disadvantages such as heightened complexity "
12500
"and additional network overhead from router communications, which does not "
12501
"immediately benefit the end users, but still consumes network bandwidth."
12502
msgstr ""
12503
12504
#: serverguide/C/network-config.xml:782(title)
12505
msgid "TCP and UDP"
12506
msgstr ""
12507
12508
#: serverguide/C/network-config.xml:783(para)
12509
msgid ""
12510
"TCP is a connection-based protocol, offering error correction and guaranteed "
12511
"delivery of data via what is known as <emphasis>flow control</emphasis>. "
12512
"Flow control determines when the flow of a data stream needs to be stopped, "
12513
"and previously sent data packets should to be re-sent due to problems such "
12514
"as <emphasis>collisions</emphasis>, for example, thus ensuring complete and "
12515
"accurate delivery of the data. TCP is typically used in the exchange of "
12516
"important information such as database transactions."
12517
msgstr ""
12518
12519
#: serverguide/C/network-config.xml:791(para)
12520
msgid ""
12521
"The User Datagram Protocol (UDP), on the other hand, is a "
12522
"<emphasis>connectionless</emphasis> protocol which seldom deals with the "
12523
"transmission of important data because it lacks flow control or any other "
12524
"method to ensure reliable delivery of the data. UDP is commonly used in such "
12525
"applications as audio and video streaming, where it is considerably faster "
12526
"than TCP due to the lack of error correction and flow control, and where the "
12527
"loss of a few packets is not generally catastrophic."
12528
msgstr ""
12529
12530
#: serverguide/C/network-config.xml:801(title)
12531
msgid "ICMP"
12532
msgstr ""
12533
12534
#: serverguide/C/network-config.xml:802(para)
12535
msgid ""
12536
"The Internet Control Messaging Protocol (ICMP) is an extension to the "
12537
"Internet Protocol (IP) as defined in the Request For Comments (RFC) #792 and "
12538
"supports network packets containing control, error, and informational "
12539
"messages. ICMP is used by such network applications as the "
12540
"<application>ping</application> utility, which can determine the "
12541
"availability of a network host or device. Examples of some error messages "
12542
"returned by ICMP which are useful to both network hosts and devices such as "
12543
"routers, include <emphasis>Destination Unreachable</emphasis> and "
12544
"<emphasis>Time Exceeded</emphasis>."
12545
msgstr ""
12546
12547
#: serverguide/C/network-config.xml:812(title)
12548
msgid "Daemons"
12549
msgstr ""
12550
12551
#: serverguide/C/network-config.xml:813(para)
12552
msgid ""
12553
"Daemons are special system applications which typically execute continuously "
12554
"in the background and await requests for the functions they provide from "
12555
"other applications. Many daemons are network-centric; that is, a large "
12556
"number of daemons executing in the background on an Ubuntu system may "
12557
"provide network-related functionality. Some examples of such network daemons "
12558
"include the <emphasis>Hyper Text Transport Protocol Daemon</emphasis> "
12559
"(httpd), which provides web server functionality; the <emphasis>Secure SHell "
12560
"Daemon</emphasis> (sshd), which provides secure remote login shell and file "
12561
"transfer capabilities; and the <emphasis>Internet Message Access Protocol "
12562
"Daemon</emphasis> (imapd), which provides E-Mail services."
12563
msgstr ""
12564
12565
#: serverguide/C/network-config.xml:828(para)
12566
msgid ""
12567
"There are man pages for <ulink "
12568
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man7/tcp.7.html\">TCP</uli"
12569
"nk> and <ulink "
12570
"url=\"http://manpages.ubuntu.com/manpages/lucid/man7/ip.7.html\">IP</ulink> "
12571
"that contain more useful information."
12572
msgstr ""
12573
12574
#: serverguide/C/network-config.xml:834(para)
12575
msgid ""
12576
"Also, see the <ulink "
12577
"url=\"http://www.redbooks.ibm.com/abstracts/gg243376.html\">TCP/IP Tutorial "
12578
"and Technical Overview</ulink> IBM Redbook."
12579
msgstr ""
12580
12581
#: serverguide/C/network-config.xml:840(para)
12582
msgid ""
12583
"Another resource is O'Reilly's <ulink "
12584
"url=\"http://oreilly.com/catalog/9780596002978/\">TCP/IP Network "
12585
"Administration</ulink>."
12586
msgstr ""
12587
12588
#: serverguide/C/network-config.xml:849(title)
12589
msgid "Dynamic Host Configuration Protocol (DHCP)"
12590
msgstr ""
12591
12592
#: serverguide/C/network-config.xml:850(para)
12593
msgid ""
12594
"The Dynamic Host Configuration Protocol (DHCP) is a network service that "
12595
"enables host computers to be automatically assigned settings from a server "
12596
"as opposed to manually configuring each network host. Computers configured "
12597
"to be DHCP clients have no control over the settings they receive from the "
12598
"DHCP server, and the configuration is transparent to the computer's user."
12599
msgstr ""
12600
12601
#: serverguide/C/network-config.xml:857(para)
12602
msgid ""
12603
"The most common settings provided by a DHCP server to DHCP clients include:"
12604
msgstr ""
12605
12606
#: serverguide/C/network-config.xml:862(para)
12607
msgid "IP-Address and Netmask"
12608
msgstr ""
12609
12610
#: serverguide/C/network-config.xml:865(para)
12611
msgid "DNS"
12612
msgstr ""
12613
12614
#: serverguide/C/network-config.xml:868(para)
12615
msgid "WINS"
12616
msgstr ""
12617
12618
#: serverguide/C/network-config.xml:871(para)
12619
msgid ""
12620
"However, a DHCP server can also supply configuration properties such as:"
12621
msgstr ""
12622
12623
#: serverguide/C/network-config.xml:876(para)
12624
msgid "Host Name"
12625
msgstr ""
12626
12627
#: serverguide/C/network-config.xml:879(para)
12628
msgid "Domain Name"
12629
msgstr ""
12630
12631
#: serverguide/C/network-config.xml:882(para)
12632
msgid "Default Gateway"
12633
msgstr ""
12634
12635
#: serverguide/C/network-config.xml:885(para)
12636
msgid "Time Server"
12637
msgstr ""
12638
12639
#: serverguide/C/network-config.xml:888(para)
12640
msgid "Print Server"
12641
msgstr ""
12642
12643
#: serverguide/C/network-config.xml:891(para)
12644
msgid ""
12645
"The advantage of using DHCP is that changes to the network, for example a "
12646
"change in the address of the DNS server, need only be changed at the DHCP "
12647
"server, and all network hosts will be reconfigured the next time their DHCP "
12648
"clients poll the DHCP server. As an added advantage, it is also easier to "
12649
"integrate new computers into the network, as there is no need to check for "
12650
"the availability of an IP address. Conflicts in IP address allocation are "
12651
"also reduced."
12652
msgstr ""
12653
12654
#: serverguide/C/network-config.xml:899(para)
12655
msgid "A DHCP server can provide configuration settings using two methods:"
12656
msgstr ""
12657
12658
#: serverguide/C/network-config.xml:904(term)
12659
msgid "MAC Address"
12660
msgstr ""
12661
12662
#: serverguide/C/network-config.xml:906(para)
12663
msgid ""
12664
"This method entails using DHCP to identify the unique hardware address of "
12665
"each network card connected to the network and then continually supplying a "
12666
"constant configuration each time the DHCP client makes a request to the DHCP "
12667
"server using that network device."
12668
msgstr ""
12669
12670
#: serverguide/C/network-config.xml:915(term)
12671
msgid "Address Pool"
12672
msgstr ""
12673
12674
#: serverguide/C/network-config.xml:917(para)
12675
msgid ""
12676
"This method entails defining a pool (sometimes also called a range or scope) "
12677
"of IP addresses from which DHCP clients are supplied their configuration "
12678
"properties dynamically and on a \"first come, first served\" basis. When a "
12679
"DHCP client is no longer on the network for a specified period, the "
12680
"configuration is expired and released back to the address pool for use by "
12681
"other DHCP Clients."
12682
msgstr ""
12683
12684
#: serverguide/C/network-config.xml:928(para)
12685
msgid ""
12686
"Ubuntu is shipped with both DHCP server and client. The server is "
12687
"<application>dhcpd</application> (dynamic host configuration protocol "
12688
"daemon). The client provided with Ubuntu is "
12689
"<application>dhclient</application> and should be installed on all computers "
12690
"required to be automatically configured. Both programs are easy to install "
12691
"and configure and will be automatically started at system boot."
12692
msgstr ""
12693
12694
#: serverguide/C/network-config.xml:938(para)
12695
msgid ""
12696
"At a terminal prompt, enter the following command to install "
12697
"<application>dhcpd</application>:"
12698
msgstr ""
12699
12700
#: serverguide/C/network-config.xml:943(command)
12701
msgid "sudo apt-get install dhcp3-server"
12702
msgstr ""
12703
12704
#: serverguide/C/network-config.xml:945(para)
12705
msgid ""
12706
"You will probably need to change the default configuration by editing "
12707
"/etc/dhcp3/dhcpd.conf to suit your needs and particular configuration."
12708
msgstr ""
12709
12710
#: serverguide/C/network-config.xml:949(para)
12711
msgid ""
12712
"You also need to edit /etc/default/dhcp3-server to specify the interfaces "
12713
"dhcpd should listen to. By default it listens to eth0."
12714
msgstr ""
12715
12716
#: serverguide/C/network-config.xml:953(para)
12717
msgid ""
12718
"NOTE: dhcpd's messages are being sent to syslog. Look there for diagnostics "
12719
"messages."
12720
msgstr ""
12721
12722
#: serverguide/C/network-config.xml:960(para)
12723
msgid ""
12724
"The error message the installation ends with might be a little confusing, "
12725
"but the following steps will help you configure the service:"
12726
msgstr ""
12727
12728
#: serverguide/C/network-config.xml:964(para)
12729
msgid ""
12730
"Most commonly, what you want to do is assign an IP address randomly. This "
12731
"can be done with settings as follows:"
12732
msgstr ""
12733
12734
#: serverguide/C/network-config.xml:968(programlisting)
12735
#, no-wrap
12736
msgid ""
12737
"\n"
12738
"# Sample /etc/dhcpd.conf\n"
12739
"# (add your comments here) \n"
12740
"default-lease-time 600;\n"
12741
"max-lease-time 7200;\n"
12742
"option subnet-mask 255.255.255.0;\n"
12743
"option broadcast-address 192.168.1.255;\n"
12744
"option routers 192.168.1.254;\n"
12745
"option domain-name-servers 192.168.1.1, 192.168.1.2;\n"
12746
"option domain-name \"mydomain.example\";\n"
12747
"\n"
12748
"subnet 192.168.1.0 netmask 255.255.255.0 {\n"
12749
"range 192.168.1.10 192.168.1.100;\n"
12750
"range 192.168.1.150 192.168.1.200;\n"
12751
"} \n"
12752
msgstr ""
12753
12754
#: serverguide/C/network-config.xml:984(para)
12755
msgid ""
12756
"This will result in the DHCP server giving a client an IP address from the "
12757
"range 192.168.1.10-192.168.1.100 or 192.168.1.150-192.168.1.200. It will "
12758
"lease an IP address for 600 seconds if the client doesn't ask for a specific "
12759
"time frame. Otherwise the maximum (allowed) lease will be 7200 seconds. The "
12760
"server will also \"advise\" the client that it should use 255.255.255.0 as "
12761
"its subnet mask, 192.168.1.255 as its broadcast address, 192.168.1.254 as "
12762
"the router/gateway and 192.168.1.1 and 192.168.1.2 as its DNS servers."
12763
msgstr ""
12764
12765
#: serverguide/C/network-config.xml:993(para)
12766
msgid ""
12767
"If you need to specify a WINS server for your Windows clients, you will need "
12768
"to include the netbios-name-servers option, e.g."
12769
msgstr ""
12770
12771
#: serverguide/C/network-config.xml:997(programlisting)
12772
#, no-wrap
12773
msgid ""
12774
"\n"
12775
"option netbios-name-servers 192.168.1.1; \n"
12776
msgstr ""
12777
12778
#: serverguide/C/network-config.xml:1000(para)
12779
msgid ""
12780
"Dhcpd configuration settings are taken from the DHCP mini-HOWTO, which can "
12781
"be found <ulink "
12782
"url=\"http://www.tldp.org/HOWTO/DHCP/index.html\">here</ulink>."
12783
msgstr ""
12784
12785
#: serverguide/C/network-config.xml:1010(para)
12786
msgid ""
12787
"The <ulink url=\"https://help.ubuntu.com/community/dhcp3-server\">dhcp3-"
12788
"server Ubuntu Wiki</ulink> page has more information."
12789
msgstr ""
12790
12791
#: serverguide/C/network-config.xml:1015(para)
12792
msgid ""
12793
"For more <filename>/etc/dhcp3/dchpd.conf</filename> options see the <ulink "
12794
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/dhcpd.conf.5.html\">d"
12795
"hcpd.conf man page</ulink>."
12796
msgstr ""
12797
12798
#: serverguide/C/network-config.xml:1021(para)
12799
msgid ""
12800
"Also see the <ulink url=\"http://www.dhcp-handbook.com/dhcp_faq.html\">DHCP "
12801
"FAQ</ulink>"
12802
msgstr ""
12803
12804
#: serverguide/C/network-config.xml:1031(title)
12805
msgid "Time Synchronisation with NTP"
12806
msgstr ""
12807
12808
#: serverguide/C/network-config.xml:1032(para)
12809
msgid ""
12810
"This page describes methods for keeping your computer's time accurate. This "
12811
"is useful for servers, but is not necessary (or desirable) for desktop "
12812
"machines."
12813
msgstr ""
12814
12815
#: serverguide/C/network-config.xml:1035(para)
12816
msgid ""
12817
"NTP is a TCP/IP protocol for synchronising time over a network. Basically a "
12818
"client requests the current time from a server, and uses it to set its own "
12819
"clock."
12820
msgstr ""
12821
12822
#: serverguide/C/network-config.xml:1038(para)
12823
msgid ""
12824
"Behind this simple description, there is a lot of complexity - there are "
12825
"tiers of NTP servers, with the tier one NTP servers connected to atomic "
12826
"clocks (often via GPS), and tier two and three servers spreading the load of "
12827
"actually handling requests across the Internet. Also the client software is "
12828
"a lot more complex than you might think - it has to factor out communication "
12829
"delays, and adjust the time in a way that does not upset all the other "
12830
"processes that run on the server. But luckily all that complexity is hidden "
12831
"from you!"
12832
msgstr ""
12833
12834
#: serverguide/C/network-config.xml:1041(para)
12835
msgid ""
12836
"Ubuntu has two ways of automatically setting your time: ntpdate and ntpd."
12837
msgstr ""
12838
12839
#: serverguide/C/network-config.xml:1046(title)
12840
msgid "ntpdate"
12841
msgstr ""
12842
12843
#: serverguide/C/network-config.xml:1047(para)
12844
msgid ""
12845
"Ubuntu comes with ntpdate as standard, and will run it once at boot time to "
12846
"set up your time according to Ubuntu's NTP server. However, a server's clock "
12847
"is likely to drift considerably between reboots, so it makes sense to "
12848
"correct the time occasionally. The easiest way to do this is to get cron to "
12849
"run ntpdate every day. With your favorite editor, as root, create a file "
12850
"<code>/etc/cron.daily/ntpdate</code> containing:"
12851
msgstr ""
12852
12853
#: serverguide/C/network-config.xml:1052(screen)
12854
#, no-wrap
12855
msgid "ntpdate ntp.ubuntu.com\n"
12856
msgstr ""
12857
12858
#: serverguide/C/network-config.xml:1054(para)
12859
msgid ""
12860
"The file <code>/etc/cron.daily/ntpdate</code> must also be executable."
12861
msgstr ""
12862
12863
#: serverguide/C/network-config.xml:1057(screen)
12864
#, no-wrap
12865
msgid "sudo chmod 755 /etc/cron.daily/ntpdate\n"
12866
msgstr ""
12867
12868
#: serverguide/C/network-config.xml:1061(title)
12869
msgid "ntpd"
12870
msgstr ""
12871
12872
#: serverguide/C/network-config.xml:1062(para)
12873
msgid ""
12874
"ntpdate is a bit of a blunt instrument - it can only adjust the time once a "
12875
"day, in one big correction. The ntp daemon ntpd is far more subtle. It "
12876
"calculates the drift of your system clock and continuously adjusts it, so "
12877
"there are no large corrections that could lead to inconsistent logs for "
12878
"instance. The cost is a little processing power and memory, but for a modern "
12879
"server this is negligible."
12880
msgstr ""
12881
12882
#: serverguide/C/network-config.xml:1065(para)
12883
msgid "To set up ntpd:"
12884
msgstr ""
12885
12886
#: serverguide/C/network-config.xml:1066(screen)
12887
#, no-wrap
12888
msgid "sudo apt-get install ntp\n"
12889
msgstr ""
12890
12891
#: serverguide/C/network-config.xml:1071(title)
12892
msgid "Changing Time Servers"
12893
msgstr ""
12894
12895
#: serverguide/C/network-config.xml:1072(para)
12896
msgid ""
12897
"In both cases above, your system will use Ubuntu's NTP server at "
12898
"<code>ntp.ubuntu.com</code> by default. This is OK, but you might want to "
12899
"use several servers to increase accuracy and resilience, and you may want to "
12900
"use time servers that are geographically closer to you. to do this for "
12901
"ntpdate, change the contents of <code>/etc/cron.daily/ntpdate</code> to:"
12902
msgstr ""
12903
12904
#: serverguide/C/network-config.xml:1079(screen)
12905
#, no-wrap
12906
msgid "ntpdate ntp.ubuntu.com pool.ntp.org \n"
12907
msgstr ""
12908
12909
#: serverguide/C/network-config.xml:1081(para)
12910
msgid ""
12911
"And for ntpd edit <code>/etc/ntp.conf</code> to include additional server "
12912
"lines:"
12913
msgstr ""
12914
12915
#: serverguide/C/network-config.xml:1086(screen)
12916
#, no-wrap
12917
msgid ""
12918
"server ntp.ubuntu.com\n"
12919
"server pool.ntp.org\n"
12920
msgstr ""
12921
12922
#: serverguide/C/network-config.xml:1089(para)
12923
msgid ""
12924
"You may notice <code>pool.ntp.org</code> in the examples above. This is a "
12925
"really good idea which uses round-robin DNS to return an NTP server from a "
12926
"pool, spreading the load between several different servers. Even better, "
12927
"they have pools for different regions - for instance, if you are in New "
12928
"Zealand, so you could use <code>nz.pool.ntp.org</code> instead of "
12929
"<code>pool.ntp.org</code> . Look at <ulink "
12930
"url=\"http://www.pool.ntp.org/\">http://www.pool.ntp.org/</ulink> for more "
12931
"details."
12932
msgstr ""
12933
12934
#: serverguide/C/network-config.xml:1100(para)
12935
msgid ""
12936
"You can also Google for NTP servers in your region, and add these to your "
12937
"configuration. To test that a server works, just type <code>sudo ntpdate "
12938
"ntp.server.name</code> and see what happens."
12939
msgstr ""
12940
12941
#: serverguide/C/network-config.xml:1111(para)
12942
msgid ""
12943
"See the <ulink url=\"https://help.ubuntu.com/community/UbuntuTime\">Ubuntu "
12944
"Time</ulink> wiki page for more information."
12945
msgstr ""
12946
12947
#: serverguide/C/network-config.xml:1117(ulink)
12948
msgid "NTP Support"
12949
msgstr ""
12950
12951
#: serverguide/C/network-config.xml:1122(ulink)
12952
msgid "The NTP FAQ and HOWTO"
12953
msgstr ""
12954
12955
#: serverguide/C/network-auth.xml:13(title)
12956
msgid "Network Authentication"
12957
msgstr ""
12958
12959
#: serverguide/C/network-auth.xml:15(para)
12960
msgid "This section explains various Network Authentication protocols."
12961
msgstr ""
12962
12963
#: serverguide/C/network-auth.xml:19(title)
12964
msgid "OpenLDAP Server"
12965
msgstr ""
12966
12967
#: serverguide/C/network-auth.xml:20(para)
12968
msgid ""
12969
"LDAP is an acronym for Lightweight Directory Access Protocol, it is a "
12970
"simplified version of the X.500 protocol. The directory setup in this "
12971
"section will be used for authentication. Nevertheless, LDAP can be used in "
12972
"numerous ways: authentication, shared directory (for mail clients), address "
12973
"book, etc."
12974
msgstr ""
12975
12976
#: serverguide/C/network-auth.xml:28(para)
12977
msgid ""
12978
"To describe LDAP quickly, all information is stored in a tree structure. "
12979
"With <application>OpenLDAP</application> you have freedom to determine the "
12980
"directory arborescence (the Directory Information Tree: the DIT) yourself. "
12981
"We will begin with a basic tree containing two nodes below the root:"
12982
msgstr ""
12983
12984
#: serverguide/C/network-auth.xml:37(para)
12985
msgid "\"People\" node where your users will be stored"
12986
msgstr ""
12987
12988
#: serverguide/C/network-auth.xml:40(para)
12989
msgid "\"Groups\" node where your groups will be stored"
12990
msgstr "\"Groups\"節點，將儲存你的群組"
12991
12992
#: serverguide/C/network-auth.xml:44(para)
12993
msgid ""
12994
"Before beginning, you should determine what the root of your LDAP directory "
12995
"will be. By default, your tree will be determined by your Fully Qualified "
12996
"Domain Name (FQDN). If your domain is example.com (which we will use in this "
12997
"example), your root node will be dc=example,dc=com."
12998
msgstr ""
12999
13000
#: serverguide/C/network-auth.xml:54(para)
13001
msgid ""
13002
"First, install the <application>OpenLDAP</application> server daemon "
13003
"<application>slapd</application> and <application>ldap-utils</application>, "
13004
"a package containing LDAP management utilities:"
13005
msgstr ""
13006
13007
#: serverguide/C/network-auth.xml:60(command)
13008
msgid "sudo apt-get install slapd ldap-utils"
13009
msgstr ""
13010
13011
#: serverguide/C/network-auth.xml:63(para)
13012
msgid ""
13013
"By default <application>slapd</application> is configured with minimal "
13014
"options needed to run the <application>slapd</application> daemon."
13015
msgstr ""
13016
13017
#: serverguide/C/network-auth.xml:68(para)
13018
msgid ""
13019
"The configuration example in the following sections will match the domain "
13020
"name of the server. For example, if the machine's Fully Qualified Domain "
13021
"Name (FQDN) is ldap.example.com, the default suffix will be "
13022
"<emphasis>dc=example,dc=com</emphasis>."
13023
msgstr ""
13024
13025
#: serverguide/C/network-auth.xml:76(title)
13026
msgid "Populating LDAP"
13027
msgstr ""
13028
13029
#: serverguide/C/network-auth.xml:78(para)
13030
msgid ""
13031
"<application>OpenLDAP</application> uses a separate directory which contains "
13032
"the <emphasis>cn=config</emphasis> Directory Information Tree (DIT). The "
13033
"<emphasis>cn=config</emphasis> DIT is used to dynamically configure the "
13034
"<application>slapd</application> daemon, allowing the modification of schema "
13035
"definitions, indexes, ACLs, etc without stopping the service."
13036
msgstr ""
13037
13038
#: serverguide/C/network-auth.xml:86(para)
13039
msgid ""
13040
"The backend <emphasis>cn=config</emphasis> directory has only a minimal "
13041
"configuration and will need additional configuration options in order to "
13042
"populate the frontend directory. The frontend will be populated with a "
13043
"\"classical\" scheme that will be compatible with address book applications "
13044
"and with Unix Posix accounts. Posix accounts will allow authentication to "
13045
"various applications, such as web applications, email Mail Transfer Agent "
13046
"(MTA) applications, etc."
13047
msgstr ""
13048
13049
#: serverguide/C/network-auth.xml:95(para)
13050
msgid ""
13051
"For external applications to authenticate using LDAP they will each need to "
13052
"be specifically configured to do so. Refer to the individual application "
13053
"documentation for details."
13054
msgstr ""
13055
13056
#: serverguide/C/network-auth.xml:103(para)
13057
msgid ""
13058
"Remember to change <emphasis>dc=example,dc=com</emphasis> in the following "
13059
"examples to match your LDAP configuration."
13060
msgstr ""
13061
13062
#: serverguide/C/network-auth.xml:108(para)
13063
msgid ""
13064
"First, some additional schema files need to be loaded. In a terminal enter:"
13065
msgstr ""
13066
13067
#: serverguide/C/network-auth.xml:113(command) serverguide/C/network-auth.xml:702(command)
13068
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif"
13069
msgstr ""
13070
13071
#: serverguide/C/network-auth.xml:114(command) serverguide/C/network-auth.xml:703(command)
13072
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif"
13073
msgstr ""
13074
13075
#: serverguide/C/network-auth.xml:115(command) serverguide/C/network-auth.xml:704(command)
13076
msgid ""
13077
"sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif"
13078
msgstr ""
13079
13080
#: serverguide/C/network-auth.xml:118(para)
13081
msgid ""
13082
"Next, copy the following example LDIF file, naming it "
13083
"<filename>backend.example.com.ldif</filename>, somewhere on your system:"
13084
msgstr ""
13085
13086
#: serverguide/C/network-auth.xml:123(programlisting)
13087
#, no-wrap
13088
msgid ""
13089
"\n"
13090
"# Load dynamic backend modules\n"
13091
"dn: cn=module,cn=config\n"
13092
"objectClass: olcModuleList\n"
13093
"cn: module\n"
13094
"olcModulepath: /usr/lib/ldap\n"
13095
"olcModuleload: back_hdb\n"
13096
"\n"
13097
"# Database settings\n"
13098
"dn: olcDatabase=hdb,cn=config\n"
13099
"objectClass: olcDatabaseConfig\n"
13100
"objectClass: olcHdbConfig\n"
13101
"olcDatabase: {1}hdb\n"
13102
"olcSuffix: dc=example,dc=com\n"
13103
"olcDbDirectory: /var/lib/ldap\n"
13104
"olcRootDN: cn=admin,dc=example,dc=com\n"
13105
"olcRootPW: secret\n"
13106
"olcDbConfig: set_cachesize 0 2097152 0\n"
13107
"olcDbConfig: set_lk_max_objects 1500\n"
13108
"olcDbConfig: set_lk_max_locks 1500\n"
13109
"olcDbConfig: set_lk_max_lockers 1500\n"
13110
"olcDbIndex: objectClass eq\n"
13111
"olcLastMod: TRUE\n"
13112
"olcDbCheckpoint: 512 30\n"
13113
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13114
"by anonymous auth by self write by * none\n"
13115
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13116
"olcAccess: to dn.base=\"\" by * read\n"
13117
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13118
"\n"
13119
msgstr ""
13120
13121
#: serverguide/C/network-auth.xml:155(para)
13122
msgid ""
13123
"Change <emphasis>olcRootPW: secret</emphasis> to a password of your choosing."
13124
msgstr ""
13125
13126
#: serverguide/C/network-auth.xml:160(para)
13127
msgid "Now add the LDIF to the directory:"
13128
msgstr ""
13129
13130
#: serverguide/C/network-auth.xml:165(command) serverguide/C/network-auth.xml:746(command)
13131
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.example.com.ldif"
13132
msgstr ""
13133
13134
#: serverguide/C/network-auth.xml:168(para)
13135
msgid ""
13136
"The frontend directory is now ready to be populated. Create a "
13137
"<filename>frontend.example.com.ldif</filename> with the following contents:"
13138
msgstr ""
13139
13140
#: serverguide/C/network-auth.xml:173(programlisting)
13141
#, no-wrap
13142
msgid ""
13143
"\n"
13144
"# Create top-level object in domain\n"
13145
"dn: dc=example,dc=com\n"
13146
"objectClass: top\n"
13147
"objectClass: dcObject\n"
13148
"objectclass: organization\n"
13149
"o: Example Organization\n"
13150
"dc: Example\n"
13151
"description: LDAP Example \n"
13152
"\n"
13153
"# Admin user.\n"
13154
"dn: cn=admin,dc=example,dc=com\n"
13155
"objectClass: simpleSecurityObject\n"
13156
"objectClass: organizationalRole\n"
13157
"cn: admin\n"
13158
"description: LDAP administrator\n"
13159
"userPassword: secret\n"
13160
"\n"
13161
"dn: ou=people,dc=example,dc=com\n"
13162
"objectClass: organizationalUnit\n"
13163
"ou: people\n"
13164
"\n"
13165
"dn: ou=groups,dc=example,dc=com\n"
13166
"objectClass: organizationalUnit\n"
13167
"ou: groups\n"
13168
"\n"
13169
"dn: uid=john,ou=people,dc=example,dc=com\n"
13170
"objectClass: inetOrgPerson\n"
13171
"objectClass: posixAccount\n"
13172
"objectClass: shadowAccount\n"
13173
"uid: john\n"
13174
"sn: Doe\n"
13175
"givenName: John\n"
13176
"cn: John Doe\n"
13177
"displayName: John Doe\n"
13178
"uidNumber: 1000\n"
13179
"gidNumber: 10000\n"
13180
"userPassword: password\n"
13181
"gecos: John Doe\n"
13182
"loginShell: /bin/bash\n"
13183
"homeDirectory: /home/john\n"
13184
"shadowExpire: -1\n"
13185
"shadowFlag: 0\n"
13186
"shadowWarning: 7\n"
13187
"shadowMin: 8\n"
13188
"shadowMax: 999999\n"
13189
"shadowLastChange: 10877\n"
13190
"mail: john.doe@example.com\n"
13191
"postalCode: 31000\n"
13192
"l: Toulouse\n"
13193
"o: Example\n"
13194
"mobile: +33 (0)6 xx xx xx xx\n"
13195
"homePhone: +33 (0)5 xx xx xx xx\n"
13196
"title: System Administrator\n"
13197
"postalAddress: \n"
13198
"initials: JD\n"
13199
"\n"
13200
"dn: cn=example,ou=groups,dc=example,dc=com\n"
13201
"objectClass: posixGroup\n"
13202
"cn: example\n"
13203
"gidNumber: 10000\n"
13204
msgstr ""
13205
13206
#: serverguide/C/network-auth.xml:236(para)
13207
msgid ""
13208
"In this example the directory structure, a user, and a group have been "
13209
"setup. In other examples you might see the <emphasis>objectClass: "
13210
"top</emphasis> added in every entry, but that is the default behaviour so "
13211
"you do not have to add it explicitly."
13212
msgstr ""
13213
13214
#: serverguide/C/network-auth.xml:243(para)
13215
msgid "Add the entries to the LDAP directory:"
13216
msgstr ""
13217
13218
#: serverguide/C/network-auth.xml:249(command) serverguide/C/network-auth.xml:757(command)
13219
msgid ""
13220
"sudo ldapadd -x -D cn=admin,dc=example,dc=com -W -f frontend.example.com.ldif"
13221
msgstr ""
13222
13223
#: serverguide/C/network-auth.xml:252(para)
13224
msgid ""
13225
"We can check that the content has been correctly added with the "
13226
"<application>ldapsearch</application> utility. Execute a search of the LDAP "
13227
"directory:"
13228
msgstr ""
13229
13230
#: serverguide/C/network-auth.xml:258(command)
13231
msgid "ldapsearch -xLLL -b \"dc=example,dc=com\" uid=john sn givenName cn"
13232
msgstr ""
13233
13234
#: serverguide/C/network-auth.xml:259(computeroutput)
13235
#, no-wrap
13236
msgid ""
13237
"\n"
13238
"dn: uid=john,ou=people,dc=example,dc=com\n"
13239
"cn: John Doe\n"
13240
"sn: Doe\n"
13241
"givenName: John\n"
13242
msgstr ""
13243
13244
#: serverguide/C/network-auth.xml:267(para)
13245
msgid "Just a quick explanation:"
13246
msgstr ""
13247
13248
#: serverguide/C/network-auth.xml:273(para)
13249
msgid ""
13250
"<emphasis>-x:</emphasis> will not use SASL authentication method, which is "
13251
"the default."
13252
msgstr ""
13253
13254
#: serverguide/C/network-auth.xml:279(para)
13255
msgid "<emphasis>-LLL:</emphasis> disable printing LDIF schema information."
13256
msgstr ""
13257
13258
#: serverguide/C/network-auth.xml:287(title)
13259
msgid "Further Configuration"
13260
msgstr ""
13261
13262
#: serverguide/C/network-auth.xml:290(para)
13263
msgid ""
13264
"The <emphasis>cn=config</emphasis> tree can be manipulated using the "
13265
"utilities in the <application>ldap-utils</application> package. For example:"
13266
msgstr ""
13267
13268
#: serverguide/C/network-auth.xml:298(para)
13269
msgid ""
13270
"Use <application>ldapsearch</application> to view the tree, entering the "
13271
"admin password set during installation or reconfiguration:"
13272
msgstr ""
13273
13274
#: serverguide/C/network-auth.xml:304(command)
13275
msgid "sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn"
13276
msgstr ""
13277
13278
#: serverguide/C/network-auth.xml:308(computeroutput)
13279
#, no-wrap
13280
msgid ""
13281
"\n"
13282
"SASL/EXTERNAL authentication started\n"
13283
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13284
"SASL SSF: 0\n"
13285
"dn: cn=config\n"
13286
"\n"
13287
"dn: cn=module{0},cn=config\n"
13288
"\n"
13289
"dn: cn=schema,cn=config\n"
13290
"\n"
13291
"dn: cn={0}core,cn=schema,cn=config\n"
13292
"\n"
13293
"dn: cn={1}cosine,cn=schema,cn=config\n"
13294
"\n"
13295
"dn: cn={2}nis,cn=schema,cn=config\n"
13296
"\n"
13297
"dn: cn={3}inetorgperson,cn=schema,cn=config\n"
13298
"\n"
13299
"dn: olcDatabase={-1}frontend,cn=config\n"
13300
"\n"
13301
"dn: olcDatabase={0}config,cn=config\n"
13302
"\n"
13303
"dn: olcDatabase={1}hdb,cn=config\n"
13304
msgstr ""
13305
13306
#: serverguide/C/network-auth.xml:334(para)
13307
msgid ""
13308
"The output above is the current configuration options for the "
13309
"<emphasis>cn=config</emphasis> backend database. Your output may be vary."
13310
msgstr ""
13311
13312
#: serverguide/C/network-auth.xml:342(para)
13313
msgid ""
13314
"As an example of modifying the <emphasis>cn=config</emphasis> tree, add "
13315
"another attribute to the index list using "
13316
"<application>ldapmodify</application>:"
13317
msgstr ""
13318
13319
#: serverguide/C/network-auth.xml:348(command) serverguide/C/network-auth.xml:984(command) serverguide/C/network-auth.xml:1155(command) serverguide/C/network-auth.xml:1191(command)
13320
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:///"
13321
msgstr ""
13322
13323
#: serverguide/C/network-auth.xml:356(userinput)
13324
#, no-wrap
13325
msgid ""
13326
"dn: olcDatabase={1}hdb,cn=config\n"
13327
"add: olcDbIndex\n"
13328
"olcDbIndex: uidNumber eq"
13329
msgstr ""
13330
13331
#: serverguide/C/network-auth.xml:352(computeroutput)
13332
#, no-wrap
13333
msgid ""
13334
"\n"
13335
"SASL/EXTERNAL authentication started\n"
13336
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13337
"SASL SSF: 0\n"
13338
"<placeholder-1/>\n"
13339
"\n"
13340
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13341
msgstr ""
13342
13343
#: serverguide/C/network-auth.xml:364(para)
13344
msgid ""
13345
"Once the modification has completed, press <emphasis>Ctrl+D</emphasis> to "
13346
"exit the utility."
13347
msgstr ""
13348
13349
#: serverguide/C/network-auth.xml:371(para)
13350
msgid ""
13351
"<application>ldapmodify</application> can also read the changes from a file. "
13352
"Copy and paste the following into a file named "
13353
"<filename>uid_index.ldif</filename>:"
13354
msgstr ""
13355
13356
#: serverguide/C/network-auth.xml:376(programlisting)
13357
#, no-wrap
13358
msgid ""
13359
"\n"
13360
"dn: olcDatabase={1}hdb,cn=config\n"
13361
"add: olcDbIndex\n"
13362
"olcDbIndex: uid eq,pres,sub\n"
13363
msgstr ""
13364
13365
#: serverguide/C/network-auth.xml:382(para)
13366
msgid "Then execute <application>ldapmodify</application>:"
13367
msgstr ""
13368
13369
#: serverguide/C/network-auth.xml:387(command)
13370
msgid "sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f uid_index.ldif"
13371
msgstr ""
13372
13373
#: serverguide/C/network-auth.xml:391(computeroutput)
13374
#, no-wrap
13375
msgid ""
13376
"\n"
13377
"SASL/EXTERNAL authentication started\n"
13378
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
13379
"SASL SSF: 0\n"
13380
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
13381
msgstr ""
13382
13383
#: serverguide/C/network-auth.xml:399(para)
13384
msgid "The file method is very useful for large changes."
13385
msgstr ""
13386
13387
#: serverguide/C/network-auth.xml:406(para)
13388
msgid ""
13389
"Adding additional <emphasis>schemas</emphasis> to "
13390
"<application>slapd</application> requires the schema to be converted to LDIF "
13391
"format. The <filename role=\"directory\">/etc/ldap/schema</filename> "
13392
"directory contains some schema files already converted to LDIF format as "
13393
"demonstrated in the previous section. Fortunately, the "
13394
"<application>slapd</application> program can be used to automate the "
13395
"conversion. The following example will add the "
13396
"<emphasis>dyngoup.schema</emphasis>:"
13397
msgstr ""
13398
13399
#: serverguide/C/network-auth.xml:416(para)
13400
msgid ""
13401
"First, create a conversion <filename>schema_convert.conf</filename> file "
13402
"containing the following lines:"
13403
msgstr ""
13404
13405
#: serverguide/C/network-auth.xml:421(programlisting)
13406
#, no-wrap
13407
msgid ""
13408
"\n"
13409
"include /etc/ldap/schema/core.schema\n"
13410
"include /etc/ldap/schema/collective.schema\n"
13411
"include /etc/ldap/schema/corba.schema\n"
13412
"include /etc/ldap/schema/cosine.schema\n"
13413
"include /etc/ldap/schema/duaconf.schema\n"
13414
"include /etc/ldap/schema/dyngroup.schema\n"
13415
"include /etc/ldap/schema/inetorgperson.schema\n"
13416
"include /etc/ldap/schema/java.schema\n"
13417
"include /etc/ldap/schema/misc.schema\n"
13418
"include /etc/ldap/schema/nis.schema\n"
13419
"include /etc/ldap/schema/openldap.schema\n"
13420
"include /etc/ldap/schema/ppolicy.schema\n"
13421
msgstr ""
13422
13423
#: serverguide/C/network-auth.xml:439(para) serverguide/C/network-auth.xml:1655(para)
13424
msgid "Next, create a temporary directory to hold the output:"
13425
msgstr ""
13426
13427
#: serverguide/C/network-auth.xml:444(command) serverguide/C/network-auth.xml:1660(command) serverguide/C/network-auth.xml:2695(command)
13428
msgid "mkdir /tmp/ldif_output"
13429
msgstr ""
13430
13431
#: serverguide/C/network-auth.xml:450(para)
13432
msgid ""
13433
"Now using <application>slapcat</application> convert the schema files to "
13434
"LDIF:"
13435
msgstr ""
13436
13437
#: serverguide/C/network-auth.xml:455(command)
13438
msgid ""
13439
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
13440
"\"cn={5}dyngroup,cn=schema,cn=config\" > /tmp/cn=dyngroup.ldif"
13441
msgstr ""
13442
13443
#: serverguide/C/network-auth.xml:458(para)
13444
msgid ""
13445
"Adjust the configuration file name and temporary directory names if yours "
13446
"are different. Also, it may be worthwhile to keep the "
13447
"<filename>ldif_output</filename> directory around in case you want to add "
13448
"additional schemas in the future."
13449
msgstr ""
13450
13451
#: serverguide/C/network-auth.xml:467(para)
13452
msgid ""
13453
"Edit the <filename>/tmp/cn\\=dyngroup.ldif</filename> file, changing the "
13454
"following attributes:"
13455
msgstr ""
13456
13457
#: serverguide/C/network-auth.xml:471(programlisting)
13458
#, no-wrap
13459
msgid ""
13460
"\n"
13461
"dn: cn=dyngroup,cn=schema,cn=config\n"
13462
"...\n"
13463
"cn: dyngroup\n"
13464
msgstr ""
13465
13466
#: serverguide/C/network-auth.xml:477(para) serverguide/C/network-auth.xml:1691(para)
13467
msgid "And remove the following lines from the bottom of the file:"
13468
msgstr ""
13469
13470
#: serverguide/C/network-auth.xml:481(programlisting)
13471
#, no-wrap
13472
msgid ""
13473
"\n"
13474
"structuralObjectClass: olcSchemaConfig\n"
13475
"entryUUID: 10dae0ea-0760-102d-80d3-f9366b7f7757\n"
13476
"creatorsName: cn=config\n"
13477
"createTimestamp: 20080826021140Z\n"
13478
"entryCSN: 20080826021140.791425Z#000000#000#000000\n"
13479
"modifiersName: cn=config\n"
13480
"modifyTimestamp: 20080826021140Z\n"
13481
msgstr ""
13482
13483
#: serverguide/C/network-auth.xml:492(para) serverguide/C/network-auth.xml:1706(para) serverguide/C/network-auth.xml:2741(para)
13484
msgid ""
13485
"The attribute values will vary, just be sure the attributes are removed."
13486
msgstr ""
13487
13488
#: serverguide/C/network-auth.xml:500(para) serverguide/C/network-auth.xml:1714(para)
13489
msgid ""
13490
"Finally, using the <application>ldapadd</application> utility, add the new "
13491
"schema to the directory:"
13492
msgstr ""
13493
13494
#: serverguide/C/network-auth.xml:506(command)
13495
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/cn\\=dyngroup.ldif"
13496
msgstr ""
13497
13498
#: serverguide/C/network-auth.xml:512(para)
13499
msgid ""
13500
"There should now be a <emphasis>dn: "
13501
"cn={4}dyngroup,cn=schema,cn=config</emphasis> entry in the cn=config tree."
13502
msgstr ""
13503
13504
#: serverguide/C/network-auth.xml:522(title)
13505
msgid "LDAP Replication"
13506
msgstr ""
13507
13508
#: serverguide/C/network-auth.xml:524(para)
13509
msgid ""
13510
"LDAP often quickly becomes a highly critical service to the network. "
13511
"Multiple systems will come to depend on LDAP for authentication, "
13512
"authorization, configuration, etc. It is a good idea to setup a redundant "
13513
"system through replication."
13514
msgstr ""
13515
13516
#: serverguide/C/network-auth.xml:530(para)
13517
msgid ""
13518
"Replication is achieved using the <emphasis>Syncrepl</emphasis> engine. "
13519
"Syncrepl allows the changes to be synced using a "
13520
"<emphasis>consumer</emphasis>, <emphasis>provider</emphasis> model. A "
13521
"provider sends directory changes to consumers."
13522
msgstr ""
13523
13524
#: serverguide/C/network-auth.xml:537(title)
13525
msgid "Provider Configuration"
13526
msgstr ""
13527
13528
#: serverguide/C/network-auth.xml:539(para)
13529
msgid ""
13530
"The following is an example of a <emphasis>Single-Master</emphasis> "
13531
"configuration. In this configuration one OpenLDAP server is configured as a "
13532
"<emphasis>provider</emphasis> and another as a <emphasis>consumer</emphasis>."
13533
msgstr ""
13534
13535
#: serverguide/C/network-auth.xml:547(para)
13536
msgid ""
13537
"First, configure the provider server. Copy the following to a file named "
13538
"<filename>provider_sync.ldif</filename>:"
13539
msgstr ""
13540
13541
#: serverguide/C/network-auth.xml:552(programlisting)
13542
#, no-wrap
13543
msgid ""
13544
"\n"
13545
"# Add indexes to the frontend db.\n"
13546
"dn: olcDatabase={1}hdb,cn=config\n"
13547
"changetype: modify\n"
13548
"add: olcDbIndex\n"
13549
"olcDbIndex: entryCSN eq\n"
13550
"-\n"
13551
"add: olcDbIndex\n"
13552
"olcDbIndex: entryUUID eq\n"
13553
"\n"
13554
"#Load the syncprov and accesslog modules.\n"
13555
"dn: cn=module{0},cn=config\n"
13556
"changetype: modify\n"
13557
"add: olcModuleLoad\n"
13558
"olcModuleLoad: syncprov\n"
13559
"-\n"
13560
"add: olcModuleLoad\n"
13561
"olcModuleLoad: accesslog\n"
13562
"\n"
13563
"# Accesslog database definitions\n"
13564
"dn: olcDatabase={2}hdb,cn=config\n"
13565
"objectClass: olcDatabaseConfig\n"
13566
"objectClass: olcHdbConfig\n"
13567
"olcDatabase: {2}hdb\n"
13568
"olcDbDirectory: /var/lib/ldap/accesslog\n"
13569
"olcSuffix: cn=accesslog\n"
13570
"olcRootDN: cn=admin,dc=example,dc=com\n"
13571
"olcDbIndex: default eq\n"
13572
"olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart\n"
13573
"\n"
13574
"# Accesslog db syncprov.\n"
13575
"dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config\n"
13576
"changetype: add\n"
13577
"objectClass: olcOverlayConfig\n"
13578
"objectClass: olcSyncProvConfig\n"
13579
"olcOverlay: syncprov\n"
13580
"olcSpNoPresent: TRUE\n"
13581
"olcSpReloadHint: TRUE\n"
13582
"\n"
13583
"# syncrepl Provider for primary db\n"
13584
"dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config\n"
13585
"changetype: add\n"
13586
"objectClass: olcOverlayConfig\n"
13587
"objectClass: olcSyncProvConfig\n"
13588
"olcOverlay: syncprov\n"
13589
"olcSpNoPresent: TRUE\n"
13590
"\n"
13591
"# accesslog overlay definitions for primary db\n"
13592
"dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config\n"
13593
"objectClass: olcOverlayConfig\n"
13594
"objectClass: olcAccessLogConfig\n"
13595
"olcOverlay: accesslog\n"
13596
"olcAccessLogDB: cn=accesslog\n"
13597
"olcAccessLogOps: writes\n"
13598
"olcAccessLogSuccess: TRUE\n"
13599
"# scan the accesslog DB every day, and purge entries older than 7 days\n"
13600
"olcAccessLogPurge: 07+00:00 01+00:00\n"
13601
msgstr ""
13602
13603
#: serverguide/C/network-auth.xml:614(para)
13604
msgid ""
13605
"The <application>AppArmor</application> profile for "
13606
"<application>slapd</application> will need to be adjusted for the accesslog "
13607
"database location. Edit <filename>/etc/apparmor.d/usr.sbin.slapd</filename> "
13608
"adding:"
13609
msgstr ""
13610
13611
#: serverguide/C/network-auth.xml:619(programlisting)
13612
#, no-wrap
13613
msgid ""
13614
"\n"
13615
" /var/lib/ldap/accesslog/ r,\n"
13616
" /var/lib/ldap/accesslog/** rwk,\n"
13617
msgstr ""
13618
13619
#: serverguide/C/network-auth.xml:624(para)
13620
msgid ""
13621
"Then create the directory, reload the <application>apparmor</application> "
13622
"profile, and copy the <filename>DB_CONFIG</filename> file:"
13623
msgstr ""
13624
13625
#: serverguide/C/network-auth.xml:630(command)
13626
msgid "sudo -u openldap mkdir /var/lib/ldap/accesslog"
13627
msgstr ""
13628
13629
#: serverguide/C/network-auth.xml:631(command)
13630
msgid "sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog/"
13631
msgstr ""
13632
13633
#: serverguide/C/network-auth.xml:636(para)
13634
msgid ""
13635
"Using the <emphasis>-u openldap</emphasis> option with the "
13636
"<application>sudo</application> commands above removes the need to adjust "
13637
"permissions for the new directory later."
13638
msgstr ""
13639
13640
#: serverguide/C/network-auth.xml:645(para)
13641
msgid ""
13642
"Edit the file and change the <emphasis>olcRootDN</emphasis> to match your "
13643
"directory:"
13644
msgstr ""
13645
13646
#: serverguide/C/network-auth.xml:649(programlisting)
13647
#, no-wrap
13648
msgid ""
13649
"\n"
13650
"olcRootDN: cn=admin,dc=example,dc=com\n"
13651
msgstr ""
13652
13653
#: serverguide/C/network-auth.xml:657(para)
13654
msgid ""
13655
"Next, add the LDIF file using the <application>ldapadd</application> utility:"
13656
msgstr ""
13657
13658
#: serverguide/C/network-auth.xml:662(command)
13659
msgid "sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif"
13660
msgstr ""
13661
13662
#: serverguide/C/network-auth.xml:669(para)
13663
msgid "Restart <application>slapd</application>:"
13664
msgstr ""
13665
13666
#: serverguide/C/network-auth.xml:674(command) serverguide/C/network-auth.xml:1040(command) serverguide/C/network-auth.xml:1227(command)
13667
msgid "sudo /etc/init.d/slapd restart"
13668
msgstr ""
13669
13670
#: serverguide/C/network-auth.xml:680(para)
13671
msgid ""
13672
"The <emphasis>Provider</emphasis> server is now configured, and it is time "
13673
"to configure a <emphasis>Consumer</emphasis> server."
13674
msgstr ""
13675
13676
#: serverguide/C/network-auth.xml:687(title)
13677
msgid "Consumer Configuration"
13678
msgstr ""
13679
13680
#: serverguide/C/network-auth.xml:692(para)
13681
msgid ""
13682
"On the <emphasis>Consumer</emphasis> server configure it the same as the "
13683
"<emphasis>Provider</emphasis> except for the <emphasis>Syncrepl</emphasis> "
13684
"configuration steps."
13685
msgstr ""
13686
13687
#: serverguide/C/network-auth.xml:697(para)
13688
msgid "Add the additional schema files:"
13689
msgstr ""
13690
13691
#: serverguide/C/network-auth.xml:707(para)
13692
msgid ""
13693
"Also, create, or copy from the provider server, the "
13694
"<filename>backend.example.com.ldif</filename>"
13695
msgstr ""
13696
13697
#: serverguide/C/network-auth.xml:711(programlisting)
13698
#, no-wrap
13699
msgid ""
13700
"\n"
13701
"# Load dynamic backend modules\n"
13702
"dn: cn=module,cn=config\n"
13703
"objectClass: olcModuleList\n"
13704
"cn: module\n"
13705
"olcModulepath: /usr/lib/ldap\n"
13706
"olcModuleload: back_hdb\n"
13707
"\n"
13708
"# Database settings\n"
13709
"dn: olcDatabase=hdb,cn=config\n"
13710
"objectClass: olcDatabaseConfig\n"
13711
"objectClass: olcHdbConfig\n"
13712
"olcDatabase: {1}hdb\n"
13713
"olcSuffix: dc=example,dc=com\n"
13714
"olcDbDirectory: /var/lib/ldap\n"
13715
"olcRootDN: cn=admin,dc=example,dc=com\n"
13716
"olcRootPW: secret\n"
13717
"olcDbConfig: set_cachesize 0 2097152 0\n"
13718
"olcDbConfig: set_lk_max_objects 1500\n"
13719
"olcDbConfig: set_lk_max_locks 1500\n"
13720
"olcDbConfig: set_lk_max_lockers 1500\n"
13721
"olcDbIndex: objectClass eq\n"
13722
"olcLastMod: TRUE\n"
13723
"olcDbCheckpoint: 512 30\n"
13724
"olcAccess: to attrs=userPassword by dn=\"cn=admin,dc=example,dc=com\" write "
13725
"by anonymous auth by self write by * none\n"
13726
"olcAccess: to attrs=shadowLastChange by self write by * read\n"
13727
"olcAccess: to dn.base=\"\" by * read\n"
13728
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13729
msgstr ""
13730
13731
#: serverguide/C/network-auth.xml:741(para)
13732
msgid "And add the LDIF by entering:"
13733
msgstr ""
13734
13735
#: serverguide/C/network-auth.xml:752(para)
13736
msgid ""
13737
"Do the same with the <filename>frontend.example.com.ldif</filename> file "
13738
"listed above, and add it:"
13739
msgstr ""
13740
13741
#: serverguide/C/network-auth.xml:760(para)
13742
msgid ""
13743
"The two severs should now have the same configuration except for the "
13744
"<emphasis>Syncrepl</emphasis> options."
13745
msgstr ""
13746
13747
#: serverguide/C/network-auth.xml:768(para)
13748
msgid ""
13749
"Now create a file named <filename>consumer_sync.ldif</filename> containing:"
13750
msgstr ""
13751
13752
#: serverguide/C/network-auth.xml:772(programlisting)
13753
#, no-wrap
13754
msgid ""
13755
"\n"
13756
"#Load the syncprov module.\n"
13757
"dn: cn=module{0},cn=config\n"
13758
"changetype: modify\n"
13759
"add: olcModuleLoad\n"
13760
"olcModuleLoad: syncprov\n"
13761
"\n"
13762
"# syncrepl specific indices\n"
13763
"dn: olcDatabase={1}hdb,cn=config\n"
13764
"changetype: modify\n"
13765
"add: olcDbIndex\n"
13766
"olcDbIndex: entryUUID eq\n"
13767
"-\n"
13768
"add: olcSyncRepl\n"
13769
"olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
13770
"binddn=\"cn=admin,dc=example,dc=com\" \n"
13771
" credentials=secret searchbase=\"dc=example,dc=com\" "
13772
"logbase=\"cn=accesslog\" \n"
13773
" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" "
13774
"schemachecking=on \n"
13775
" type=refreshAndPersist retry=\"60 +\" syncdata=accesslog\n"
13776
"-\n"
13777
"add: olcUpdateRef\n"
13778
"olcUpdateRef: ldap://ldap01.example.com\n"
13779
msgstr ""
13780
13781
#: serverguide/C/network-auth.xml:795(para)
13782
msgid "You will probably want to change the following attributes:"
13783
msgstr ""
13784
13785
#: serverguide/C/network-auth.xml:800(para)
13786
msgid "<emphasis>ldap01.example.com</emphasis> to your server's hostname."
13787
msgstr ""
13788
13789
#: serverguide/C/network-auth.xml:801(emphasis)
13790
msgid "binddn"
13791
msgstr ""
13792
13793
#: serverguide/C/network-auth.xml:802(emphasis)
13794
msgid "credentials"
13795
msgstr ""
13796
13797
#: serverguide/C/network-auth.xml:803(emphasis)
13798
msgid "searchbase"
13799
msgstr ""
13800
13801
#: serverguide/C/network-auth.xml:804(emphasis)
13802
msgid "olcUpdateRef:"
13803
msgstr ""
13804
13805
#: serverguide/C/network-auth.xml:810(para)
13806
msgid "Add the LDIF file to the configuration tree:"
13807
msgstr ""
13808
13809
#: serverguide/C/network-auth.xml:815(command)
13810
msgid "sudo ldapadd -c -Y EXTERNAL -H ldapi:/// -f consumer_sync.ldif"
13811
msgstr ""
13812
13813
#: serverguide/C/network-auth.xml:821(para)
13814
msgid ""
13815
"The frontend database should now sync between servers. You can add "
13816
"additional servers using the steps above as the need arises."
13817
msgstr ""
13818
13819
#: serverguide/C/network-auth.xml:831(programlisting)
13820
#, no-wrap
13821
msgid "127.0.0.1\tldap01.example.com ldap01"
13822
msgstr ""
13823
13824
#: serverguide/C/network-auth.xml:827(para)
13825
msgid ""
13826
"The <application>slapd</application> daemon will send log information to "
13827
"<filename>/var/log/syslog</filename> by default. So if all does "
13828
"<emphasis>not</emphasis> go well check there for errors and other "
13829
"troubleshooting information. Also, be sure that each server knows it's Fully "
13830
"Qualified Domain Name (FQDN). This is configured in "
13831
"<filename>/etc/hosts</filename> with a line similar to: <placeholder-1/>."
13832
msgstr ""
13833
13834
#: serverguide/C/network-auth.xml:839(title)
13835
msgid "Setting up ACL"
13836
msgstr ""
13837
13838
#: serverguide/C/network-auth.xml:841(para)
13839
msgid ""
13840
"Authentication requires access to the password field, that should be not "
13841
"accessible by default. Also, in order for users to change their own "
13842
"password, using <command>passwd</command> or other utilities, "
13843
"<emphasis>shadowLastChange</emphasis> needs to be accessible once a user has "
13844
"authenticated."
13845
msgstr ""
13846
13847
#: serverguide/C/network-auth.xml:848(para)
13848
msgid ""
13849
"To view the Access Control List (ACL), use the "
13850
"<application>ldapsearch</application> utility:"
13851
msgstr ""
13852
13853
#: serverguide/C/network-auth.xml:853(command)
13854
msgid ""
13855
"ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb "
13856
"olcAccess"
13857
msgstr ""
13858
13859
#: serverguide/C/network-auth.xml:857(computeroutput)
13860
#, no-wrap
13861
msgid ""
13862
"Enter LDAP Password: \n"
13863
"dn: olcDatabase={1}hdb,cn=config\n"
13864
"olcAccess: {0}to attrs=userPassword,shadowLastChange by "
13865
"dn=\"cn=admin,dc=exampl\n"
13866
" e,dc=com\" write by anonymous auth by self write by * none\n"
13867
"olcAccess: {1}to dn.base=\"\" by * read\n"
13868
"olcAccess: {2}to * by dn=\"cn=admin,dc=example,dc=com\" write by * read\n"
13869
msgstr ""
13870
13871
#: serverguide/C/network-auth.xml:869(title)
13872
msgid "TLS and SSL"
13873
msgstr ""
13874
13875
#: serverguide/C/network-auth.xml:871(para)
13876
msgid ""
13877
"When authenticating to an OpenLDAP server it is best to do so using an "
13878
"encrypted session. This can be accomplished using Transport Layer Security "
13879
"(TLS) and/or Secure Sockets Layer (SSL)."
13880
msgstr ""
13881
13882
#: serverguide/C/network-auth.xml:876(para)
13883
msgid ""
13884
"The first step in the process is to obtain or create a "
13885
"<emphasis>certificate</emphasis>. Because <application>slapd</application> "
13886
"is compiled using the <application>gnutls</application> library, the "
13887
"<application>certtool</application> utility will be used to create "
13888
"certificates."
13889
msgstr ""
13890
13891
#: serverguide/C/network-auth.xml:885(para)
13892
msgid ""
13893
"First, install <application>gnutls-bin</application> by entering the "
13894
"following in a terminal:"
13895
msgstr ""
13896
13897
#: serverguide/C/network-auth.xml:890(command)
13898
msgid "sudo apt-get install gnutls-bin"
13899
msgstr ""
13900
13901
#: serverguide/C/network-auth.xml:896(para)
13902
msgid ""
13903
"Next, create a private key for the <emphasis>Certificate "
13904
"Authority</emphasis> (CA):"
13905
msgstr ""
13906
13907
#: serverguide/C/network-auth.xml:901(command)
13908
msgid ""
13909
"sudo sh -c \"certtool --generate-privkey > /etc/ssl/private/cakey.pem\""
13910
msgstr ""
13911
13912
#: serverguide/C/network-auth.xml:907(para)
13913
msgid ""
13914
"Create a <filename>/etc/ssl/ca.info</filename> details file to self-sign the "
13915
"CA certificate containing:"
13916
msgstr ""
13917
13918
#: serverguide/C/network-auth.xml:911(programlisting)
13919
#, no-wrap
13920
msgid ""
13921
"\n"
13922
"cn = Example Company\n"
13923
"ca\n"
13924
"cert_signing_key\n"
13925
msgstr ""
13926
13927
#: serverguide/C/network-auth.xml:920(para)
13928
msgid "Now create the self-signed CA certificate:"
13929
msgstr ""
13930
13931
#: serverguide/C/network-auth.xml:925(command)
13932
msgid ""
13933
"sudo certtool --generate-self-signed --load-privkey "
13934
"/etc/ssl/private/cakey.pem \\ --template /etc/ssl/ca.info --outfile "
13935
"/etc/ssl/certs/cacert.pem"
13936
msgstr ""
13937
13938
#: serverguide/C/network-auth.xml:932(para)
13939
msgid "Make a private key for the server:"
13940
msgstr ""
13941
13942
#: serverguide/C/network-auth.xml:937(command)
13943
msgid ""
13944
"sudo sh -c \"certtool --generate-privkey > "
13945
"/etc/ssl/private/ldap01_slapd_key.pem\""
13946
msgstr ""
13947
13948
#: serverguide/C/network-auth.xml:941(para)
13949
msgid ""
13950
"Replace <emphasis>ldap01</emphasis> in the filename with your server's "
13951
"hostname. Naming the certificate and key for the host and service that will "
13952
"be using them will help keep filenames and paths straight."
13953
msgstr ""
13954
13955
#: serverguide/C/network-auth.xml:950(para)
13956
msgid ""
13957
"To sign the server's certificate with the CA, create the "
13958
"<filename>/etc/ssl/ldap01.info</filename> info file containing:"
13959
msgstr ""
13960
13961
#: serverguide/C/network-auth.xml:954(programlisting)
13962
#, no-wrap
13963
msgid ""
13964
"\n"
13965
"organization = Example Company\n"
13966
"cn = ldap01.example.com\n"
13967
"tls_www_server\n"
13968
"encryption_key\n"
13969
"signing_key\n"
13970
msgstr ""
13971
13972
#: serverguide/C/network-auth.xml:965(para)
13973
msgid "Create the server's certificate:"
13974
msgstr ""
13975
13976
#: serverguide/C/network-auth.xml:970(command)
13977
msgid ""
13978
"sudo certtool --generate-certificate --load-privkey /etc/ssl/private/x01-"
13979
"test_slapd_key.pem \\ --load-ca-certificate /etc/ssl/certs/cacert.pem --load-"
13980
"ca-privkey /etc/ssl/private/cakey.pem \\ --template /etc/ssl/x01-test.info --"
13981
"outfile /etc/ssl/certs/x01-test_slapd_cert.pem"
13982
msgstr ""
13983
13984
#: serverguide/C/network-auth.xml:978(para)
13985
msgid ""
13986
"Once you have a certificate, key, and CA cert installed, use "
13987
"<application>ldapmodify</application> to add the new configuration options:"
13988
msgstr ""
13989
13990
#: serverguide/C/network-auth.xml:989(userinput)
13991
#, no-wrap
13992
msgid ""
13993
"dn: cn=config\n"
13994
"add: olcTLSCACertificateFile\n"
13995
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
13996
"-\n"
13997
"add: olcTLSCertificateFile\n"
13998
"olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem\n"
13999
"-\n"
14000
"add: olcTLSCertificateKeyFile\n"
14001
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem"
14002
msgstr ""
14003
14004
#: serverguide/C/network-auth.xml:988(computeroutput) serverguide/C/network-auth.xml:1159(computeroutput)
14005
#, no-wrap
14006
msgid ""
14007
"Enter LDAP Password:\n"
14008
"<placeholder-1/>\n"
14009
"\n"
14010
"modifying entry \"cn=config\"\n"
14011
msgstr ""
14012
14013
#: serverguide/C/network-auth.xml:1004(para)
14014
msgid ""
14015
"Adjust the <filename>ldap01_slapd_cert.pem</filename>, "
14016
"<filename>ldap01_slapd_key.pem</filename>, and "
14017
"<filename>cacert.pem</filename> names if yours are different."
14018
msgstr ""
14019
14020
#: serverguide/C/network-auth.xml:1010(para)
14021
msgid ""
14022
"Next, edit <filename>/etc/default/slapd</filename> uncomment the "
14023
"<emphasis>SLAPD_SERVICES</emphasis> option:"
14024
msgstr ""
14025
14026
#: serverguide/C/network-auth.xml:1014(programlisting)
14027
#, no-wrap
14028
msgid ""
14029
"\n"
14030
"SLAPD_SERVICES=\"ldap:/// ldapi:/// ldaps:///\"\n"
14031
msgstr ""
14032
14033
#: serverguide/C/network-auth.xml:1018(para)
14034
msgid ""
14035
"Now the <emphasis>openldap</emphasis> user needs access to the certificate:"
14036
msgstr ""
14037
14038
#: serverguide/C/network-auth.xml:1023(command)
14039
msgid "sudo adduser openldap ssl-cert"
14040
msgstr ""
14041
14042
#: serverguide/C/network-auth.xml:1024(command)
14043
msgid "sudo chgrp ssl-cert /etc/ssl/private/ldap01_slapd_key.pem"
14044
msgstr ""
14045
14046
#: serverguide/C/network-auth.xml:1025(command)
14047
msgid "sudo chmod g+r /etc/ssl/private/ldap01_slapd_key.pem"
14048
msgstr ""
14049
14050
#: serverguide/C/network-auth.xml:1029(para)
14051
msgid ""
14052
"If the <filename role=\"directory\">/etc/ssl/private</filename> and "
14053
"<filename>/etc/ssl/private/server.key</filename> have different permissions, "
14054
"adjust the commands appropriately."
14055
msgstr ""
14056
14057
#: serverguide/C/network-auth.xml:1035(para)
14058
msgid "Finally, restart <application>slapd</application>:"
14059
msgstr ""
14060
14061
#: serverguide/C/network-auth.xml:1043(para)
14062
msgid ""
14063
"The <application>slapd</application> daemon should now be listening for "
14064
"LDAPS connections and be able to use STARTTLS during authentication."
14065
msgstr ""
14066
14067
#: serverguide/C/network-auth.xml:1049(para)
14068
msgid ""
14069
"If you run into troubles with the server not starting, check the "
14070
"/var/log/syslog. If you see errors like main: TLS init def ctx failed: -1, "
14071
"it is likely there is a configuration problem. Check that the certificate is "
14072
"signed by the authority from in the files configured, and that the ssl-cert "
14073
"group has read permissions on the private key."
14074
msgstr ""
14075
14076
#: serverguide/C/network-auth.xml:1061(title)
14077
msgid "TLS Replication"
14078
msgstr ""
14079
14080
#: serverguide/C/network-auth.xml:1063(para)
14081
msgid ""
14082
"If you have setup <application>Syncrepl</application> between servers, it is "
14083
"prudent to encrypt the replication traffic using <emphasis>Transport Layer "
14084
"Security (TLS)</emphasis>. For details on setting up replication see <xref "
14085
"linkend=\"openldap-server-replication\"/>."
14086
msgstr ""
14087
14088
#: serverguide/C/network-auth.xml:1069(para)
14089
msgid ""
14090
"Assuming you have followed the above instructions and created a CA "
14091
"certificate and server certificate on the <emphasis>Provider</emphasis> "
14092
"server. Follow the following instructions to create a certificate and key "
14093
"for the <emphasis>Consumer</emphasis> server."
14094
msgstr ""
14095
14096
#: serverguide/C/network-auth.xml:1078(para)
14097
msgid "Create a new key for the Consumer server:"
14098
msgstr ""
14099
14100
#: serverguide/C/network-auth.xml:1083(command)
14101
msgid "mkdir ldap02-ssl"
14102
msgstr ""
14103
14104
#: serverguide/C/network-auth.xml:1084(command)
14105
msgid "cd ldap02-ssl"
14106
msgstr ""
14107
14108
#: serverguide/C/network-auth.xml:1085(command)
14109
msgid "certtool --generate-privkey > ldap02_slapd_key.pem"
14110
msgstr ""
14111
14112
#: serverguide/C/network-auth.xml:1089(para)
14113
msgid ""
14114
"Creating a new directory is not strictly necessary, but it will help keep "
14115
"things organized and make it easier to copy the files to the Consumer server."
14116
msgstr ""
14117
14118
#: serverguide/C/network-auth.xml:1098(para)
14119
msgid ""
14120
"Next, create an info file, <filename>ldap02.info</filename> for the Consumer "
14121
"server, changing the attributes to match your locality and server:"
14122
msgstr ""
14123
14124
#: serverguide/C/network-auth.xml:1103(programlisting)
14125
#, no-wrap
14126
msgid ""
14127
"\n"
14128
"country = US\n"
14129
"state = North Carolina\n"
14130
"locality = Winston-Salem\n"
14131
"organization = Example Company\n"
14132
"cn = ldap02.salem.edu\n"
14133
"tls_www_client\n"
14134
"encryption_key\n"
14135
"signing_key\n"
14136
msgstr ""
14137
14138
#: serverguide/C/network-auth.xml:1117(para)
14139
msgid "Create the certificate:"
14140
msgstr ""
14141
14142
#: serverguide/C/network-auth.xml:1122(command)
14143
msgid ""
14144
"sudo certtool --generate-certificate --load-privkey ldap02_slapd_key.pem \\ -"
14145
"-load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey "
14146
"/etc/ssl/private/cakey.pem \\ --template ldap02.info --outfile "
14147
"ldap02_slapd_cert.pem"
14148
msgstr ""
14149
14150
#: serverguide/C/network-auth.xml:1130(para)
14151
msgid "Copy the <filename>cacert.pem</filename> to the dicretory:"
14152
msgstr ""
14153
14154
#: serverguide/C/network-auth.xml:1135(command)
14155
msgid "cp /etc/ssl/certs/cacert.pem ."
14156
msgstr ""
14157
14158
#: serverguide/C/network-auth.xml:1141(para)
14159
msgid ""
14160
"The only thing left is to copy the <filename>ldap02-ssl</filename> directory "
14161
"to the Consumer server, then copy <filename>ldap02_slapd_cert.pem</filename> "
14162
"and <filename>cacert.pem</filename> to <filename>/etc/ssl/certs</filename>, "
14163
"and copy <filename>ldap02_slapd_key.pem</filename> to "
14164
"<filename>/etc/ssl/private</filename>."
14165
msgstr ""
14166
14167
#: serverguide/C/network-auth.xml:1150(para)
14168
msgid ""
14169
"Once the files are in place adjust the <emphasis>cn=config</emphasis> tree "
14170
"by entering:"
14171
msgstr ""
14172
14173
#: serverguide/C/network-auth.xml:1160(userinput)
14174
#, no-wrap
14175
msgid ""
14176
"dn: cn=config\n"
14177
"add: olcTLSCACertificateFile\n"
14178
"olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem\n"
14179
"-\n"
14180
"add: olcTLSCertificateFile\n"
14181
"olcTLSCertificateFile: /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14182
"-\n"
14183
"add: olcTLSCertificateKeyFile\n"
14184
"olcTLSCertificateKeyFile: /etc/ssl/private/ldap02_slapd_key.pem"
14185
msgstr ""
14186
14187
#: serverguide/C/network-auth.xml:1177(para)
14188
msgid ""
14189
"As with the Provider you can now edit "
14190
"<filename>/etc/default/slapd</filename> and add the "
14191
"<emphasis>ldaps:///</emphasis> parameter to the "
14192
"<emphasis>SLAPD_SERVICES</emphasis> option."
14193
msgstr ""
14194
14195
#: serverguide/C/network-auth.xml:1185(para)
14196
msgid ""
14197
"Now that <emphasis>TLS</emphasis> has been setup on each server, once again "
14198
"modify the <emphasis>Consumer</emphasis> server's "
14199
"<emphasis>cn=config</emphasis> tree by entering the following in a terminal:"
14200
msgstr ""
14201
14202
#: serverguide/C/network-auth.xml:1198(userinput)
14203
#, no-wrap
14204
msgid ""
14205
"\n"
14206
"dn: olcDatabase={1}hdb,cn=config\n"
14207
"replace: olcSyncrepl\n"
14208
"olcSyncrepl: {0}rid=0 provider=ldap://ldap01.example.com bindmethod=simple "
14209
"binddn=\"cn=ad\n"
14210
" min,dc=example,dc=com\" credentials=secret searchbase=\"dc=example,dc=com\" "
14211
"logbas\n"
14212
" e=\"cn=accesslog\" "
14213
"logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" s\n"
14214
" chemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog "
14215
"starttls=yes"
14216
msgstr ""
14217
14218
#: serverguide/C/network-auth.xml:1195(computeroutput)
14219
#, no-wrap
14220
msgid ""
14221
"SASL/EXTERNAL authentication started\n"
14222
"SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\n"
14223
"SASL SSF: 0\n"
14224
"<placeholder-1/>\n"
14225
"\n"
14226
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
14227
msgstr ""
14228
14229
#: serverguide/C/network-auth.xml:1210(para)
14230
msgid ""
14231
"If the LDAP server hostname does not match the Fully Qualified Domain Name "
14232
"(FQDN) in the certificate, you may have to edit "
14233
"<filename>/etc/ldap/ldap.conf</filename> and add the following TLS options:"
14234
msgstr ""
14235
14236
#: serverguide/C/network-auth.xml:1215(programlisting)
14237
#, no-wrap
14238
msgid ""
14239
"\n"
14240
"TLS_CERT /etc/ssl/certs/ldap02_slapd_cert.pem\n"
14241
"TLS_KEY /etc/ssl/private/ldap02_slapd_key.pem\n"
14242
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
14243
msgstr ""
14244
14245
#: serverguide/C/network-auth.xml:1222(para)
14246
msgid ""
14247
"Finally, restart <application>slapd</application> on each of the servers:"
14248
msgstr ""
14249
14250
#: serverguide/C/network-auth.xml:1235(title)
14251
msgid "LDAP Authentication"
14252
msgstr ""
14253
14254
#: serverguide/C/network-auth.xml:1237(para)
14255
msgid ""
14256
"Once you have a working LDAP server, the <application>auth-client-"
14257
"config</application> and <application>libnss-ldap</application> packages "
14258
"take the pain out of configuring an Ubuntu client to authenticate using "
14259
"LDAP. To install the packages from, a terminal prompt enter:"
14260
msgstr ""
14261
14262
#: serverguide/C/network-auth.xml:1244(command)
14263
msgid "sudo apt-get install libnss-ldap"
14264
msgstr ""
14265
14266
#: serverguide/C/network-auth.xml:1247(para)
14267
msgid ""
14268
"During the install a menu dialog will ask you connection details about your "
14269
"LDAP server."
14270
msgstr ""
14271
14272
#: serverguide/C/network-auth.xml:1251(para)
14273
msgid ""
14274
"If you make a mistake when entering your information you can execute the "
14275
"dialog again using:"
14276
msgstr ""
14277
14278
#: serverguide/C/network-auth.xml:1256(command)
14279
msgid "sudo dpkg-reconfigure ldap-auth-config"
14280
msgstr ""
14281
14282
#: serverguide/C/network-auth.xml:1259(para)
14283
msgid ""
14284
"The results of the dialog can be seen in "
14285
"<filename>/etc/ldap.conf</filename>. If your server requires options not "
14286
"covered in the menu edit this file accordingly."
14287
msgstr ""
14288
14289
#: serverguide/C/network-auth.xml:1264(para)
14290
msgid ""
14291
"Now that <application>libnss-ldap</application> is configured enable the "
14292
"<application>auth-client-config</application> LDAP profile by entering:"
14293
msgstr ""
14294
14295
#: serverguide/C/network-auth.xml:1270(command)
14296
msgid "sudo auth-client-config -t nss -p lac_ldap"
14297
msgstr ""
14298
14299
#: serverguide/C/network-auth.xml:1275(para)
14300
msgid ""
14301
"<emphasis>-t:</emphasis> only modifies "
14302
"<filename>/etc/nsswitch.conf</filename>."
14303
msgstr ""
14304
14305
#: serverguide/C/network-auth.xml:1280(para)
14306
msgid "<emphasis>-p:</emphasis> name of the profile to enable, disable, etc."
14307
msgstr ""
14308
14309
#: serverguide/C/network-auth.xml:1285(para)
14310
msgid ""
14311
"<emphasis>lac_ldap:</emphasis> the <application>auth-client-"
14312
"config</application> profile that is part of the <application>ldap-auth-"
14313
"config</application> package."
14314
msgstr ""
14315
14316
#: serverguide/C/network-auth.xml:1292(para)
14317
msgid ""
14318
"Using the <application>pam-auth-update</application> utility, configure the "
14319
"system to use LDAP for authentication:"
14320
msgstr ""
14321
14322
#: serverguide/C/network-auth.xml:1297(command)
14323
msgid "sudo pam-auth-update"
14324
msgstr ""
14325
14326
#: serverguide/C/network-auth.xml:1300(para)
14327
msgid ""
14328
"From the <application>pam-auth-update</application> menu, choose LDAP and "
14329
"any other authentication mechanisms you need."
14330
msgstr ""
14331
14332
#: serverguide/C/network-auth.xml:1304(para)
14333
msgid ""
14334
"You should now be able to login using user credentials stored in the LDAP "
14335
"directory."
14336
msgstr ""
14337
14338
#: serverguide/C/network-auth.xml:1309(para)
14339
msgid ""
14340
"If you are going to use LDAP to store Samba users you will need to configure "
14341
"the server to authenticate using LDAP. See <xref linkend=\"samba-ldap\"/> "
14342
"for details."
14343
msgstr ""
14344
14345
#: serverguide/C/network-auth.xml:1317(title)
14346
msgid "User and Group Management"
14347
msgstr ""
14348
14349
#: serverguide/C/network-auth.xml:1319(para)
14350
msgid ""
14351
"The <application>ldap-utils</application> package comes with multiple "
14352
"utilities to manage the directory, but the long string of options needed, "
14353
"can make them a burden to use. The <application>ldapscripts</application> "
14354
"package contains configurable scripts to easily manage LDAP users and groups."
14355
msgstr ""
14356
14357
#: serverguide/C/network-auth.xml:1325(para)
14358
msgid "To install the package, from a terminal enter:"
14359
msgstr ""
14360
14361
#: serverguide/C/network-auth.xml:1330(command)
14362
msgid "sudo apt-get install ldapscripts"
14363
msgstr ""
14364
14365
#: serverguide/C/network-auth.xml:1333(para)
14366
msgid ""
14367
"Next, edit the config file "
14368
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> uncommenting and "
14369
"changing the following to match your environment:"
14370
msgstr ""
14371
14372
#: serverguide/C/network-auth.xml:1338(programlisting)
14373
#, no-wrap
14374
msgid ""
14375
"\n"
14376
"SERVER=localhost\n"
14377
"BINDDN='cn=admin,dc=example,dc=com'\n"
14378
"BINDPWDFILE=\"/etc/ldapscripts/ldapscripts.passwd\"\n"
14379
"SUFFIX='dc=example,dc=com'\n"
14380
"GSUFFIX='ou=Groups'\n"
14381
"USUFFIX='ou=People'\n"
14382
"MSUFFIX='ou=Computers'\n"
14383
"GIDSTART=10000\n"
14384
"UIDSTART=10000\n"
14385
"MIDSTART=10000\n"
14386
msgstr ""
14387
14388
#: serverguide/C/network-auth.xml:1351(para)
14389
msgid ""
14390
"Now, create the <filename>ldapscripts.passwd</filename> file to allow "
14391
"authenticated access to the directory:"
14392
msgstr ""
14393
14394
#: serverguide/C/network-auth.xml:1356(command)
14395
msgid ""
14396
"sudo sh -c \"echo -n 'secret' > /etc/ldapscripts/ldapscripts.passwd\""
14397
msgstr ""
14398
14399
#: serverguide/C/network-auth.xml:1357(command)
14400
msgid "sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd"
14401
msgstr ""
14402
14403
#: serverguide/C/network-auth.xml:1361(para)
14404
msgid ""
14405
"Replace <quote>secret</quote> with the actual password for your LDAP admin "
14406
"user."
14407
msgstr ""
14408
14409
#: serverguide/C/network-auth.xml:1366(para)
14410
msgid ""
14411
"The <application>ldapscripts</application> are now ready to help manage your "
14412
"directory. The following are some examples of how to use the scripts:"
14413
msgstr ""
14414
14415
#: serverguide/C/network-auth.xml:1373(para)
14416
msgid "Create a new user:"
14417
msgstr ""
14418
14419
#: serverguide/C/network-auth.xml:1377(command)
14420
msgid "sudo ldapadduser george example"
14421
msgstr ""
14422
14423
#: serverguide/C/network-auth.xml:1379(para)
14424
msgid ""
14425
"This will create a user with uid <emphasis role=\"italic\">george</emphasis> "
14426
"and set the user's primary group (gid) to <emphasis "
14427
"role=\"italic\">example</emphasis>"
14428
msgstr ""
14429
14430
#: serverguide/C/network-auth.xml:1385(para)
14431
msgid "Change a user's password:"
14432
msgstr ""
14433
14434
#: serverguide/C/network-auth.xml:1389(command)
14435
msgid "sudo ldapsetpasswd george"
14436
msgstr ""
14437
14438
#: serverguide/C/network-auth.xml:1390(computeroutput)
14439
#, no-wrap
14440
msgid "Changing password for user uid=george,ou=People,dc=example,dc=com"
14441
msgstr ""
14442
14443
#: serverguide/C/network-auth.xml:1391(userinput)
14444
#, no-wrap
14445
msgid "New Password: "
14446
msgstr ""
14447
14448
#: serverguide/C/network-auth.xml:1392(userinput)
14449
#, no-wrap
14450
msgid "New Password (verify): "
14451
msgstr ""
14452
14453
#: serverguide/C/network-auth.xml:1396(para)
14454
msgid "Delete a user:"
14455
msgstr ""
14456
14457
#: serverguide/C/network-auth.xml:1400(command)
14458
msgid "sudo ldapdeleteuser george"
14459
msgstr ""
14460
14461
#: serverguide/C/network-auth.xml:1405(para)
14462
msgid "Add a group:"
14463
msgstr ""
14464
14465
#: serverguide/C/network-auth.xml:1409(command)
14466
msgid "sudo ldapaddgroup qa"
14467
msgstr ""
14468
14469
#: serverguide/C/network-auth.xml:1413(para)
14470
msgid "Delete a group:"
14471
msgstr ""
14472
14473
#: serverguide/C/network-auth.xml:1417(command)
14474
msgid "sudo ldapdeletegroup qa"
14475
msgstr ""
14476
14477
#: serverguide/C/network-auth.xml:1421(para)
14478
msgid "Add a user to a group:"
14479
msgstr ""
14480
14481
#: serverguide/C/network-auth.xml:1425(command)
14482
msgid "sudo ldapaddusertogroup george qa"
14483
msgstr ""
14484
14485
#: serverguide/C/network-auth.xml:1427(para)
14486
msgid ""
14487
"You should now see a <emphasis>memberUid</emphasis> attribute for the "
14488
"<emphasis role=\"italic\">qa</emphasis> group with a value of <emphasis "
14489
"role=\"italic\">george</emphasis>."
14490
msgstr ""
14491
14492
#: serverguide/C/network-auth.xml:1433(para)
14493
msgid "Remove a user from a group:"
14494
msgstr ""
14495
14496
#: serverguide/C/network-auth.xml:1437(command)
14497
msgid "sudo ldapdeleteuserfromgroup george qa"
14498
msgstr ""
14499
14500
#: serverguide/C/network-auth.xml:1439(para)
14501
msgid ""
14502
"The <emphasis>memberUid</emphasis> attribute should now be removed from the "
14503
"<emphasis role=\"italic\">qa</emphasis> group."
14504
msgstr ""
14505
14506
#: serverguide/C/network-auth.xml:1445(para)
14507
msgid ""
14508
"The <application>ldapmodifyuser</application> script allows you to add, "
14509
"remove, or replace a user's attributes. The script uses the same syntax as "
14510
"the <application>ldapmodify</application> utility. For example:"
14511
msgstr ""
14512
14513
#: serverguide/C/network-auth.xml:1450(command)
14514
msgid "sudo ldapmodifyuser george"
14515
msgstr ""
14516
14517
#: serverguide/C/network-auth.xml:1451(computeroutput)
14518
#, no-wrap
14519
msgid ""
14520
"# About to modify the following entry :\n"
14521
"dn: uid=george,ou=People,dc=example,dc=com\n"
14522
"objectClass: account\n"
14523
"objectClass: posixAccount\n"
14524
"cn: george\n"
14525
"uid: george\n"
14526
"uidNumber: 1001\n"
14527
"gidNumber: 1001\n"
14528
"homeDirectory: /home/george\n"
14529
"loginShell: /bin/bash\n"
14530
"gecos: george\n"
14531
"description: User account\n"
14532
"userPassword:: e1NTSEF9eXFsTFcyWlhwWkF1eGUybVdFWHZKRzJVMjFTSG9vcHk=\n"
14533
"\n"
14534
"# Enter your modifications here, end with CTRL-D.\n"
14535
"dn: uid=george,ou=People,dc=example,dc=com"
14536
msgstr ""
14537
14538
#: serverguide/C/network-auth.xml:1467(userinput)
14539
#, no-wrap
14540
msgid ""
14541
"replace: gecos\n"
14542
"gecos: George Carlin"
14543
msgstr ""
14544
14545
#: serverguide/C/network-auth.xml:1470(para)
14546
msgid ""
14547
"The user's <emphasis>gecos</emphasis> should now be <quote>George "
14548
"Carlin</quote>."
14549
msgstr ""
14550
14551
#: serverguide/C/network-auth.xml:1475(para)
14552
msgid ""
14553
"Another great feature of <application>ldapscripts</application>, is the "
14554
"template system. Templates allow you to customize the attributes of user, "
14555
"group, and machine objectes. For example, to enable the "
14556
"<emphasis>user</emphasis> template edit "
14557
"<filename>/etc/ldapscripts/ldapscripts.conf</filename> changing:"
14558
msgstr ""
14559
14560
#: serverguide/C/network-auth.xml:1482(programlisting)
14561
#, no-wrap
14562
msgid ""
14563
"\n"
14564
"UTEMPLATE=\"/etc/ldapscripts/ldapadduser.template\"\n"
14565
msgstr ""
14566
14567
#: serverguide/C/network-auth.xml:1486(para)
14568
msgid ""
14569
"There are <emphasis role=\"italic\">sample</emphasis> templates in the "
14570
"<filename>/etc/ldapscripts</filename> directory. Copy or rename the "
14571
"<filename>ldapadduser.template.sample</filename> file to "
14572
"<filename>/etc/ldapscripts/ldapadduser.template</filename>:"
14573
msgstr ""
14574
14575
#: serverguide/C/network-auth.xml:1493(command)
14576
msgid ""
14577
"sudo cp /etc/ldapscripts/ldapadduser.template.sample "
14578
"/etc/ldapscripts/ldapadduser.template"
14579
msgstr ""
14580
14581
#: serverguide/C/network-auth.xml:1496(para)
14582
msgid ""
14583
"Edit the new template to add the desired attributes. The following will "
14584
"create new user's as with an <emphasis>objectClass</emphasis> of "
14585
"<emphasis>inetOrgPerson</emphasis>:"
14586
msgstr ""
14587
14588
#: serverguide/C/network-auth.xml:1501(programlisting)
14589
#, no-wrap
14590
msgid ""
14591
"\n"
14592
"dn: uid=<user>,<usuffix>,<suffix>\n"
14593
"objectClass: inetOrgPerson\n"
14594
"objectClass: posixAccount\n"
14595
"cn: <user>\n"
14596
"sn: <ask>\n"
14597
"uid: <user>\n"
14598
"uidNumber: <uid>\n"
14599
"gidNumber: <gid>\n"
14600
"homeDirectory: <home>\n"
14601
"loginShell: <shell>\n"
14602
"gecos: <user>\n"
14603
"description: User account\n"
14604
"title: Employee\n"
14605
msgstr ""
14606
14607
#: serverguide/C/network-auth.xml:1517(para)
14608
msgid ""
14609
"Notice the <emphasis><ask></emphasis> option used for the "
14610
"<emphasis>cn</emphasis> value. Using <ask> will configure "
14611
"<application>ldapadduser</application> to prompt you for the attribute value "
14612
"during user creation."
14613
msgstr ""
14614
14615
#: serverguide/C/network-auth.xml:1525(para)
14616
msgid ""
14617
"There are more useful scripts in the package, to see a full list enter: "
14618
"<command>dpkg -L ldapscripts | grep bin</command>"
14619
msgstr ""
14620
14621
#: serverguide/C/network-auth.xml:1534(para)
14622
msgid ""
14623
"The <ulink url=\"https://help.ubuntu.com/community/OpenLDAPServer\">OpenLDAP "
14624
"Ubuntu Wiki</ulink> page has more details."
14625
msgstr ""
14626
14627
#: serverguide/C/network-auth.xml:1539(para)
14628
msgid ""
14629
"For more information see <ulink url=\"http://www.openldap.org/\">OpenLDAP "
14630
"Home Page</ulink>"
14631
msgstr ""
14632
14633
#: serverguide/C/network-auth.xml:1544(para)
14634
msgid ""
14635
"Though starting to show it's age, a great source for in depth LDAP "
14636
"information is O'Reilly's <ulink "
14637
"url=\"http://www.oreilly.com/catalog/ldapsa/\">LDAP System "
14638
"Administration</ulink>"
14639
msgstr ""
14640
14641
#: serverguide/C/network-auth.xml:1550(para)
14642
msgid ""
14643
"Packt's <ulink url=\"http://www.packtpub.com/OpenLDAP-Developers-Server-Open-"
14644
"Source-Linux/book\">Mastering OpenLDAP</ulink> is a great reference covering "
14645
"newer versions of OpenLDAP."
14646
msgstr ""
14647
14648
#: serverguide/C/network-auth.xml:1556(para)
14649
msgid ""
14650
"For more information on <application>auth-client-config</application> see "
14651
"the man page: <command>man auth-client-config</command>."
14652
msgstr ""
14653
14654
#: serverguide/C/network-auth.xml:1561(para)
14655
msgid ""
14656
"For more details regarding the <application>ldapscripts</application> "
14657
"package see the man pages: <command>man ldapscripts</command>, <command>man "
14658
"ldapadduser</command>, <command>man ldapaddgroup</command>, etc."
14659
msgstr ""
14660
14661
#: serverguide/C/network-auth.xml:1571(title)
14662
msgid "Samba and LDAP"
14663
msgstr ""
14664
14665
#: serverguide/C/network-auth.xml:1573(para)
14666
msgid ""
14667
"This section covers configuring Samba to use LDAP for user, group, and "
14668
"machine account information and authentication. The assumption is, you "
14669
"already have a working OpenLDAP directory installed and the server is "
14670
"configured to use it for authentication. See <xref linkend=\"openldap-"
14671
"server\"/> and <xref linkend=\"openldap-auth-config\"/> for details on "
14672
"setting up OpenLDAP. For more information on installing and configuring "
14673
"Samba see <xref linkend=\"windows-networking\"/>."
14674
msgstr ""
14675
14676
#: serverguide/C/network-auth.xml:1583(para)
14677
msgid ""
14678
"There are three packages needed when integrating Samba with LDAP. "
14679
"<application>samba</application>, <application>samba-doc</application>, and "
14680
"<application>smbldap-tools</application> packages . To install the packages, "
14681
"from a terminal enter:"
14682
msgstr ""
14683
14684
#: serverguide/C/network-auth.xml:1589(command)
14685
msgid "sudo apt-get install samba samba-doc smbldap-tools"
14686
msgstr ""
14687
14688
#: serverguide/C/network-auth.xml:1592(para)
14689
msgid ""
14690
"Strictly speaking the <application>smbldap-tools</application> package isn't "
14691
"needed, but unless you have another package or custom scripts, a method of "
14692
"managing users, groups, and computer accounts is needed."
14693
msgstr ""
14694
14695
#: serverguide/C/network-auth.xml:1599(title)
14696
msgid "OpenLDAP Configuration"
14697
msgstr ""
14698
14699
#: serverguide/C/network-auth.xml:1601(para)
14700
msgid ""
14701
"In order for Samba to use OpenLDAP as a <emphasis>passdb backend</emphasis>, "
14702
"the user objects in the directory will need additional attributes. This "
14703
"section assumes you want Samba to be configured as a Windows NT domain "
14704
"controller, and will add the necessary LDAP objects and attributes."
14705
msgstr ""
14706
14707
#: serverguide/C/network-auth.xml:1609(para)
14708
msgid ""
14709
"The Samba attributes are defined in the <filename>samba.schema</filename> "
14710
"file which is part of the <application>samba-doc</application> package. The "
14711
"schema file needs to be unzipped and copied to "
14712
"<filename>/etc/ldap/schema</filename>. From a terminal prompt enter:"
14713
msgstr ""
14714
14715
#: serverguide/C/network-auth.xml:1616(command)
14716
msgid ""
14717
"sudo cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz "
14718
"/etc/ldap/schema/"
14719
msgstr ""
14720
14721
#: serverguide/C/network-auth.xml:1617(command)
14722
msgid "sudo gzip -d /etc/ldap/schema/samba.schema.gz"
14723
msgstr ""
14724
14725
#: serverguide/C/network-auth.xml:1623(para)
14726
msgid ""
14727
"The <emphasis>samba</emphasis> schema needs to be added to the "
14728
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
14729
"<application>slapd</application> is also detailed in <xref "
14730
"linkend=\"openldap-configuration\"/>."
14731
msgstr ""
14732
14733
#: serverguide/C/network-auth.xml:1631(para) serverguide/C/network-auth.xml:2666(para)
14734
msgid ""
14735
"First, create a configuration file named "
14736
"<filename>schema_convert.conf</filename>, or a similar descriptive name, "
14737
"containing the following lines:"
14738
msgstr ""
14739
14740
#: serverguide/C/network-auth.xml:1636(programlisting)
14741
#, no-wrap
14742
msgid ""
14743
"\n"
14744
"include /etc/ldap/schema/core.schema\n"
14745
"include /etc/ldap/schema/collective.schema\n"
14746
"include /etc/ldap/schema/corba.schema\n"
14747
"include /etc/ldap/schema/cosine.schema\n"
14748
"include /etc/ldap/schema/duaconf.schema\n"
14749
"include /etc/ldap/schema/dyngroup.schema\n"
14750
"include /etc/ldap/schema/inetorgperson.schema\n"
14751
"include /etc/ldap/schema/java.schema\n"
14752
"include /etc/ldap/schema/misc.schema\n"
14753
"include /etc/ldap/schema/nis.schema\n"
14754
"include /etc/ldap/schema/openldap.schema\n"
14755
"include /etc/ldap/schema/ppolicy.schema\n"
14756
"include /etc/ldap/schema/samba.schema\n"
14757
msgstr ""
14758
14759
#: serverguide/C/network-auth.xml:1666(para) serverguide/C/network-auth.xml:2701(para)
14760
msgid ""
14761
"Now use <application>slapcat</application> to convert the schema files:"
14762
msgstr ""
14763
14764
#: serverguide/C/network-auth.xml:1671(command)
14765
msgid ""
14766
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
14767
"\"cn={12}samba,cn=schema,cn=config\" > /tmp/cn=samba.ldif"
14768
msgstr ""
14769
14770
#: serverguide/C/network-auth.xml:1674(para) serverguide/C/network-auth.xml:2709(para)
14771
msgid ""
14772
"Change the above file and path names to match your own if they are different."
14773
msgstr ""
14774
14775
#: serverguide/C/network-auth.xml:1681(para)
14776
msgid ""
14777
"Edit the generated <filename>/tmp/cn\\=samba.ldif</filename> file, changing "
14778
"the following attributes:"
14779
msgstr ""
14780
14781
#: serverguide/C/network-auth.xml:1685(programlisting)
14782
#, no-wrap
14783
msgid ""
14784
"\n"
14785
"dn: cn=samba,cn=schema,cn=config\n"
14786
"...\n"
14787
"cn: samba\n"
14788
msgstr ""
14789
14790
#: serverguide/C/network-auth.xml:1695(programlisting)
14791
#, no-wrap
14792
msgid ""
14793
"\n"
14794
"structuralObjectClass: olcSchemaConfig\n"
14795
"entryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95\n"
14796
"creatorsName: cn=config\n"
14797
"createTimestamp: 20080827045234Z\n"
14798
"entryCSN: 20080827045234.341425Z#000000#000#000000\n"
14799
"modifiersName: cn=config\n"
14800
"modifyTimestamp: 20080827045234Z\n"
14801
msgstr ""
14802
14803
#: serverguide/C/network-auth.xml:1720(command)
14804
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=samba.ldif"
14805
msgstr ""
14806
14807
#: serverguide/C/network-auth.xml:1726(para)
14808
msgid ""
14809
"There should now be a <emphasis>dn: "
14810
"cn={X}misc,cn=schema,cn=config</emphasis>, where \"X\" is the next "
14811
"sequential schema, entry in the cn=config tree."
14812
msgstr ""
14813
14814
#: serverguide/C/network-auth.xml:1734(para)
14815
msgid ""
14816
"Copy and paste the following into a file named "
14817
"<filename>samba_indexes.ldif</filename>:"
14818
msgstr ""
14819
14820
#: serverguide/C/network-auth.xml:1738(programlisting)
14821
#, no-wrap
14822
msgid ""
14823
"\n"
14824
"dn: olcDatabase={1}hdb,cn=config\n"
14825
"changetype: modify\n"
14826
"add: olcDbIndex\n"
14827
"olcDbIndex: uidNumber eq\n"
14828
"olcDbIndex: gidNumber eq\n"
14829
"olcDbIndex: loginShell eq\n"
14830
"olcDbIndex: uid eq,pres,sub\n"
14831
"olcDbIndex: memberUid eq,pres,sub\n"
14832
"olcDbIndex: uniqueMember eq,pres\n"
14833
"olcDbIndex: sambaSID eq\n"
14834
"olcDbIndex: sambaPrimaryGroupSID eq\n"
14835
"olcDbIndex: sambaGroupType eq\n"
14836
"olcDbIndex: sambaSIDList eq\n"
14837
"olcDbIndex: sambaDomainName eq\n"
14838
"olcDbIndex: default sub\n"
14839
msgstr ""
14840
14841
#: serverguide/C/network-auth.xml:1756(para)
14842
msgid ""
14843
"Using the <application>ldapmodify</application> utility load the new indexes:"
14844
msgstr ""
14845
14846
#: serverguide/C/network-auth.xml:1761(command)
14847
msgid "ldapmodify -x -D cn=admin,cn=config -W -f samba_indexes.ldif"
14848
msgstr ""
14849
14850
#: serverguide/C/network-auth.xml:1763(para)
14851
msgid ""
14852
"If all went well you should see the new indexes using "
14853
"<application>ldapsearch</application>:"
14854
msgstr ""
14855
14856
#: serverguide/C/network-auth.xml:1768(command)
14857
msgid ""
14858
"ldapsearch -xLLL -D cn=admin,cn=config -x -b cn=config -W olcDatabase={1}hdb"
14859
msgstr ""
14860
14861
#: serverguide/C/network-auth.xml:1774(para)
14862
msgid ""
14863
"Next, configure the <application>smbldap-tools</application> package to "
14864
"match your environment. The package comes with a configuration script that "
14865
"will ask questions about the needed options. To run the script enter:"
14866
msgstr ""
14867
14868
#: serverguide/C/network-auth.xml:1780(command)
14869
msgid "sudo gzip -d /usr/share/doc/smbldap-tools/configure.pl.gz"
14870
msgstr ""
14871
14872
#: serverguide/C/network-auth.xml:1781(command)
14873
msgid "sudo perl /usr/share/doc/smbldap-tools/configure.pl"
14874
msgstr ""
14875
14876
#: serverguide/C/network-auth.xml:1784(para)
14877
msgid ""
14878
"Once you have answered the questions, there should be <filename>/etc/smbldap-"
14879
"tools/smbldap.conf</filename> and <filename>/etc/smbldap-"
14880
"tools/smbldap_bind.conf</filename> files. These files are generated by the "
14881
"configure script, so if you made any mistakes while executing the script it "
14882
"may be simpler to edit the file appropriately."
14883
msgstr ""
14884
14885
#: serverguide/C/network-auth.xml:1794(para)
14886
msgid ""
14887
"The <application>smbldap-populate</application> script will add the "
14888
"necessary users, groups, and LDAP objects required for Samba. It is a good "
14889
"idea to make a backup LDAP Data Interchange Format (LDIF) file with "
14890
"<application>slapcat</application> before executing the command:"
14891
msgstr ""
14892
14893
#: serverguide/C/network-auth.xml:1801(command)
14894
msgid "sudo slapcat -l backup.ldif"
14895
msgstr ""
14896
14897
#: serverguide/C/network-auth.xml:1807(para)
14898
msgid ""
14899
"Once you have a current backup execute <application>smbldap-"
14900
"populate</application> by entering:"
14901
msgstr ""
14902
14903
#: serverguide/C/network-auth.xml:1812(command)
14904
msgid "sudo smbldap-populate"
14905
msgstr ""
14906
14907
#: serverguide/C/network-auth.xml:1816(para)
14908
msgid ""
14909
"You can create an LDIF file containing the new Samba objects by executing "
14910
"<command>sudo smbldap-populate -e samba.ldif</command>. This allows you to "
14911
"look over the changes making sure everything is correct."
14912
msgstr ""
14913
14914
#: serverguide/C/network-auth.xml:1824(para)
14915
msgid ""
14916
"Your LDAP directory now has the necessary domain information to authenticate "
14917
"Samba users."
14918
msgstr ""
14919
14920
#: serverguide/C/network-auth.xml:1830(title)
14921
msgid "Samba Configuration"
14922
msgstr ""
14923
14924
#: serverguide/C/network-auth.xml:1832(para)
14925
msgid ""
14926
"There a multiple ways to configure Samba for details on some common "
14927
"configurations see <xref linkend=\"windows-networking\"/>. To configure "
14928
"Samba to use LDAP, edit the main Samba configuration file "
14929
"<filename>/etc/samba/smb.conf</filename> commenting the <emphasis>passdb "
14930
"backend</emphasis> option and adding the following:"
14931
msgstr ""
14932
14933
#: serverguide/C/network-auth.xml:1838(programlisting)
14934
#, no-wrap
14935
msgid ""
14936
"\n"
14937
"# passdb backend = tdbsam\n"
14938
"\n"
14939
"# LDAP Settings\n"
14940
" passdb backend = ldapsam:ldap://hostname\n"
14941
" ldap suffix = dc=example,dc=com\n"
14942
" ldap user suffix = ou=People\n"
14943
" ldap group suffix = ou=Groups\n"
14944
" ldap machine suffix = ou=Computers\n"
14945
" ldap idmap suffix = ou=Idmap\n"
14946
" ldap admin dn = cn=admin,dc=example,dc=com\n"
14947
" ldap ssl = start tls\n"
14948
" ldap passwd sync = yes\n"
14949
"...\n"
14950
" add machine script = sudo /usr/sbin/smbldap-useradd -t 0 -w \"%u\"\n"
14951
msgstr ""
14952
14953
#: serverguide/C/network-auth.xml:1855(para)
14954
msgid "Restart <application>samba</application> to enable the new settings:"
14955
msgstr ""
14956
14957
#: serverguide/C/network-auth.xml:1863(para)
14958
msgid ""
14959
"Now Samba needs to know the LDAP admin password. From a terminal prompt "
14960
"enter:"
14961
msgstr ""
14962
14963
#: serverguide/C/network-auth.xml:1868(command)
14964
msgid "sudo smbpasswd -w secret"
14965
msgstr ""
14966
14967
#: serverguide/C/network-auth.xml:1872(para)
14968
msgid ""
14969
"Replacing <emphasis role=\"italic\">secret</emphasis> with your LDAP admin "
14970
"password."
14971
msgstr ""
14972
14973
#: serverguide/C/network-auth.xml:1877(para)
14974
msgid ""
14975
"If you currently have users in LDAP, and you want them to authenticate using "
14976
"Samba, they will need some Samba attributes defined in the "
14977
"<filename>samba.schema</filename> file. Add the Samba attributes to existing "
14978
"users using the <application>smbpasswd</application> utility, replacing "
14979
"<emphasis role=\"italic\">username</emphasis> with an actual user:"
14980
msgstr ""
14981
14982
#: serverguide/C/network-auth.xml:1885(command)
14983
msgid "sudo smbpasswd -a username"
14984
msgstr ""
14985
14986
#: serverguide/C/network-auth.xml:1888(para)
14987
msgid "You will then be asked to enter the user's password."
14988
msgstr ""
14989
14990
#: serverguide/C/network-auth.xml:1892(para)
14991
msgid ""
14992
"To add new user, group, and machine accounts use the utilities from the "
14993
"<application>smbldap-tools</application> package. Here are some examples:"
14994
msgstr ""
14995
14996
#: serverguide/C/network-auth.xml:1899(para)
14997
msgid ""
14998
"To add a new user to LDAP with Samba attributes enter the following, "
14999
"replacing username with an actual username:"
15000
msgstr ""
15001
15002
#: serverguide/C/network-auth.xml:1903(command)
15003
msgid "sudo smbldap-useradd -a -P username"
15004
msgstr ""
15005
15006
#: serverguide/C/network-auth.xml:1905(para)
15007
msgid ""
15008
"The <emphasis>-a</emphasis> option adds the Samba attributes, and the "
15009
"<emphasis>-P</emphasis> options calls the <application>smbldap-"
15010
"passwd</application> utility after the user is created allowing you to enter "
15011
"a password for the user."
15012
msgstr ""
15013
15014
#: serverguide/C/network-auth.xml:1911(para)
15015
msgid "To remove a user from the directory enter:"
15016
msgstr ""
15017
15018
#: serverguide/C/network-auth.xml:1915(command)
15019
msgid "sudo smbldap-userdel username"
15020
msgstr ""
15021
15022
#: serverguide/C/network-auth.xml:1917(para)
15023
msgid ""
15024
"The <application>smbldap-userdel</application> utility also has a <emphasis>-"
15025
"r</emphasis> option to remove the user's home directory."
15026
msgstr ""
15027
15028
#: serverguide/C/network-auth.xml:1922(para)
15029
msgid ""
15030
"Use <application>smbldap-groupadd</application> to add a group, replacing "
15031
"groupname with an appropriate group:"
15032
msgstr ""
15033
15034
#: serverguide/C/network-auth.xml:1926(command)
15035
msgid "sudo smbldap-groupadd -a groupname"
15036
msgstr ""
15037
15038
#: serverguide/C/network-auth.xml:1928(para)
15039
msgid ""
15040
"Similar to <application>smbldap-useradd</application>, the <emphasis>-"
15041
"a</emphasis> adds the Samba attributes."
15042
msgstr ""
15043
15044
#: serverguide/C/network-auth.xml:1933(para)
15045
msgid ""
15046
"To add a user to a group use <application>smbldap-groupmod</application>:"
15047
msgstr ""
15048
15049
#: serverguide/C/network-auth.xml:1937(command)
15050
msgid "sudo smbldap-groupmod -m username groupname"
15051
msgstr ""
15052
15053
#: serverguide/C/network-auth.xml:1939(para)
15054
msgid ""
15055
"Be sure to replace <emphasis>username</emphasis> with a real user. Also, the "
15056
"<emphasis>-m</emphasis> option can add more than one user at a time by "
15057
"listing them in <emphasis>comma separated</emphasis> format."
15058
msgstr ""
15059
15060
#: serverguide/C/network-auth.xml:1945(para)
15061
msgid ""
15062
"<application>smbldap-groupmod</application> can also be used to remove a "
15063
"user from a group:"
15064
msgstr ""
15065
15066
#: serverguide/C/network-auth.xml:1949(command)
15067
msgid "sudo smbldap-groupmod -x username groupname"
15068
msgstr ""
15069
15070
#: serverguide/C/network-auth.xml:1953(para)
15071
msgid ""
15072
"Additionally, the <application>smbldap-useradd</application> utility can add "
15073
"Samba machine accounts:"
15074
msgstr ""
15075
15076
#: serverguide/C/network-auth.xml:1957(command)
15077
msgid "sudo smbldap-useradd -t 0 -w username"
15078
msgstr ""
15079
15080
#: serverguide/C/network-auth.xml:1959(para)
15081
msgid ""
15082
"Replace <emphasis>username</emphasis> with the name of the workstation. The "
15083
"<emphasis>-t 0</emphasis> option creates the machine account without a "
15084
"delay, while the <emphasis>-w</emphasis> option specifies the user as a "
15085
"machine account. Also, note the <emphasis>add machine script</emphasis> "
15086
"option in <filename>/etc/samba/smb.conf</filename> was changed to use "
15087
"<application>smbldap-useradd</application>."
15088
msgstr ""
15089
15090
#: serverguide/C/network-auth.xml:1968(para)
15091
msgid ""
15092
"There are more useful utilities and options in the <application>smbldap-"
15093
"tools</application> package. The man page for each utility provides more "
15094
"details."
15095
msgstr ""
15096
15097
#: serverguide/C/network-auth.xml:1979(para)
15098
msgid ""
15099
"There are multiple places where LDAP and Samba is documented in the <ulink "
15100
"url=\"http://samba.org/samba/docs/man/Samba-HOWTO-Collection/\">Samba HOWTO "
15101
"Collection</ulink>."
15102
msgstr ""
15103
15104
#: serverguide/C/network-auth.xml:1985(para)
15105
msgid ""
15106
"Specifically see the <ulink url=\"http://samba.org/samba/docs/man/Samba-"
15107
"HOWTO-Collection/passdb.html\">passdb section</ulink>."
15108
msgstr ""
15109
15110
#: serverguide/C/network-auth.xml:1991(para)
15111
msgid ""
15112
"Another good site is <ulink url=\"http://www.iallanis.info/smbldap-"
15113
"tools/docs/samba-ldap-howto/\">Samba OpenLDAP HOWTO</ulink>."
15114
msgstr ""
15115
15116
#: serverguide/C/network-auth.xml:1997(para)
15117
msgid ""
15118
"Again, for more information on <application>smbldap-tools</application> see "
15119
"the man pages: <command>man smbldap-useradd</command>, <command>man smbldap-"
15120
"groupadd</command>, <command>man smbldap-populate</command>, etc."
15121
msgstr ""
15122
15123
#: serverguide/C/network-auth.xml:2004(para)
15124
msgid ""
15125
"Also, there is a list of <ulink "
15126
"url=\"https://help.ubuntu.com/community/Samba#samba-ldap\">Ubuntu "
15127
"wiki</ulink> articles with more information."
15128
msgstr ""
15129
15130
#: serverguide/C/network-auth.xml:2013(title)
15131
msgid "Kerberos"
15132
msgstr ""
15133
15134
#: serverguide/C/network-auth.xml:2015(para)
15135
msgid ""
15136
"<application>Kerberos</application> is a network authentication system based "
15137
"on the principal of a trusted third party. The other two parties being the "
15138
"user and the service the user wishes to authenticate to. Not all services "
15139
"and applications can use Kerberos, but for those that can, it brings the "
15140
"network environment one step closer to being Single Sign On (SSO)."
15141
msgstr ""
15142
15143
#: serverguide/C/network-auth.xml:2021(para)
15144
msgid ""
15145
"This section covers installation and configuration of a Kerberos server, and "
15146
"some example client configurations."
15147
msgstr ""
15148
15149
#: serverguide/C/network-auth.xml:2028(para)
15150
msgid ""
15151
"If you are new to Kerberos there are a few terms that are good to understand "
15152
"before setting up a Kerberos server. Most of the terms will relate to things "
15153
"you may be familiar with in other environments:"
15154
msgstr ""
15155
15156
#: serverguide/C/network-auth.xml:2035(para)
15157
msgid ""
15158
"<emphasis>Principal:</emphasis> any users, computers, and services provided "
15159
"by servers need to be defined as Kerberos Principals."
15160
msgstr ""
15161
15162
#: serverguide/C/network-auth.xml:2040(para)
15163
msgid ""
15164
"<emphasis>Instances:</emphasis> are used for service principals and special "
15165
"administrative principals."
15166
msgstr ""
15167
15168
#: serverguide/C/network-auth.xml:2045(para)
15169
msgid ""
15170
"<emphasis>Realms:</emphasis> the unique realm of control provided by the "
15171
"Kerberos installation. Usually the DNS domain converted to uppercase "
15172
"(EXAMPLE.COM)."
15173
msgstr ""
15174
15175
#: serverguide/C/network-auth.xml:2051(para)
15176
msgid ""
15177
"<emphasis>Key Distribution Center:</emphasis> (KDC) consist of three parts, "
15178
"a database of all principals, the authentication server, and the ticket "
15179
"granting server. For each realm there must be at least one KDC."
15180
msgstr ""
15181
15182
#: serverguide/C/network-auth.xml:2057(para)
15183
msgid ""
15184
"<emphasis>Ticket Granting Ticket:</emphasis> issued by the Authentication "
15185
"Server (AS), the Ticket Granting Ticket (TGT) is encrypted in the user's "
15186
"password which is known only to the user and the KDC."
15187
msgstr ""
15188
15189
#: serverguide/C/network-auth.xml:2063(para)
15190
msgid ""
15191
"<emphasis>Ticket Granting Server:</emphasis> (TGS) issues service tickets to "
15192
"clients upon request."
15193
msgstr ""
15194
15195
#: serverguide/C/network-auth.xml:2068(para)
15196
msgid ""
15197
"<emphasis>Tickets:</emphasis> confirm the identity of the two principals. "
15198
"One principal being a user and the other a service requested by the user. "
15199
"Tickets establish an encryption key used for secure communication during the "
15200
"authenticated session."
15201
msgstr ""
15202
15203
#: serverguide/C/network-auth.xml:2074(para)
15204
msgid ""
15205
"<emphasis>Keytab Files:</emphasis> are files extracted from the KDC "
15206
"principal database and contain the encryption key for a service or host."
15207
msgstr ""
15208
15209
#: serverguide/C/network-auth.xml:2081(para)
15210
msgid ""
15211
"To put the pieces together, a Realm has at least one KDC, preferably two for "
15212
"redundancy, which contains a database of Principals. When a user principal "
15213
"logs into a workstation, configured for Kerberos authentication, the KDC "
15214
"issues a Ticket Granting Ticket (TGT). If the user supplied credentials "
15215
"match, the user is authenticated and can then request tickets for Kerberized "
15216
"services from the Ticket Granting Server (TGS). The service tickets allow "
15217
"the user to authenticate to the service without entering another username "
15218
"and password."
15219
msgstr ""
15220
15221
#: serverguide/C/network-auth.xml:2090(title)
15222
msgid "Kerberos Server"
15223
msgstr ""
15224
15225
#: serverguide/C/network-auth.xml:2094(para)
15226
msgid ""
15227
"Before installing the Kerberos server a properly configured DNS server is "
15228
"needed for your domain. Since the Kerberos Realm by convention matches the "
15229
"domain name, this section uses the <emphasis>example.com</emphasis> domain "
15230
"configured in <xref linkend=\"dns-primarymaster-configuration\"/>."
15231
msgstr ""
15232
15233
#: serverguide/C/network-auth.xml:2100(para)
15234
msgid ""
15235
"Also, Kerberos is a time sensitive protocol. So if the local system time "
15236
"between a client machine and the server differs by more than five minutes "
15237
"(by default), the workstation will not be able to authenticate. To correct "
15238
"the problem all hosts should have their time synchronized using the "
15239
"<emphasis>Network Time Protocol (NTP)</emphasis>. For details on setting up "
15240
"NTP see <xref linkend=\"NTP\"/>."
15241
msgstr ""
15242
15243
#: serverguide/C/network-auth.xml:2107(para)
15244
msgid ""
15245
"The first step in installing a Kerberos Realm is to install the "
15246
"<application>krb5-kdc</application> and <application>krb5-admin-"
15247
"server</application> packages. From a terminal enter:"
15248
msgstr ""
15249
15250
#: serverguide/C/network-auth.xml:2113(command) serverguide/C/network-auth.xml:2288(command)
15251
msgid "sudo apt-get install krb5-kdc krb5-admin-server"
15252
msgstr ""
15253
15254
#: serverguide/C/network-auth.xml:2116(para)
15255
msgid ""
15256
"You will be asked at the end of the install to supply a name for the "
15257
"Kerberos and Admin servers, which may or may not be the same server, for the "
15258
"realm."
15259
msgstr ""
15260
15261
#: serverguide/C/network-auth.xml:2121(para)
15262
msgid ""
15263
"Next, create the new realm with the <application>kdb5_newrealm</application> "
15264
"utility:"
15265
msgstr ""
15266
15267
#: serverguide/C/network-auth.xml:2126(command)
15268
msgid "sudo krb5_newrealm"
15269
msgstr ""
15270
15271
#: serverguide/C/network-auth.xml:2133(para)
15272
msgid ""
15273
"The questions asked during installation are used to configure the "
15274
"<filename>/etc/krb5.conf</filename> file. If you need to adjust the Key "
15275
"Distribution Center (KDC) settings simply edit the file and restart the "
15276
"<application>krb5-kdc</application> daemon."
15277
msgstr ""
15278
15279
#: serverguide/C/network-auth.xml:2141(para)
15280
msgid ""
15281
"Now that the KDC running an admin user is needed. It is recommended to use a "
15282
"different username from your everyday username. Using the "
15283
"<application>kadmin.local</application> utility in a terminal prompt enter:"
15284
msgstr ""
15285
15286
#: serverguide/C/network-auth.xml:2147(command) serverguide/C/network-auth.xml:2943(command)
15287
msgid "sudo kadmin.local"
15288
msgstr ""
15289
15290
#: serverguide/C/network-auth.xml:2148(computeroutput)
15291
#, no-wrap
15292
msgid ""
15293
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
15294
"kadmin.local:"
15295
msgstr ""
15296
15297
#: serverguide/C/network-auth.xml:2149(userinput)
15298
#, no-wrap
15299
msgid " addprinc steve/admin"
15300
msgstr ""
15301
15302
#: serverguide/C/network-auth.xml:2150(computeroutput)
15303
#, no-wrap
15304
msgid ""
15305
"WARNING: no policy specified for steve/admin@EXAMPLE.COM; defaulting to no "
15306
"policy\n"
15307
"Enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15308
"Re-enter password for principal \"steve/admin@EXAMPLE.COM\": \n"
15309
"Principal \"steve/admin@EXAMPLE.COM\" created.\n"
15310
"kadmin.local:"
15311
msgstr ""
15312
15313
#: serverguide/C/network-auth.xml:2154(userinput)
15314
#, no-wrap
15315
msgid " quit"
15316
msgstr ""
15317
15318
#: serverguide/C/network-auth.xml:2157(para)
15319
msgid ""
15320
"In the above example <emphasis role=\"italic\">steve</emphasis> is the "
15321
"<emphasis>Principal</emphasis>, <emphasis role=\"italic\">/admin</emphasis> "
15322
"is an <emphasis>Instance</emphasis>, and <emphasis "
15323
"role=\"italic\">@EXAMPLE.COM</emphasis> signifies the realm. The <emphasis "
15324
"role=\"italic\">\"every day\"</emphasis> Principal would be "
15325
"<emphasis>steve@EXAMPLE.COM</emphasis>, and should have only normal user "
15326
"rights."
15327
msgstr ""
15328
15329
#: serverguide/C/network-auth.xml:2165(para)
15330
msgid ""
15331
"Replace <emphasis>EXAMPLE.COM</emphasis> and <emphasis>steve</emphasis> with "
15332
"your Realm and admin username."
15333
msgstr ""
15334
15335
#: serverguide/C/network-auth.xml:2173(para)
15336
msgid ""
15337
"Next, the new admin user needs to have the appropriate Access Control List "
15338
"(ACL) permissions. The permissions are configured in the "
15339
"<filename>/etc/krb5kdc/kadm5.acl</filename> file:"
15340
msgstr ""
15341
15342
#: serverguide/C/network-auth.xml:2178(programlisting)
15343
#, no-wrap
15344
msgid ""
15345
"\n"
15346
"steve/admin@EXAMPLE.COM *\n"
15347
msgstr ""
15348
15349
#: serverguide/C/network-auth.xml:2182(para)
15350
msgid ""
15351
"This entry grants <emphasis>steve/admin</emphasis> the ability to perform "
15352
"any operation on all principals in the realm."
15353
msgstr ""
15354
15355
#: serverguide/C/network-auth.xml:2189(para)
15356
msgid ""
15357
"Now restart the <application>krb5-admin-server</application> for the new ACL "
15358
"to take affect:"
15359
msgstr ""
15360
15361
#: serverguide/C/network-auth.xml:2194(command)
15362
msgid "sudo /etc/init.d/krb5-admin-server restart"
15363
msgstr ""
15364
15365
#: serverguide/C/network-auth.xml:2200(para)
15366
msgid ""
15367
"The new user principal can be tested using the <application>kinit "
15368
"utility</application>:"
15369
msgstr ""
15370
15371
#: serverguide/C/network-auth.xml:2205(command)
15372
msgid "kinit steve/admin"
15373
msgstr ""
15374
15375
#: serverguide/C/network-auth.xml:2206(computeroutput)
15376
#, no-wrap
15377
msgid "steve/admin@EXAMPLE.COM's Password:"
15378
msgstr ""
15379
15380
#: serverguide/C/network-auth.xml:2209(para)
15381
msgid ""
15382
"After entering the password, use the <application>klist</application> "
15383
"utility to view information about the Ticket Granting Ticket (TGT):"
15384
msgstr ""
15385
15386
#: serverguide/C/network-auth.xml:2215(command) serverguide/C/network-auth.xml:2550(command)
15387
msgid "klist"
15388
msgstr ""
15389
15390
#: serverguide/C/network-auth.xml:2216(computeroutput)
15391
#, no-wrap
15392
msgid ""
15393
"Credentials cache: FILE:/tmp/krb5cc_1000\n"
15394
" Principal: steve/admin@EXAMPLE.COM\n"
15395
"\n"
15396
" Issued Expires Principal\n"
15397
"Jul 13 17:53:34 Jul 14 03:53:34 krbtgt/EXAMPLE.COM@EXAMPLE.COM"
15398
msgstr ""
15399
15400
#: serverguide/C/network-auth.xml:2223(para)
15401
msgid ""
15402
"You may need to add an entry into the <filename>/etc/hosts</filename> for "
15403
"the KDC. For example:"
15404
msgstr ""
15405
15406
#: serverguide/C/network-auth.xml:2227(programlisting)
15407
#, no-wrap
15408
msgid ""
15409
"\n"
15410
"192.168.0.1 kdc01.example.com kdc01\n"
15411
msgstr ""
15412
15413
#: serverguide/C/network-auth.xml:2231(para)
15414
msgid ""
15415
"Replacing <emphasis>192.168.0.1</emphasis> with the IP address of your KDC."
15416
msgstr ""
15417
15418
#: serverguide/C/network-auth.xml:2238(para)
15419
msgid ""
15420
"In order for clients to determine the KDC for the Realm some DNS SRV records "
15421
"are needed. Add the following to "
15422
"<filename>/etc/named/db.example.com</filename>:"
15423
msgstr ""
15424
15425
#: serverguide/C/network-auth.xml:2243(programlisting)
15426
#, no-wrap
15427
msgid ""
15428
"\n"
15429
"_kerberos._udp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15430
"_kerberos._tcp.EXAMPLE.COM. IN SRV 1 0 88 kdc01.example.com.\n"
15431
"_kerberos._udp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15432
"_kerberos._tcp.EXAMPLE.COM. IN SRV 10 0 88 kdc02.example.com. \n"
15433
"_kerberos-adm._tcp.EXAMPLE.COM. IN SRV 1 0 749 kdc01.example.com.\n"
15434
"_kpasswd._udp.EXAMPLE.COM. IN SRV 1 0 464 kdc01.example.com.\n"
15435
msgstr ""
15436
15437
#: serverguide/C/network-auth.xml:2253(para)
15438
msgid ""
15439
"Replace <emphasis>EXAMPLE.COM</emphasis>, <emphasis>kdc01</emphasis>, and "
15440
"<emphasis>kdc02</emphasis> with your domain name, primary KDC, and secondary "
15441
"KDC."
15442
msgstr ""
15443
15444
#: serverguide/C/network-auth.xml:2259(para)
15445
msgid ""
15446
"See <xref linkend=\"dns\"/> for detailed instructions on setting up DNS."
15447
msgstr ""
15448
15449
#: serverguide/C/network-auth.xml:2266(para)
15450
msgid "Your new Kerberos Realm is now ready to authenticate clients."
15451
msgstr ""
15452
15453
#: serverguide/C/network-auth.xml:2273(title)
15454
msgid "Secondary KDC"
15455
msgstr ""
15456
15457
#: serverguide/C/network-auth.xml:2275(para)
15458
msgid ""
15459
"Once you have one Key Distribution Center (KDC) on your network, it is good "
15460
"practice to have a Secondary KDC in case the primary becomes unavailable."
15461
msgstr ""
15462
15463
#: serverguide/C/network-auth.xml:2283(para)
15464
msgid ""
15465
"First, install the packages, and when asked for the Kerberos and Admin "
15466
"server names enter the name of the Primary KDC:"
15467
msgstr ""
15468
15469
#: serverguide/C/network-auth.xml:2294(para)
15470
msgid ""
15471
"Once you have the packages installed, create the Secondary KDC's host "
15472
"principal. From a terminal prompt, enter:"
15473
msgstr ""
15474
15475
#: serverguide/C/network-auth.xml:2299(command)
15476
msgid "kadmin -q \"addprinc -randkey host/kdc02.example.com\""
15477
msgstr ""
15478
15479
#: serverguide/C/network-auth.xml:2303(para)
15480
msgid ""
15481
"After, issuing any <application>kadmin</application> commands you will be "
15482
"prompted for your <emphasis>username/admin@EXAMPLE.COM</emphasis> principal "
15483
"password."
15484
msgstr ""
15485
15486
#: serverguide/C/network-auth.xml:2312(para)
15487
msgid "Extract the <emphasis>keytab</emphasis> file:"
15488
msgstr ""
15489
15490
#: serverguide/C/network-auth.xml:2317(command)
15491
msgid "kadmin -q \"ktadd -k keytab.kdc02 host/kdc02.example.com\""
15492
msgstr ""
15493
15494
#: serverguide/C/network-auth.xml:2323(para)
15495
msgid ""
15496
"There should now be a <filename>keytab.kdc02</filename> in the current "
15497
"directory, move the file to <filename>/etc/krb5.keytab</filename>:"
15498
msgstr ""
15499
15500
#: serverguide/C/network-auth.xml:2329(command)
15501
msgid "sudo mv keytab.kdc02 /etc/krb5.keytab"
15502
msgstr ""
15503
15504
#: serverguide/C/network-auth.xml:2333(para)
15505
msgid ""
15506
"If the path to the <filename>keytab.kdc02</filename> file is different "
15507
"adjust accordingly."
15508
msgstr ""
15509
15510
#: serverguide/C/network-auth.xml:2338(para)
15511
msgid ""
15512
"Also, you can list the principals in a Keytab file, which can be useful when "
15513
"troubleshooting, using the <application>klist</application> utility:"
15514
msgstr ""
15515
15516
#: serverguide/C/network-auth.xml:2344(command)
15517
msgid "sudo klist -k /etc/krb5.keytab"
15518
msgstr ""
15519
15520
#: serverguide/C/network-auth.xml:2350(para)
15521
msgid ""
15522
"Next, there needs to be a <filename>kpropd.acl</filename> file on each KDC "
15523
"that lists all KDCs for the Realm. For example, on both primary and "
15524
"secondary KDC, create <filename>/etc/krb5kdc/kpropd.acl</filename>:"
15525
msgstr ""
15526
15527
#: serverguide/C/network-auth.xml:2355(programlisting)
15528
#, no-wrap
15529
msgid ""
15530
"\n"
15531
"host/kdc01.example.com@EXAMPLE.COM\n"
15532
"host/kdc02.example.com@EXAMPLE.COM\n"
15533
msgstr ""
15534
15535
#: serverguide/C/network-auth.xml:2363(para)
15536
msgid "Create an empty database on the <emphasis>Secondary KDC</emphasis>:"
15537
msgstr ""
15538
15539
#: serverguide/C/network-auth.xml:2368(command)
15540
msgid "sudo kdb5_util -s create"
15541
msgstr ""
15542
15543
#: serverguide/C/network-auth.xml:2374(para)
15544
msgid ""
15545
"Now start the <application>kpropd</application> daemon, which listens for "
15546
"connections from the <application>kprop</application> utility. "
15547
"<application>kprop</application> is used to transfer dump files:"
15548
msgstr ""
15549
15550
#: serverguide/C/network-auth.xml:2381(command)
15551
msgid "sudo kpropd -S"
15552
msgstr ""
15553
15554
#: serverguide/C/network-auth.xml:2387(para)
15555
msgid ""
15556
"From a terminal on the <emphasis>Primary KDC</emphasis>, create a dump file "
15557
"of the principal database:"
15558
msgstr ""
15559
15560
#: serverguide/C/network-auth.xml:2392(command)
15561
msgid "sudo kdb5_util dump /var/lib/krb5kdc/dump"
15562
msgstr ""
15563
15564
#: serverguide/C/network-auth.xml:2398(para)
15565
msgid ""
15566
"Extract the Primary KDC's <emphasis>keytab</emphasis> file and copy it to "
15567
"<filename>/etc/krb5.keytab</filename>:"
15568
msgstr ""
15569
15570
#: serverguide/C/network-auth.xml:2403(command)
15571
msgid "kadmin -q \"ktadd -k keytab.kdc01 host/kdc01.example.com\""
15572
msgstr ""
15573
15574
#: serverguide/C/network-auth.xml:2404(command)
15575
msgid "sudo mv keytab.kdc01 /etc/kr5b.keytab"
15576
msgstr ""
15577
15578
#: serverguide/C/network-auth.xml:2408(para)
15579
msgid ""
15580
"Make sure there is a <emphasis>host</emphasis> for "
15581
"<emphasis>kdc01.example.com</emphasis> before extracting the Keytab."
15582
msgstr ""
15583
15584
#: serverguide/C/network-auth.xml:2416(para)
15585
msgid ""
15586
"Using the <application>kprop</application> utility push the database to the "
15587
"Secondary KDC:"
15588
msgstr ""
15589
15590
#: serverguide/C/network-auth.xml:2421(command)
15591
msgid "sudo kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com"
15592
msgstr ""
15593
15594
#: serverguide/C/network-auth.xml:2425(para)
15595
msgid ""
15596
"There should be a <emphasis>SUCCEEDED</emphasis> message if the propagation "
15597
"worked. If there is an error message check "
15598
"<filename>/var/log/syslog</filename> on the secondary KDC for more "
15599
"information."
15600
msgstr ""
15601
15602
#: serverguide/C/network-auth.xml:2431(para)
15603
msgid ""
15604
"You may also want to create a <application>cron</application> job to "
15605
"periodically update the database on the Secondary KDC. For example, the "
15606
"following will push the database every hour:"
15607
msgstr ""
15608
15609
#: serverguide/C/network-auth.xml:2436(programlisting)
15610
#, no-wrap
15611
msgid ""
15612
"\n"
15613
"# m h dom mon dow command\n"
15614
"0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump && "
15615
"/usr/sbin/kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com\n"
15616
msgstr ""
15617
15618
#: serverguide/C/network-auth.xml:2444(para)
15619
msgid ""
15620
"Back on the <emphasis>Secondary KDC</emphasis>, create a "
15621
"<emphasis>stash</emphasis> file to hold the Kerberos master key:"
15622
msgstr ""
15623
15624
#: serverguide/C/network-auth.xml:2450(command)
15625
msgid "sudo kdb5_util stash"
15626
msgstr ""
15627
15628
#: serverguide/C/network-auth.xml:2456(para)
15629
msgid ""
15630
"Finally, start the <application>krb5-kdc</application> daemon on the "
15631
"Secondary KDC:"
15632
msgstr ""
15633
15634
#: serverguide/C/network-auth.xml:2461(command) serverguide/C/network-auth.xml:3073(command)
15635
msgid "sudo /etc/init.d/krb5-kdc start"
15636
msgstr ""
15637
15638
#: serverguide/C/network-auth.xml:2467(para)
15639
msgid ""
15640
"The <emphasis>Secondary KDC</emphasis> should now be able to issue tickets "
15641
"for the Realm. You can test this by stopping the <application>krb5-"
15642
"kdc</application> daemon on the Primary KDC, then use "
15643
"<application>kinit</application> to request a ticket. If all goes well you "
15644
"should receive a ticket from the Secondary KDC."
15645
msgstr ""
15646
15647
#: serverguide/C/network-auth.xml:2475(title)
15648
msgid "Kerberos Linux Client"
15649
msgstr ""
15650
15651
#: serverguide/C/network-auth.xml:2477(para)
15652
msgid ""
15653
"This section covers configuring a Linux system as a "
15654
"<application>Kerberos</application> client. This will allow access to any "
15655
"kerberized services once a user has successfully logged into the system."
15656
msgstr ""
15657
15658
#: serverguide/C/network-auth.xml:2485(para)
15659
msgid ""
15660
"In order to authenticate to a Kerberos Realm, the <application>krb5-"
15661
"user</application> and <application>libpam-krb5</application> packages are "
15662
"needed, along with a few others that are not strictly necessary but make "
15663
"life easier. To install the packages enter the following in a terminal "
15664
"prompt:"
15665
msgstr ""
15666
15667
#: serverguide/C/network-auth.xml:2492(command)
15668
msgid ""
15669
"sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config"
15670
msgstr ""
15671
15672
#: serverguide/C/network-auth.xml:2495(para)
15673
msgid ""
15674
"The <application>auth-client-config</application> package allows simple "
15675
"configuration of PAM for authentication from multiple sources, and the "
15676
"<application>libpam-ccreds</application> will cache authentication "
15677
"credentials allowing you to login in case the Key Distribution Center (KDC) "
15678
"is unavailable. This package is also useful for laptops that may "
15679
"authenticate using Kerberos while on the corporate network, but will need to "
15680
"be accessed off the network as well."
15681
msgstr ""
15682
15683
#: serverguide/C/network-auth.xml:2506(para)
15684
msgid "To configure the client in a terminal enter:"
15685
msgstr ""
15686
15687
#: serverguide/C/network-auth.xml:2511(command)
15688
msgid "sudo dpkg-reconfigure krb5-config"
15689
msgstr ""
15690
15691
#: serverguide/C/network-auth.xml:2514(para)
15692
msgid ""
15693
"You will then be prompted to enter the name of the Kerberos Realm. Also, if "
15694
"you don't have DNS configured with Kerberos <emphasis>SRV</emphasis> "
15695
"records, the menu will prompt you for the hostname of the Key Distribution "
15696
"Center (KDC) and Realm Administration server."
15697
msgstr ""
15698
15699
#: serverguide/C/network-auth.xml:2520(para)
15700
msgid ""
15701
"The <application>dpkg-reconfigure</application> adds entries to the "
15702
"<filename>/etc/krb5.conf</filename> file for your Realm. You should have "
15703
"entries similar to the following:"
15704
msgstr ""
15705
15706
#: serverguide/C/network-auth.xml:2525(programlisting)
15707
#, no-wrap
15708
msgid ""
15709
"\n"
15710
"[libdefaults]\n"
15711
" default_realm = EXAMPLE.COM\n"
15712
"...\n"
15713
"[realms]\n"
15714
" EXAMPLE.COM = } \n"
15715
" kdc = 192.168.0.1 \n"
15716
" admin_server = 192.168.0.1\n"
15717
" }\n"
15718
msgstr ""
15719
15720
#: serverguide/C/network-auth.xml:2536(para)
15721
msgid ""
15722
"You can test the configuration by requesting a ticket using the "
15723
"<application>kinit</application> utility. For example:"
15724
msgstr ""
15725
15726
#: serverguide/C/network-auth.xml:2541(command)
15727
msgid "kinit steve@EXAMPLE.COM"
15728
msgstr ""
15729
15730
#: serverguide/C/network-auth.xml:2542(computeroutput)
15731
#, no-wrap
15732
msgid "Password for steve@EXAMPLE.COM:"
15733
msgstr ""
15734
15735
#: serverguide/C/network-auth.xml:2545(para)
15736
msgid ""
15737
"When a ticket has been granted, the details can be viewed using "
15738
"<application>klist</application>:"
15739
msgstr ""
15740
15741
#: serverguide/C/network-auth.xml:2551(computeroutput)
15742
#, no-wrap
15743
msgid ""
15744
"Ticket cache: FILE:/tmp/krb5cc_1000\n"
15745
"Default principal: steve@EXAMPLE.COM\n"
15746
"\n"
15747
"Valid starting Expires Service principal\n"
15748
"07/24/08 05:18:56 07/24/08 15:18:56 krbtgt/EXAMPLE.COM@EXAMPLE.COM\n"
15749
" renew until 07/25/08 05:18:57\n"
15750
"\n"
15751
"\n"
15752
"Kerberos 4 ticket cache: /tmp/tkt1000\n"
15753
"klist: You have no tickets cached"
15754
msgstr ""
15755
15756
#: serverguide/C/network-auth.xml:2563(para)
15757
msgid ""
15758
"Next, use the <application>auth-client-config</application> to configure the "
15759
"<application>libpam-krb5</application> module to request a ticket during "
15760
"login:"
15761
msgstr ""
15762
15763
#: serverguide/C/network-auth.xml:2569(command)
15764
msgid "sudo auth-client-config -a -p kerberos_example"
15765
msgstr ""
15766
15767
#: serverguide/C/network-auth.xml:2572(para)
15768
msgid ""
15769
"You will should now receive a ticket upon successful login authentication."
15770
msgstr ""
15771
15772
#: serverguide/C/network-auth.xml:2583(para)
15773
msgid ""
15774
"For more information on Kerberos see the <ulink "
15775
"url=\"http://web.mit.edu/Kerberos/\">MIT Kerberos</ulink> site."
15776
msgstr ""
15777
15778
#: serverguide/C/network-auth.xml:2588(para)
15779
msgid ""
15780
"The <ulink url=\"https://help.ubuntu.com/community/Kerberos\">Ubuntu Wiki "
15781
"Kerberos</ulink> page has more details."
15782
msgstr ""
15783
15784
#: serverguide/C/network-auth.xml:2593(para)
15785
msgid ""
15786
"O'Reilly's <ulink "
15787
"url=\"http://oreilly.com/catalog/9780596004033/\">Kerberos: The Definitive "
15788
"Guide</ulink> is a great reference when setting up Kerberos."
15789
msgstr ""
15790
15791
#: serverguide/C/network-auth.xml:2599(para)
15792
msgid ""
15793
"Also, feel free to stop by the <emphasis>#ubuntu-server</emphasis> IRC "
15794
"channel on <ulink url=\"http://freenode.net/\">Freenode</ulink> if you have "
15795
"Kerberos questions."
15796
msgstr ""
15797
15798
#: serverguide/C/network-auth.xml:2609(title)
15799
msgid "Kerberos and LDAP"
15800
msgstr ""
15801
15802
#: serverguide/C/network-auth.xml:2611(para)
15803
msgid ""
15804
"Replicating a Kerberos principal database between two servers can be "
15805
"complicated, and adds an additional user database to your network. "
15806
"Fortunately, MIT Kerberos can be configured to use an "
15807
"<application>LDAP</application> directory as a principal database. This "
15808
"section covers configuring a primary and secondary kerberos server to use "
15809
"<application>OpenLDAP</application> for the principal database."
15810
msgstr ""
15811
15812
#: serverguide/C/network-auth.xml:2619(title)
15813
msgid "Configuring OpenLDAP"
15814
msgstr ""
15815
15816
#: serverguide/C/network-auth.xml:2621(para)
15817
msgid ""
15818
"First, the necessary <emphasis>schema</emphasis> needs to be loaded on an "
15819
"<application>OpenLDAP</application> server that has network connectivity to "
15820
"the Primary and Secondary KDCs. The rest of this section assumes that you "
15821
"also have LDAP replication configured between at least two servers. For "
15822
"information on setting up OpenLDAP see <xref linkend=\"openldap-server\"/>."
15823
msgstr ""
15824
15825
#: serverguide/C/network-auth.xml:2628(para)
15826
msgid ""
15827
"It is also required to configure OpenLDAP for TLS and SSL connections, so "
15828
"that traffic between the KDC and LDAP server is encrypted. See <xref "
15829
"linkend=\"openldap-tls\"/> for details."
15830
msgstr ""
15831
15832
#: serverguide/C/network-auth.xml:2635(para)
15833
msgid ""
15834
"To load the schema into LDAP, on the LDAP server install the "
15835
"<application>krb5-kdc-ldap</application> package. From a terminal enter:"
15836
msgstr ""
15837
15838
#: serverguide/C/network-auth.xml:2641(command)
15839
msgid "sudo apt-get install krb5-kdc-ldap"
15840
msgstr ""
15841
15842
#: serverguide/C/network-auth.xml:2646(para)
15843
msgid "Next, extract the <filename>kerberos.schema.gz</filename> file:"
15844
msgstr ""
15845
15846
#: serverguide/C/network-auth.xml:2651(command)
15847
msgid "sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz"
15848
msgstr ""
15849
15850
#: serverguide/C/network-auth.xml:2652(command)
15851
msgid ""
15852
"sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/"
15853
msgstr ""
15854
15855
#: serverguide/C/network-auth.xml:2658(para)
15856
msgid ""
15857
"The <emphasis>kerberos</emphasis> schema needs to be added to the "
15858
"<emphasis>cn=config</emphasis> tree. The procedure to add a new schema to "
15859
"<application>slapd</application> is also detailed in <xref "
15860
"linkend=\"openldap-configuration\"/>."
15861
msgstr ""
15862
15863
#: serverguide/C/network-auth.xml:2671(programlisting)
15864
#, no-wrap
15865
msgid ""
15866
"\n"
15867
"include /etc/ldap/schema/core.schema\n"
15868
"include /etc/ldap/schema/collective.schema\n"
15869
"include /etc/ldap/schema/corba.schema\n"
15870
"include /etc/ldap/schema/cosine.schema\n"
15871
"include /etc/ldap/schema/duaconf.schema\n"
15872
"include /etc/ldap/schema/dyngroup.schema\n"
15873
"include /etc/ldap/schema/inetorgperson.schema\n"
15874
"include /etc/ldap/schema/java.schema\n"
15875
"include /etc/ldap/schema/misc.schema\n"
15876
"include /etc/ldap/schema/nis.schema\n"
15877
"include /etc/ldap/schema/openldap.schema\n"
15878
"include /etc/ldap/schema/ppolicy.schema\n"
15879
"include /etc/ldap/schema/kerberos.schema\n"
15880
msgstr ""
15881
15882
#: serverguide/C/network-auth.xml:2691(para)
15883
msgid "Create a temporary directory to hold the LDIF files:"
15884
msgstr ""
15885
15886
#: serverguide/C/network-auth.xml:2706(command)
15887
msgid ""
15888
"slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "
15889
"\"cn={12}kerberos,cn=schema,cn=config\" > /tmp/cn=kerberos.ldif"
15890
msgstr ""
15891
15892
#: serverguide/C/network-auth.xml:2716(para)
15893
msgid ""
15894
"Edit the generated <filename>/tmp/cn\\=kerberos.ldif</filename> file, "
15895
"changing the following attributes:"
15896
msgstr ""
15897
15898
#: serverguide/C/network-auth.xml:2720(programlisting)
15899
#, no-wrap
15900
msgid ""
15901
"\n"
15902
"dn: cn=kerberos,cn=schema,cn=config\n"
15903
"...\n"
15904
"cn: kerberos\n"
15905
msgstr ""
15906
15907
#: serverguide/C/network-auth.xml:2726(para)
15908
msgid "And remove the following lines from the end of the file:"
15909
msgstr ""
15910
15911
#: serverguide/C/network-auth.xml:2730(programlisting)
15912
#, no-wrap
15913
msgid ""
15914
"\n"
15915
"structuralObjectClass: olcSchemaConfig\n"
15916
"entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc\n"
15917
"creatorsName: cn=config\n"
15918
"createTimestamp: 20090111203515Z\n"
15919
"entryCSN: 20090111203515.326445Z#000000#000#000000\n"
15920
"modifiersName: cn=config\n"
15921
"modifyTimestamp: 20090111203515Z\n"
15922
msgstr ""
15923
15924
#: serverguide/C/network-auth.xml:2749(para)
15925
msgid "Load the new schema with <application>ldapadd</application>:"
15926
msgstr ""
15927
15928
#: serverguide/C/network-auth.xml:2754(command)
15929
msgid "ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\\=kerberos.ldif"
15930
msgstr ""
15931
15932
#: serverguide/C/network-auth.xml:2760(para)
15933
msgid ""
15934
"Add an index for the <emphasis>krb5principalname</emphasis> attribute:"
15935
msgstr ""
15936
15937
#: serverguide/C/network-auth.xml:2765(command) serverguide/C/network-auth.xml:2782(command)
15938
msgid "ldapmodify -x -D cn=admin,cn=config -W"
15939
msgstr ""
15940
15941
#: serverguide/C/network-auth.xml:2767(userinput)
15942
#, no-wrap
15943
msgid ""
15944
"dn: olcDatabase={1}hdb,cn=config\n"
15945
"add: olcDbIndex\n"
15946
"olcDbIndex: krbPrincipalName eq,pres,sub"
15947
msgstr ""
15948
15949
#: serverguide/C/network-auth.xml:2766(computeroutput)
15950
#, no-wrap
15951
msgid ""
15952
"Enter LDAP Password:\n"
15953
"<placeholder-1/>\n"
15954
"\n"
15955
"modifying entry \"olcDatabase={1}hdb,cn=config\""
15956
msgstr ""
15957
15958
#: serverguide/C/network-auth.xml:2777(para)
15959
msgid "Finally, update the Access Control Lists (ACL):"
15960
msgstr ""
15961
15962
#: serverguide/C/network-auth.xml:2784(userinput)
15963
#, no-wrap
15964
msgid ""
15965
"dn: olcDatabase={1}hdb,cn=config\n"
15966
"replace: olcAccess\n"
15967
"olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by "
15968
"dn=\"cn=admin,dc=exampl\n"
15969
" e,dc=com\" write by anonymous auth by self write by * none\n"
15970
"-\n"
15971
"add: olcAccess\n"
15972
"olcAccess: to dn.base=\"\" by * read\n"
15973
"-\n"
15974
"add: olcAccess\n"
15975
"olcAccess: to * by dn=\"cn=admin,dc=example,dc=com\" write by * read"
15976
msgstr ""
15977
15978
#: serverguide/C/network-auth.xml:2783(computeroutput)
15979
#, no-wrap
15980
msgid ""
15981
"Enter LDAP Password: \n"
15982
"<placeholder-1/>\n"
15983
"\n"
15984
"modifying entry \"olcDatabase={1}hdb,cn=config\"\n"
15985
msgstr ""
15986
15987
#: serverguide/C/network-auth.xml:2804(para)
15988
msgid ""
15989
"That's it, your LDAP directory is now ready to serve as a Kerberos principal "
15990
"database."
15991
msgstr ""
15992
15993
#: serverguide/C/network-auth.xml:2810(title)
15994
msgid "Primary KDC Configuration"
15995
msgstr ""
15996
15997
#: serverguide/C/network-auth.xml:2812(para)
15998
msgid ""
15999
"With <application>OpenLDAP</application> configured it is time to configure "
16000
"the KDC."
16001
msgstr ""
16002
16003
#: serverguide/C/network-auth.xml:2818(para)
16004
msgid "First, install the necessary packages, from a terminal enter:"
16005
msgstr ""
16006
16007
#: serverguide/C/network-auth.xml:2823(command) serverguide/C/network-auth.xml:2980(command)
16008
msgid "sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap"
16009
msgstr ""
16010
16011
#: serverguide/C/network-auth.xml:2829(para)
16012
msgid ""
16013
"Now edit <filename>/etc/krb5.conf</filename> adding the following options to "
16014
"under the appropriate sections:"
16015
msgstr ""
16016
16017
#: serverguide/C/network-auth.xml:2833(programlisting)
16018
#, no-wrap
16019
msgid ""
16020
"\n"
16021
"[libdefaults]\n"
16022
" default_realm = EXAMPLE.COM\n"
16023
"\n"
16024
"...\n"
16025
"\n"
16026
"[realms]\n"
16027
" EXAMPLE.COM = {\n"
16028
" kdc = kdc01.example.com\n"
16029
" kdc = kdc02.example.com\n"
16030
" admin_server = kdc01.example.com\n"
16031
" admin_server = kdc02.example.com\n"
16032
" default_domain = example.com\n"
16033
" database_module = openldap_ldapconf\n"
16034
" }\n"
16035
"\n"
16036
"...\n"
16037
"\n"
16038
"[domain_realm]\n"
16039
" .example.com = EXAMPLE.COM\n"
16040
"\n"
16041
"\n"
16042
"...\n"
16043
"\n"
16044
"[dbdefaults]\n"
16045
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16046
"\n"
16047
"[dbmodules]\n"
16048
" openldap_ldapconf = {\n"
16049
" db_library = kldap\n"
16050
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16051
"\n"
16052
" # this object needs to have read rights on\n"
16053
" # the realm container, principal container and realm sub-"
16054
"trees\n"
16055
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16056
"\n"
16057
" # this object needs to have read and write rights on\n"
16058
" # the realm container, principal container and realm sub-"
16059
"trees\n"
16060
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16061
" ldap_servers = ldaps://ldap01.example.com "
16062
"ldaps://ldap02.example.com\n"
16063
" ldap_conns_per_server = 5\n"
16064
" }\n"
16065
msgstr ""
16066
16067
#: serverguide/C/network-auth.xml:2878(para)
16068
msgid ""
16069
"Change <emphasis>example.com</emphasis>, "
16070
"<emphasis>dc=example,dc=com</emphasis>, "
16071
"<emphasis>cn=admin,dc=example,dc=com</emphasis>, and "
16072
"<emphasis>ldap01.example.com</emphasis> to the appropriate domain, LDAP "
16073
"object, and LDAP server for your network."
16074
msgstr ""
16075
16076
#: serverguide/C/network-auth.xml:2887(para)
16077
msgid ""
16078
"Next, use the <application>kdb5_ldap_util</application> utility to create "
16079
"the realm:"
16080
msgstr ""
16081
16082
#: serverguide/C/network-auth.xml:2892(command)
16083
msgid ""
16084
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees "
16085
"dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com"
16086
msgstr ""
16087
16088
#: serverguide/C/network-auth.xml:2898(para)
16089
msgid ""
16090
"Create a stash of the password used to bind to the LDAP server. This "
16091
"password is used by the <emphasis>ldap_kdc_dn</emphasis> and "
16092
"<emphasis>ldap_kadmin_dn</emphasis> options in "
16093
"<filename>/etc/krb5.conf</filename>:"
16094
msgstr ""
16095
16096
#: serverguide/C/network-auth.xml:2904(command) serverguide/C/network-auth.xml:3042(command)
16097
msgid ""
16098
"sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com stashsrvpw -f "
16099
"/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com"
16100
msgstr ""
16101
16102
#: serverguide/C/network-auth.xml:2910(para)
16103
msgid "Copy the CA certificate from the LDAP server:"
16104
msgstr ""
16105
16106
#: serverguide/C/network-auth.xml:2915(command)
16107
msgid "scp ldap01:/etc/ssl/certs/cacert.pem ."
16108
msgstr ""
16109
16110
#: serverguide/C/network-auth.xml:2916(command)
16111
msgid "sudo cp cacert.pem /etc/ssl/certs"
16112
msgstr ""
16113
16114
#: serverguide/C/network-auth.xml:2919(para)
16115
msgid ""
16116
"And edit <filename>/etc/ldap/ldap.conf</filename> to use the certificate:"
16117
msgstr ""
16118
16119
#: serverguide/C/network-auth.xml:2923(programlisting)
16120
#, no-wrap
16121
msgid ""
16122
"\n"
16123
"TLS_CACERT /etc/ssl/certs/cacert.pem\n"
16124
msgstr ""
16125
16126
#: serverguide/C/network-auth.xml:2928(para)
16127
msgid ""
16128
"The certificate will also need to be copied to the Secondary KDC, to allow "
16129
"the connection to the LDAP servers using LDAPS."
16130
msgstr ""
16131
16132
#: serverguide/C/network-auth.xml:2937(para)
16133
msgid ""
16134
"You can now add Kerberos principals to the LDAP database, and they will be "
16135
"copied to any other LDAP servers configured for replication. To add a "
16136
"principal using the <application>kadmin.local</application> utility enter:"
16137
msgstr ""
16138
16139
#: serverguide/C/network-auth.xml:2945(userinput)
16140
#, no-wrap
16141
msgid "addprinc -x dn=\"uid=steve,ou=people,dc=example,dc=com\" steve"
16142
msgstr ""
16143
16144
#: serverguide/C/network-auth.xml:2944(computeroutput)
16145
#, no-wrap
16146
msgid ""
16147
"Authenticating as principal root/admin@EXAMPLE.COM with password.\n"
16148
"kadmin.local: <placeholder-1/>\n"
16149
"WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy\n"
16150
"Enter password for principal \"steve@EXAMPLE.COM\": \n"
16151
"Re-enter password for principal \"steve@EXAMPLE.COM\": \n"
16152
"Principal \"steve@EXAMPLE.COM\" created."
16153
msgstr ""
16154
16155
#: serverguide/C/network-auth.xml:2952(para)
16156
msgid ""
16157
"There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and "
16158
"krbExtraData attributes added to the "
16159
"<emphasis>uid=steve,ou=people,dc=example,dc=com</emphasis> user object. Use "
16160
"the <application>kinit</application> and <application>klist</application> "
16161
"utilities to test that the user is indeed issued a ticket."
16162
msgstr ""
16163
16164
#: serverguide/C/network-auth.xml:2959(para)
16165
msgid ""
16166
"If the user object is already created the <emphasis>-x dn=\"...\"</emphasis> "
16167
"option is needed to add the Kerberos attributes. Otherwise a new "
16168
"<emphasis>principal</emphasis> object will be created in the realm subtree."
16169
msgstr ""
16170
16171
#: serverguide/C/network-auth.xml:2967(title)
16172
msgid "Secondary KDC Configuration"
16173
msgstr ""
16174
16175
#: serverguide/C/network-auth.xml:2969(para)
16176
msgid ""
16177
"Configuring a Secondary KDC using the LDAP backend is similar to configuring "
16178
"one using the normal Kerberos database."
16179
msgstr ""
16180
16181
#: serverguide/C/network-auth.xml:2975(para)
16182
msgid "First, install the necessary packages. In a terminal enter:"
16183
msgstr ""
16184
16185
#: serverguide/C/network-auth.xml:2986(para)
16186
msgid ""
16187
"Next, edit <filename>/etc/krb5.conf</filename> to use the LDAP backend:"
16188
msgstr ""
16189
16190
#: serverguide/C/network-auth.xml:2990(programlisting)
16191
#, no-wrap
16192
msgid ""
16193
"\n"
16194
"[libdefaults]\n"
16195
" default_realm = EXAMPLE.COM\n"
16196
"\n"
16197
"...\n"
16198
"\n"
16199
"[realms]\n"
16200
" EXAMPLE.COM = {\n"
16201
" kdc = kdc01.example.com\n"
16202
" kdc = kdc02.example.com\n"
16203
" admin_server = kdc01.example.com\n"
16204
" admin_server = kdc02.example.com\n"
16205
" default_domain = example.com\n"
16206
" database_module = openldap_ldapconf\n"
16207
" }\n"
16208
"\n"
16209
"...\n"
16210
"\n"
16211
"[domain_realm]\n"
16212
" .example.com = EXAMPLE.COM\n"
16213
"\n"
16214
"...\n"
16215
"\n"
16216
"[dbdefaults]\n"
16217
" ldap_kerberos_container_dn = dc=example,dc=com\n"
16218
"\n"
16219
"[dbmodules]\n"
16220
" openldap_ldapconf = {\n"
16221
" db_library = kldap\n"
16222
" ldap_kdc_dn = \"cn=admin,dc=example,dc=com\"\n"
16223
"\n"
16224
" # this object needs to have read rights on\n"
16225
" # the realm container, principal container and realm sub-"
16226
"trees\n"
16227
" ldap_kadmind_dn = \"cn=admin,dc=example,dc=com\"\n"
16228
"\n"
16229
" # this object needs to have read and write rights on\n"
16230
" # the realm container, principal container and realm sub-"
16231
"trees\n"
16232
" ldap_service_password_file = /etc/krb5kdc/service.keyfile\n"
16233
" ldap_servers = ldaps://ldap01.example.com "
16234
"ldaps://ldap02.example.com\n"
16235
" ldap_conns_per_server = 5\n"
16236
" }\n"
16237
msgstr ""
16238
16239
#: serverguide/C/network-auth.xml:3037(para)
16240
msgid "Create the stash for the LDAP bind password:"
16241
msgstr ""
16242
16243
#: serverguide/C/network-auth.xml:3048(para)
16244
msgid ""
16245
"Now, on the <emphasis>Primary KDC</emphasis> copy the "
16246
"<filename>/etc/krb5kdc/.k5.EXAMPLE.COM</filename><emphasis>Master "
16247
"Key</emphasis> stash to the Secondary KDC. Be sure to copy the file over an "
16248
"encrypted connection such as <application>scp</application>, or on physical "
16249
"media."
16250
msgstr ""
16251
16252
#: serverguide/C/network-auth.xml:3055(command)
16253
msgid "sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM steve@kdc02.example.com:~"
16254
msgstr ""
16255
16256
#: serverguide/C/network-auth.xml:3056(command)
16257
msgid "sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/"
16258
msgstr ""
16259
16260
#: serverguide/C/network-auth.xml:3060(para)
16261
msgid ""
16262
"Again, replace <emphasis>EXAMPLE.COM</emphasis> with your actual realm."
16263
msgstr ""
16264
16265
#: serverguide/C/network-auth.xml:3068(para)
16266
msgid "Finally, start the <application>krb5-kdc</application> daemon:"
16267
msgstr ""
16268
16269
#: serverguide/C/network-auth.xml:3079(para)
16270
msgid ""
16271
"You now have redundant KDCs on your network, and with redundant LDAP servers "
16272
"you should be able to continue to authenticate users if one LDAP server, one "
16273
"Kerberos server, or one LDAP and one Kerberos server become unavailable."
16274
msgstr ""
16275
16276
#: serverguide/C/network-auth.xml:3091(para)
16277
msgid ""
16278
"The <ulink url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16279
"admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend\"> Kerberos Admin "
16280
"Guide</ulink> has some additional details."
16281
msgstr ""
16282
16283
#: serverguide/C/network-auth.xml:3097(para)
16284
msgid ""
16285
"For more information on <application>kdb5_ldap_util</application> see <ulink "
16286
"url=\"http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-"
16287
"admin.html#Global-Operations-on-the-Kerberos-LDAP-Database\"> Section "
16288
"5.6</ulink> and the <ulink "
16289
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/kdb5_ldap_util.8.html"
16290
"\">kdb5_ldap_util man page</ulink>."
16291
msgstr ""
16292
16293
#: serverguide/C/network-auth.xml:3105(para)
16294
msgid ""
16295
"Another useful link is the <ulink "
16296
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/krb5.conf.5.html\">kr"
16297
"b5.conf man page</ulink>."
16298
msgstr ""
16299
16300
#: serverguide/C/network-auth.xml:3110(para)
16301
msgid ""
16302
"Also, see the <ulink "
16303
"url=\"https://help.ubuntu.com/community/Kerberos#kerberos-ldap\">Kerberos "
16304
"and LDAP</ulink> Ubuntu wiki page."
16305
msgstr ""
16306
16307
#: serverguide/C/monitoring.xml:13(title)
16308
msgid "Monitoring"
16309
msgstr ""
16310
16311
#: serverguide/C/monitoring.xml:17(para)
16312
msgid ""
16313
"The monitoring of essential servers and services is an important part of "
16314
"system administration. Most network services are monitored for performance, "
16315
"availability, or both. This section will cover installation and "
16316
"configuration of <application>Nagios</application> for availability "
16317
"monitoring, and <application>Munin</application> for performance monitoring."
16318
msgstr ""
16319
16320
#: serverguide/C/monitoring.xml:24(para)
16321
msgid ""
16322
"The examples in this section will use two servers with hostnames "
16323
"<emphasis>server01</emphasis> and <emphasis>server02</emphasis>. "
16324
"<emphasis>Server01</emphasis> will be configured with "
16325
"<application>Nagios</application> to monitor services on itself and "
16326
"<emphasis>server02</emphasis>. Server01 will also be setup with the "
16327
"<application>munin</application> package to gather information from the "
16328
"network. Using the <application>munin-node</application> package, "
16329
"<emphasis>server02</emphasis> will be configured to send information to "
16330
"<emphasis>server01</emphasis>."
16331
msgstr ""
16332
16333
#: serverguide/C/monitoring.xml:33(para)
16334
msgid ""
16335
"Hopefully these simple examples will allow you to monitor additional servers "
16336
"and services on your network."
16337
msgstr ""
16338
16339
#: serverguide/C/monitoring.xml:39(title)
16340
msgid "Nagios"
16341
msgstr ""
16342
16343
#: serverguide/C/monitoring.xml:44(para)
16344
msgid ""
16345
"First, on <emphasis>server01</emphasis> install the "
16346
"<application>nagios</application> package. In a terminal enter:"
16347
msgstr ""
16348
16349
#: serverguide/C/monitoring.xml:50(command)
16350
msgid "sudo apt-get install nagios3 nagios-nrpe-plugin"
16351
msgstr ""
16352
16353
#: serverguide/C/monitoring.xml:53(para)
16354
msgid ""
16355
"You will be asked to enter a password for the "
16356
"<emphasis>nagiosadmin</emphasis> user. The user's credentials are stored in "
16357
"<filename>/etc/nagios3/htpasswd.users</filename>. To change the "
16358
"<emphasis>nagiosadmin</emphasis> password, or add additional users to the "
16359
"Nagios CGI scripts, use the <application>htpasswd</application> that is part "
16360
"of the <application>apache2-utils</application> package."
16361
msgstr ""
16362
16363
#: serverguide/C/monitoring.xml:60(para)
16364
msgid ""
16365
"For example, to change the password for the <emphasis>nagiosadmin</emphasis> "
16366
"user enter:"
16367
msgstr ""
16368
16369
#: serverguide/C/monitoring.xml:65(command)
16370
msgid "sudo htpasswd /etc/nagios3/htpasswd.users nagiosadmin"
16371
msgstr ""
16372
16373
#: serverguide/C/monitoring.xml:68(para)
16374
msgid "To add a user:"
16375
msgstr ""
16376
16377
#: serverguide/C/monitoring.xml:73(command)
16378
msgid "sudo htpasswd /etc/nagios3/htpasswd.users steve"
16379
msgstr ""
16380
16381
#: serverguide/C/monitoring.xml:76(para)
16382
msgid ""
16383
"Next, on <emphasis>server02</emphasis> install the <application>nagios-nrpe-"
16384
"server</application> package. From a terminal on server02 enter:"
16385
msgstr ""
16386
16387
#: serverguide/C/monitoring.xml:82(command)
16388
msgid "sudo apt-get install nagios-nrpe-server"
16389
msgstr ""
16390
16391
#: serverguide/C/monitoring.xml:86(para)
16392
msgid ""
16393
"<application>NRPE</application> allows you to execute local checks on remote "
16394
"hosts. There are other ways of accomplishing this through other Nagios "
16395
"plugins as well as other checks."
16396
msgstr ""
16397
16398
#: serverguide/C/monitoring.xml:94(title)
16399
msgid "Configuration Overview"
16400
msgstr ""
16401
16402
#: serverguide/C/monitoring.xml:96(para)
16403
msgid ""
16404
"There are a couple of directories containing "
16405
"<application>Nagios</application> configuration and check files."
16406
msgstr ""
16407
16408
#: serverguide/C/monitoring.xml:102(para)
16409
msgid ""
16410
"<filename>/etc/nagios3</filename>: contains configuration files for the "
16411
"operation of the <application>nagios</application> daemon, CGI files, hosts, "
16412
"etc."
16413
msgstr ""
16414
16415
#: serverguide/C/monitoring.xml:108(para)
16416
msgid ""
16417
"<filename>/etc/nagios-plugins</filename>: houses configuration files for the "
16418
"service checks."
16419
msgstr ""
16420
16421
#: serverguide/C/monitoring.xml:113(para)
16422
msgid ""
16423
"<filename>/etc/nagios</filename>: on the remote host contains the "
16424
"<application>nagios-nrpe-server</application> configuration files."
16425
msgstr ""
16426
16427
#: serverguide/C/monitoring.xml:118(para)
16428
msgid ""
16429
"<filename>/usr/lib/nagios/plugins/</filename>: where the check binaries are "
16430
"stored. To see the options of a check use the <emphasis>-h</emphasis> option."
16431
msgstr ""
16432
16433
#: serverguide/C/monitoring.xml:123(para)
16434
msgid "For example: <command>/usr/lib/nagios/plugins/check_dhcp -h</command>"
16435
msgstr ""
16436
16437
#: serverguide/C/monitoring.xml:129(para)
16438
msgid ""
16439
"There are a plethora of checks <application>Nagios</application> can be "
16440
"configured to execute for any given host. For this example Nagios will be "
16441
"configured to check disk space, DNS, and a MySQL hostgroup. The DNS check "
16442
"will be on <emphasis>server02</emphasis>, and the MySQL hostgroup will "
16443
"include both <emphasis>server01</emphasis> and <emphasis>server02</emphasis>."
16444
msgstr ""
16445
16446
#: serverguide/C/monitoring.xml:136(para)
16447
msgid ""
16448
"See <xref linkend=\"httpd\"/> for details on setting up Apache, <xref "
16449
"linkend=\"dns\"/> for DNS, and <xref linkend=\"mysql\"/> for MySQL."
16450
msgstr ""
16451
16452
#: serverguide/C/monitoring.xml:141(para)
16453
msgid ""
16454
"Additionally, there are some terms that once explained will hopefully make "
16455
"understanding Nagios configuration easier:"
16456
msgstr ""
16457
16458
#: serverguide/C/monitoring.xml:147(para)
16459
msgid ""
16460
"<emphasis>Host</emphasis>: a server, workstation, network device, etc that "
16461
"is being monitored."
16462
msgstr ""
16463
16464
#: serverguide/C/monitoring.xml:152(para)
16465
msgid ""
16466
"<emphasis>Host Group</emphasis>: a group of similar hosts. For example, you "
16467
"could group all web servers, file server, etc."
16468
msgstr ""
16469
16470
#: serverguide/C/monitoring.xml:157(para)
16471
msgid ""
16472
"<emphasis>Service</emphasis>: the service being monitored on the host. Such "
16473
"as HTTP, DNS, NFS, etc."
16474
msgstr ""
16475
16476
#: serverguide/C/monitoring.xml:162(para)
16477
msgid ""
16478
"<emphasis>Service Group</emphasis>: allows you to group multiple services "
16479
"together. This is useful for grouping multiple HTTP for example."
16480
msgstr ""
16481
16482
#: serverguide/C/monitoring.xml:168(para)
16483
msgid ""
16484
"<emphasis>Contact</emphasis>: person to be notified when an event takes "
16485
"place. Nagios can be configured to send emails, SMS messages, etc."
16486
msgstr ""
16487
16488
#: serverguide/C/monitoring.xml:174(para)
16489
msgid ""
16490
"By default Nagios is configured to check HTTP, disk space, SSH, current "
16491
"users, processes, and load on the <emphasis>localhost</emphasis>. Nagios "
16492
"will also <application>ping</application> check the "
16493
"<emphasis>gateway</emphasis>."
16494
msgstr ""
16495
16496
#: serverguide/C/monitoring.xml:179(para)
16497
msgid ""
16498
"Large Nagios installations can be quite complex to configure. It is usually "
16499
"best to start small, one or two hosts, get things configured the way you "
16500
"like then expand."
16501
msgstr ""
16502
16503
#: serverguide/C/monitoring.xml:194(para)
16504
msgid ""
16505
"First, create a <emphasis>host</emphasis> configuration file for "
16506
"<emphasis>server02</emphasis>. In a terminal enter:"
16507
msgstr ""
16508
16509
#: serverguide/C/monitoring.xml:199(command)
16510
msgid ""
16511
"sudo cp /etc/nagios3/conf.d/localhost_nagios2.cfg "
16512
"/etc/nagios3/conf.d/server02.cfg"
16513
msgstr ""
16514
16515
#: serverguide/C/monitoring.xml:203(para)
16516
msgid ""
16517
"In the above and following command examples, replace "
16518
"<emphasis>\"server01\"</emphasis>, "
16519
"<emphasis>\"server02\"</emphasis><emphasis>172.18.100.100</emphasis>, and "
16520
"<emphasis>172.18.100.101</emphasis> with the host names and IP addresses of "
16521
"your servers."
16522
msgstr ""
16523
16524
#: serverguide/C/monitoring.xml:212(para)
16525
msgid "Next, edit <filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16526
msgstr ""
16527
16528
#: serverguide/C/monitoring.xml:216(programlisting)
16529
#, no-wrap
16530
msgid ""
16531
"\n"
16532
"define host{\n"
16533
" use generic-host ; Name of host "
16534
"template to use\n"
16535
" host_name server02\n"
16536
" alias Server 02\n"
16537
" address 172.18.100.101\n"
16538
"}\n"
16539
"\n"
16540
"# check DNS service.\n"
16541
"define service {\n"
16542
" use generic-service\n"
16543
" host_name server02\n"
16544
" service_description DNS\n"
16545
" check_command check_dns!172.18.100.101\n"
16546
"}\n"
16547
msgstr ""
16548
16549
#: serverguide/C/monitoring.xml:236(para)
16550
msgid ""
16551
"Restart the <application>nagios</application> daemon to enable the new "
16552
"configuration:"
16553
msgstr ""
16554
16555
#: serverguide/C/monitoring.xml:241(command) serverguide/C/monitoring.xml:308(command) serverguide/C/monitoring.xml:375(command)
16556
msgid "sudo /etc/init.d/nagios3 restart"
16557
msgstr ""
16558
16559
#: serverguide/C/monitoring.xml:251(para)
16560
msgid ""
16561
"Now add a service definition for the MySQL check by adding the following to "
16562
"<filename>/etc/nagios3/conf.d/services_nagios2.cfg</filename>:"
16563
msgstr ""
16564
16565
#: serverguide/C/monitoring.xml:255(programlisting)
16566
#, no-wrap
16567
msgid ""
16568
"\n"
16569
"# check MySQL servers.\n"
16570
"define service {\n"
16571
" hostgroup_name mysql-servers\n"
16572
" service_description MySQL\n"
16573
" check_command "
16574
"check_mysql_cmdlinecred!nagios!secret!$HOSTADDRESS\n"
16575
" use generic-service\n"
16576
" notification_interval 0 ; set > 0 if you want to be "
16577
"renotified\n"
16578
"}\n"
16579
msgstr ""
16580
16581
#: serverguide/C/monitoring.xml:269(para)
16582
msgid ""
16583
"A <emphasis>mysqsl-servers</emphasis> hostgroup now needs to be defined. "
16584
"Edit <filename>/etc/nagios3/conf.d/hostgroups_nagios2.cfg</filename> adding:"
16585
msgstr ""
16586
16587
#: serverguide/C/monitoring.xml:274(programlisting)
16588
#, no-wrap
16589
msgid ""
16590
"\n"
16591
"# MySQL hostgroup.\n"
16592
"define hostgroup {\n"
16593
" hostgroup_name mysql-servers\n"
16594
" alias MySQL servers\n"
16595
" members localhost, server02\n"
16596
" }\n"
16597
msgstr ""
16598
16599
#: serverguide/C/monitoring.xml:286(para)
16600
msgid ""
16601
"The Nagios check needs to authenticate to MySQL. To add a "
16602
"<emphasis>nagios</emphasis> user to MySQL enter:"
16603
msgstr ""
16604
16605
#: serverguide/C/monitoring.xml:291(command)
16606
msgid "mysql -u root -p -e \"create user nagios identified by 'secret';\""
16607
msgstr ""
16608
16609
#: serverguide/C/monitoring.xml:295(para)
16610
msgid ""
16611
"The <emphasis>nagios</emphasis> user will need to be added all hosts in the "
16612
"<emphasis>mysql-servers</emphasis> hostgroup."
16613
msgstr ""
16614
16615
#: serverguide/C/monitoring.xml:303(para)
16616
msgid ""
16617
"Restart <application>nagios</application> to start checking the MySQL "
16618
"servers."
16619
msgstr ""
16620
16621
#: serverguide/C/monitoring.xml:318(para)
16622
msgid ""
16623
"Lastly configure NRPE to check the disk space on "
16624
"<emphasis>server02</emphasis>."
16625
msgstr ""
16626
16627
#: serverguide/C/monitoring.xml:322(para)
16628
msgid ""
16629
"On <emphasis>server01</emphasis> add the service check to "
16630
"<filename>/etc/nagios3/conf.d/server02.cfg</filename>:"
16631
msgstr ""
16632
16633
#: serverguide/C/monitoring.xml:327(programlisting)
16634
#, no-wrap
16635
msgid ""
16636
"\n"
16637
"# NRPE disk check.\n"
16638
"define service {\n"
16639
" use generic-service\n"
16640
" host_name server02\n"
16641
" service_description nrpe-disk\n"
16642
" check_command "
16643
"check_nrpe_1arg!check_all_disks!172.18.100.101\n"
16644
"}\n"
16645
msgstr ""
16646
16647
#: serverguide/C/monitoring.xml:340(para)
16648
msgid ""
16649
"Now on <emphasis>server02</emphasis> edit "
16650
"<filename>/etc/nagios/nrpe.cfg</filename> changing:"
16651
msgstr ""
16652
16653
#: serverguide/C/monitoring.xml:344(programlisting)
16654
#, no-wrap
16655
msgid ""
16656
"\n"
16657
"allowed_hosts=172.18.100.100\n"
16658
msgstr ""
16659
16660
#: serverguide/C/monitoring.xml:348(para)
16661
msgid "And below in the command definition area add:"
16662
msgstr ""
16663
16664
#: serverguide/C/monitoring.xml:352(programlisting)
16665
#, no-wrap
16666
msgid ""
16667
"\n"
16668
"command[check_all_disks]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -"
16669
"e\n"
16670
msgstr ""
16671
16672
#: serverguide/C/monitoring.xml:359(para)
16673
msgid "Finally, restart <application>nagios-nrpe-server</application>:"
16674
msgstr ""
16675
16676
#: serverguide/C/monitoring.xml:364(command)
16677
msgid "sudo /etc/init.d/nagios-nrpe-server restart"
16678
msgstr ""
16679
16680
#: serverguide/C/monitoring.xml:370(para)
16681
msgid ""
16682
"Also, on <emphasis>server01</emphasis> restart "
16683
"<application>nagios</application>:"
16684
msgstr ""
16685
16686
#: serverguide/C/monitoring.xml:383(para)
16687
msgid ""
16688
"You should now be able to see the host and service checks in the Nagios CGI "
16689
"files. To access them point a browser to http://server01/nagios3. You will "
16690
"then be prompted for the <emphasis>nagiosadmin</emphasis> username and "
16691
"password."
16692
msgstr ""
16693
16694
#: serverguide/C/monitoring.xml:393(para)
16695
msgid ""
16696
"This section has just scratched the surface of Nagios' features. The "
16697
"<application>nagios-plugins-extra</application> and <application>nagios-snmp-"
16698
"plugins</application> contain many more service checks."
16699
msgstr ""
16700
16701
#: serverguide/C/monitoring.xml:400(para)
16702
msgid ""
16703
"For more information see <ulink "
16704
"url=\"http://www.nagios.org/\">Nagios</ulink> website."
16705
msgstr ""
16706
16707
#: serverguide/C/monitoring.xml:405(para)
16708
msgid ""
16709
"Specifically the <ulink "
16710
"url=\"http://nagios.sourceforge.net/docs/3_0/\">Online Documentation</ulink> "
16711
"site."
16712
msgstr ""
16713
16714
#: serverguide/C/monitoring.xml:410(para)
16715
msgid ""
16716
"There is also a list of <ulink "
16717
"url=\"http://www.nagios.org/propaganda/books/\">books</ulink> related to "
16718
"Nagios and network monitoring:"
16719
msgstr ""
16720
16721
#: serverguide/C/monitoring.xml:416(para)
16722
msgid ""
16723
"The <ulink url=\"https://help.ubuntu.com/community/Nagios\">Nagios Ubuntu "
16724
"Wiki</ulink> page also has more details."
16725
msgstr ""
16726
16727
#: serverguide/C/monitoring.xml:425(title)
16728
msgid "Munin"
16729
msgstr ""
16730
16731
#: serverguide/C/monitoring.xml:430(para)
16732
msgid ""
16733
"Before installing <application>Munin</application> on "
16734
"<emphasis>server01</emphasis><application>apache2</application> will need to "
16735
"be installed. The default configuration is fine for running a "
16736
"<application>munin</application> server. For more information see <xref "
16737
"linkend=\"httpd\"/>."
16738
msgstr ""
16739
16740
#: serverguide/C/monitoring.xml:436(para)
16741
msgid ""
16742
"First, on <emphasis>server01</emphasis> install "
16743
"<application>munin</application>. In a terminal enter:"
16744
msgstr ""
16745
16746
#: serverguide/C/monitoring.xml:441(command)
16747
msgid "sudo apt-get install munin"
16748
msgstr ""
16749
16750
#: serverguide/C/monitoring.xml:444(para)
16751
msgid ""
16752
"Now on <emphasis>server02</emphasis> install the <application>munin-"
16753
"node</application> package:"
16754
msgstr ""
16755
16756
#: serverguide/C/monitoring.xml:449(command)
16757
msgid "sudo apt-get install munin-node"
16758
msgstr ""
16759
16760
#: serverguide/C/monitoring.xml:456(para)
16761
msgid ""
16762
"On <emphasis>server01</emphasis> edit the "
16763
"<filename>/etc/munin/munin.conf</filename> adding the IP address for "
16764
"<emphasis>server02</emphasis>:"
16765
msgstr ""
16766
16767
#: serverguide/C/monitoring.xml:461(programlisting)
16768
#, no-wrap
16769
msgid ""
16770
"\n"
16771
"## First our \"normal\" host.\n"
16772
"[server02]\n"
16773
" address 172.18.100.101\n"
16774
msgstr ""
16775
16776
#: serverguide/C/monitoring.xml:468(para)
16777
msgid ""
16778
"Replace <emphasis>server02</emphasis> and "
16779
"<emphasis>172.18.100.101</emphasis> with the actual hostname and IP address "
16780
"for your server."
16781
msgstr ""
16782
16783
#: serverguide/C/monitoring.xml:474(para)
16784
msgid ""
16785
"Next, configure <application>munin-node</application> on "
16786
"<emphasis>server02</emphasis>. Edit <filename>/etc/munin/munin-"
16787
"node.conf</filename> to allow access by <emphasis>server01</emphasis>:"
16788
msgstr ""
16789
16790
#: serverguide/C/monitoring.xml:479(programlisting)
16791
#, no-wrap
16792
msgid ""
16793
"\n"
16794
"allow ^172\\.18\\.100\\.100$\n"
16795
msgstr ""
16796
16797
#: serverguide/C/monitoring.xml:484(para)
16798
msgid ""
16799
"Replace <emphasis>^172\\.18\\.100\\.100$</emphasis> with IP address for your "
16800
"<application>munin</application> server."
16801
msgstr ""
16802
16803
#: serverguide/C/monitoring.xml:489(para)
16804
msgid ""
16805
"Now restart <application>munin-node</application> on "
16806
"<emphasis>server02</emphasis> for the changes to take effect:"
16807
msgstr ""
16808
16809
#: serverguide/C/monitoring.xml:494(command)
16810
msgid "sudo /etc/init.d/munin-node restart"
16811
msgstr ""
16812
16813
#: serverguide/C/monitoring.xml:497(para)
16814
msgid ""
16815
"Finally, in a browser go to <emphasis>http://server01/munin</emphasis>, and "
16816
"you should see links to nice graphs displaying information from the standard "
16817
"<emphasis>munin-plugins</emphasis> for disk, network, processes, and system."
16818
msgstr ""
16819
16820
#: serverguide/C/monitoring.xml:503(para)
16821
msgid ""
16822
"Since this is a new install it may take some time for the graphs to display "
16823
"anything useful."
16824
msgstr ""
16825
16826
#: serverguide/C/monitoring.xml:510(title)
16827
msgid "Additional Plugins"
16828
msgstr ""
16829
16830
#: serverguide/C/monitoring.xml:512(para)
16831
msgid ""
16832
"The <application>munin-plugins-extra</application> package contains "
16833
"performance checks additional services such as DNS, DHCP, Samba, etc. To "
16834
"install the package, from a terminal enter:"
16835
msgstr ""
16836
16837
#: serverguide/C/monitoring.xml:518(command)
16838
msgid "sudo apt-get install munin-plugins-extra"
16839
msgstr ""
16840
16841
#: serverguide/C/monitoring.xml:521(para)
16842
msgid "Be sure to install the package on both the server and node machines."
16843
msgstr ""
16844
16845
#: serverguide/C/monitoring.xml:531(para)
16846
msgid ""
16847
"See the <ulink url=\"http://munin.projects.linpro.no/\">Munin</ulink> "
16848
"website for more details."
16849
msgstr ""
16850
16851
#: serverguide/C/monitoring.xml:536(para)
16852
msgid ""
16853
"Specifically the <ulink "
16854
"url=\"http://munin.projects.linpro.no/wiki/Documentation\">Munin "
16855
"Documentation</ulink> page includes information on additional plugins, "
16856
"writing plugins, etc."
16857
msgstr ""
16858
16859
#: serverguide/C/monitoring.xml:542(para)
16860
msgid ""
16861
"Also, there is a book in German by Open Source Press: <ulink "
16862
"url=\"https://www.opensourcepress.de/index.php?26&backPID=178&tt_prod"
16863
"ucts=152\">Munin Graphisches Netzwerk- und System-Monitoring</ulink>."
16864
msgstr ""
16865
16866
#: serverguide/C/monitoring.xml:548(para)
16867
msgid ""
16868
"Another resource is the <ulink "
16869
"url=\"https://help.ubuntu.com/community/Munin\">Munin Ubuntu Wiki</ulink> "
16870
"page."
16871
msgstr ""
16872
16873
#: serverguide/C/mail.xml:13(title)
16874
msgid "Email Services"
16875
msgstr ""
16876
16877
#: serverguide/C/mail.xml:14(para)
16878
msgid ""
16879
"The process of getting an email from one person to another over a network or "
16880
"the Internet involves many systems working together. Each of these systems "
16881
"must be correctly configured for the process to work. The sender uses a "
16882
"<emphasis>Mail User Agent</emphasis> (MUA), or email client, to send the "
16883
"message through one or more <emphasis>Mail Transfer Agents</emphasis> (MTA), "
16884
"the last of which will hand it off to a <emphasis>Mail Delivery "
16885
"Agent</emphasis> (MDA) for delivery to the recipient's mailbox, from which "
16886
"it will be retrieved by the recipient's email client, usually via a POP3 or "
16887
"IMAP server."
16888
msgstr ""
16889
16890
#: serverguide/C/mail.xml:24(title) serverguide/C/mail.xml:832(application) serverguide/C/mail.xml:866(title) serverguide/C/mail.xml:944(title) serverguide/C/mail.xml:1510(title)
16891
msgid "Postfix"
16892
msgstr ""
16893
16894
#: serverguide/C/mail.xml:25(para)
16895
msgid ""
16896
"<application>Postfix</application> is the default Mail Transfer Agent (MTA) "
16897
"in Ubuntu. It attempts to be fast and easy to administer and secure. It is "
16898
"compatible with the MTA <application>sendmail</application>. This section "
16899
"explains how to install and configure <application>postfix</application>. It "
16900
"also explains how to set it up as an SMTP server using a secure connection "
16901
"(for sending emails securely)."
16902
msgstr ""
16903
16904
#: serverguide/C/mail.xml:34(para)
16905
msgid ""
16906
"This guide does not cover setting up Postfix <emphasis>Virtual "
16907
"Domains</emphasis>, for information on Virtual Domains and other advanced "
16908
"configurations see <xref linkend=\"postfix-references\"/>."
16909
msgstr ""
16910
16911
#: serverguide/C/mail.xml:41(para)
16912
msgid ""
16913
"To install <application>postfix</application> run the following command:"
16914
msgstr ""
16915
16916
#: serverguide/C/mail.xml:47(para)
16917
msgid ""
16918
"Simply press return when the installation process asks questions, the "
16919
"configuration will be done in greater detail in the next stage."
16920
msgstr ""
16921
16922
#: serverguide/C/mail.xml:52(title)
16923
msgid "Basic Configuration"
16924
msgstr ""
16925
16926
#: serverguide/C/mail.xml:53(para)
16927
msgid ""
16928
"To configure <application>postfix</application>, run the following command:"
16929
msgstr ""
16930
16931
#: serverguide/C/mail.xml:57(command)
16932
msgid "sudo dpkg-reconfigure postfix"
16933
msgstr ""
16934
16935
#: serverguide/C/mail.xml:63(para)
16936
msgid "Internet Site"
16937
msgstr ""
16938
16939
#: serverguide/C/mail.xml:64(para)
16940
msgid "mail.example.com"
16941
msgstr ""
16942
16943
#: serverguide/C/mail.xml:65(para)
16944
msgid "steve"
16945
msgstr ""
16946
16947
#: serverguide/C/mail.xml:66(para)
16948
msgid "mail.example.com, localhost.localdomain, localhost"
16949
msgstr ""
16950
16951
#: serverguide/C/mail.xml:67(para)
16952
msgid "No"
16953
msgstr ""
16954
16955
#: serverguide/C/mail.xml:68(para)
16956
msgid "127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24"
16957
msgstr ""
16958
16959
#: serverguide/C/mail.xml:69(para)
16960
msgid "0"
16961
msgstr ""
16962
16963
#: serverguide/C/mail.xml:70(para)
16964
msgid "+"
16965
msgstr ""
16966
16967
#: serverguide/C/mail.xml:71(para)
16968
msgid "all"
16969
msgstr ""
16970
16971
#: serverguide/C/mail.xml:59(para)
16972
msgid ""
16973
"The user interface will be displayed. On each screen, select the following "
16974
"values: <placeholder-1/>"
16975
msgstr ""
16976
16977
#: serverguide/C/mail.xml:75(para)
16978
msgid ""
16979
"Replace mail.example.com with the domain for which you'll accept email, "
16980
"192.168.0.0/24 with the actual network and class range of your mail server, "
16981
"and steve with the appropriate username."
16982
msgstr ""
16983
16984
#: serverguide/C/mail.xml:81(para)
16985
msgid ""
16986
"Now is a good time to decide which mailbox format you want to use. By "
16987
"default Postfix will use <emphasis role=\"strong\">mbox</emphasis> for the "
16988
"mailbox format. Rather than editing the configuration file directly, you can "
16989
"use the <command>postconf</command> command to configure all "
16990
"<application>postfix</application> parameters. The configuration parameters "
16991
"will be stored in <filename>/etc/postfix/main.cf</filename> file. Later if "
16992
"you wish to re-configure a particular parameter, you can either run the "
16993
"command or change it manually in the file."
16994
msgstr ""
16995
16996
#: serverguide/C/mail.xml:92(para)
16997
msgid ""
16998
"To configure the mailbox format for <emphasis "
16999
"role=\"strong\">Maildir:</emphasis>"
17000
msgstr ""
17001
17002
#: serverguide/C/mail.xml:97(command)
17003
msgid "sudo postconf -e 'home_mailbox = Maildir/'"
17004
msgstr ""
17005
17006
#: serverguide/C/mail.xml:100(para)
17007
msgid ""
17008
"This will place new mail in /home/<emphasis "
17009
"role=\"italic\">username</emphasis>/Maildir so you will need to configure "
17010
"your Mail Delivery Agent (MDA) to use the same path."
17011
msgstr ""
17012
17013
#: serverguide/C/mail.xml:108(title) serverguide/C/mail.xml:556(title)
17014
msgid "SMTP Authentication"
17015
msgstr ""
17016
17017
#: serverguide/C/mail.xml:110(para)
17018
msgid ""
17019
"SMTP-AUTH allows a client to identify itself through an authentication "
17020
"mechanism (SASL). Transport Layer Security (TLS) should be used to encrypt "
17021
"the authentication process. Once authenticated the SMTP server will allow "
17022
"the client to relay mail."
17023
msgstr ""
17024
17025
#: serverguide/C/mail.xml:117(para)
17026
msgid "Configure Postfix for SMTP-AUTH using SASL (Dovecot SASL):"
17027
msgstr ""
17028
17029
#: serverguide/C/mail.xml:120(screen)
17030
#, no-wrap
17031
msgid ""
17032
"\n"
17033
"sudo postconf -e 'smtpd_sasl_type = dovecot'\n"
17034
"sudo postconf -e 'smtpd_sasl_path = private/auth-client'\n"
17035
"sudo postconf -e 'smtpd_sasl_local_domain ='\n"
17036
"sudo postconf -e 'smtpd_sasl_security_options = noanonymous'\n"
17037
"sudo postconf -e 'broken_sasl_auth_clients = yes'\n"
17038
"sudo postconf -e 'smtpd_sasl_auth_enable = yes'\n"
17039
"sudo postconf -e 'smtpd_recipient_restrictions = "
17040
"permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination'\n"
17041
"sudo postconf -e 'inet_interfaces = all'\n"
17042
msgstr ""
17043
17044
#: serverguide/C/mail.xml:131(para)
17045
msgid ""
17046
"The <emphasis>smtpd_sasl_path</emphasis> configuration is a path relative to "
17047
"the Postfix queue directory."
17048
msgstr ""
17049
17050
#: serverguide/C/mail.xml:137(para)
17051
msgid ""
17052
"Next, obtain a digital certificate for TLS. See <xref linkend=\"certificates-"
17053
"and-security\"/> for details. This example also uses a Certificate Authority "
17054
"(CA). For information on generating a CA certificate see <xref "
17055
"linkend=\"certificate-authority\"/>."
17056
msgstr ""
17057
17058
#: serverguide/C/mail.xml:143(para)
17059
msgid ""
17060
"You can get the digital certificate from a certificate authority. But unlike "
17061
"web clients, SMTP clients rarely complain about \"self-signed "
17062
"certificates\", so alternatively, you can create the certificate yourself. "
17063
"Refer to <xref linkend=\"creating-a-self-signed-certificate\"/> for more "
17064
"details."
17065
msgstr ""
17066
17067
#: serverguide/C/mail.xml:155(para)
17068
msgid ""
17069
"Once you have a certificate, configure Postfix to provide TLS encryption for "
17070
"both incoming and outgoing mail:"
17071
msgstr ""
17072
17073
#: serverguide/C/mail.xml:158(screen)
17074
#, no-wrap
17075
msgid ""
17076
"\n"
17077
"sudo postconf -e 'smtpd_tls_auth_only = no'\n"
17078
"sudo postconf -e 'smtp_use_tls = yes'\n"
17079
"sudo postconf -e 'smtpd_use_tls = yes'\n"
17080
"sudo postconf -e 'smtp_tls_note_starttls_offer = yes'\n"
17081
"sudo postconf -e 'smtpd_tls_key_file = /etc/ssl/private/server.key'\n"
17082
"sudo postconf -e 'smtpd_tls_cert_file = /etc/ssl/certs/server.crt'\n"
17083
"sudo postconf -e 'smtpd_tls_loglevel = 1'\n"
17084
"sudo postconf -e 'smtpd_tls_received_header = yes'\n"
17085
"sudo postconf -e 'smtpd_tls_session_cache_timeout = 3600s'\n"
17086
"sudo postconf -e 'tls_random_source = dev:/dev/urandom'\n"
17087
"sudo postconf -e 'myhostname = mail.example.com'\n"
17088
msgstr ""
17089
17090
#: serverguide/C/mail.xml:173(para)
17091
msgid ""
17092
"If you are using your own <emphasis>Certificate Authority</emphasis> to sign "
17093
"the certificate enter:"
17094
msgstr ""
17095
17096
#: serverguide/C/mail.xml:177(command)
17097
msgid "sudo postconf -e 'smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem'"
17098
msgstr ""
17099
17100
#: serverguide/C/mail.xml:180(para)
17101
msgid ""
17102
"Again, for more details about certificates see <xref linkend=\"certificates-"
17103
"and-security\"/>."
17104
msgstr ""
17105
17106
#: serverguide/C/mail.xml:186(para)
17107
msgid ""
17108
"After running all the commands, <application>Postfix</application> is "
17109
"configured for SMTP-AUTH and a self-signed certificate has been created for "
17110
"TLS encryption."
17111
msgstr ""
17112
17113
#: serverguide/C/mail.xml:191(para)
17114
msgid ""
17115
"Now, the file <filename>/etc/postfix/main.cf</filename> should look like "
17116
"<ulink url=\"../sample/postfix_configuration\">this</ulink>."
17117
msgstr ""
17118
17119
#: serverguide/C/mail.xml:195(para)
17120
msgid ""
17121
"The postfix initial configuration is complete. Run the following command to "
17122
"restart the postfix daemon:"
17123
msgstr ""
17124
17125
#: serverguide/C/mail.xml:201(command) serverguide/C/mail.xml:315(command) serverguide/C/mail.xml:378(command) serverguide/C/mail.xml:984(command) serverguide/C/mail.xml:1561(command)
17126
msgid "sudo /etc/init.d/postfix restart"
17127
msgstr ""
17128
17129
#: serverguide/C/mail.xml:204(para)
17130
msgid ""
17131
"<application>Postfix</application> supports SMTP-AUTH as defined in <ulink "
17132
"url=\"ftp://ftp.isi.edu/in-notes/rfc2554.txt\">RFC2554</ulink>. It is based "
17133
"on <ulink url=\"ftp://ftp.isi.edu/in-notes/rfc2222.txt\">SASL</ulink>. "
17134
"However it is still necessary to set up SASL authentication before you can "
17135
"use SMTP-AUTH."
17136
msgstr ""
17137
17138
#: serverguide/C/mail.xml:214(title) serverguide/C/mail.xml:609(title)
17139
msgid "Configuring SASL"
17140
msgstr ""
17141
17142
#: serverguide/C/mail.xml:215(para)
17143
msgid ""
17144
"Postfix supports two SASL implementations Cyrus SASL and Dovecot SASL. To "
17145
"enable Dovecot SASL the <application>dovecot-common</application> package "
17146
"will need to be installed. From a terminal prompt enter the following:"
17147
msgstr ""
17148
17149
#: serverguide/C/mail.xml:221(command)
17150
msgid "sudo apt-get install dovecot-common"
17151
msgstr ""
17152
17153
#: serverguide/C/mail.xml:223(para)
17154
msgid ""
17155
"Next you will need to edit <filename>/etc/dovecot/dovecot.conf</filename>. "
17156
"In the <emphasis>auth default</emphasis> section uncomment the "
17157
"<emphasis>socket listen</emphasis> option and change the following:"
17158
msgstr ""
17159
17160
#: serverguide/C/mail.xml:227(programlisting)
17161
#, no-wrap
17162
msgid ""
17163
"\n"
17164
" socket listen {\n"
17165
" #master {\n"
17166
" # Master socket provides access to userdb information. It's typically\n"
17167
" # used to give Dovecot's local delivery agent access to userdb so it\n"
17168
" # can find mailbox locations.\n"
17169
" #path = /var/run/dovecot/auth-master\n"
17170
" #mode = 0600\n"
17171
" # Default user/group is the one who started dovecot-auth (root)\n"
17172
" #user = \n"
17173
" #group = \n"
17174
" #}\n"
17175
" client {\n"
17176
" # The client socket is generally safe to export to everyone. Typical "
17177
"use\n"
17178
" # is to export it to your SMTP server so it can do SMTP AUTH lookups\n"
17179
" # using it.\n"
17180
" path = /var/spool/postfix/private/auth-client\n"
17181
" mode = 0660\n"
17182
" user = postfix\n"
17183
" group = postfix\n"
17184
" }\n"
17185
" }\n"
17186
msgstr ""
17187
17188
#: serverguide/C/mail.xml:251(para)
17189
msgid ""
17190
"In order to let <application>Outlook</application> clients use SMTPAUTH, in "
17191
"the <emphasis>auth default</emphasis> section of /etc/dovecot/dovecot.conf "
17192
"add <emphasis>\"login\"</emphasis>:"
17193
msgstr ""
17194
17195
#: serverguide/C/mail.xml:256(programlisting)
17196
#, no-wrap
17197
msgid ""
17198
"\n"
17199
" mechanisms = plain login\n"
17200
msgstr ""
17201
17202
#: serverguide/C/mail.xml:260(para)
17203
msgid ""
17204
"Once you have <application>Dovecot</application> configured restart it with:"
17205
msgstr ""
17206
17207
#: serverguide/C/mail.xml:264(command) serverguide/C/mail.xml:735(command)
17208
msgid "sudo /etc/init.d/dovecot restart"
17209
msgstr ""
17210
17211
#: serverguide/C/mail.xml:269(title)
17212
msgid "Postfix-Dovecot"
17213
msgstr ""
17214
17215
#: serverguide/C/mail.xml:271(para)
17216
msgid ""
17217
"Another option for configuring <application>Postfix</application> for SMTP-"
17218
"AUTH is using the <application>dovecot-postfix</application> package. This "
17219
"package will install <application>Dovecot</application> and configure "
17220
"<application>Postfix</application> to use it for both SASL authentication "
17221
"and as a Mail Delivery Agent (MDA). The package also configures "
17222
"<application>Dovecot</application> for IMAP, IMAPS, POP3, and POP3S."
17223
msgstr ""
17224
17225
#: serverguide/C/mail.xml:280(para)
17226
msgid ""
17227
"You may or may not want to run IMAP, IMAPS, POP3, or POP3S on your mail "
17228
"server. For example, if you are configuring your server to be a mail "
17229
"gateway, spam/virus filter, etc. If this is the case it may be easier to use "
17230
"the above commands to configure Postfix for SMTPAUTH."
17231
msgstr ""
17232
17233
#: serverguide/C/mail.xml:287(para)
17234
msgid "To install the package, from a terminal prompt enter:"
17235
msgstr ""
17236
17237
#: serverguide/C/mail.xml:292(command)
17238
msgid "sudo apt-get install dovecot-postfix"
17239
msgstr ""
17240
17241
#: serverguide/C/mail.xml:295(para)
17242
msgid ""
17243
"You should now have a working mail server, but there are a few options that "
17244
"you may wish to further customize. For example, the package uses the "
17245
"certificate and key from the <application>ssl-cert</application> package, "
17246
"and in a production environment you should use a certificate and key "
17247
"generated for the host. See <xref linkend=\"certificates-and-security\"/> "
17248
"for more details."
17249
msgstr ""
17250
17251
#: serverguide/C/mail.xml:301(para)
17252
msgid ""
17253
"Once you have a customized certificate and key for the host, change the "
17254
"following options in <filename>/etc/postfix/main.cf</filename>:"
17255
msgstr ""
17256
17257
#: serverguide/C/mail.xml:305(programlisting)
17258
#, no-wrap
17259
msgid ""
17260
"\n"
17261
"smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem\n"
17262
"smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key\n"
17263
msgstr ""
17264
17265
#: serverguide/C/mail.xml:310(para)
17266
msgid "Then restart Postfix:"
17267
msgstr ""
17268
17269
#: serverguide/C/mail.xml:321(para)
17270
msgid ""
17271
"SMTP-AUTH configuration is complete. Now it is time to test the setup."
17272
msgstr ""
17273
17274
#: serverguide/C/mail.xml:324(para)
17275
msgid "To see if SMTP-AUTH and TLS work properly, run the following command:"
17276
msgstr ""
17277
17278
#: serverguide/C/mail.xml:329(command)
17279
msgid "telnet mail.example.com 25"
17280
msgstr ""
17281
17282
#: serverguide/C/mail.xml:331(para)
17283
msgid ""
17284
"After you have established the connection to the postfix mail server, type:"
17285
msgstr ""
17286
17287
#: serverguide/C/mail.xml:335(screen)
17288
#, no-wrap
17289
msgid ""
17290
"\n"
17291
"ehlo mail.example.com\n"
17292
msgstr ""
17293
17294
#: serverguide/C/mail.xml:338(para)
17295
msgid ""
17296
"If you see the following lines among others, then everything is working "
17297
"perfectly. Type <command>quit</command> to exit."
17298
msgstr ""
17299
17300
#: serverguide/C/mail.xml:342(programlisting)
17301
#, no-wrap
17302
msgid ""
17303
"\n"
17304
"250-STARTTLS\n"
17305
"250-AUTH LOGIN PLAIN\n"
17306
"250-AUTH=LOGIN PLAIN\n"
17307
"250 8BITMIME\n"
17308
msgstr ""
17309
17310
#: serverguide/C/mail.xml:352(para)
17311
msgid ""
17312
"This section introduces some common ways to determine the cause if problems "
17313
"arise."
17314
msgstr ""
17315
17316
#: serverguide/C/mail.xml:356(title)
17317
msgid "Escaping chroot"
17318
msgstr ""
17319
17320
#: serverguide/C/mail.xml:357(para)
17321
msgid ""
17322
"The Ubuntu <application>postfix</application> package will by default "
17323
"install into a <emphasis>chroot</emphasis> environment for security reasons. "
17324
"This can add greater complexity when troubleshooting problems."
17325
msgstr ""
17326
17327
#: serverguide/C/mail.xml:361(para)
17328
msgid ""
17329
"To turn off the chroot operation locate for the following line in the "
17330
"<filename>/etc/postfix/master.cf</filename> configuration file:"
17331
msgstr ""
17332
17333
#: serverguide/C/mail.xml:365(screen)
17334
#, no-wrap
17335
msgid ""
17336
"\n"
17337
"smtp inet n - - - - smtpd\n"
17338
msgstr ""
17339
17340
#: serverguide/C/mail.xml:368(para)
17341
msgid "and modify it as follows:"
17342
msgstr ""
17343
17344
#: serverguide/C/mail.xml:371(screen)
17345
#, no-wrap
17346
msgid ""
17347
"\n"
17348
"smtp inet n - n - - smtpd\n"
17349
msgstr ""
17350
17351
#: serverguide/C/mail.xml:374(para)
17352
msgid ""
17353
"You will then need to restart Postfix to use the new configuration. From a "
17354
"terminal prompt enter:"
17355
msgstr ""
17356
17357
#: serverguide/C/mail.xml:382(title)
17358
msgid "Log Files"
17359
msgstr ""
17360
17361
#: serverguide/C/mail.xml:383(para)
17362
msgid ""
17363
"<application>Postfix</application> sends all log messages to "
17364
"<filename>/var/log/mail.log</filename>. However error and warning messages "
17365
"can sometimes get lost in the normal log output so they are also logged to "
17366
"<filename>/var/log/mail.err</filename> and "
17367
"<filename>/var/log/mail.warn</filename> respectively."
17368
msgstr ""
17369
17370
#: serverguide/C/mail.xml:388(para)
17371
msgid ""
17372
"To see messages entered into the logs in real time you can use the "
17373
"<application>tail -f</application> command:"
17374
msgstr ""
17375
17376
#: serverguide/C/mail.xml:393(command)
17377
msgid "tail -f /var/log/mail.err"
17378
msgstr ""
17379
17380
#: serverguide/C/mail.xml:395(para)
17381
msgid ""
17382
"The amount of detail that is recorded in the logs can be increased. Below "
17383
"are some configuration options for increasing the log level for some of the "
17384
"areas covered above."
17385
msgstr ""
17386
17387
#: serverguide/C/mail.xml:401(para)
17388
msgid ""
17389
"To increase <emphasis>TLS</emphasis> activity logging set the "
17390
"<emphasis>smtpd_tls_loglevel</emphasis> option to a value from 1 to 4."
17391
msgstr ""
17392
17393
#: serverguide/C/mail.xml:405(command)
17394
msgid "sudo postconf -e 'smtpd_tls_loglevel = 4'"
17395
msgstr ""
17396
17397
#: serverguide/C/mail.xml:409(para)
17398
msgid ""
17399
"If you are having trouble sending or receiving mail from a specific domain "
17400
"you can add the domain to the <emphasis>debug_peer_list</emphasis> parameter."
17401
msgstr ""
17402
17403
#: serverguide/C/mail.xml:414(command)
17404
msgid "sudo postconf -e 'debug_peer_list = problem.domain'"
17405
msgstr ""
17406
17407
#: serverguide/C/mail.xml:418(para)
17408
msgid ""
17409
"You can increase the verbosity of any <application>Postfix</application> "
17410
"daemon process by editing the <filename>/etc/postfix/master.cf</filename> "
17411
"and adding a <emphasis>-v</emphasis> after the entry. For example edit the "
17412
"<emphasis>smtp</emphasis> entry:"
17413
msgstr ""
17414
17415
#: serverguide/C/mail.xml:422(programlisting)
17416
#, no-wrap
17417
msgid ""
17418
"\n"
17419
"smtp unix - - - - - smtp -v\n"
17420
msgstr ""
17421
17422
#: serverguide/C/mail.xml:428(para)
17423
msgid ""
17424
"It is important to note that after making one of the logging changes above "
17425
"the <application>Postfix</application> process will need to be reloaded in "
17426
"order to recognize the new configuration: <command>sudo /etc/init.d/postfix "
17427
"reload</command>"
17428
msgstr ""
17429
17430
#: serverguide/C/mail.xml:435(para)
17431
msgid ""
17432
"To increase the amount of information logged when troubleshooting "
17433
"<emphasis>SASL</emphasis> issues you can set the following options in "
17434
"<filename>/etc/dovecot/dovecot.conf</filename>"
17435
msgstr ""
17436
17437
#: serverguide/C/mail.xml:439(programlisting)
17438
#, no-wrap
17439
msgid ""
17440
"\n"
17441
"auth_debug=yes\n"
17442
"auth_debug_passwords=yes\n"
17443
msgstr ""
17444
17445
#: serverguide/C/mail.xml:446(para)
17446
msgid ""
17447
"Just like <application>Postfix</application> if you change a "
17448
"<application>Dovecot</application> configuration the process will need to be "
17449
"reloaded: <command>sudo /etc/init.d/dovecot reload</command>."
17450
msgstr ""
17451
17452
#: serverguide/C/mail.xml:452(para)
17453
msgid ""
17454
"Some of the options above can drastically increase the amount of information "
17455
"sent to the log files. Remember to return the log level back to normal after "
17456
"you have corrected the problem. Then reload the appropriate daemon for the "
17457
"new configuration to take affect."
17458
msgstr ""
17459
17460
#: serverguide/C/mail.xml:460(para)
17461
msgid ""
17462
"Administering a <application>Postfix</application> server can be a very "
17463
"complicated task. At some point you may need to turn to the Ubuntu community "
17464
"for more experienced help."
17465
msgstr ""
17466
17467
#: serverguide/C/mail.xml:464(para)
17468
msgid ""
17469
"A great place to ask for <application>Postfix</application> assistance, and "
17470
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
17471
"server</emphasis> IRC channel on <ulink "
17472
"url=\"http://freenode.net\">freenode</ulink>. You can also post a message to "
17473
"one of the <ulink "
17474
"url=\"http://www.ubuntu.com/support/community/webforums\">Web Forums</ulink>."
17475
msgstr ""
17476
17477
#: serverguide/C/mail.xml:469(para)
17478
msgid ""
17479
"For in depth <application>Postfix</application> information Ubuntu "
17480
"developers highly recommend: <ulink url=\"http://www.postfix-book.com/\">The "
17481
"Book of Postfix</ulink>."
17482
msgstr ""
17483
17484
#: serverguide/C/mail.xml:473(para)
17485
msgid ""
17486
"Finally, the <ulink "
17487
"url=\"http://www.postfix.org/documentation.html\">Postfix</ulink> website "
17488
"also has great documentation on all the different configuration options "
17489
"available."
17490
msgstr ""
17491
17492
#: serverguide/C/mail.xml:477(para)
17493
msgid ""
17494
"Also, the <ulink url=\"https://help.ubuntu.com/community/Postfix\">Ubuntu "
17495
"Wiki Postifx</ulink> page has more information."
17496
msgstr ""
17497
17498
#: serverguide/C/mail.xml:485(title) serverguide/C/mail.xml:872(title) serverguide/C/mail.xml:988(title)
17499
msgid "Exim4"
17500
msgstr ""
17501
17502
#: serverguide/C/mail.xml:486(para)
17503
msgid ""
17504
"<application>Exim4</application> is another Message Transfer Agent (MTA) "
17505
"developed at the University of Cambridge for use on Unix systems connected "
17506
"to the Internet. Exim can be installed in place of "
17507
"<application>sendmail</application>, although the configuration of "
17508
"<application>exim</application> is quite different to that of "
17509
"<application>sendmail</application>."
17510
msgstr ""
17511
17512
#: serverguide/C/mail.xml:497(para)
17513
msgid ""
17514
"To install <application>exim4</application>, run the following command: "
17515
"<screen>\n"
17516
"<command>sudo apt-get install exim4</command>\n"
17517
"</screen>"
17518
msgstr ""
17519
17520
#: serverguide/C/mail.xml:506(para)
17521
msgid ""
17522
"To configure <application>Exim4</application>, run the following command:"
17523
msgstr ""
17524
17525
#: serverguide/C/mail.xml:510(command)
17526
msgid "sudo dpkg-reconfigure exim4-config"
17527
msgstr ""
17528
17529
#: serverguide/C/mail.xml:512(para)
17530
msgid ""
17531
"The user interface will be displayed. The user interface lets you configure "
17532
"many parameters. For example, In <application>Exim4</application> the "
17533
"configuration files are split among multiple files. If you wish to have them "
17534
"in one file you can configure accordingly in this user interface."
17535
msgstr ""
17536
17537
#: serverguide/C/mail.xml:520(para)
17538
msgid ""
17539
"All the parameters you configure in the user interface are stored in "
17540
"<filename>/etc/exim4/update-exim4.conf.conf</filename> file. If you wish to "
17541
"re-configure, either you re-run the configuration wizard or manually edit "
17542
"this file using your favorite editor. Once you configure, you can run the "
17543
"following command to generate the master configuration file:"
17544
msgstr ""
17545
17546
#: serverguide/C/mail.xml:531(command) serverguide/C/mail.xml:604(command)
17547
msgid "sudo update-exim4.conf"
17548
msgstr ""
17549
17550
#: serverguide/C/mail.xml:533(para)
17551
msgid ""
17552
"The master configuration file, is generated and it is stored in "
17553
"<filename>/var/lib/exim4/config.autogenerated</filename>."
17554
msgstr ""
17555
17556
#: serverguide/C/mail.xml:539(para)
17557
msgid ""
17558
"At any time, you should not edit the master configuration file, "
17559
"<filename>/var/lib/exim4/config.autogenerated</filename> manually. It is "
17560
"updated automatically every time you run <command>update-exim4.conf</command>"
17561
msgstr ""
17562
17563
#: serverguide/C/mail.xml:547(para)
17564
msgid ""
17565
"You can run the following command to start <application>Exim4</application> "
17566
"daemon."
17567
msgstr ""
17568
17569
#: serverguide/C/mail.xml:552(command) serverguide/C/mail.xml:994(command)
17570
msgid "sudo /etc/init.d/exim4 start"
17571
msgstr ""
17572
17573
#: serverguide/C/mail.xml:557(para)
17574
msgid ""
17575
"This section covers configuring Exim4 to use SMTP-AUTH with TLS and SASL."
17576
msgstr ""
17577
17578
#: serverguide/C/mail.xml:560(para)
17579
msgid ""
17580
"The first step is to create a certificate for use with TLS. Enter the "
17581
"following into a terminal prompt:"
17582
msgstr ""
17583
17584
#: serverguide/C/mail.xml:564(command)
17585
msgid "sudo /usr/share/doc/exim4-base/examples/exim-gencert"
17586
msgstr ""
17587
17588
#: serverguide/C/mail.xml:566(para)
17589
msgid ""
17590
"Now Exim4 needs to be configured for TLS by editing "
17591
"<filename>/etc/exim4/conf.d/main/03_exim4-config_tlsoptions</filename> add "
17592
"the following:"
17593
msgstr ""
17594
17595
#: serverguide/C/mail.xml:570(programlisting)
17596
#, no-wrap
17597
msgid ""
17598
"\n"
17599
"MAIN_TLS_ENABLE = yes\n"
17600
msgstr ""
17601
17602
#: serverguide/C/mail.xml:573(para)
17603
msgid ""
17604
"Next you need to configure <application>Exim4</application> to use the "
17605
"<application>saslauthd</application> for authentication. Edit "
17606
"<filename>/etc/exim4/conf.d/auth/30_exim4-config_examples</filename> and "
17607
"uncomment the <emphasis>plain_saslauthd_server</emphasis> and "
17608
"<emphasis>login_saslauthd_server</emphasis> sections:"
17609
msgstr ""
17610
17611
#: serverguide/C/mail.xml:578(programlisting)
17612
#, no-wrap
17613
msgid ""
17614
"\n"
17615
" plain_saslauthd_server:\n"
17616
" driver = plaintext\n"
17617
" public_name = PLAIN\n"
17618
" server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}\n"
17619
" server_set_id = $auth2\n"
17620
" server_prompts = :\n"
17621
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17622
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17623
" .endif\n"
17624
"#\n"
17625
" login_saslauthd_server:\n"
17626
" driver = plaintext\n"
17627
" public_name = LOGIN\n"
17628
" server_prompts = \"Username:: : Password::\"\n"
17629
" # don't send system passwords over unencrypted connections\n"
17630
" server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}\n"
17631
" server_set_id = $auth1\n"
17632
" .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS\n"
17633
" server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}\n"
17634
" .endif\n"
17635
msgstr ""
17636
17637
#: serverguide/C/mail.xml:600(para)
17638
msgid "Finally, update the Exim4 configuration and restart the service:"
17639
msgstr ""
17640
17641
#: serverguide/C/mail.xml:605(command)
17642
msgid "sudo /etc/init.d/exim4 restart"
17643
msgstr ""
17644
17645
#: serverguide/C/mail.xml:610(para)
17646
msgid ""
17647
"This section provides details on configuring the saslauthd to provide "
17648
"authentication for <application>Exim4</application>."
17649
msgstr ""
17650
17651
#: serverguide/C/mail.xml:613(para)
17652
msgid ""
17653
"The first step is to install the sasl2-bin package. From a terminal prompt "
17654
"enter the following:"
17655
msgstr ""
17656
17657
#: serverguide/C/mail.xml:617(command)
17658
msgid "sudo apt-get install sasl2-bin"
17659
msgstr ""
17660
17661
#: serverguide/C/mail.xml:619(para)
17662
msgid ""
17663
"To configure saslauthd edit the /etc/default/saslauthd configuration file "
17664
"and set START=no to:"
17665
msgstr ""
17666
17667
#: serverguide/C/mail.xml:622(programlisting)
17668
#, no-wrap
17669
msgid ""
17670
"\n"
17671
"START=yes\n"
17672
msgstr ""
17673
17674
#: serverguide/C/mail.xml:625(para)
17675
msgid ""
17676
"Next the <emphasis>Debian-exim</emphasis> user needs to be part of the "
17677
"<emphasis>sasl</emphasis> group in order for Exim4 to use the saslauthd "
17678
"service:"
17679
msgstr ""
17680
17681
#: serverguide/C/mail.xml:630(command)
17682
msgid "sudo adduser Debian-exim sasl"
17683
msgstr ""
17684
17685
#: serverguide/C/mail.xml:632(para)
17686
msgid "Now start the <application>saslauthd</application> service:"
17687
msgstr ""
17688
17689
#: serverguide/C/mail.xml:636(command)
17690
msgid "sudo /etc/init.d/saslauthd start"
17691
msgstr ""
17692
17693
#: serverguide/C/mail.xml:638(para)
17694
msgid ""
17695
"<application>Exim4</application> is now configured with SMTP-AUTH using TLS "
17696
"and SASL authentication."
17697
msgstr ""
17698
17699
#: serverguide/C/mail.xml:647(para)
17700
msgid ""
17701
"See <ulink url=\"http://www.exim.org/\">exim.org</ulink> for more "
17702
"information."
17703
msgstr ""
17704
17705
#: serverguide/C/mail.xml:652(para)
17706
msgid ""
17707
"There is also an <ulink url=\"http://www.uit.co.uk/content/exim-smtp-mail-"
17708
"server\">Exim4 Book</ulink> available."
17709
msgstr ""
17710
17711
#: serverguide/C/mail.xml:657(para)
17712
msgid ""
17713
"Another resource is the <ulink "
17714
"url=\"https://help.ubuntu.com/community/Exim4\">Exim4 Ubuntu Wiki </ulink> "
17715
"page."
17716
msgstr ""
17717
17718
#: serverguide/C/mail.xml:666(title)
17719
msgid "Dovecot Server"
17720
msgstr ""
17721
17722
#: serverguide/C/mail.xml:667(para)
17723
msgid ""
17724
"<application>Dovecot</application> is a Mail Delivery Agent, written with "
17725
"security primarily in mind. It supports the major mailbox formats: mbox or "
17726
"Maildir. This section explain how to set it up as an imap or pop3 server."
17727
msgstr ""
17728
17729
#: serverguide/C/mail.xml:675(para)
17730
msgid ""
17731
"To install <application>dovecot</application>, run the following command in "
17732
"the command prompt:"
17733
msgstr ""
17734
17735
#: serverguide/C/mail.xml:680(command)
17736
msgid "sudo apt-get install dovecot-imapd dovecot-pop3d"
17737
msgstr ""
17738
17739
#: serverguide/C/mail.xml:685(para)
17740
msgid ""
17741
"To configure <application>dovecot</application>, you can edit the file "
17742
"<filename>/etc/dovecot/dovecot.conf</filename>. You can choose the protocol "
17743
"you use. It could be pop3, pop3s (pop3 secure), imap and imaps (imap "
17744
"secure). A description of these protocols is beyond the scope of this guide. "
17745
"For further information, refer to the Wikipedia articles on <ulink "
17746
"url=\"http://en.wikipedia.org/wiki/POP3\">POP3</ulink> and <ulink "
17747
"url=\"http://en.wikipedia.org/wiki/Internet_Message_Access_Protocol\">IMAP</u"
17748
"link>."
17749
msgstr ""
17750
17751
#: serverguide/C/mail.xml:695(para)
17752
msgid ""
17753
"IMAPS and POP3S are more secure that the simple IMAP and POP3 because they "
17754
"use SSL encryption to connect. Once you have chosen the protocol, amend the "
17755
"following line in the file <filename>/etc/dovecot/dovecot.conf</filename>:"
17756
msgstr ""
17757
17758
#: serverguide/C/mail.xml:701(programlisting)
17759
#, no-wrap
17760
msgid ""
17761
"\n"
17762
"protocols = pop3 pop3s imap imaps\n"
17763
msgstr ""
17764
17765
#: serverguide/C/mail.xml:704(para)
17766
msgid ""
17767
"Next, choose the mailbox you would like to use. "
17768
"<application>Dovecot</application> supports <emphasis "
17769
"role=\"strong\">maildir</emphasis> and <emphasis "
17770
"role=\"strong\">mbox</emphasis> formats. These are the most commonly used "
17771
"mailbox formats. They both have their own benefits and are discussed on "
17772
"<ulink url=\"http://wiki.dovecot.org/MailboxFormat\">the Dovecot web "
17773
"site</ulink>."
17774
msgstr ""
17775
17776
#: serverguide/C/mail.xml:712(para)
17777
msgid ""
17778
"Once you have chosen your mailbox type, edit the file "
17779
"<filename>/etc/dovecot/dovecot.conf</filename> and change the following line:"
17780
msgstr ""
17781
17782
#: serverguide/C/mail.xml:717(programlisting)
17783
#, no-wrap
17784
msgid ""
17785
"\n"
17786
"mail_location = maildir:~/Maildir # (for maildir)\n"
17787
"or\n"
17788
"mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u # (for mbox)\n"
17789
msgstr ""
17790
17791
#: serverguide/C/mail.xml:723(para)
17792
msgid ""
17793
"You should configure your Mail Transport Agent (MTA) to transfer the "
17794
"incoming mail to this type of mailbox if it is different from the one you "
17795
"have configured."
17796
msgstr ""
17797
17798
#: serverguide/C/mail.xml:729(para)
17799
msgid ""
17800
"Once you have configured dovecot, restart the "
17801
"<application>dovecot</application> daemon in order to test your setup:"
17802
msgstr ""
17803
17804
#: serverguide/C/mail.xml:738(para)
17805
msgid ""
17806
"If you have enabled imap, or pop3, you can also try to log in with the "
17807
"commands <command>telnet localhost pop3</command> or <command>telnet "
17808
"localhost imap2</command>. If you see something like the following, the "
17809
"installation has been successful:"
17810
msgstr ""
17811
17812
#: serverguide/C/mail.xml:745(programlisting)
17813
#, no-wrap
17814
msgid ""
17815
"\n"
17816
"bhuvan@rainbow:~$ telnet localhost pop3\n"
17817
"Trying 127.0.0.1...\n"
17818
"Connected to localhost.localdomain.\n"
17819
"Escape character is '^]'.\n"
17820
"+OK Dovecot ready.\n"
17821
msgstr ""
17822
17823
#: serverguide/C/mail.xml:754(title)
17824
msgid "Dovecot SSL Configuration"
17825
msgstr ""
17826
17827
#: serverguide/C/mail.xml:755(para)
17828
msgid ""
17829
"To configure <application>dovecot</application> to use SSL, you can edit the "
17830
"file <filename>/etc/dovecot/dovecot.conf</filename> and amend following "
17831
"lines:"
17832
msgstr ""
17833
17834
#: serverguide/C/mail.xml:760(programlisting)
17835
#, no-wrap
17836
msgid ""
17837
"\n"
17838
"ssl_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem\n"
17839
"ssl_key_file = /etc/ssl/private/ssl-cert-snakeoil.key\n"
17840
"ssl_disable = no\n"
17841
"disable_plaintext_auth = no\n"
17842
msgstr ""
17843
17844
#: serverguide/C/mail.xml:766(para)
17845
msgid ""
17846
"You can get the SSL certificate from a Certificate Issuing Authority or you "
17847
"can create self signed SSL certificate. The latter is a good option for "
17848
"email, because SMTP clients rarely complain about \"self-signed "
17849
"certificates\". Please refer to <xref linkend=\"certificates-and-"
17850
"security\"/> for details about how to create self signed SSL certificate. "
17851
"Once you create the certificate, you will have a key file and a certificate "
17852
"file. Please copy them to the location pointed in the "
17853
"<filename>/etc/dovecot/dovecot.conf</filename> configuration file."
17854
msgstr ""
17855
17856
#: serverguide/C/mail.xml:781(title)
17857
msgid "Firewall Configuration for an Email Server"
17858
msgstr ""
17859
17860
#: serverguide/C/mail.xml:787(para)
17861
msgid "IMAP - 143"
17862
msgstr ""
17863
17864
#: serverguide/C/mail.xml:788(para)
17865
msgid "IMAPS - 993"
17866
msgstr ""
17867
17868
#: serverguide/C/mail.xml:789(para)
17869
msgid "POP3 - 110"
17870
msgstr ""
17871
17872
#: serverguide/C/mail.xml:790(para)
17873
msgid "POP3S - 995"
17874
msgstr ""
17875
17876
#: serverguide/C/mail.xml:782(para)
17877
msgid ""
17878
"To access your mail server from another computer, you must configure your "
17879
"firewall to allow connections to the server on the necessary ports. "
17880
"<placeholder-1/>"
17881
msgstr ""
17882
17883
#: serverguide/C/mail.xml:799(para)
17884
msgid ""
17885
"See the <ulink url=\"http://www.dovecot.org/\">Dovecot website</ulink> for "
17886
"more information."
17887
msgstr ""
17888
17889
#: serverguide/C/mail.xml:804(para)
17890
msgid ""
17891
"Also, the <ulink url=\"https://help.ubuntu.com/community/Dovecot\">Dovecot "
17892
"Ubuntu Wiki</ulink> page has more details."
17893
msgstr ""
17894
17895
#: serverguide/C/mail.xml:813(title) serverguide/C/mail.xml:890(title) serverguide/C/mail.xml:1113(title)
17896
msgid "Mailman"
17897
msgstr ""
17898
17899
#: serverguide/C/mail.xml:814(para)
17900
msgid ""
17901
"Mailman is an open source program for managing electronic mail discussions "
17902
"and e-newsletter lists. Many open source mailing lists (including all the "
17903
"<ulink url=\"http://lists.ubuntu.com\">Ubuntu mailing lists</ulink>) use "
17904
"Mailman as their mailing list software. It is powerful and easy to install "
17905
"and maintain."
17906
msgstr ""
17907
17908
#: serverguide/C/mail.xml:824(para)
17909
msgid ""
17910
"Mailman provides a web interface for the administrators and users, using an "
17911
"external mail server to send and receive emails. It works perfectly with the "
17912
"following mail servers:"
17913
msgstr ""
17914
17915
#: serverguide/C/mail.xml:835(application)
17916
msgid "Exim"
17917
msgstr ""
17918
17919
#: serverguide/C/mail.xml:838(application)
17920
msgid "Sendmail"
17921
msgstr ""
17922
17923
#: serverguide/C/mail.xml:841(application)
17924
msgid "Qmail"
17925
msgstr ""
17926
17927
#: serverguide/C/mail.xml:846(para)
17928
msgid ""
17929
"We will see how to install and configure Mailman with, the Apache web "
17930
"server, and either the Postfix or Exim mail server. If you wish to install "
17931
"Mailman with a different mail server, please refer to the references section."
17932
msgstr ""
17933
17934
#: serverguide/C/mail.xml:853(para)
17935
msgid ""
17936
"You only need to install one mail server and "
17937
"<application>Postfix</application> is the default Ubuntu Mail Transfer Agent."
17938
msgstr ""
17939
17940
#: serverguide/C/mail.xml:858(title) serverguide/C/mail.xml:917(title)
17941
msgid "Apache2"
17942
msgstr ""
17943
17944
#: serverguide/C/mail.xml:859(para)
17945
msgid ""
17946
"To install apache2 you refer to <ulink url=\"./web-servers.xml#http-"
17947
"installation\">HTTPD Installation</ulink> section for details."
17948
msgstr ""
17949
17950
#: serverguide/C/mail.xml:867(para)
17951
msgid ""
17952
"For instructions on installing and configuring Postfix refer to <xref "
17953
"linkend=\"postfix\"/>"
17954
msgstr ""
17955
17956
#: serverguide/C/mail.xml:873(para)
17957
msgid "To install Exim4 refer to <xref linkend=\"exim4\"/>."
17958
msgstr ""
17959
17960
#: serverguide/C/mail.xml:884(application)
17961
msgid "dc_use_split_config='true'"
17962
msgstr ""
17963
17964
#: serverguide/C/mail.xml:876(para)
17965
msgid ""
17966
"Once exim4 is installed, the configuration files are stored in the "
17967
"<filename>/etc/exim4</filename> directory. In Ubuntu, by default, the exim4 "
17968
"configuration files are split across different files. You can change this "
17969
"behavior by changing the following variable in the "
17970
"<filename>/etc/exim4/update-exim4.conf</filename> file: <placeholder-1/>"
17971
msgstr ""
17972
17973
#: serverguide/C/mail.xml:891(para)
17974
msgid ""
17975
"To install <application>Mailman</application>, run following command at a "
17976
"terminal prompt:"
17977
msgstr ""
17978
17979
#: serverguide/C/mail.xml:895(command)
17980
msgid "sudo apt-get install mailman"
17981
msgstr ""
17982
17983
#: serverguide/C/mail.xml:897(para)
17984
msgid ""
17985
"It copies the installation files in "
17986
"<application>/var/lib/mailman</application> directory. It installs the CGI "
17987
"scripts in <application>/usr/lib/cgi-bin/mailman</application> directory. It "
17988
"creates <emphasis>list</emphasis> linux user. It creates the "
17989
"<emphasis>list</emphasis> linux group. The mailman process will be owned by "
17990
"this user."
17991
msgstr ""
17992
17993
#: serverguide/C/mail.xml:909(para)
17994
msgid ""
17995
"This section assumes you have successfully installed "
17996
"<application>mailman</application>, <application>apache2</application>, and "
17997
"<application>postfix</application> or <application>exim4</application>. Now "
17998
"you just need to configure them."
17999
msgstr ""
18000
18001
#: serverguide/C/mail.xml:918(para)
18002
msgid ""
18003
"An example Apache configuration file comes with "
18004
"<application>Mailman</application> and is placed in "
18005
"<filename>/etc/mailman/apache.conf</filename>. In order for Apache to use "
18006
"the config file it needs to be copied to <filename>/etc/apache2/sites-"
18007
"available</filename>:"
18008
msgstr ""
18009
18010
#: serverguide/C/mail.xml:924(command)
18011
msgid ""
18012
"sudo cp /etc/mailman/apache.conf /etc/apache2/sites-available/mailman.conf"
18013
msgstr ""
18014
18015
#: serverguide/C/mail.xml:926(para)
18016
msgid ""
18017
"This will setup a new Apache <emphasis>VirtualHost</emphasis> for the "
18018
"Mailman administration site. Now enable the new configuration and restart "
18019
"Apache:"
18020
msgstr ""
18021
18022
#: serverguide/C/mail.xml:931(command)
18023
msgid "sudo a2ensite mailman.conf"
18024
msgstr ""
18025
18026
#: serverguide/C/mail.xml:934(para)
18027
msgid ""
18028
"Mailman uses apache2 to render its CGI scripts. The mailman CGI scripts are "
18029
"installed in the <application>/usr/lib/cgi-bin/mailman</application> "
18030
"directory. So, the mailman url will be http://hostname/cgi-bin/mailman/. You "
18031
"can make changes to the <filename>/etc/apache2/sites-"
18032
"available/mailman.conf</filename> file if you wish to change this behavior."
18033
msgstr ""
18034
18035
#: serverguide/C/mail.xml:945(para)
18036
msgid ""
18037
"For <application>Postfix</application> integration, we will associate the "
18038
"domain lists.example.com with the mailing lists. Please replace "
18039
"<emphasis>lists.example.com</emphasis> with the domain of your choosing."
18040
msgstr ""
18041
18042
#: serverguide/C/mail.xml:949(para)
18043
msgid ""
18044
"You can use the postconf command to add the necessary configuration to "
18045
"<filename>/etc/postfix/main.cf</filename>:"
18046
msgstr ""
18047
18048
#: serverguide/C/mail.xml:953(command)
18049
msgid "sudo postconf -e 'relay_domains = lists.example.com'"
18050
msgstr ""
18051
18052
#: serverguide/C/mail.xml:954(command)
18053
msgid "sudo postconf -e 'transport_maps = hash:/etc/postfix/transport'"
18054
msgstr ""
18055
18056
#: serverguide/C/mail.xml:955(command)
18057
msgid "sudo postconf -e 'mailman_destination_recipient_limit = 1'"
18058
msgstr ""
18059
18060
#: serverguide/C/mail.xml:957(para)
18061
msgid ""
18062
"In <filename>/etc/postfix/master.cf</filename> double check that you have "
18063
"the following transport:"
18064
msgstr ""
18065
18066
#: serverguide/C/mail.xml:960(programlisting)
18067
#, no-wrap
18068
msgid ""
18069
"\n"
18070
"mailman unix - n n - - pipe\n"
18071
" flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py\n"
18072
" ${nexthop} ${user}\n"
18073
msgstr ""
18074
18075
#: serverguide/C/mail.xml:965(para)
18076
msgid ""
18077
"It calls the <emphasis>postfix-to-mailman.py</emphasis> script when a mail "
18078
"is delivered to a list."
18079
msgstr ""
18080
18081
#: serverguide/C/mail.xml:968(para)
18082
msgid ""
18083
"Associate the domain lists.example.com to the Mailman transport with the "
18084
"transport map. Edit the file <filename>/etc/postfix/transport</filename>:"
18085
msgstr ""
18086
18087
#: serverguide/C/mail.xml:971(programlisting)
18088
#, no-wrap
18089
msgid ""
18090
"\n"
18091
"lists.example.com mailman:\n"
18092
msgstr ""
18093
18094
#: serverguide/C/mail.xml:974(para)
18095
msgid ""
18096
"Now have <application>Postfix</application> build the transport map by "
18097
"entering the following from a terminal prompt:"
18098
msgstr ""
18099
18100
#: serverguide/C/mail.xml:978(command)
18101
msgid "sudo postmap -v /etc/postfix/transport"
18102
msgstr ""
18103
18104
#: serverguide/C/mail.xml:980(para)
18105
msgid "Then restart Postfix to enable the new configurations:"
18106
msgstr ""
18107
18108
#: serverguide/C/mail.xml:989(para)
18109
msgid ""
18110
"Once Exim4 is installed, you can start the Exim server using the following "
18111
"command from a terminal prompt:"
18112
msgstr ""
18113
18114
#: serverguide/C/mail.xml:1005(para) serverguide/C/mail.xml:1020(title)
18115
msgid "Main"
18116
msgstr ""
18117
18118
#: serverguide/C/mail.xml:1008(para) serverguide/C/mail.xml:1060(title)
18119
msgid "Transport"
18120
msgstr ""
18121
18122
#: serverguide/C/mail.xml:1011(para) serverguide/C/mail.xml:1083(title)
18123
msgid "Router"
18124
msgstr ""
18125
18126
#: serverguide/C/mail.xml:996(para)
18127
msgid ""
18128
"In order to make mailman work with Exim4, you need to configure Exim4. As "
18129
"mentioned earlier, by default, Exim4 uses multiple configuration files of "
18130
"different types. For details, please refer to the <ulink "
18131
"url=\"http://www.exim.org\">Exim</ulink> web site. To run mailman, we should "
18132
"add new a configuration file to the following configuration types: "
18133
"<placeholder-1/> Exim creates a master configuration file by sorting all "
18134
"these mini configuration files. So, the order of these configuration files "
18135
"is very important."
18136
msgstr ""
18137
18138
#: serverguide/C/mail.xml:1027(programlisting)
18139
#, no-wrap
18140
msgid ""
18141
"\n"
18142
"# start\n"
18143
"# Home dir for your Mailman installation -- aka Mailman's prefix\n"
18144
"# directory.\n"
18145
"# On Ubuntu this should be \"/var/lib/mailman\"\n"
18146
"# This is normally the same as ~mailman\n"
18147
"MM_HOME=/var/lib/mailman\n"
18148
"#\n"
18149
"# User and group for Mailman, should match your --with-mail-gid\n"
18150
"# switch to Mailman's configure script. Value is normally \"mailman\"\n"
18151
"MM_UID=list\n"
18152
"MM_GID=list\n"
18153
"#\n"
18154
"# Domains that your lists are in - colon separated list\n"
18155
"# you may wish to add these into local_domains as well\n"
18156
"domainlist mm_domains=hostname.com\n"
18157
"#\n"
18158
"# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
18159
"#\n"
18160
"# These values are derived from the ones above and should not need\n"
18161
"# editing unless you have munged your mailman installation\n"
18162
"#\n"
18163
"# The path of the Mailman mail wrapper script\n"
18164
"MM_WRAP=MM_HOME/mail/mailman\n"
18165
"#\n"
18166
"# The path of the list config file (used as a required file when\n"
18167
"# verifying list addresses)\n"
18168
"MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck\n"
18169
"# end\n"
18170
msgstr ""
18171
18172
#: serverguide/C/mail.xml:1021(para)
18173
msgid ""
18174
"All the configuration files belonging to the main type are stored in the "
18175
"<filename>/etc/exim4/conf.d/main/</filename> directory. You can add the "
18176
"following content to a new file, named <filename>04_exim4-"
18177
"config_mailman</filename>: <placeholder-1/>"
18178
msgstr ""
18179
18180
#: serverguide/C/mail.xml:1067(programlisting)
18181
#, no-wrap
18182
msgid ""
18183
"\n"
18184
" mailman_transport:\n"
18185
" driver = pipe\n"
18186
" command = MM_WRAP \\\n"
18187
" '${if def:local_part_suffix \\\n"
18188
" {${sg{$local_part_suffix}{-(\\\\w+)(\\\\+.*)?}{\\$1}}} "
18189
"\\\n"
18190
" {post}}' \\\n"
18191
" $local_part\n"
18192
" current_directory = MM_HOME\n"
18193
" home_directory = MM_HOME\n"
18194
" user = MM_UID\n"
18195
" group = MM_GID\n"
18196
msgstr ""
18197
18198
#: serverguide/C/mail.xml:1061(para)
18199
msgid ""
18200
"All the configuration files belonging to transport type are stored in the "
18201
"<filename>/etc/exim4/conf.d/transport/</filename> directory. You can add the "
18202
"following content to a new file named <filename> 40_exim4-"
18203
"config_mailman</filename>: <placeholder-1/>"
18204
msgstr ""
18205
18206
#: serverguide/C/mail.xml:1088(programlisting)
18207
#, no-wrap
18208
msgid ""
18209
"\n"
18210
" mailman_router:\n"
18211
" driver = accept\n"
18212
" require_files = MM_HOME/lists/$local_part/config.pck\n"
18213
" local_part_suffix_optional\n"
18214
" local_part_suffix = -bounces : -bounces+* : \\\n"
18215
" -confirm+* : -join : -leave : \\\n"
18216
" -owner : -request : -admin\n"
18217
" transport = mailman_transport\n"
18218
msgstr ""
18219
18220
#: serverguide/C/mail.xml:1084(para)
18221
msgid ""
18222
"All the configuration files belonging to router type are stored in the "
18223
"<filename>/etc/exim4/conf.d/router/</filename> directory. You can add the "
18224
"following content in to a new file named <filename>101_exim4-"
18225
"config_mailman</filename>: <placeholder-1/>"
18226
msgstr ""
18227
18228
#: serverguide/C/mail.xml:1101(para)
18229
msgid ""
18230
"The order of main and transport configuration files can be in any order. "
18231
"But, the order of router configuration files must be the same. This "
18232
"particular file must appear before the <application>200_exim4-"
18233
"config_primary</application> file. These two configuration files contain "
18234
"same type of information. The first file takes the precedence. For more "
18235
"details, please refer to the references section."
18236
msgstr ""
18237
18238
#: serverguide/C/mail.xml:1114(para)
18239
msgid ""
18240
"Once mailman is installed, you can run it using the following command:"
18241
msgstr ""
18242
18243
#: serverguide/C/mail.xml:1118(command)
18244
msgid "sudo /etc/init.d/mailman start"
18245
msgstr ""
18246
18247
#: serverguide/C/mail.xml:1120(para)
18248
msgid ""
18249
"Once mailman is installed, you should create the default mailing list. Run "
18250
"the following command to create the mailing list:"
18251
msgstr ""
18252
18253
#: serverguide/C/mail.xml:1126(command)
18254
msgid "sudo /usr/sbin/newlist mailman"
18255
msgstr ""
18256
18257
#: serverguide/C/mail.xml:1129(programlisting)
18258
#, no-wrap
18259
msgid ""
18260
"\n"
18261
" Enter the email address of the person running the list: bhuvan at "
18262
"ubuntu.com\n"
18263
" Initial mailman password:\n"
18264
" To finish creating your mailing list, you must edit your "
18265
"<filename>/etc/aliases</filename> (or\n"
18266
" equivalent) file by adding the following lines, and possibly running the\n"
18267
" `newaliases' program:\n"
18268
"\n"
18269
" ## mailman mailing list\n"
18270
" mailman: \"|/var/lib/mailman/mail/mailman post mailman\"\n"
18271
" mailman-admin: \"|/var/lib/mailman/mail/mailman admin mailman\"\n"
18272
" mailman-bounces: \"|/var/lib/mailman/mail/mailman bounces mailman\"\n"
18273
" mailman-confirm: \"|/var/lib/mailman/mail/mailman confirm mailman\"\n"
18274
" mailman-join: \"|/var/lib/mailman/mail/mailman join mailman\"\n"
18275
" mailman-leave: \"|/var/lib/mailman/mail/mailman leave mailman\"\n"
18276
" mailman-owner: \"|/var/lib/mailman/mail/mailman owner mailman\"\n"
18277
" mailman-request: \"|/var/lib/mailman/mail/mailman request mailman\"\n"
18278
" mailman-subscribe: \"|/var/lib/mailman/mail/mailman subscribe "
18279
"mailman\"\n"
18280
" mailman-unsubscribe: \"|/var/lib/mailman/mail/mailman unsubscribe "
18281
"mailman\"\n"
18282
"\n"
18283
" Hit enter to notify mailman owner...\n"
18284
"\n"
18285
" # \n"
18286
msgstr ""
18287
18288
#: serverguide/C/mail.xml:1152(para)
18289
msgid ""
18290
"We have configured either Postfix or Exim4 to recognize all emails from "
18291
"mailman. So, it is not mandatory to make any new entries in "
18292
"<filename>/etc/aliases</filename>. If you have made any changes to the "
18293
"configuration files, please ensure that you restart those services before "
18294
"continuing to next section."
18295
msgstr ""
18296
18297
#: serverguide/C/mail.xml:1160(para)
18298
msgid ""
18299
"The Exim4 does not use the above aliases to forward mails to Mailman, as it "
18300
"uses a <emphasis>discover</emphasis> approach. To suppress the aliases while "
18301
"creating the list, you can add <emphasis>MTA=None</emphasis> line in Mailman "
18302
"configuration file, <filename>/etc/mailman/mm_cfg.py</filename>."
18303
msgstr ""
18304
18305
#: serverguide/C/mail.xml:1171(title)
18306
msgid "Administration"
18307
msgstr ""
18308
18309
#: serverguide/C/mail.xml:1172(para)
18310
msgid ""
18311
"We assume you have a default installation. The mailman cgi scripts are still "
18312
"in the <application>/usr/lib/cgi-bin/mailman/</application> directory. "
18313
"Mailman provides a web based administration facility. To access this page, "
18314
"point your browser to the following url:"
18315
msgstr ""
18316
18317
#: serverguide/C/mail.xml:1180(para)
18318
msgid "http://hostname/cgi-bin/mailman/admin"
18319
msgstr ""
18320
18321
#: serverguide/C/mail.xml:1184(para)
18322
msgid ""
18323
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18324
"screen. If you click the mailing list name, it will ask for your "
18325
"authentication password. If you enter the correct password, you will be able "
18326
"to change administrative settings of this mailing list. You can create a new "
18327
"mailing list using the command line utility "
18328
"(<command>/usr/sbin/newlist</command>). Alternatively, you can create a new "
18329
"mailing list using the web interface."
18330
msgstr ""
18331
18332
#: serverguide/C/mail.xml:1197(title)
18333
msgid "Users"
18334
msgstr ""
18335
18336
#: serverguide/C/mail.xml:1198(para)
18337
msgid ""
18338
"Mailman provides a web based interface for users. To access this page, point "
18339
"your browser to the following url:"
18340
msgstr ""
18341
18342
#: serverguide/C/mail.xml:1203(para)
18343
msgid "http://hostname/cgi-bin/mailman/listinfo"
18344
msgstr ""
18345
18346
#: serverguide/C/mail.xml:1207(para)
18347
msgid ""
18348
"The default mailing list, <emphasis>mailman</emphasis>, will appear in this "
18349
"screen. If you click the mailing list name, it will display the subscription "
18350
"form. You can enter your email address, name (optional), and password to "
18351
"subscribe. An email invitation will be sent to you. You can follow the "
18352
"instructions in the email to subscribe."
18353
msgstr ""
18354
18355
#: serverguide/C/mail.xml:1219(ulink)
18356
msgid "GNU Mailman - Installation Manual"
18357
msgstr ""
18358
18359
#: serverguide/C/mail.xml:1223(ulink)
18360
msgid "HOWTO - Using Exim 4 and Mailman 2.1 together"
18361
msgstr ""
18362
18363
#: serverguide/C/mail.xml:1226(para)
18364
msgid ""
18365
"Also, see the <ulink "
18366
"url=\"https://help.ubuntu.com/community/Mailman\">Mailman Ubuntu "
18367
"Wiki</ulink> page."
18368
msgstr ""
18369
18370
#: serverguide/C/mail.xml:1232(title)
18371
msgid "Mail Filtering"
18372
msgstr ""
18373
18374
#: serverguide/C/mail.xml:1233(para)
18375
msgid ""
18376
"One of the largest issues with email today is the problem of Unsolicited "
18377
"Bulk Email (UBE). Also known as SPAM, such messages may also carry viruses "
18378
"and other forms of malware. According to some reports these messages make up "
18379
"the bulk of all email traffic on the Internet."
18380
msgstr ""
18381
18382
#: serverguide/C/mail.xml:1238(para)
18383
msgid ""
18384
"This section will cover integrating <application>Amavisd-new</application>, "
18385
"<application>Spamassassin</application>, and "
18386
"<application>ClamAV</application> with the "
18387
"<application>Postfix</application> Mail Transport Agent (MTA). "
18388
"<application>Postfix</application> can also check email validity by passing "
18389
"it through external content filters. These filters can sometimes determine "
18390
"if a message is spam without needing to process it with more resource "
18391
"intensive applications. Two common filters are <application>dkim-"
18392
"filter</application> and <application>python-policyd-spf</application>."
18393
msgstr ""
18394
18395
#: serverguide/C/mail.xml:1248(para)
18396
msgid ""
18397
"<application>Amavisd-new</application> is a wrapper program that can call "
18398
"any number of content filtering programs for spam detection, antivirus, etc."
18399
msgstr ""
18400
18401
#: serverguide/C/mail.xml:1254(para)
18402
msgid ""
18403
"<application>Spamassassin</application> uses a variety of mechanisms to "
18404
"filter email based on the message content."
18405
msgstr ""
18406
18407
#: serverguide/C/mail.xml:1259(para)
18408
msgid ""
18409
"<application>ClamAV</application> is an open source antivirus application."
18410
msgstr ""
18411
18412
#: serverguide/C/mail.xml:1264(para)
18413
msgid ""
18414
"<application>dkim-filter</application> implements a Sendmail Mail Filter "
18415
"(Milter) for the DomainKeys Identified Mail (DKIM) standard."
18416
msgstr ""
18417
18418
#: serverguide/C/mail.xml:1270(para)
18419
msgid ""
18420
"<application>python-policyd-spf</application> enables Sender Policy "
18421
"Framework (SPF) checking with <application>Postfix</application>."
18422
msgstr ""
18423
18424
#: serverguide/C/mail.xml:1275(para)
18425
msgid "This is how the pieces fit together:"
18426
msgstr ""
18427
18428
#: serverguide/C/mail.xml:1280(para)
18429
msgid "An email message is accepted by <application>Postfix</application>."
18430
msgstr ""
18431
18432
#: serverguide/C/mail.xml:1285(para)
18433
msgid ""
18434
"The message is passed through any external filters <application>dkim-"
18435
"filter</application> and <application>python-policyd-spf</application> in "
18436
"this case."
18437
msgstr ""
18438
18439
#: serverguide/C/mail.xml:1291(para)
18440
msgid "<application>Amavisd-new</application> then processes the message."
18441
msgstr ""
18442
18443
#: serverguide/C/mail.xml:1296(para)
18444
msgid ""
18445
"<application>ClamAV</application> is used to scan the message. If the "
18446
"message contains a virus <application>Postfix</application> will reject the "
18447
"message."
18448
msgstr ""
18449
18450
#: serverguide/C/mail.xml:1302(para)
18451
msgid ""
18452
"Clean messages will then be analyzed by "
18453
"<application>Spamassassin</application> to find out if the message is spam. "
18454
"<application>Spamassassin</application> will then add X-Header lines "
18455
"allowing <application>Amavisd-new</application> to further manipulate the "
18456
"message."
18457
msgstr ""
18458
18459
#: serverguide/C/mail.xml:1309(para)
18460
msgid ""
18461
"For example, if a message has a Spam score of over fifty the message could "
18462
"be automatically dropped from the queue without the recipient ever having to "
18463
"be bothered. Another, way to handle flagged messages is to deliver them to "
18464
"the Mail User Agent (MUA) allowing the user to deal with the message as they "
18465
"see fit."
18466
msgstr ""
18467
18468
#: serverguide/C/mail.xml:1316(para)
18469
msgid ""
18470
"See <xref linkend=\"postfix\"/> for instructions on installing and "
18471
"configuring Postfix."
18472
msgstr ""
18473
18474
#: serverguide/C/mail.xml:1319(para)
18475
msgid ""
18476
"To install the rest of the applications enter the following from a terminal "
18477
"prompt:"
18478
msgstr ""
18479
18480
#: serverguide/C/mail.xml:1323(command)
18481
msgid "sudo apt-get install amavisd-new spamassassin clamav-daemon"
18482
msgstr ""
18483
18484
#: serverguide/C/mail.xml:1324(command)
18485
msgid "sudo apt-get install dkim-filter python-policyd-spf"
18486
msgstr ""
18487
18488
#: serverguide/C/mail.xml:1326(para)
18489
msgid ""
18490
"There are some optional packages that integrate with "
18491
"<application>Spamassassin</application> for better spam detection:"
18492
msgstr ""
18493
18494
#: serverguide/C/mail.xml:1330(command)
18495
msgid "sudo apt-get install pyzor razor"
18496
msgstr ""
18497
18498
#: serverguide/C/mail.xml:1332(para)
18499
msgid ""
18500
"Along with the main filtering applications compression utilities are needed "
18501
"to process some email attachments:"
18502
msgstr ""
18503
18504
#: serverguide/C/mail.xml:1336(command)
18505
msgid ""
18506
"sudo apt-get install arj cabextract cpio lha nomarch pax rar unrar unzip zip"
18507
msgstr ""
18508
18509
#: serverguide/C/mail.xml:1339(para)
18510
msgid ""
18511
"If some packages are not found, check that the "
18512
"<emphasis>multiverse</emphasis> repository is enabled in "
18513
"<filename>/etc/apt/sources.list</filename>"
18514
msgstr ""
18515
18516
#: serverguide/C/mail.xml:1340(para)
18517
msgid ""
18518
"If you make changes to the file, be sure to run <command>sudo apt-get "
18519
"update</command> before trying to install again."
18520
msgstr ""
18521
18522
#: serverguide/C/mail.xml:1345(para)
18523
msgid "Now configure everything to work together and filter email."
18524
msgstr ""
18525
18526
#: serverguide/C/mail.xml:1349(title)
18527
msgid "ClamAV"
18528
msgstr ""
18529
18530
#: serverguide/C/mail.xml:1350(para)
18531
msgid ""
18532
"The default behaviour of <application>ClamAV</application> will fit our "
18533
"needs. For more ClamAV configuration options, check the configuration files "
18534
"in <filename>/etc/clamav</filename>."
18535
msgstr ""
18536
18537
#: serverguide/C/mail.xml:1355(para)
18538
msgid ""
18539
"Add the <emphasis>clamav</emphasis> user to the <emphasis>amavis</emphasis> "
18540
"group in order for <application>Amavisd-new</application> to have the "
18541
"appropriate access to scan files:"
18542
msgstr ""
18543
18544
#: serverguide/C/mail.xml:1360(command)
18545
msgid "sudo adduser clamav amavis"
18546
msgstr ""
18547
18548
#: serverguide/C/mail.xml:1364(title)
18549
msgid "Spamassassin"
18550
msgstr ""
18551
18552
#: serverguide/C/mail.xml:1365(para)
18553
msgid ""
18554
"Spamassassin automatically detects optional components and will use them if "
18555
"they are present. This means that there is no need to configure "
18556
"<application>pyzor</application> and <application>razor</application>."
18557
msgstr ""
18558
18559
#: serverguide/C/mail.xml:1369(para)
18560
msgid ""
18561
"Edit <filename>/etc/default/spamassassin</filename> to activate the "
18562
"<application>Spamassassin</application> daemon. Change "
18563
"<emphasis>ENABLED=0</emphasis> to:"
18564
msgstr ""
18565
18566
#: serverguide/C/mail.xml:1373(programlisting)
18567
#, no-wrap
18568
msgid ""
18569
"\n"
18570
"ENABLED=1\n"
18571
msgstr ""
18572
18573
#: serverguide/C/mail.xml:1376(para)
18574
msgid "Now start the daemon:"
18575
msgstr ""
18576
18577
#: serverguide/C/mail.xml:1380(command)
18578
msgid "sudo /etc/init.d/spamassassin start"
18579
msgstr ""
18580
18581
#: serverguide/C/mail.xml:1384(title)
18582
msgid "Amavisd-new"
18583
msgstr ""
18584
18585
#: serverguide/C/mail.xml:1385(para)
18586
msgid ""
18587
"First activate spam and antivirus detection in <application>Amavisd-"
18588
"new</application> by editing <filename>/etc/amavis/conf.d/15-"
18589
"content_filter_mode</filename>:"
18590
msgstr ""
18591
18592
#: serverguide/C/mail.xml:1389(programlisting)
18593
#, no-wrap
18594
msgid ""
18595
"\n"
18596
"use strict;\n"
18597
"\n"
18598
"# You can modify this file to re-enable SPAM checking through spamassassin\n"
18599
"# and to re-enable antivirus checking.\n"
18600
"\n"
18601
"#\n"
18602
"# Default antivirus checking mode\n"
18603
"# Uncomment the two lines below to enable it\n"
18604
"#\n"
18605
"\n"
18606
"@bypass_virus_checks_maps = (\n"
18607
" \\%bypass_virus_checks, \\@bypass_virus_checks_acl, \\"
18608
"$bypass_virus_checks_re);\n"
18609
"\n"
18610
"\n"
18611
"#\n"
18612
"# Default SPAM checking mode\n"
18613
"# Uncomment the two lines below to enable it\n"
18614
"#\n"
18615
"\n"
18616
"@bypass_spam_checks_maps = (\n"
18617
" \\%bypass_spam_checks, \\@bypass_spam_checks_acl, \\"
18618
"$bypass_spam_checks_re);\n"
18619
"\n"
18620
"1; # insure a defined return\n"
18621
msgstr ""
18622
18623
#: serverguide/C/mail.xml:1414(para)
18624
msgid ""
18625
"Bouncing spam can be a bad idea as the return address is often faked. "
18626
"Consider editing <filename>/etc/amavis/conf.d/20-debian_defaults</filename> "
18627
"to set <emphasis>$final_spam_destiny</emphasis> to D_DISCARD rather than "
18628
"D_BOUNCE, as follows:"
18629
msgstr ""
18630
18631
#: serverguide/C/mail.xml:1420(programlisting)
18632
#, no-wrap
18633
msgid ""
18634
"\n"
18635
"$final_spam_destiny = D_DISCARD;\n"
18636
msgstr ""
18637
18638
#: serverguide/C/mail.xml:1424(para)
18639
msgid ""
18640
"Additionally, you may want to adjust the following options to flag more "
18641
"messages as spam:"
18642
msgstr ""
18643
18644
#: serverguide/C/mail.xml:1428(programlisting)
18645
#, no-wrap
18646
msgid ""
18647
"\n"
18648
"$sa_tag_level_deflt = -999; # add spam info headers if at, or above that "
18649
"level\n"
18650
"$sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level\n"
18651
"$sa_kill_level_deflt = 21.0; # triggers spam evasive actions\n"
18652
"$sa_dsn_cutoff_level = 4; # spam level beyond which a DSN is not sent\n"
18653
msgstr ""
18654
18655
#: serverguide/C/mail.xml:1435(para)
18656
msgid ""
18657
"If the server's <emphasis>hostname</emphasis> is different from the domain's "
18658
"MX record you may need to manually set the <emphasis>$myhostname</emphasis> "
18659
"option. Also, if the server receives mail for multiple domains the "
18660
"<emphasis>@local_domains_acl</emphasis> option will need to be customized. "
18661
"Edit the <filename>/etc/amavis/conf.d/50-user</filename> file:"
18662
msgstr ""
18663
18664
#: serverguide/C/mail.xml:1442(programlisting)
18665
#, no-wrap
18666
msgid ""
18667
"\n"
18668
"$myhostname = 'mail.example.com';\n"
18669
"@local_domains_acl = ( \"example.com\", \"example.org\" );\n"
18670
msgstr ""
18671
18672
#: serverguide/C/mail.xml:1447(para)
18673
msgid ""
18674
"After configuration <application>Amavisd-new</application> needs to be "
18675
"restarted:"
18676
msgstr ""
18677
18678
#: serverguide/C/mail.xml:1451(command) serverguide/C/mail.xml:1497(command)
18679
msgid "sudo /etc/init.d/amavis restart"
18680
msgstr ""
18681
18682
#: serverguide/C/mail.xml:1454(title)
18683
msgid "DKIM Whitelist"
18684
msgstr ""
18685
18686
#: serverguide/C/mail.xml:1456(para)
18687
msgid ""
18688
"<application>Amavisd-new</application> can be configured to automatically "
18689
"<emphasis>Whitelist</emphasis> addresses from domains with valid Domain "
18690
"Keys. There are some pre-configured domains in the "
18691
"<filename>/etc/amavis/conf.d/40-policy_banks</filename>."
18692
msgstr ""
18693
18694
#: serverguide/C/mail.xml:1462(para)
18695
msgid "There are multiple ways to configure the Whitelist for a domain:"
18696
msgstr ""
18697
18698
#: serverguide/C/mail.xml:1468(para)
18699
msgid ""
18700
"<emphasis>'example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18701
"address from the \"example.com\" domain."
18702
msgstr ""
18703
18704
#: serverguide/C/mail.xml:1473(para)
18705
msgid ""
18706
"<emphasis>'.example.com' => 'WHITELIST',</emphasis>: will whitelist any "
18707
"address from any <emphasis>subdomains</emphasis> of \"example.com\" that "
18708
"have a valid signature."
18709
msgstr ""
18710
18711
#: serverguide/C/mail.xml:1479(para)
18712
msgid ""
18713
"<emphasis>'.example.com/@example.com' => 'WHITELIST',</emphasis>: will "
18714
"whitelist subdomains of \"example.com\" that use the signature of <emphasis "
18715
"role=\"italic\">example.com</emphasis> the parent domain."
18716
msgstr ""
18717
18718
#: serverguide/C/mail.xml:1485(para)
18719
msgid ""
18720
"<emphasis>'./@example.com' => 'WHITELIST',</emphasis>: adds addresses "
18721
"that have a valid signature from \"example.com\". This is usually used for "
18722
"discussion groups that sign thier messages."
18723
msgstr ""
18724
18725
#: serverguide/C/mail.xml:1492(para)
18726
msgid ""
18727
"A domain can also have multiple Whitelist configurations. After, editing the "
18728
"file restart <application>amaisd-new</application>:"
18729
msgstr ""
18730
18731
#: serverguide/C/mail.xml:1501(para)
18732
msgid ""
18733
"In this context, once a domain has been added to the Whitelist the message "
18734
"will not receive any anti-virus or spam filtering. This may or may not be "
18735
"the intended behavior you wish for a domain."
18736
msgstr ""
18737
18738
#: serverguide/C/mail.xml:1511(para)
18739
msgid ""
18740
"For <application>Postfix</application> integration, enter the following from "
18741
"a terminal prompt:"
18742
msgstr ""
18743
18744
#: serverguide/C/mail.xml:1515(command)
18745
msgid "sudo postconf -e 'content_filter = smtp-amavis:[127.0.0.1]:10024'"
18746
msgstr ""
18747
18748
#: serverguide/C/mail.xml:1517(para)
18749
msgid ""
18750
"Next edit <filename>/etc/postfix/master.cf</filename> and add the following "
18751
"to the end of the file:"
18752
msgstr ""
18753
18754
#: serverguide/C/mail.xml:1520(programlisting)
18755
#, no-wrap
18756
msgid ""
18757
"\n"
18758
"smtp-amavis unix - - - - 2 smtp\n"
18759
" -o smtp_data_done_timeout=1200\n"
18760
" -o smtp_send_xforward_command=yes\n"
18761
" -o disable_dns_lookups=yes\n"
18762
" -o max_use=20\n"
18763
"\n"
18764
"127.0.0.1:10025 inet n - - - - smtpd\n"
18765
" -o content_filter=\n"
18766
" -o local_recipient_maps=\n"
18767
" -o relay_recipient_maps=\n"
18768
" -o smtpd_restriction_classes=\n"
18769
" -o smtpd_delay_reject=no\n"
18770
" -o smtpd_client_restrictions=permit_mynetworks,reject\n"
18771
" -o smtpd_helo_restrictions=\n"
18772
" -o smtpd_sender_restrictions=\n"
18773
" -o smtpd_recipient_restrictions=permit_mynetworks,reject\n"
18774
" -o smtpd_data_restrictions=reject_unauth_pipelining\n"
18775
" -o smtpd_end_of_data_restrictions=\n"
18776
" -o mynetworks=127.0.0.0/8\n"
18777
" -o smtpd_error_sleep_time=0\n"
18778
" -o smtpd_soft_error_limit=1001\n"
18779
" -o smtpd_hard_error_limit=1000\n"
18780
" -o smtpd_client_connection_count_limit=0\n"
18781
" -o smtpd_client_connection_rate_limit=0\n"
18782
" -o "
18783
"receive_override_options=no_header_body_checks,no_unknown_recipient_checks\n"
18784
msgstr ""
18785
18786
#: serverguide/C/mail.xml:1547(para)
18787
msgid ""
18788
"Also add the following two lines immediately below the "
18789
"<emphasis>\"pickup\"</emphasis> transport service:"
18790
msgstr ""
18791
18792
#: serverguide/C/mail.xml:1550(programlisting)
18793
#, no-wrap
18794
msgid ""
18795
"\n"
18796
" -o content_filter=\n"
18797
" -o receive_override_options=no_header_body_checks\n"
18798
msgstr ""
18799
18800
#: serverguide/C/mail.xml:1554(para)
18801
msgid ""
18802
"This will prevent messages that are generated to report on spam from being "
18803
"classified as spam."
18804
msgstr ""
18805
18806
#: serverguide/C/mail.xml:1557(para)
18807
msgid "Now restart <application>Postfix</application>:"
18808
msgstr ""
18809
18810
#: serverguide/C/mail.xml:1563(para)
18811
msgid "Content filtering with spam and virus detection is now enabled."
18812
msgstr ""
18813
18814
#: serverguide/C/mail.xml:1570(para)
18815
msgid ""
18816
"First, test that the <application>Amavisd-new</application> SMTP is "
18817
"listening:"
18818
msgstr ""
18819
18820
#: serverguide/C/mail.xml:1573(programlisting)
18821
#, no-wrap
18822
msgid ""
18823
"\n"
18824
"telnet localhost 10024\n"
18825
"Trying 127.0.0.1...\n"
18826
"Connected to localhost.\n"
18827
"Escape character is '^]'.\n"
18828
"220 [127.0.0.1] ESMTP amavisd-new service ready\n"
18829
"^]\n"
18830
msgstr ""
18831
18832
#: serverguide/C/mail.xml:1581(para)
18833
msgid ""
18834
"In the Header of messages that go through the content filter you should see:"
18835
msgstr ""
18836
18837
#: serverguide/C/mail.xml:1584(programlisting)
18838
#, no-wrap
18839
msgid ""
18840
"\n"
18841
"X-Spam-Level: \n"
18842
"X-Virus-Scanned: Debian amavisd-new at example.com\n"
18843
"X-Spam-Status: No, hits=-2.3 tagged_above=-1000.0 required=5.0 tests=AWL, "
18844
"BAYES_00\n"
18845
"X-Spam-Level: \n"
18846
msgstr ""
18847
18848
#: serverguide/C/mail.xml:1591(para)
18849
msgid ""
18850
"Your output will vary, but the important thing is that there are <emphasis>X-"
18851
"Virus-Scanned</emphasis> and <emphasis>X-Spam-Status</emphasis> entries."
18852
msgstr ""
18853
18854
#: serverguide/C/mail.xml:1599(para)
18855
msgid ""
18856
"The best way to figure out why something is going wrong is to check the log "
18857
"files."
18858
msgstr ""
18859
18860
#: serverguide/C/mail.xml:1604(para)
18861
msgid ""
18862
"For instructions on <application>Postfix</application> logging see the <xref "
18863
"linkend=\"postfix-troubleshooting\"/> section."
18864
msgstr ""
18865
18866
#: serverguide/C/mail.xml:1610(para)
18867
msgid ""
18868
"<application>Amavisd-new</application> uses "
18869
"<application>Syslog</application> to send messages to "
18870
"<filename>/var/log/mail.log</filename>. The amount of detail can be "
18871
"increased by adding the <emphasis>$log_level</emphasis> option to "
18872
"<filename>/etc/amavis/conf.d/50-user</filename>, and setting the value from "
18873
"1 to 5."
18874
msgstr ""
18875
18876
#: serverguide/C/mail.xml:1615(programlisting)
18877
#, no-wrap
18878
msgid ""
18879
"\n"
18880
"$log_level = 2;\n"
18881
msgstr ""
18882
18883
#: serverguide/C/mail.xml:1619(para)
18884
msgid ""
18885
"When the <application>Amavisd-new</application> log output is increased "
18886
"<application>Spamassassin</application> log output is also increased."
18887
msgstr ""
18888
18889
#: serverguide/C/mail.xml:1626(para)
18890
msgid ""
18891
"The <application>ClamAV</application> log level can be increased by editing "
18892
"<filename>/etc/clamav/clamd.conf</filename> and setting the following option:"
18893
msgstr ""
18894
18895
#: serverguide/C/mail.xml:1630(programlisting)
18896
#, no-wrap
18897
msgid ""
18898
"\n"
18899
"LogVerbose true\n"
18900
msgstr ""
18901
18902
#: serverguide/C/mail.xml:1633(para)
18903
msgid ""
18904
"By default <application>ClamAV</application> will send log messages to "
18905
"<filename>/var/log/clamav/clamav.log</filename>."
18906
msgstr ""
18907
18908
#: serverguide/C/mail.xml:1639(para)
18909
msgid ""
18910
"After changing an applications log settings remember to restart the service "
18911
"for the new settings to take affect. Also, once the issue you are "
18912
"troubleshooting is resolved it is a good idea to change the log settings "
18913
"back to normal."
18914
msgstr ""
18915
18916
#: serverguide/C/mail.xml:1647(para)
18917
msgid "For more information on filtering mail see the following links:"
18918
msgstr ""
18919
18920
#: serverguide/C/mail.xml:1653(ulink)
18921
msgid "Amavisd-new Documentation"
18922
msgstr ""
18923
18924
#: serverguide/C/mail.xml:1657(para)
18925
msgid ""
18926
"<ulink url=\"http://www.clamav.org/doc/latest/html/\">ClamAV "
18927
"Documentation</ulink> and <ulink "
18928
"url=\"http://wiki.clamav.net/Main/WebHome\">ClamAV Wiki</ulink>"
18929
msgstr ""
18930
18931
#: serverguide/C/mail.xml:1664(ulink)
18932
msgid "Spamassassin Wiki"
18933
msgstr ""
18934
18935
#: serverguide/C/mail.xml:1669(ulink)
18936
msgid "Pyzor Homepage"
18937
msgstr ""
18938
18939
#: serverguide/C/mail.xml:1674(ulink)
18940
msgid "Razor Homepage"
18941
msgstr ""
18942
18943
#: serverguide/C/mail.xml:1679(ulink)
18944
msgid "DKIM.org"
18945
msgstr ""
18946
18947
#: serverguide/C/mail.xml:1684(ulink)
18948
msgid "Postfix Amavis New"
18949
msgstr ""
18950
18951
#: serverguide/C/mail.xml:1688(para)
18952
msgid ""
18953
"Also, feel free to ask questions in the <emphasis>#ubuntu-server</emphasis> "
18954
"IRC channel on <ulink url=\"http://freenode.net\">freenode</ulink>."
18955
msgstr ""
18956
18957
#: serverguide/C/lamp-applications.xml:13(title)
18958
msgid "LAMP Applications"
18959
msgstr ""
18960
18961
#: serverguide/C/lamp-applications.xml:19(para)
18962
msgid ""
18963
"LAMP installations (Linux + Apache + MySQL + PHP) are a popular setup for "
18964
"Ubuntu servers. There is a plethora of Open Source applications written "
18965
"using the LAMP application stack. Some popular LAMP applications are Wiki's, "
18966
"Content Management Systems, and Management Software such as phpMyAdmin."
18967
msgstr ""
18968
18969
#: serverguide/C/lamp-applications.xml:26(para)
18970
msgid ""
18971
"One advantage of LAMP is the substantial flexibility for different database, "
18972
"web server, and scripting languages. Popular substitutes for MySQL include "
18973
"Posgresql and SQLite. Python, Perl, and Ruby are also frequently used "
18974
"instead of PHP."
18975
msgstr ""
18976
18977
#: serverguide/C/lamp-applications.xml:32(para)
18978
msgid ""
18979
"The traditional way to install most <emphasis>LAMP</emphasis> applications "
18980
"is:"
18981
msgstr ""
18982
18983
#: serverguide/C/lamp-applications.xml:38(para)
18984
msgid "Download an archive containing the application source files."
18985
msgstr ""
18986
18987
#: serverguide/C/lamp-applications.xml:43(para)
18988
msgid ""
18989
"Unpack the archive, usually in a directory accessible to a web server."
18990
msgstr ""
18991
18992
#: serverguide/C/lamp-applications.xml:48(para)
18993
msgid ""
18994
"Depending on where the source was extracted, configure a web browser to "
18995
"serve the files."
18996
msgstr ""
18997
18998
#: serverguide/C/lamp-applications.xml:53(para)
18999
msgid "Configure the application to connect to the database."
19000
msgstr ""
19001
19002
#: serverguide/C/lamp-applications.xml:58(para)
19003
msgid ""
19004
"Run a script, or browse to a page of the application, to install the "
19005
"database needed by the application."
19006
msgstr ""
19007
19008
#: serverguide/C/lamp-applications.xml:63(para)
19009
msgid ""
19010
"Once the steps above, or similar steps, are completed you are ready to begin "
19011
"using the application."
19012
msgstr ""
19013
19014
#: serverguide/C/lamp-applications.xml:69(para)
19015
msgid ""
19016
"A disadvantage of using this approach is that the application files are not "
19017
"placed in the file system in a standard way, which can cause confusion as to "
19018
"where the application is installed. Another larger disadvantage is updating "
19019
"the application. When a new version is released, the same process used to "
19020
"install the application is needed to apply updates."
19021
msgstr ""
19022
19023
#: serverguide/C/lamp-applications.xml:76(para)
19024
msgid ""
19025
"Fortunately, a number of <emphasis>LAMP</emphasis> applications are already "
19026
"packaged for Ubuntu, and are available for installation in the same way as "
19027
"non-LAMP applications. Depending on the application some extra configuration "
19028
"and setup steps may be needed, however."
19029
msgstr ""
19030
19031
#: serverguide/C/lamp-applications.xml:82(para)
19032
msgid ""
19033
"This section covers howto install and configure the Wiki applications "
19034
"<application>MoinMoin</application>, <application>MediaWiki</application>, "
19035
"and the MySQL management application <application>phpMyAdmin</application>."
19036
msgstr ""
19037
19038
#: serverguide/C/lamp-applications.xml:88(para)
19039
msgid ""
19040
"A Wiki is a website that allows the visitors to easily add, remove and "
19041
"modify available content easily. The ease of interaction and operation makes "
19042
"Wiki an effective tool for mass collaborative authoring. The term Wiki is "
19043
"also referred to the collaborative software."
19044
msgstr ""
19045
19046
#: serverguide/C/lamp-applications.xml:100(title)
19047
msgid "Moin Moin"
19048
msgstr ""
19049
19050
#: serverguide/C/lamp-applications.xml:102(para)
19051
msgid ""
19052
"MoinMoin is a Wiki engine implemented in Python, based on the PikiPiki Wiki "
19053
"engine, and licensed under the GNU GPL."
19054
msgstr ""
19055
19056
#: serverguide/C/lamp-applications.xml:110(para)
19057
msgid ""
19058
"To install <application>MoinMoin</application>, run the following command in "
19059
"the command prompt:"
19060
msgstr ""
19061
19062
#: serverguide/C/lamp-applications.xml:116(command)
19063
msgid "sudo apt-get install python-moinmoin"
19064
msgstr ""
19065
19066
#: serverguide/C/lamp-applications.xml:119(para)
19067
msgid ""
19068
"You should also install <application>apache2</application> web server. For "
19069
"installing <application>apache2</application> web server, please refer to "
19070
"<xref linkend=\"http-installation\"/> sub-section in <xref "
19071
"linkend=\"httpd\"/> section."
19072
msgstr ""
19073
19074
#: serverguide/C/lamp-applications.xml:130(para)
19075
msgid ""
19076
"For configuring your first Wiki application, please run the following set of "
19077
"commands. Let us assume that you are creating a Wiki named "
19078
"<emphasis>mywiki</emphasis>:"
19079
msgstr ""
19080
19081
#: serverguide/C/lamp-applications.xml:137(command)
19082
msgid "cd /usr/share/moin"
19083
msgstr ""
19084
19085
#: serverguide/C/lamp-applications.xml:138(command)
19086
msgid "sudo mkdir mywiki"
19087
msgstr ""
19088
19089
#: serverguide/C/lamp-applications.xml:139(command)
19090
msgid "sudo cp -R data mywiki"
19091
msgstr ""
19092
19093
#: serverguide/C/lamp-applications.xml:140(command)
19094
msgid "sudo cp -R underlay mywiki"
19095
msgstr ""
19096
19097
#: serverguide/C/lamp-applications.xml:141(command)
19098
msgid "sudo cp server/moin.cgi mywiki"
19099
msgstr ""
19100
19101
#: serverguide/C/lamp-applications.xml:142(command)
19102
msgid "sudo chown -R www-data.www-data mywiki"
19103
msgstr ""
19104
19105
#: serverguide/C/lamp-applications.xml:143(command)
19106
msgid "sudo chmod -R ug+rwX mywiki"
19107
msgstr ""
19108
19109
#: serverguide/C/lamp-applications.xml:144(command)
19110
msgid "sudo chmod -R o-rwx mywiki"
19111
msgstr ""
19112
19113
#: serverguide/C/lamp-applications.xml:147(para)
19114
msgid ""
19115
"Now you should configure <application>MoinMoin</application> to find your "
19116
"new Wiki <emphasis>mywiki</emphasis>. To configure "
19117
"<application>MoinMoin</application>, open "
19118
"<filename>/etc/moin/mywiki.py</filename> file and change the following line:"
19119
msgstr ""
19120
19121
#: serverguide/C/lamp-applications.xml:155(programlisting)
19122
#, no-wrap
19123
msgid "data_dir = '/org/mywiki/data'"
19124
msgstr ""
19125
19126
#: serverguide/C/lamp-applications.xml:157(para)
19127
msgid "to"
19128
msgstr ""
19129
19130
#: serverguide/C/lamp-applications.xml:161(programlisting)
19131
#, no-wrap
19132
msgid "data_dir = '/usr/share/moin/mywiki/data'"
19133
msgstr ""
19134
19135
#: serverguide/C/lamp-applications.xml:163(para)
19136
msgid ""
19137
"Also, below the <emphasis>data_dir</emphasis> option add the "
19138
"<emphasis>data_underlay_dir</emphasis>:"
19139
msgstr ""
19140
19141
#: serverguide/C/lamp-applications.xml:167(programlisting)
19142
#, no-wrap
19143
msgid ""
19144
"\n"
19145
"data_underlay_dir='/usr/share/moin/mywiki/underlay'\n"
19146
msgstr ""
19147
19148
#: serverguide/C/lamp-applications.xml:172(para)
19149
msgid ""
19150
"If the <filename>/etc/moin/mywiki.py</filename> file does not exists, you "
19151
"should copy <filename>/etc/moin/moinmaster.py</filename> file to "
19152
"<filename>/etc/moin/mywiki.py</filename> file and do the above mentioned "
19153
"change."
19154
msgstr ""
19155
19156
#: serverguide/C/lamp-applications.xml:181(para)
19157
msgid ""
19158
"If you have named your Wiki as <emphasis>my_wiki_name</emphasis> you should "
19159
"insert a line <quote>(\"my_wiki_name\", r\".*\")</quote> in "
19160
"<filename>/etc/moin/farmconfig.py</filename> file after the line "
19161
"<quote>(\"mywiki\", r\".*\")</quote>."
19162
msgstr ""
19163
19164
#: serverguide/C/lamp-applications.xml:189(para)
19165
msgid ""
19166
"Once you have configured <application>MoinMoin</application> to find your "
19167
"first Wiki application <emphasis>mywiki</emphasis>, you should configure "
19168
"<application>apache2</application> and make it ready for your Wiki "
19169
"application."
19170
msgstr ""
19171
19172
#: serverguide/C/lamp-applications.xml:196(para)
19173
msgid ""
19174
"You should add the following lines in <filename>/etc/apache2/sites-"
19175
"available/default</filename> file inside the <quote><VirtualHost "
19176
"*></quote> tag:"
19177
msgstr ""
19178
19179
#: serverguide/C/lamp-applications.xml:202(programlisting)
19180
#, no-wrap
19181
msgid ""
19182
"\n"
19183
"### moin\n"
19184
" ScriptAlias /mywiki \"/usr/share/moin/mywiki/moin.cgi\"\n"
19185
" alias /moin_static184 \"/usr/share/moin/htdocs\"\n"
19186
" <Directory /usr/share/moin/htdocs>\n"
19187
" Order allow,deny\n"
19188
" allow from all\n"
19189
" </Directory>\n"
19190
"### end moin\n"
19191
msgstr ""
19192
19193
#: serverguide/C/lamp-applications.xml:214(para)
19194
msgid ""
19195
"Adjust the <emphasis>\"moin_static184\"</emphasis> in the "
19196
"<emphasis>alias</emphasis> line above, to the "
19197
"<application>moinmoin</application> version installed."
19198
msgstr ""
19199
19200
#: serverguide/C/lamp-applications.xml:220(para)
19201
msgid ""
19202
"Once you configure the <application>apache2</application> web server and "
19203
"make it ready for your Wiki application, you should restart it. You can run "
19204
"the following command to restart the <application>apache2</application> web "
19205
"server:"
19206
msgstr ""
19207
19208
#: serverguide/C/lamp-applications.xml:233(title)
19209
msgid "Verification"
19210
msgstr ""
19211
19212
#: serverguide/C/lamp-applications.xml:235(para)
19213
msgid ""
19214
"You can verify the Wiki application and see if it works by pointing your web "
19215
"browser to the following URL:"
19216
msgstr ""
19217
19218
#: serverguide/C/lamp-applications.xml:239(programlisting)
19219
#, no-wrap
19220
msgid ""
19221
"\n"
19222
"http://localhost/mywiki\n"
19223
msgstr ""
19224
19225
#: serverguide/C/lamp-applications.xml:243(para)
19226
msgid ""
19227
"You can also run the test command by pointing your web browser to the "
19228
"following URL:"
19229
msgstr ""
19230
19231
#: serverguide/C/lamp-applications.xml:248(programlisting)
19232
#, no-wrap
19233
msgid ""
19234
"\n"
19235
"http://localhost/mywiki?action=test\n"
19236
msgstr ""
19237
19238
#: serverguide/C/lamp-applications.xml:252(para)
19239
msgid ""
19240
"For more details, please refer to the <ulink "
19241
"url=\"http://moinmo.in/\">MoinMoin</ulink> web site."
19242
msgstr ""
19243
19244
#: serverguide/C/lamp-applications.xml:263(para)
19245
msgid ""
19246
"For more information see the <ulink url=\"http://moinmo.in/\">moinmoin "
19247
"Wiki</ulink>."
19248
msgstr ""
19249
19250
#: serverguide/C/lamp-applications.xml:268(para)
19251
msgid ""
19252
"Also, see the <ulink "
19253
"url=\"https://help.ubuntu.com/community/MoinMoin\">Ubuntu Wiki "
19254
"MoinMoin</ulink> page."
19255
msgstr ""
19256
19257
#: serverguide/C/lamp-applications.xml:277(title)
19258
msgid "MediaWiki"
19259
msgstr ""
19260
19261
#: serverguide/C/lamp-applications.xml:279(para)
19262
msgid ""
19263
"MediaWiki is an web based Wiki software written in the PHP language. It can "
19264
"either use <application>MySQL</application> or "
19265
"<application>PostgreSQL</application> Database Management System."
19266
msgstr ""
19267
19268
#: serverguide/C/lamp-applications.xml:289(para)
19269
msgid ""
19270
"Before installing <application>MediaWiki</application> you should also "
19271
"install <application>Apache2</application>, the "
19272
"<application>PHP5</application> scripting language and Database a Management "
19273
"System. <application>MySQL</application> or "
19274
"<application>PostgreSQL</application> are the most common, choose one "
19275
"depending on your need. Please refer to those sections in this manual for "
19276
"installation instructions."
19277
msgstr ""
19278
19279
#: serverguide/C/lamp-applications.xml:297(para)
19280
msgid ""
19281
"To install <application>MediaWiki</application>, run the following command "
19282
"in the command prompt:"
19283
msgstr ""
19284
19285
#: serverguide/C/lamp-applications.xml:303(command)
19286
msgid "sudo apt-get install mediawiki php5-gd"
19287
msgstr ""
19288
19289
#: serverguide/C/lamp-applications.xml:306(para)
19290
msgid ""
19291
"For additional <application>MediaWiki</application> functionality see the "
19292
"<application>mediawiki-extensions</application> package."
19293
msgstr ""
19294
19295
#: serverguide/C/lamp-applications.xml:316(para)
19296
msgid ""
19297
"The Apache configuration file <filename>mediawiki.conf</filename> for "
19298
"MediaWiki is installed in <filename>/etc/apache2/conf.d/</filename> "
19299
"directory. You should uncomment the following line in this file to access "
19300
"MediaWiki application."
19301
msgstr ""
19302
19303
#: serverguide/C/lamp-applications.xml:324(screen)
19304
#, no-wrap
19305
msgid ""
19306
"\n"
19307
"# Alias /mediawiki /var/lib/mediawiki\n"
19308
msgstr ""
19309
19310
#: serverguide/C/lamp-applications.xml:328(para)
19311
msgid ""
19312
"After you uncomment the above line, restart Apache server and access "
19313
"MediaWiki using the following url:"
19314
msgstr ""
19315
19316
#: serverguide/C/lamp-applications.xml:333(programlisting)
19317
#, no-wrap
19318
msgid ""
19319
"\n"
19320
"http://localhost/mediawiki/config/index.php\n"
19321
msgstr ""
19322
19323
#: serverguide/C/lamp-applications.xml:338(para)
19324
msgid ""
19325
"Please read the <quote>Checking environment...</quote> section in this page. "
19326
"You should be able to fix many issues by carefully reading this section."
19327
msgstr ""
19328
19329
#: serverguide/C/lamp-applications.xml:345(para)
19330
msgid ""
19331
"Once the configuration is complete, you should copy the "
19332
"<filename>LocalSettings.php</filename> file to "
19333
"<filename>/etc/mediawiki</filename> directory:"
19334
msgstr ""
19335
19336
#: serverguide/C/lamp-applications.xml:352(command)
19337
msgid "sudo mv /var/lib/mediawiki/config/LocalSettings.php /etc/mediawiki/"
19338
msgstr ""
19339
19340
#: serverguide/C/lamp-applications.xml:355(para)
19341
msgid ""
19342
"You may also want to edit "
19343
"<filename>/etc/mediawiki/LocalSettings.php</filename> adjusting:"
19344
msgstr ""
19345
19346
#: serverguide/C/lamp-applications.xml:360(programlisting)
19347
#, no-wrap
19348
msgid ""
19349
"\n"
19350
"ini_set( 'memory_limit', '64M' );\n"
19351
msgstr ""
19352
19353
#: serverguide/C/lamp-applications.xml:367(title)
19354
msgid "Extensions"
19355
msgstr ""
19356
19357
#: serverguide/C/lamp-applications.xml:368(para)
19358
msgid ""
19359
"The extensions add new features and enhancements for the MediaWiki "
19360
"application. The extensions give wiki administrators and end users the "
19361
"ability to customize MediaWiki to their requirements."
19362
msgstr ""
19363
19364
#: serverguide/C/lamp-applications.xml:374(para)
19365
msgid ""
19366
"You can download MediaWiki extensions as an archive file or checkout from "
19367
"the Subversion repository. You should copy it to "
19368
"<filename>/var/lib/mediawiki/extensions</filename> directory. You should "
19369
"also add the following line at the end of file: "
19370
"<filename>/etc/mediawiki/LocalSettings.php</filename>."
19371
msgstr ""
19372
19373
#: serverguide/C/lamp-applications.xml:382(programlisting)
19374
#, no-wrap
19375
msgid ""
19376
"\n"
19377
"require_once \"$IP/extensions/ExtentionName/ExtentionName.php\";\n"
19378
msgstr ""
19379
19380
#: serverguide/C/lamp-applications.xml:392(para)
19381
msgid ""
19382
"For more details, please refer to the <ulink "
19383
"url=\"http://www.mediawiki.org\">MediaWiki</ulink> web site."
19384
msgstr ""
19385
19386
#: serverguide/C/lamp-applications.xml:398(para)
19387
msgid ""
19388
"The <ulink url=\"http://www.packtpub.com/Mediawiki/book\">MediaWiki "
19389
"Administrators’ Tutorial Guide</ulink> contains a wealth of information for "
19390
"new MediaWiki administrators."
19391
msgstr ""
19392
19393
#: serverguide/C/lamp-applications.xml:404(para)
19394
msgid ""
19395
"Also, the <ulink url=\"https://help.ubuntu.com/community/MediaWiki\">Ubuntu "
19396
"Wiki MediaWiki</ulink> page is a good resource."
19397
msgstr ""
19398
19399
#: serverguide/C/lamp-applications.xml:414(title)
19400
msgid "phpMyAdmin"
19401
msgstr ""
19402
19403
#: serverguide/C/lamp-applications.xml:416(para)
19404
msgid ""
19405
"<application>phpMyAdmin</application> is a LAMP application specifically "
19406
"written for administering <application>MySQL</application> servers. Written "
19407
"in <application>PHP</application>, and accessed through a web browser, "
19408
"phpMyAdmin provides a graphical interface for database administration tasks."
19409
msgstr ""
19410
19411
#: serverguide/C/lamp-applications.xml:425(para)
19412
msgid ""
19413
"Before installing <application>phpMyAdmin</application> you will need access "
19414
"to a <application>MySQL</application> database either on the same host as "
19415
"that phpMyAdmin is installed on, or on a host accessible over the network. "
19416
"For more information see <xref linkend=\"mysql\"/>. From a terminal prompt "
19417
"enter:"
19418
msgstr ""
19419
19420
#: serverguide/C/lamp-applications.xml:432(command)
19421
msgid "sudo apt-get install phpmyadmin"
19422
msgstr ""
19423
19424
#: serverguide/C/lamp-applications.xml:435(para)
19425
msgid ""
19426
"At the prompt choose which web server to be configured for "
19427
"<application>phpMyAdmin</application>. The rest of this section will use "
19428
"<application>Apache2</application> for the web server."
19429
msgstr ""
19430
19431
#: serverguide/C/lamp-applications.xml:440(para)
19432
msgid ""
19433
"In a browser go to <emphasis>http://servername/phpmyadmin</emphasis>, "
19434
"replacing <emphasis role=\"italic\">serveranme</emphasis> with the server's "
19435
"actual hostname. At the login, page enter <emphasis>root</emphasis> for the "
19436
"<emphasis>username</emphasis>, or another <application>MySQL</application> "
19437
"user if you any setup, and enter the <application>MySQL</application> user's "
19438
"password."
19439
msgstr ""
19440
19441
#: serverguide/C/lamp-applications.xml:447(para)
19442
msgid ""
19443
"Once logged in you can reset the <emphasis>root</emphasis> password if "
19444
"needed, create users, create/destroy databases and tables, etc."
19445
msgstr ""
19446
19447
#: serverguide/C/lamp-applications.xml:455(para)
19448
msgid ""
19449
"The configuration files for <application>phpMyAdmin</application> are "
19450
"located in <filename>/etc/phpmyadmin</filename>. The main configuration file "
19451
"is <filename>/etc/phpmyadmin/config.inc.php</filename>. This file contains "
19452
"configuration options that apply globally to "
19453
"<application>phpMyAdmin</application>."
19454
msgstr ""
19455
19456
#: serverguide/C/lamp-applications.xml:461(para)
19457
msgid ""
19458
"To use <application>phpMyAdmin</application> to administer a MySQL database "
19459
"hosted on another server, adjust the following in "
19460
"<filename>/etc/phpmyadmin/config.inc.php</filename>:"
19461
msgstr ""
19462
19463
#: serverguide/C/lamp-applications.xml:466(programlisting)
19464
#, no-wrap
19465
msgid ""
19466
"\n"
19467
"$cfg['Servers'][$i]['host'] = 'db_server';\n"
19468
msgstr ""
19469
19470
#: serverguide/C/lamp-applications.xml:471(para)
19471
msgid ""
19472
"Replace <emphasis role=\"italic\">db_server</emphasis> with the actual "
19473
"remote database server name or IP address. Also, be sure that the "
19474
"<application>phpMyAdmin</application> host has permissions to access the "
19475
"remote database."
19476
msgstr ""
19477
19478
#: serverguide/C/lamp-applications.xml:477(para)
19479
msgid ""
19480
"Once configured, log out of <application>phpMyAdmin</application> and back "
19481
"in, and you should be accessing the new server."
19482
msgstr ""
19483
19484
#: serverguide/C/lamp-applications.xml:481(para)
19485
msgid ""
19486
"The <filename>config.header.inc.php</filename> and "
19487
"<filename>config.footer.inc.php</filename> files are used to add a HTML "
19488
"header and footer to <application>phpMyAdmin</application>."
19489
msgstr ""
19490
19491
#: serverguide/C/lamp-applications.xml:486(para)
19492
msgid ""
19493
"Another important configuration file is "
19494
"<filename>/etc/phpmyadmin/apache.conf</filename>, this file is symlinked to "
19495
"<filename>/etc/apache2/conf.d/phpmyadmin.conf</filename>, and is used to "
19496
"configure <application>Apache2</application> to serve the "
19497
"<application>phpMyAdmin</application> site. The file contains directives for "
19498
"loading <application>PHP</application>, directory permissions, etc. For more "
19499
"information on configuring <application>Apache2</application> see <xref "
19500
"linkend=\"httpd\"/>."
19501
msgstr ""
19502
19503
#: serverguide/C/lamp-applications.xml:500(para)
19504
msgid ""
19505
"The <application>phpMyAdmin</application> documentation comes installed with "
19506
"the package and can be accessed from the <emphasis>phpMyAdmin "
19507
"Documentation</emphasis> link (a question mark with a box around it) under "
19508
"the phpMyAdmin logo. The official docs can also be access on the <ulink "
19509
"url=\"http://www.phpmyadmin.net/home_page/docs.php\">phpMyAdmin</ulink> site."
19510
msgstr ""
19511
19512
#: serverguide/C/lamp-applications.xml:507(para)
19513
msgid ""
19514
"Also, <ulink url=\"http://www.packtpub.com/phpmyadmin-3rd-"
19515
"edition/book\">Mastering phpMyAdmin</ulink> is a great resource."
19516
msgstr ""
19517
19518
#: serverguide/C/lamp-applications.xml:512(para)
19519
msgid ""
19520
"A third resource is the <ulink "
19521
"url=\"https://help.ubuntu.com/community/phpMyAdmin\">phpMyAdmin Ubuntu "
19522
"Wiki</ulink> page."
19523
msgstr ""
19524
19525
#: serverguide/C/introduction.xml:14(para)
19526
msgid "Welcome to the <emphasis>Ubuntu Server Guide</emphasis>!"
19527
msgstr ""
19528
19529
#: serverguide/C/introduction.xml:15(para)
19530
msgid ""
19531
"Here you can find information on how to install and configure various server "
19532
"applications. It is a step-by-step, task-oriented guide for configuring and "
19533
"customizing your system."
19534
msgstr ""
19535
19536
#: serverguide/C/introduction.xml:19(para)
19537
msgid ""
19538
"This guide assumes you have a basic understanding of your Ubuntu system. "
19539
"Some installation details are covered in <xref linkend=\"installation\"/>, "
19540
"but if you need detailed instructions installing Ubuntu please refer to the "
19541
"<ulink url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19542
"Installation Guide</ulink>."
19543
msgstr ""
19544
19545
#: serverguide/C/introduction.xml:25(para)
19546
msgid ""
19547
"A HTML version of the manual is available online at <ulink "
19548
"url=\"http://help.ubuntu.com\">the Ubuntu Documentation website</ulink>. The "
19549
"HTML files are also available in the <application>ubuntu-"
19550
"serverguide</application> package. See <xref linkend=\"package-"
19551
"management\"/> for details on installing packages."
19552
msgstr ""
19553
19554
#: serverguide/C/introduction.xml:32(para)
19555
msgid ""
19556
"If you choose to install the <application>ubuntu-serverguide</application> "
19557
"you can view this document from a console by:"
19558
msgstr ""
19559
19560
#: serverguide/C/introduction.xml:36(command)
19561
msgid "w3m /usr/share/ubuntu-serverguide/html/C/index.html"
19562
msgstr ""
19563
19564
#: serverguide/C/introduction.xml:39(para)
19565
msgid ""
19566
"If you are using a localized version of Ubuntu, replace "
19567
"<emphasis>C</emphasis> with your language localization (e.g. "
19568
"<emphasis>en_GB</emphasis>)."
19569
msgstr ""
19570
19571
#: serverguide/C/introduction.xml:53(title)
19572
msgid "Support"
19573
msgstr ""
19574
19575
#: serverguide/C/introduction.xml:55(para)
19576
msgid ""
19577
"There are a couple of different ways that Ubuntu Server Edition is "
19578
"supported, commercial support and community support. The main commercial "
19579
"support (and development funding) is available from Canonical Ltd. They "
19580
"supply reasonably priced support contracts on a per desktop or per server "
19581
"basis. For more information see the <ulink "
19582
"url=\"http://www.canonical.com/services/support\">Canonical Services</ulink> "
19583
"page."
19584
msgstr ""
19585
19586
#: serverguide/C/introduction.xml:62(para)
19587
msgid ""
19588
"Community support is also provided by dedicated individuals, and companies, "
19589
"that wish to make Ubuntu the best distribution possible. Support is provided "
19590
"through multiple mailing lists, IRC channels, forums, blogs, wikis, etc. The "
19591
"large amount of information available can be overwhelming, but a good search "
19592
"engine query can usually provide an answer to your questions. See the <ulink "
19593
"url=\"http://www.ubuntu.com/support\">Ubuntu Support</ulink> page for more "
19594
"information."
19595
msgstr ""
19596
19597
#: serverguide/C/installation.xml:14(para)
19598
msgid ""
19599
"This chapter provides a quick overview of installing Ubuntu 10.04 LTS Server "
19600
"Edition. For more detailed instructions, please refer to the <ulink "
19601
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\">Ubuntu "
19602
"Installation Guide</ulink>."
19603
msgstr ""
19604
19605
#: serverguide/C/installation.xml:19(title)
19606
msgid "Preparing to Install"
19607
msgstr ""
19608
19609
#: serverguide/C/installation.xml:20(para)
19610
msgid ""
19611
"This section explains various aspects to consider before starting the "
19612
"installation."
19613
msgstr ""
19614
19615
#: serverguide/C/installation.xml:24(title)
19616
msgid "System Requirements"
19617
msgstr ""
19618
19619
#: serverguide/C/installation.xml:25(para)
19620
msgid ""
19621
"Ubuntu 10.04 LTS Server Edition supports two (2) major architectures: Intel "
19622
"x86 and AMD64. The table below lists recommended hardware specifications. "
19623
"Depending on your needs, you might manage with less than this. However, most "
19624
"users risk being frustrated if they ignore these suggestions."
19625
msgstr ""
19626
19627
#: serverguide/C/installation.xml:27(title)
19628
msgid "Recommended Minimum Requirements"
19629
msgstr ""
19630
19631
#: serverguide/C/installation.xml:35(para)
19632
msgid "Install Type"
19633
msgstr ""
19634
19635
#: serverguide/C/installation.xml:36(para)
19636
msgid "RAM"
19637
msgstr ""
19638
19639
#: serverguide/C/installation.xml:37(para)
19640
msgid "Hard Drive Space"
19641
msgstr ""
19642
19643
#: serverguide/C/installation.xml:40(para)
19644
msgid "Base System"
19645
msgstr ""
19646
19647
#: serverguide/C/installation.xml:41(para)
19648
msgid "All Tasks Installed"
19649
msgstr ""
19650
19651
#: serverguide/C/installation.xml:46(para)
19652
msgid "Server"
19653
msgstr ""
19654
19655
#: serverguide/C/installation.xml:47(para)
19656
msgid "128 megabytes"
19657
msgstr ""
19658
19659
#: serverguide/C/installation.xml:48(para)
19660
msgid "500 megabytes"
19661
msgstr ""
19662
19663
#: serverguide/C/installation.xml:49(para)
19664
msgid "1 gigabyte"
19665
msgstr ""
19666
19667
#: serverguide/C/installation.xml:54(para)
19668
msgid ""
19669
"The Server Edition provides a common base for all sorts of server "
19670
"applications. It is a minimalist design providing a platform for the desired "
19671
"services, such as file/print services, web hosting, email hosting, etc."
19672
msgstr ""
19673
19674
#: serverguide/C/installation.xml:60(para)
19675
msgid ""
19676
"The requirements for UEC are slightly different for Front End requirements "
19677
"see <xref linkend=\"uec-frontend-requirements\"/> and for UEC Node "
19678
"requirements see <xref linkend=\"uec-node-requirements\"/>."
19679
msgstr ""
19680
19681
#: serverguide/C/installation.xml:68(title)
19682
msgid "Server and Desktop Differences"
19683
msgstr ""
19684
19685
#: serverguide/C/installation.xml:69(para)
19686
msgid ""
19687
"There are a few differences between the <emphasis>Ubuntu Server "
19688
"Edition</emphasis> and the <emphasis>Ubuntu Desktop Edition</emphasis>. It "
19689
"should be noted that both editions use the same "
19690
"<application>apt</application> repositories. Making it just as easy to "
19691
"install a <emphasis role=\"italic\">server</emphasis> application on the "
19692
"Desktop Edition as it is on the Server Edition."
19693
msgstr ""
19694
19695
#: serverguide/C/installation.xml:75(para)
19696
msgid ""
19697
"The differences between the two editions are the lack of an X window "
19698
"environment in the Server Edition, the installation process, and different "
19699
"Kernel options."
19700
msgstr ""
19701
19702
#: serverguide/C/installation.xml:82(title)
19703
msgid "Kernel Differences:"
19704
msgstr ""
19705
19706
#: serverguide/C/installation.xml:85(para)
19707
msgid ""
19708
"The Server Edition uses the <emphasis>Deadline</emphasis> I/O scheduler "
19709
"instead of the <emphasis>CFQ</emphasis> scheduler used by the Desktop "
19710
"Edition."
19711
msgstr ""
19712
19713
#: serverguide/C/installation.xml:91(para)
19714
msgid "<emphasis>Preemption</emphasis> is turned off in the Server Edition."
19715
msgstr ""
19716
19717
#: serverguide/C/installation.xml:96(para)
19718
msgid ""
19719
"The timer interrupt is 100 Hz in the Server Edition and 250 Hz in the "
19720
"Desktop Edition."
19721
msgstr ""
19722
19723
#: serverguide/C/installation.xml:102(para)
19724
msgid ""
19725
"When running a 64-bit version of Ubuntu on 64-bit processors you are not "
19726
"limited by memory addressing space."
19727
msgstr ""
19728
19729
#: serverguide/C/installation.xml:107(para)
19730
msgid ""
19731
"To see all kernel configuration options you can look through "
19732
"<filename>/boot/config-2.6.31-server</filename>. Also, <ulink "
19733
"url=\"http://www.kroah.com/lkn/\">Linux Kernel in a Nutshell</ulink> is a "
19734
"great resource on the options available."
19735
msgstr ""
19736
19737
#: serverguide/C/installation.xml:116(title)
19738
msgid "Backing Up"
19739
msgstr ""
19740
19741
#: serverguide/C/installation.xml:119(para)
19742
msgid ""
19743
"Before installing <application>Ubuntu Server Edition</application> you "
19744
"should make sure all data on the system is backed up. See <xref "
19745
"linkend=\"backups\"/> for backup options."
19746
msgstr ""
19747
19748
#: serverguide/C/installation.xml:123(para)
19749
msgid ""
19750
"If this is not the first time an operating system has been installed on your "
19751
"computer, it is likely you will need to re-partition your disk to make room "
19752
"for Ubuntu."
19753
msgstr ""
19754
19755
#: serverguide/C/installation.xml:127(para)
19756
msgid ""
19757
"Any time you partition your disk, you should be prepared to lose everything "
19758
"on the disk should you make a mistake or something goes wrong during "
19759
"partitioning. The programs used in installation are quite reliable, most "
19760
"have seen years of use, but they also perform destructive actions."
19761
msgstr ""
19762
19763
#: serverguide/C/installation.xml:139(title)
19764
msgid "Installing from CD"
19765
msgstr ""
19766
19767
#: serverguide/C/installation.xml:140(para)
19768
msgid ""
19769
"The basic steps to install Ubuntu Server Edition from CD are the same for "
19770
"installing any operating system from CD. Unlike the <emphasis>Desktop "
19771
"Edition</emphasis> the <emphasis>Server Edition</emphasis> does not include "
19772
"a graphical installation program. Instead the Server Edition uses a console "
19773
"menu based process."
19774
msgstr ""
19775
19776
#: serverguide/C/installation.xml:147(para)
19777
msgid ""
19778
"First, download and burn the appropriate ISO file from the <ulink "
19779
"url=\"http://www.ubuntu.com/getubuntu/download\"> Ubuntu web site</ulink>."
19780
msgstr ""
19781
19782
#: serverguide/C/installation.xml:153(para)
19783
msgid "Boot the system from the CD-ROM drive."
19784
msgstr ""
19785
19786
#: serverguide/C/installation.xml:158(para)
19787
msgid ""
19788
"At the boot prompt you will be asked to select the language. Afterwards the "
19789
"installation process begins by asking for your keyboard layout."
19790
msgstr ""
19791
19792
#: serverguide/C/installation.xml:164(para)
19793
msgid ""
19794
"From the main boot menu there are some additional options to install Ubuntu "
19795
"Server Edition. You can install a basic Ubuntu Server, or install Ubuntu "
19796
"Server as part of a <emphasis>Ubuntu Enterprise Cloud</emphasis>. For more "
19797
"information on UEC see <xref linkend=\"uec\"/>. The rest of this section "
19798
"will cover the basic Ubuntu Server install."
19799
msgstr ""
19800
19801
#: serverguide/C/installation.xml:172(para)
19802
msgid ""
19803
"The installer then discovers your hardware configuration, and configures the "
19804
"network settings using DHCP. If you do not wish to use DHCP at the next "
19805
"screen choose \"Go Back\", and you have the option to \"Configure the "
19806
"network manually\"."
19807
msgstr ""
19808
19809
#: serverguide/C/installation.xml:179(para)
19810
msgid "Next, the installer asks for the system's hostname and Time Zone."
19811
msgstr ""
19812
19813
#: serverguide/C/installation.xml:184(para)
19814
msgid ""
19815
"You can then choose from several options to configure the hard drive layout. "
19816
"For advanced disk options see <xref linkend=\"advanced-installation\"/>."
19817
msgstr ""
19818
19819
#: serverguide/C/installation.xml:190(para)
19820
msgid "The Ubuntu base system is then installed."
19821
msgstr ""
19822
19823
#: serverguide/C/installation.xml:195(para)
19824
msgid ""
19825
"A new user is setup, this user will have <emphasis>root</emphasis> access "
19826
"through the <application>sudo</application> utility."
19827
msgstr ""
19828
19829
#: serverguide/C/installation.xml:201(para)
19830
msgid ""
19831
"After the user is setup, you will be asked to encrypt your <filename "
19832
"role=\"directory\">home</filename> directory."
19833
msgstr ""
19834
19835
#: serverguide/C/installation.xml:207(para)
19836
msgid ""
19837
"The next step in the installation process is to decide how you want to "
19838
"update the system. There are three options:"
19839
msgstr ""
19840
19841
#: serverguide/C/installation.xml:213(para)
19842
msgid ""
19843
"<emphasis>No automatic updates</emphasis>: this requires an administrator to "
19844
"log into the machine and manually install updates."
19845
msgstr ""
19846
19847
#: serverguide/C/installation.xml:219(para)
19848
msgid ""
19849
"<emphasis>Install security updates Automatically</emphasis>: will install "
19850
"the <application>unattended-upgrades</application> package, which will "
19851
"install security updates without the intervention of an administrator. For "
19852
"more details see <xref linkend=\"automatic-updates\"/>."
19853
msgstr ""
19854
19855
#: serverguide/C/installation.xml:226(para)
19856
msgid ""
19857
"<emphasis>Manage the system with Landscape</emphasis>: Landscape is a paid "
19858
"service provided by Canonical to help manage your Ubuntu machines. See the "
19859
"<ulink url=\"http://www.canonical.com/projects/landscape\">Landscape</ulink> "
19860
"site for details."
19861
msgstr ""
19862
19863
#: serverguide/C/installation.xml:235(para)
19864
msgid ""
19865
"You now have the option to install, or not install, several package tasks. "
19866
"See <xref linkend=\"install-tasks\"/> for details. Also, there is an option "
19867
"to launch <application>aptitude</application> to choose specific packages to "
19868
"install. For more information see <xref linkend=\"aptitude\"/>."
19869
msgstr ""
19870
19871
#: serverguide/C/installation.xml:243(para)
19872
msgid "Finally, the last step before rebooting is to set the clock to UTC."
19873
msgstr ""
19874
19875
#: serverguide/C/installation.xml:249(para)
19876
msgid ""
19877
"If at any point during installation you are not satisfied by the default "
19878
"setting, use the \"Go Back\" function at any prompt to be brought to a "
19879
"detailed installation menu that will allow you to modify the default "
19880
"settings."
19881
msgstr ""
19882
19883
#: serverguide/C/installation.xml:254(para)
19884
msgid ""
19885
"At some point during the installation process you may want to read the help "
19886
"screen provided by the installation system. To do this, press F1."
19887
msgstr ""
19888
19889
#: serverguide/C/installation.xml:259(para)
19890
msgid ""
19891
"Once again, for detailed instructions see the <ulink "
19892
"url=\"https://help.ubuntu.com/10.04 LTS/installation-guide/\"> Ubuntu "
19893
"Installation Guide</ulink>."
19894
msgstr ""
19895
19896
#: serverguide/C/installation.xml:265(title)
19897
msgid "Package Tasks"
19898
msgstr ""
19899
19900
#: serverguide/C/installation.xml:266(para)
19901
msgid ""
19902
"During the Server Edition installation you have the option of installing "
19903
"additional packages from the CD. The packages are grouped by the type of "
19904
"service they provide."
19905
msgstr ""
19906
19907
#: serverguide/C/installation.xml:272(para)
19908
msgid "Cloud computing: Walrus storage service"
19909
msgstr ""
19910
19911
#: serverguide/C/installation.xml:277(para)
19912
msgid "Cloud computing: all-in-one cluster"
19913
msgstr ""
19914
19915
#: serverguide/C/installation.xml:282(para)
19916
msgid "Cloud computing: Cluster controller"
19917
msgstr ""
19918
19919
#: serverguide/C/installation.xml:287(para)
19920
msgid "Cloud computing: Node controller"
19921
msgstr ""
19922
19923
#: serverguide/C/installation.xml:292(para)
19924
msgid "Cloud computing: Storage controller"
19925
msgstr ""
19926
19927
#: serverguide/C/installation.xml:297(para)
19928
msgid "Cloud computing: top-level cloud controller"
19929
msgstr ""
19930
19931
#: serverguide/C/installation.xml:302(para)
19932
msgid "DNS server: Selects the BIND DNS server and its documentation."
19933
msgstr ""
19934
19935
#: serverguide/C/installation.xml:307(para)
19936
msgid "LAMP server: Selects a ready-made Linux/Apache/MySQL/PHP server."
19937
msgstr ""
19938
19939
#: serverguide/C/installation.xml:312(para)
19940
msgid ""
19941
"Mail server: This task selects a variety of package useful for a general "
19942
"purpose mail server system."
19943
msgstr ""
19944
19945
#: serverguide/C/installation.xml:317(para)
19946
msgid "OpenSSH server: Selects packages needed for an OpenSSH server."
19947
msgstr ""
19948
19949
#: serverguide/C/installation.xml:322(para)
19950
msgid ""
19951
"PostgreSQL database: This task selects client and server packages for the "
19952
"PostgreSQL database."
19953
msgstr ""
19954
19955
#: serverguide/C/installation.xml:327(para)
19956
msgid "Print server: This task sets up your system to be a print server."
19957
msgstr ""
19958
19959
#: serverguide/C/installation.xml:332(para)
19960
msgid ""
19961
"Samba File server: This task sets up your system to be a Samba file server, "
19962
"which is especially suitable in networks with both Windows and Linux systems."
19963
msgstr ""
19964
19965
#: serverguide/C/installation.xml:338(para)
19966
msgid ""
19967
"Tomcat server: Installs the Apache Tomcat and needed dependencies Java, gcj, "
19968
"etc."
19969
msgstr ""
19970
19971
#: serverguide/C/installation.xml:343(para)
19972
msgid ""
19973
"Virtual machine host: Includes packages needed to run KVM virtual machines."
19974
msgstr ""
19975
19976
#: serverguide/C/installation.xml:348(para)
19977
msgid ""
19978
"Manually select packages: Executes <application>apptitude</application> "
19979
"allowing you to individually select packages."
19980
msgstr ""
19981
19982
#: serverguide/C/installation.xml:353(para)
19983
msgid ""
19984
"Installing the package groups is accomplished using the "
19985
"<application>tasksel</application> utility. One of the important difference "
19986
"between Ubuntu (or Debian) and other GNU/Linux distribution is that, when "
19987
"installed, a package is also configured to reasonable defaults, eventually "
19988
"prompting you for additional required information. Likewise, when installing "
19989
"a task, the packages are not only installed, but also configured to provided "
19990
"a fully integrated service."
19991
msgstr ""
19992
19993
#: serverguide/C/installation.xml:360(para)
19994
msgid ""
19995
"For more information on the <emphasis>Cloud Computing</emphasis> tasks see "
19996
"<xref linkend=\"uec\"/>."
19997
msgstr ""
19998
19999
#: serverguide/C/installation.xml:363(para)
20000
msgid ""
20001
"Once the installation process has finished you can view a list of available "
20002
"tasks by entering the following from a terminal prompt:"
20003
msgstr ""
20004
20005
#: serverguide/C/installation.xml:368(command)
20006
msgid "tasksel --list-tasks"
20007
msgstr ""
20008
20009
#: serverguide/C/installation.xml:371(para)
20010
msgid ""
20011
"The output will list tasks from other Ubuntu based distributions such as "
20012
"Kubuntu and Edubuntu. Note that you can also invoke the "
20013
"<command>tasksel</command> command by itself, which will bring up a menu of "
20014
"the different tasks available."
20015
msgstr ""
20016
20017
#: serverguide/C/installation.xml:377(para)
20018
msgid ""
20019
"You can view a list of which packages are installed with each task using the "
20020
"<emphasis>--task-packages</emphasis> option. For example, to list the "
20021
"packages installed with the <emphasis>DNS Server</emphasis> task enter the "
20022
"following:"
20023
msgstr ""
20024
20025
#: serverguide/C/installation.xml:382(command)
20026
msgid "tasksel --task-packages dns-server"
20027
msgstr ""
20028
20029
#: serverguide/C/installation.xml:384(para)
20030
msgid "The output of the command should list:"
20031
msgstr ""
20032
20033
#: serverguide/C/installation.xml:387(programlisting)
20034
#, no-wrap
20035
msgid ""
20036
"\n"
20037
"bind9-doc \n"
20038
"bind9utils \n"
20039
"bind9\n"
20040
msgstr ""
20041
20042
#: serverguide/C/installation.xml:392(para)
20043
msgid ""
20044
"Also, if you did not install one of the tasks during the installation "
20045
"process, but for example you decide to make your new LAMP server a DNS "
20046
"server as well. Simply insert the installation CD and from a terminal:"
20047
msgstr ""
20048
20049
#: serverguide/C/installation.xml:397(command)
20050
msgid "sudo tasksel install dns-server"
20051
msgstr ""
20052
20053
#: serverguide/C/installation.xml:402(title)
20054
msgid "Upgrading"
20055
msgstr ""
20056
20057
#: serverguide/C/installation.xml:403(para)
20058
msgid ""
20059
"There are several ways to upgrade from one Ubuntu release to another. This "
20060
"section gives an overview of the recommended upgrade method."
20061
msgstr ""
20062
20063
#: serverguide/C/installation.xml:407(title) serverguide/C/installation.xml:422(command)
20064
msgid "do-release-upgrade"
20065
msgstr ""
20066
20067
#: serverguide/C/installation.xml:408(para)
20068
msgid ""
20069
"The recommended way to upgrade a Server Edition installation is to use the "
20070
"<application>do-release-upgrade</application> utility. Part of the "
20071
"<emphasis>update-manager-core</emphasis> package, it does not have any "
20072
"graphical dependencies and is installed by default."
20073
msgstr ""
20074
20075
#: serverguide/C/installation.xml:413(para)
20076
msgid ""
20077
"Debian based systems can also be upgraded by using <command>apt-get dist-"
20078
"upgrade</command>. However, using <application>do-release-"
20079
"upgrade</application> is recommended because it has the ability to handle "
20080
"system configuration changes sometimes needed between releases."
20081
msgstr ""
20082
20083
#: serverguide/C/installation.xml:418(para)
20084
msgid "To upgrade to a newer release, from a terminal prompt enter:"
20085
msgstr ""
20086
20087
#: serverguide/C/installation.xml:424(para)
20088
msgid ""
20089
"It is also possible to use <application>do-release-upgrade</application> to "
20090
"upgrade to a development version of Ubuntu. To accomplish this use the "
20091
"<emphasis>-d</emphasis> switch:"
20092
msgstr ""
20093
20094
#: serverguide/C/installation.xml:429(command)
20095
msgid "do-release-upgrade -d"
20096
msgstr ""
20097
20098
#: serverguide/C/installation.xml:432(para)
20099
msgid ""
20100
"Upgrading to a development release is <emphasis>not</emphasis> recommended "
20101
"for production environments."
20102
msgstr ""
20103
20104
#: serverguide/C/installation.xml:439(title)
20105
msgid "Advanced Installation"
20106
msgstr ""
20107
20108
#: serverguide/C/installation.xml:442(title)
20109
msgid "Software RAID"
20110
msgstr ""
20111
20112
#: serverguide/C/installation.xml:444(para)
20113
msgid ""
20114
"RAID is a method of configuring multiple hard drives to act as one, reducing "
20115
"the probability of catastrophic data loss in case of drive failure. RAID is "
20116
"implemented in either software (where the operating system knows about both "
20117
"drives and actively maintains both of them) or hardware (where a special "
20118
"controller makes the OS think there's only one drive and maintains the "
20119
"drives 'invisibly')."
20120
msgstr ""
20121
20122
#: serverguide/C/installation.xml:451(para)
20123
msgid ""
20124
"The RAID software included with current versions of Linux (and Ubuntu) is "
20125
"based on the <application>'mdadm'</application> driver and works very well, "
20126
"better even than many so-called 'hardware' RAID controllers. This section "
20127
"will guide you through installing Ubuntu Server Edition using two RAID1 "
20128
"partitions on two physical hard drives, one for <emphasis>/</emphasis> and "
20129
"another for <emphasis>swap</emphasis>."
20130
msgstr ""
20131
20132
#: serverguide/C/installation.xml:461(para) serverguide/C/installation.xml:975(para)
20133
msgid ""
20134
"Follow the installation steps until you get to the <emphasis>Partition "
20135
"disks</emphasis> step, then:"
20136
msgstr ""
20137
20138
#: serverguide/C/installation.xml:468(para)
20139
msgid "Select <emphasis>Manual</emphasis> as the partition method."
20140
msgstr ""
20141
20142
#: serverguide/C/installation.xml:475(para)
20143
msgid ""
20144
"Select the first hard drive, and agree to <emphasis>\"Create a new empty "
20145
"partition table on this device?\"</emphasis>."
20146
msgstr ""
20147
20148
#: serverguide/C/installation.xml:479(para)
20149
msgid ""
20150
"Repeat this step for each drive you wish to be part of the RAID array."
20151
msgstr ""
20152
20153
#: serverguide/C/installation.xml:486(para)
20154
msgid ""
20155
"Select the <emphasis>\"FREE SPACE\"</emphasis> on the first drive then "
20156
"select <emphasis>\"Create a new partition\"</emphasis>."
20157
msgstr ""
20158
20159
#: serverguide/C/installation.xml:493(para)
20160
msgid ""
20161
"Next, select the <emphasis>Size</emphasis> of the partition. This partition "
20162
"will be the <emphasis>swap</emphasis> partition, and a general rule for swap "
20163
"size is twice that of RAM. Enter the partition size, then choose "
20164
"<emphasis>Primary</emphasis>, then <emphasis>Beginning</emphasis>."
20165
msgstr ""
20166
20167
#: serverguide/C/installation.xml:502(para)
20168
msgid ""
20169
"Select the <emphasis>\"Use as:\"</emphasis> line at the top. By default this "
20170
"is <emphasis role=\"italic\">\"Ext4 journaling file system\"</emphasis>, "
20171
"change that to <emphasis>\"physical volume for RAID\"</emphasis> then "
20172
"<emphasis>\"Done setting up partition\"</emphasis>."
20173
msgstr ""
20174
20175
#: serverguide/C/installation.xml:511(para)
20176
msgid ""
20177
"For the <emphasis>/</emphasis> partition once again select <emphasis>\"Free "
20178
"Space\"</emphasis> on the first drive then <emphasis>\"Create a new "
20179
"partition\"</emphasis>."
20180
msgstr ""
20181
20182
#: serverguide/C/installation.xml:519(para)
20183
msgid ""
20184
"Use the rest of the free space on the drive and choose "
20185
"<emphasis>Continue</emphasis>, then <emphasis>Primary</emphasis>."
20186
msgstr ""
20187
20188
#: serverguide/C/installation.xml:526(para)
20189
msgid ""
20190
"As with the swap partition, select the <emphasis>\"Use as:\"</emphasis> line "
20191
"at the top, changing it to <emphasis>\"physical volume for "
20192
"RAID\"</emphasis>. Also select the <emphasis>\"Bootable flag:\"</emphasis> "
20193
"line to change the value to <emphasis>\"on\"</emphasis>. Then choose "
20194
"<emphasis>\"Done setting up partition\"</emphasis>."
20195
msgstr ""
20196
20197
#: serverguide/C/installation.xml:536(para)
20198
msgid "Repeat steps three through eight for the other disk and partitions."
20199
msgstr ""
20200
20201
#: serverguide/C/installation.xml:545(title)
20202
msgid "RAID Configuration"
20203
msgstr ""
20204
20205
#: serverguide/C/installation.xml:547(para)
20206
msgid "With the partitions setup the arrays are ready to be configured:"
20207
msgstr ""
20208
20209
#: serverguide/C/installation.xml:554(para)
20210
msgid ""
20211
"Back in the main \"Partition Disks\" page, select <emphasis>\"Configure "
20212
"Software RAID\"</emphasis> at the top."
20213
msgstr ""
20214
20215
#: serverguide/C/installation.xml:561(para)
20216
msgid "Select <emphasis>\"yes\"</emphasis> to write the changes to disk."
20217
msgstr ""
20218
20219
#: serverguide/C/installation.xml:568(para)
20220
msgid "Choose <emphasis>\"Create MD device\"</emphasis>."
20221
msgstr ""
20222
20223
#: serverguide/C/installation.xml:575(para)
20224
msgid ""
20225
"For this example, select <emphasis>\"RAID1\"</emphasis>, but if you are "
20226
"using a different setup choose the appropriate type (RAID0 RAID1 RAID5)."
20227
msgstr ""
20228
20229
#: serverguide/C/installation.xml:581(para)
20230
msgid ""
20231
"In order to use <emphasis>RAID5</emphasis> you need at least "
20232
"<emphasis>three</emphasis> drives. Using RAID0 or RAID1 only "
20233
"<emphasis>two</emphasis> drives are required."
20234
msgstr ""
20235
20236
#: serverguide/C/installation.xml:590(para)
20237
msgid ""
20238
"Enter the number of active devices <emphasis>\"2\"</emphasis>, or the amount "
20239
"of hard drives you have, for the array. Then select "
20240
"<emphasis>\"Continue\"</emphasis>."
20241
msgstr ""
20242
20243
#: serverguide/C/installation.xml:598(para)
20244
msgid ""
20245
"Next, enter the number of spare devices <emphasis>\"0\"</emphasis> by "
20246
"default, then choose <emphasis>\"Continue\"</emphasis>."
20247
msgstr ""
20248
20249
#: serverguide/C/installation.xml:605(para)
20250
msgid ""
20251
"Choose which partitions to use. Generally they will be sda1, sdb1, sdc1, "
20252
"etc. The numbers will usually match and the different letters correspond to "
20253
"different hard drives."
20254
msgstr ""
20255
20256
#: serverguide/C/installation.xml:610(para)
20257
msgid ""
20258
"For the <emphasis>swap</emphasis> partition choose <emphasis>sda1</emphasis> "
20259
"and <emphasis>sdb1</emphasis>. Select <emphasis>\"Continue\"</emphasis> to "
20260
"go to the next step."
20261
msgstr ""
20262
20263
#: serverguide/C/installation.xml:618(para)
20264
msgid ""
20265
"Repeat steps <emphasis>three</emphasis> through <emphasis>seven</emphasis> "
20266
"for the <emphasis>/</emphasis> partition choosing <emphasis>sda2</emphasis> "
20267
"and <emphasis>sdb2</emphasis>."
20268
msgstr ""
20269
20270
#: serverguide/C/installation.xml:626(para)
20271
msgid "Once done select <emphasis>\"Finish\"</emphasis>."
20272
msgstr ""
20273
20274
#: serverguide/C/installation.xml:636(title)
20275
msgid "Formatting"
20276
msgstr ""
20277
20278
#: serverguide/C/installation.xml:638(para)
20279
msgid ""
20280
"There should now be a list of hard drives and RAID devices. The next step is "
20281
"to format and set the mount point for the RAID devices. Treat the RAID "
20282
"device as a local hard drive, format and mount accordingly."
20283
msgstr ""
20284
20285
#: serverguide/C/installation.xml:646(para)
20286
msgid ""
20287
"Select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20288
"#0\"</emphasis> partition."
20289
msgstr ""
20290
20291
#: serverguide/C/installation.xml:653(para)
20292
msgid ""
20293
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"swap "
20294
"area\"</emphasis>, then <emphasis>\"Done setting up partition\"</emphasis>."
20295
msgstr ""
20296
20297
#: serverguide/C/installation.xml:661(para)
20298
msgid ""
20299
"Next, select <emphasis>\"#1\"</emphasis> under the <emphasis>\"RAID1 device "
20300
"#1\"</emphasis> partition."
20301
msgstr ""
20302
20303
#: serverguide/C/installation.xml:668(para)
20304
msgid ""
20305
"Choose <emphasis>\"Use as:\"</emphasis>. Then select <emphasis>\"Ext4 "
20306
"journaling file system\"</emphasis>."
20307
msgstr ""
20308
20309
#: serverguide/C/installation.xml:675(para)
20310
msgid ""
20311
"Then select the <emphasis>\"Mount point\"</emphasis> and choose "
20312
"<emphasis>\"/ - the root file system\"</emphasis>. Change any of the other "
20313
"options as appropriate, then select <emphasis>\"Done setting up "
20314
"partition\"</emphasis>."
20315
msgstr ""
20316
20317
#: serverguide/C/installation.xml:683(para)
20318
msgid ""
20319
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20320
"disk\"</emphasis>."
20321
msgstr ""
20322
20323
#: serverguide/C/installation.xml:690(para)
20324
msgid ""
20325
"If you choose to place the root partition on a RAID array, the installer "
20326
"will then ask if you would like to boot in a <emphasis>degraded</emphasis> "
20327
"state. See <xref linkend=\"raid-degraded\"/> for further details."
20328
msgstr ""
20329
20330
#: serverguide/C/installation.xml:695(para)
20331
msgid "The installation process will then continue normally."
20332
msgstr ""
20333
20334
#: serverguide/C/installation.xml:701(title)
20335
msgid "Degraded RAID"
20336
msgstr ""
20337
20338
#: serverguide/C/installation.xml:703(para)
20339
msgid ""
20340
"At some point in the life of the computer a disk failure event may occur. "
20341
"When this happens, using Software RAID, the operating system will place the "
20342
"array into what is known as a <emphasis>degraded</emphasis> state."
20343
msgstr ""
20344
20345
#: serverguide/C/installation.xml:708(para)
20346
msgid ""
20347
"If the array has become degraded, due to the chance of data corruption, by "
20348
"default Ubuntu Server Edition will boot to <emphasis>initramfs</emphasis> "
20349
"after thirty seconds. Once the initramfs has booted there is a fifteen "
20350
"second prompt giving you the option to go ahead and boot the system, or "
20351
"attempt manual recover. Booting to the initramfs prompt may or may not be "
20352
"the desired behavior, especially if the machine is in a remote location. "
20353
"Booting to a degraded array can be configured several ways:"
20354
msgstr ""
20355
20356
#: serverguide/C/installation.xml:719(para)
20357
msgid ""
20358
"The <application>dpkg-reconfigure</application> utility can be used to "
20359
"configure the default behavior, and during the process you will be queried "
20360
"about additional settings related to the array. Such as monitoring, email "
20361
"alerts, etc. To reconfigure <application>mdadm</application> enter the "
20362
"following:"
20363
msgstr ""
20364
20365
#: serverguide/C/installation.xml:726(command)
20366
msgid "sudo dpkg-reconfigure mdadm"
20367
msgstr ""
20368
20369
#: serverguide/C/installation.xml:732(para)
20370
msgid ""
20371
"The <command>dpkg-reconfigure mdadm</command> process will change the "
20372
"<filename>/etc/initramfs-tools/conf.d/mdadm</filename> configuration file. "
20373
"The file has the advantage of being able to pre-configure the system's "
20374
"behavior, and can also be manually edited:"
20375
msgstr ""
20376
20377
#: serverguide/C/installation.xml:738(programlisting)
20378
#, no-wrap
20379
msgid ""
20380
"\n"
20381
"BOOT_DEGRADED=true\n"
20382
msgstr ""
20383
20384
#: serverguide/C/installation.xml:743(para)
20385
msgid "The configuration file can be overridden by using a Kernel argument."
20386
msgstr ""
20387
20388
#: serverguide/C/installation.xml:751(para)
20389
msgid ""
20390
"Using a Kernel argument will allow the system to boot to a degraded array as "
20391
"well:"
20392
msgstr ""
20393
20394
#: serverguide/C/installation.xml:757(para)
20395
msgid ""
20396
"When the server is booting press <keycap>Shift</keycap> to open the "
20397
"<application>Grub</application> menu."
20398
msgstr ""
20399
20400
#: serverguide/C/installation.xml:762(para)
20401
msgid "Press <keycap>e</keycap> to edit your kernel command options."
20402
msgstr ""
20403
20404
#: serverguide/C/installation.xml:767(para)
20405
msgid "Press the <keycap>down</keycap> arrow to highlight the kernel line."
20406
msgstr ""
20407
20408
#: serverguide/C/installation.xml:772(para)
20409
msgid ""
20410
"Add <emphasis>\"bootdegraded=true\"</emphasis> (without the quotes) to the "
20411
"end of the line."
20412
msgstr ""
20413
20414
#: serverguide/C/installation.xml:777(para)
20415
msgid ""
20416
"Press <keycombo><keycap>Ctrl</keycap><keycap>x</keycap></keycombo> to boot "
20417
"the system."
20418
msgstr ""
20419
20420
#: serverguide/C/installation.xml:786(para)
20421
msgid ""
20422
"Once the system has booted you can either repair the array see <xref "
20423
"linkend=\"raid-maintenance\"/> for details, or copy important data to "
20424
"another machine due to major hardware failure."
20425
msgstr ""
20426
20427
#: serverguide/C/installation.xml:793(title)
20428
msgid "RAID Maintenance"
20429
msgstr ""
20430
20431
#: serverguide/C/installation.xml:795(para)
20432
msgid ""
20433
"The <application>mdadm</application> utility can be used to view the status "
20434
"of an array, add disks to an array, remove disks, etc:"
20435
msgstr ""
20436
20437
#: serverguide/C/installation.xml:802(para)
20438
msgid "To view the status of an array, from a terminal prompt enter:"
20439
msgstr ""
20440
20441
#: serverguide/C/installation.xml:806(command)
20442
msgid "sudo mdadm -D /dev/md0"
20443
msgstr ""
20444
20445
#: serverguide/C/installation.xml:809(para)
20446
msgid ""
20447
"The <emphasis>-D</emphasis> tells <application>mdadm</application> to "
20448
"display <emphasis>detailed</emphasis> information about the "
20449
"<filename>/dev/md0</filename> device. Replace <filename>/dev/md0</filename> "
20450
"with the appropriate RAID device."
20451
msgstr ""
20452
20453
#: serverguide/C/installation.xml:815(para)
20454
msgid "To view the status of a disk in an array:"
20455
msgstr ""
20456
20457
#: serverguide/C/installation.xml:819(command)
20458
msgid "sudo mdadm -E /dev/sda1"
20459
msgstr ""
20460
20461
#: serverguide/C/installation.xml:821(para)
20462
msgid ""
20463
"The output if very similar to the <command>mdadm -D</command> command, "
20464
"adjust <filename>/dev/sda1</filename> for each disk."
20465
msgstr ""
20466
20467
#: serverguide/C/installation.xml:826(para)
20468
msgid "If a disk fails and needs to be removed from an array enter:"
20469
msgstr ""
20470
20471
#: serverguide/C/installation.xml:830(command)
20472
msgid "sudo mdadm --remove /dev/md0 /dev/sda1"
20473
msgstr ""
20474
20475
#: serverguide/C/installation.xml:832(para)
20476
msgid ""
20477
"Change <filename>/dev/md0</filename> and <filename>/dev/sda1</filename> to "
20478
"the appropriate RAID device and disk."
20479
msgstr ""
20480
20481
#: serverguide/C/installation.xml:837(para)
20482
msgid "Similarly, to add a new disk:"
20483
msgstr ""
20484
20485
#: serverguide/C/installation.xml:841(command)
20486
msgid "sudo mdadm --add /dev/md0 /dev/sda1"
20487
msgstr ""
20488
20489
#: serverguide/C/installation.xml:846(para)
20490
msgid ""
20491
"Sometimes a disk can change to a <emphasis>faulty</emphasis> state even "
20492
"though there is nothing physically wrong with the drive. It is usually "
20493
"worthwhile to remove the drive from the array then re-add it. This will "
20494
"cause the drive to re-sync with the array. If the drive will not sync with "
20495
"the array, it is a good indication of hardware failure."
20496
msgstr ""
20497
20498
#: serverguide/C/installation.xml:852(para)
20499
msgid ""
20500
"The <filename>/proc/mdstat</filename> file also contains useful information "
20501
"about the system's RAID devices:"
20502
msgstr ""
20503
20504
#: serverguide/C/installation.xml:857(command)
20505
msgid "cat /proc/mdstat"
20506
msgstr ""
20507
20508
#: serverguide/C/installation.xml:858(computeroutput)
20509
#, no-wrap
20510
msgid ""
20511
"Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] "
20512
"[raid10] \n"
20513
"md0 : active raid1 sda1[0] sdb1[1]\n"
20514
" 10016384 blocks [2/2] [UU]\n"
20515
" \n"
20516
"unused devices: <none>"
20517
msgstr ""
20518
20519
#: serverguide/C/installation.xml:865(para)
20520
msgid ""
20521
"The following command is great for watching the status of a syncing drive:"
20522
msgstr ""
20523
20524
#: serverguide/C/installation.xml:870(command)
20525
msgid "watch -n1 cat /proc/mdstat"
20526
msgstr ""
20527
20528
#: serverguide/C/installation.xml:873(para)
20529
msgid ""
20530
"Press <emphasis>Ctrl+c</emphasis> to stop the "
20531
"<application>watch</application> command."
20532
msgstr ""
20533
20534
#: serverguide/C/installation.xml:877(para)
20535
msgid ""
20536
"If you do need to replace a faulty drive, after the drive has been replaced "
20537
"and synced, <application>grub</application> will need to be installed. To "
20538
"install <application>grub</application> on the new drive, enter the "
20539
"following:"
20540
msgstr ""
20541
20542
#: serverguide/C/installation.xml:883(command)
20543
msgid "sudo grub-install /dev/md0"
20544
msgstr ""
20545
20546
#: serverguide/C/installation.xml:886(para)
20547
msgid ""
20548
"Replace <filename>/dev/md0</filename> with the appropriate array device name."
20549
msgstr ""
20550
20551
#: serverguide/C/installation.xml:894(para)
20552
msgid ""
20553
"The topic of RAID arrays is a complex one due to the plethora of ways RAID "
20554
"can be configured. Please see the following links for more information:"
20555
msgstr ""
20556
20557
#: serverguide/C/installation.xml:901(para)
20558
msgid ""
20559
"<ulink url=\"https://help.ubuntu.com/community/Installation#raid\">Ubuntu "
20560
"Wiki Articles on RAID</ulink>."
20561
msgstr ""
20562
20563
#: serverguide/C/installation.xml:907(ulink)
20564
msgid "Software RAID HOWTO"
20565
msgstr ""
20566
20567
#: serverguide/C/installation.xml:912(ulink)
20568
msgid "Managing RAID on Linux"
20569
msgstr ""
20570
20571
#: serverguide/C/installation.xml:919(title)
20572
msgid "Logical Volume Manager (LVM)"
20573
msgstr ""
20574
20575
#: serverguide/C/installation.xml:921(para)
20576
msgid ""
20577
"Logical Volume Manger, or <emphasis>LVM</emphasis>, allows administrators to "
20578
"create <emphasis>logical</emphasis> volumes out of one or multiple physical "
20579
"hard disks. LVM volumes can be created on both software RAID partitions and "
20580
"standard partitions residing on a single disk. Volumes can also be extended, "
20581
"giving greater flexibility to systems as requirements change."
20582
msgstr ""
20583
20584
#: serverguide/C/installation.xml:930(para)
20585
msgid ""
20586
"A side effect of LVM's power and flexibility is a greater degree of "
20587
"complication. Before diving into the LVM installation process, it is best to "
20588
"get familiar with some terms."
20589
msgstr ""
20590
20591
#: serverguide/C/installation.xml:937(para)
20592
msgid ""
20593
"<emphasis>Volume Group (VG):</emphasis> contains one or several Logical "
20594
"Volumes (LV)."
20595
msgstr ""
20596
20597
#: serverguide/C/installation.xml:942(para)
20598
msgid ""
20599
"<emphasis>Logical Volume (LV):</emphasis> is similar to a partition in a non-"
20600
"LVM system. Multiple Physical Volumes (PV) can make up one LV, on top of "
20601
"which resides the actual EXT3, XFS, JFS, etc filesystem."
20602
msgstr ""
20603
20604
#: serverguide/C/installation.xml:948(para)
20605
msgid ""
20606
"<emphasis>Physical Volume (PV):</emphasis> physical hard disk or software "
20607
"RAID partition. The Volume Group can be extended by adding more PVs."
20608
msgstr ""
20609
20610
#: serverguide/C/installation.xml:959(para)
20611
msgid ""
20612
"As an example this section covers installing Ubuntu Server Edition with "
20613
"<filename role=\"directory\">/srv</filename> mounted on a LVM volume. During "
20614
"the initial install only one Physical Volume (PV) will be part of the Volume "
20615
"Group (VG). Another PV will be added after install to demonstrate how a VG "
20616
"can be extended."
20617
msgstr ""
20618
20619
#: serverguide/C/installation.xml:965(para)
20620
msgid ""
20621
"There are several installation options for LVM, <emphasis>\"Guided - use the "
20622
"entire disk and setup LVM\"</emphasis> which will also allow you to assign a "
20623
"portion of the available space to LVM, <emphasis>\"Guided - use entire and "
20624
"setup encrypted LVM\"</emphasis>, or <emphasis>Manually</emphasis> setup the "
20625
"partitions and configure LVM. At this time the only way to configure a "
20626
"system with both LVM and standard partitions, during installation, is to use "
20627
"the Manual approach."
20628
msgstr ""
20629
20630
#: serverguide/C/installation.xml:982(para)
20631
msgid ""
20632
"At the <emphasis>\"Partition Disks</emphasis> screen choose "
20633
"<emphasis>\"Manual\"</emphasis>."
20634
msgstr ""
20635
20636
#: serverguide/C/installation.xml:989(para)
20637
msgid ""
20638
"Select the hard disk and on the next screen choose \"yes\" to "
20639
"<emphasis>\"Create a new empty partition table on this device\"</emphasis>."
20640
msgstr ""
20641
20642
#: serverguide/C/installation.xml:996(para)
20643
msgid ""
20644
"Next, create standard <emphasis>/boot</emphasis>, <emphasis>swap</emphasis>, "
20645
"and <emphasis>/</emphasis> partitions with whichever filesystem you prefer."
20646
msgstr ""
20647
20648
#: serverguide/C/installation.xml:1004(para)
20649
msgid ""
20650
"For the LVM <emphasis>/srv</emphasis>, create a new "
20651
"<emphasis>Logical</emphasis> partition. Then change <emphasis>\"Use "
20652
"as\"</emphasis> to <emphasis>\"physical volume for LVM\"</emphasis> then "
20653
"<emphasis>\"Done setting up the partition\"</emphasis>."
20654
msgstr ""
20655
20656
#: serverguide/C/installation.xml:1012(para)
20657
msgid ""
20658
"Now select <emphasis>\"Configure the Logical Volume Manager\"</emphasis> at "
20659
"the top, and choose <emphasis>\"Yes\"</emphasis> to write the changes to "
20660
"disk."
20661
msgstr ""
20662
20663
#: serverguide/C/installation.xml:1020(para)
20664
msgid ""
20665
"For the <emphasis>\"LVM configuration action\"</emphasis> on the next "
20666
"screen, choose <emphasis>\"Create volume group\"</emphasis>. Enter a name "
20667
"for the VG such as <emphasis>vg01</emphasis>, or something more descriptive. "
20668
"After entering a name, select the partition configured for LVM, and choose "
20669
"<emphasis>\"Continue\"</emphasis>."
20670
msgstr ""
20671
20672
#: serverguide/C/installation.xml:1029(para)
20673
msgid ""
20674
"Back at the <emphasis>\"LVM configuration action\"</emphasis> screen, select "
20675
"<emphasis>\"Create logical volume\"</emphasis>. Select the newly created "
20676
"volume group, and enter a name for the new LV, for example "
20677
"<emphasis>srv</emphasis> since that is the intended mount point. Then choose "
20678
"a size, which may be the full partition because it can always be extended "
20679
"later. Choose <emphasis>\"Finish\"</emphasis> and you should be back at the "
20680
"main <emphasis>\"Partition Disks\"</emphasis> screen."
20681
msgstr ""
20682
20683
#: serverguide/C/installation.xml:1039(para)
20684
msgid ""
20685
"Now add a filesystem to the new LVM. Select the partition under "
20686
"<emphasis>\"LVM VG vg01, LV srv\"</emphasis>, or whatever name you have "
20687
"chosen, the choose <emphasis>Use as</emphasis>. Setup a file system as "
20688
"normal selecting <emphasis>/srv</emphasis> as the mount point. Once done, "
20689
"select <emphasis>\"Done setting up the partition\"</emphasis>."
20690
msgstr ""
20691
20692
#: serverguide/C/installation.xml:1048(para)
20693
msgid ""
20694
"Finally, select <emphasis>\"Finish partitioning and write changes to "
20695
"disk\"</emphasis>. Then confirm the changes and continue with the rest of "
20696
"the installation."
20697
msgstr ""
20698
20699
#: serverguide/C/installation.xml:1056(para)
20700
msgid "There are some useful utilities to view information about LVM:"
20701
msgstr ""
20702
20703
#: serverguide/C/installation.xml:1061(para)
20704
msgid ""
20705
"<emphasis>vgdisplay:</emphasis> shows information about Volume Groups."
20706
msgstr ""
20707
20708
#: serverguide/C/installation.xml:1062(para)
20709
msgid ""
20710
"<emphasis>lvdisplay:</emphasis> has information about Logical Volumes."
20711
msgstr ""
20712
20713
#: serverguide/C/installation.xml:1063(para)
20714
msgid ""
20715
"<emphasis>pvdisplay:</emphasis> similarly displays information about "
20716
"Physical Volumes."
20717
msgstr ""
20718
20719
#: serverguide/C/installation.xml:1068(title)
20720
msgid "Extending Volume Groups"
20721
msgstr ""
20722
20723
#: serverguide/C/installation.xml:1070(para)
20724
msgid ""
20725
"Continuing with <emphasis>srv</emphasis> as an LVM volume example, this "
20726
"section covers adding a second hard disk, creating a Physical Volume (PV), "
20727
"adding it to the volume group (VG), extending the logical volume <filename "
20728
"role=\"directory\">srv</filename> and finally extending the filesystem. This "
20729
"example assumes a second hard disk has been added to the system. This hard "
20730
"disk will be named <filename>/dev/sdb</filename> in our example. BEWARE: "
20731
"make sure you don't already have an existing <filename>/dev/sdb</filename> "
20732
"before issuing the commands below. You could lose some data if you issue "
20733
"those commands on a non-empty disk. In our example we will use the entire "
20734
"disk as a physical volume (you could choose to create partitions and use "
20735
"them as different physical volumes)"
20736
msgstr ""
20737
20738
#: serverguide/C/installation.xml:1082(para)
20739
msgid "First, create the physical volume, in a terminal execute:"
20740
msgstr ""
20741
20742
#: serverguide/C/installation.xml:1087(command)
20743
msgid "sudo pvcreate /dev/sdb"
20744
msgstr ""
20745
20746
#: serverguide/C/installation.xml:1093(para)
20747
msgid "Now extend the Volume Group (VG):"
20748
msgstr ""
20749
20750
#: serverguide/C/installation.xml:1098(command)
20751
msgid "sudo vgextend vg01 /dev/sdb"
20752
msgstr ""
20753
20754
#: serverguide/C/installation.xml:1104(para)
20755
msgid ""
20756
"Use <application>vgdisplay</application> to find out the free physical "
20757
"extents - Free PE / size (the size you can allocate). We will assume a free "
20758
"size of 511 PE (equivalent to 2GB with a PE size of 4MB) and we will use the "
20759
"whole free space available. Use your own PE and/or free space."
20760
msgstr ""
20761
20762
#: serverguide/C/installation.xml:1110(para)
20763
msgid ""
20764
"The Logical Volume (LV) can now be extended by different methods, we will "
20765
"only see how to use the PE to extend the LV:"
20766
msgstr ""
20767
20768
#: serverguide/C/installation.xml:1115(command)
20769
msgid "sudo lvextend /dev/vg01/srv -l +511"
20770
msgstr ""
20771
20772
#: serverguide/C/installation.xml:1118(para)
20773
msgid ""
20774
"The <emphasis>-l</emphasis> option allows the LV to be extended using PE. "
20775
"The <emphasis>-L</emphasis> option allows the LV to be extended using Meg, "
20776
"Gig, Tera, etc bytes."
20777
msgstr ""
20778
20779
#: serverguide/C/installation.xml:1126(para)
20780
msgid ""
20781
"Even though you are supposed to be able to <emphasis>expand</emphasis> an "
20782
"ext3 or ext4 filesystem without unmounting it first, it may be a good "
20783
"pratice to unmount it anyway and check the filesystem, so that you don't "
20784
"mess up the day you want to reduce a logical volume (in that case unmounting "
20785
"first is compulsory)."
20786
msgstr ""
20787
20788
#: serverguide/C/installation.xml:1132(para)
20789
msgid ""
20790
"The following commands are for an <emphasis>EXT3</emphasis> or "
20791
"<emphasis>EXT4</emphasis> filesystem. If you are using another filesystem "
20792
"there may be other utilities available."
20793
msgstr ""
20794
20795
#: serverguide/C/installation.xml:1139(command)
20796
msgid "sudo e2fsck -f /dev/vg01/srv"
20797
msgstr ""
20798
20799
#: serverguide/C/installation.xml:1142(para)
20800
msgid ""
20801
"The <emphasis>-f</emphasis> option of <application>e2fsck</application> "
20802
"forces checking even if the system seems clean."
20803
msgstr ""
20804
20805
#: serverguide/C/installation.xml:1149(para)
20806
msgid "Finally, resize the filesystem:"
20807
msgstr ""
20808
20809
#: serverguide/C/installation.xml:1154(command)
20810
msgid "sudo resize2fs /dev/vg01/srv"
20811
msgstr ""
20812
20813
#: serverguide/C/installation.xml:1160(para)
20814
msgid "Now mount the partition and check its size."
20815
msgstr ""
20816
20817
#: serverguide/C/installation.xml:1165(command)
20818
msgid "mount /dev/vg01/srv /srv && df -h /srv"
20819
msgstr ""
20820
20821
#: serverguide/C/installation.xml:1177(para)
20822
msgid ""
20823
"See the <ulink "
20824
"url=\"https://help.ubuntu.com/community/Installation#lvm\">Ubuntu Wiki LVM "
20825
"Articles</ulink>."
20826
msgstr ""
20827
20828
#: serverguide/C/installation.xml:1182(para)
20829
msgid ""
20830
"See the <ulink url=\"http://tldp.org/HOWTO/LVM-HOWTO/index.html\">LVM "
20831
"HOWTO</ulink> for more information."
20832
msgstr ""
20833
20834
#: serverguide/C/installation.xml:1187(para)
20835
msgid ""
20836
"Another good article is <ulink "
20837
"url=\"http://www.linuxdevcenter.com/pub/a/linux/2006/04/27/managing-disk-"
20838
"space-with-lvm.html\">Managing Disk Space with LVM</ulink> on O'Reilly's "
20839
"linuxdevcenter.com site."
20840
msgstr ""
20841
20842
#: serverguide/C/installation.xml:1194(para)
20843
msgid ""
20844
"For more information on <application>fdisk</application> see the <ulink "
20845
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/fdisk.8.html\">fdisk "
20846
"man page</ulink>."
20847
msgstr ""
20848
20849
#: serverguide/C/file-server.xml:13(title)
20850
msgid "File Servers"
20851
msgstr ""
20852
20853
#: serverguide/C/file-server.xml:15(para)
20854
msgid ""
20855
"If you have more than one computer on a single network. At some point you "
20856
"will probably need to share files between them. In this section we cover "
20857
"installing and configuring FTP, NFS, and CUPS."
20858
msgstr ""
20859
20860
#: serverguide/C/file-server.xml:22(title)
20861
msgid "FTP Server"
20862
msgstr ""
20863
20864
#: serverguide/C/file-server.xml:24(para)
20865
msgid ""
20866
"File Transfer Protocol (FTP) is a TCP protocol for uploading and downloading "
20867
"files between computers. FTP works on a client/server model. The server "
20868
"component is called an <emphasis>FTP daemon</emphasis>. It continuously "
20869
"listens for FTP requests from remote clients. When a request is received, it "
20870
"manages the login and sets up the connection. For the duration of the "
20871
"session it executes any of commands sent by the FTP client."
20872
msgstr ""
20873
20874
#: serverguide/C/file-server.xml:33(para)
20875
msgid "Access to an FTP server can be managed in two ways:"
20876
msgstr ""
20877
20878
#: serverguide/C/file-server.xml:37(para)
20879
msgid "Anonymous"
20880
msgstr ""
20881
20882
#: serverguide/C/file-server.xml:40(para)
20883
msgid "Authenticated"
20884
msgstr ""
20885
20886
#: serverguide/C/file-server.xml:43(para)
20887
msgid ""
20888
"In the Anonymous mode, remote clients can access the FTP server by using the "
20889
"default user account called \"anonymous\" or \"ftp\" and sending an email "
20890
"address as the password. In the Authenticated mode a user must have an "
20891
"account and a password. User access to the FTP server directories and files "
20892
"is dependent on the permissions defined for the account used at login. As a "
20893
"general rule, the FTP daemon will hide the root directory of the FTP server "
20894
"and change it to the FTP Home directory. This hides the rest of the file "
20895
"system from remote sessions."
20896
msgstr ""
20897
20898
#: serverguide/C/file-server.xml:55(title)
20899
msgid "vsftpd - FTP Server Installation"
20900
msgstr ""
20901
20902
#: serverguide/C/file-server.xml:57(para)
20903
msgid ""
20904
"vsftpd is an FTP daemon available in Ubuntu. It is easy to install, set up, "
20905
"and maintain. To install <application>vsftpd</application> you can run the "
20906
"following command:"
20907
msgstr ""
20908
20909
#: serverguide/C/file-server.xml:65(command)
20910
msgid "sudo apt-get install vsftpd"
20911
msgstr ""
20912
20913
#: serverguide/C/file-server.xml:71(title)
20914
msgid "Anonymous FTP Configuration"
20915
msgstr ""
20916
20917
#: serverguide/C/file-server.xml:73(para)
20918
msgid ""
20919
"By default <application>vsftpd</application> is configured to only allow "
20920
"anonymous download. During installation a <emphasis>ftp</emphasis> user is "
20921
"created with a home directory of <filename>/home/ftp</filename>. This is the "
20922
"default FTP directory."
20923
msgstr ""
20924
20925
#: serverguide/C/file-server.xml:80(para)
20926
msgid ""
20927
"If you wish to change this location, to <filename>/srv/ftp</filename> for "
20928
"example, simply create a directory in another location and change the "
20929
"<emphasis>ftp</emphasis> user's home directory:"
20930
msgstr ""
20931
20932
#: serverguide/C/file-server.xml:87(command)
20933
msgid "sudo mkdir /srv/ftp"
20934
msgstr ""
20935
20936
#: serverguide/C/file-server.xml:88(command)
20937
msgid "sudo usermod -d /srv/ftp ftp"
20938
msgstr ""
20939
20940
#: serverguide/C/file-server.xml:91(para)
20941
msgid "After making the change restart <application>vsftpd</application>:"
20942
msgstr ""
20943
20944
#: serverguide/C/file-server.xml:96(command) serverguide/C/file-server.xml:124(command) serverguide/C/file-server.xml:189(command) serverguide/C/file-server.xml:237(command)
20945
msgid "sudo /etc/init.d/vsftpd restart"
20946
msgstr ""
20947
20948
#: serverguide/C/file-server.xml:99(para)
20949
msgid ""
20950
"Finally, copy any files and directories you would like to make available "
20951
"through anonymous FTP to <filename>/srv/ftp</filename>."
20952
msgstr ""
20953
20954
#: serverguide/C/file-server.xml:106(title)
20955
msgid "User Authenticated FTP Configuration"
20956
msgstr ""
20957
20958
#: serverguide/C/file-server.xml:108(para)
20959
msgid ""
20960
"To configure <application>vsftpd</application> to authenticate system users "
20961
"and allow them to upload files edit <filename>/etc/vsftpd.conf</filename>:"
20962
msgstr ""
20963
20964
#: serverguide/C/file-server.xml:114(programlisting)
20965
#, no-wrap
20966
msgid ""
20967
"\n"
20968
"local_enable=YES\n"
20969
"write_enable=YES\n"
20970
msgstr ""
20971
20972
#: serverguide/C/file-server.xml:119(para)
20973
msgid "Now restart <application>vsftpd</application>:"
20974
msgstr ""
20975
20976
#: serverguide/C/file-server.xml:127(para)
20977
msgid ""
20978
"Now when system users login to FTP they will start in their "
20979
"<emphasis>home</emphasis> directories where they can download, upload, "
20980
"create directories, etc."
20981
msgstr ""
20982
20983
#: serverguide/C/file-server.xml:133(para)
20984
msgid ""
20985
"Similarly, by default, the anonymous users are not allowed to upload files "
20986
"to FTP server. To change this setting, you should uncomment the following "
20987
"line, and restart <application>vsftpd</application>:"
20988
msgstr ""
20989
20990
#: serverguide/C/file-server.xml:140(programlisting)
20991
#, no-wrap
20992
msgid ""
20993
"\n"
20994
"anon_upload_enable=YES\n"
20995
msgstr ""
20996
20997
#: serverguide/C/file-server.xml:145(para)
20998
msgid ""
20999
"Enabling anonymous FTP upload can be an extreme security risk. It is best to "
21000
"not enable anonymous upload on servers accessed directly from the Internet."
21001
msgstr ""
21002
21003
#: serverguide/C/file-server.xml:151(para)
21004
msgid ""
21005
"The configuration file consists of many configuration parameters. The "
21006
"information about each parameter is available in the configuration file. "
21007
"Alternatively, you can refer to the man page, <command>man 5 "
21008
"vsftpd.conf</command> for details of each parameter."
21009
msgstr ""
21010
21011
#: serverguide/C/file-server.xml:162(title)
21012
msgid "Securing FTP"
21013
msgstr ""
21014
21015
#: serverguide/C/file-server.xml:164(para)
21016
msgid ""
21017
"There are options in <filename>/etc/vsftpd.conf</filename> to help make "
21018
"<application>vsftpd</application> more secure. For example users can be "
21019
"limited to their home directories by uncommenting:"
21020
msgstr ""
21021
21022
#: serverguide/C/file-server.xml:170(programlisting)
21023
#, no-wrap
21024
msgid ""
21025
"\n"
21026
"chroot_local_user=YES\n"
21027
msgstr ""
21028
21029
#: serverguide/C/file-server.xml:174(para)
21030
msgid ""
21031
"You can also limit a specific list of users to just their home directories:"
21032
msgstr ""
21033
21034
#: serverguide/C/file-server.xml:178(programlisting)
21035
#, no-wrap
21036
msgid ""
21037
"\n"
21038
"chroot_list_enable=YES\n"
21039
"chroot_list_file=/etc/vsftpd.chroot_list\n"
21040
msgstr ""
21041
21042
#: serverguide/C/file-server.xml:183(para)
21043
msgid ""
21044
"After uncommenting the above options, create a "
21045
"<filename>/etc/vsftpd.chroot_list</filename> containing a list of users one "
21046
"per line. Then restart <application>vsftpd</application>:"
21047
msgstr ""
21048
21049
#: serverguide/C/file-server.xml:192(para)
21050
msgid ""
21051
"Also, the <filename>/etc/ftpusers</filename> file is a list of users that "
21052
"are <emphasis>disallowed</emphasis> FTP access. The default list includes "
21053
"root, daemon, nobody, etc. To disable FTP access for additional users simply "
21054
"add them to the list."
21055
msgstr ""
21056
21057
#: serverguide/C/file-server.xml:199(para)
21058
msgid ""
21059
"FTP can also be encrypted using <emphasis>FTPS</emphasis>. Different from "
21060
"<emphasis>SFTP</emphasis>, <emphasis>FTPS</emphasis> is FTP over Secure "
21061
"Socket Layer (SSL). <emphasis>SFTP</emphasis> is a FTP like session over an "
21062
"encrypted <emphasis>SSH</emphasis> connection. A major difference is that "
21063
"users of SFTP need to have a <emphasis>shell</emphasis> account on the "
21064
"system, instead of a <emphasis>nologin</emphasis> shell. Providing all users "
21065
"with a shell may not be ideal for some environments, such as a shared web "
21066
"host."
21067
msgstr ""
21068
21069
#: serverguide/C/file-server.xml:208(para)
21070
msgid ""
21071
"To configure <emphasis>FTPS</emphasis>, edit "
21072
"<filename>/etc/vsftpd.conf</filename> and at the bottom add:"
21073
msgstr ""
21074
21075
#: serverguide/C/file-server.xml:212(programlisting)
21076
#, no-wrap
21077
msgid ""
21078
"\n"
21079
"ssl_enable=Yes\n"
21080
msgstr ""
21081
21082
#: serverguide/C/file-server.xml:216(para)
21083
msgid "Also, notice the certificate and key related options:"
21084
msgstr ""
21085
21086
#: serverguide/C/file-server.xml:220(programlisting)
21087
#, no-wrap
21088
msgid ""
21089
"\n"
21090
"rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem\n"
21091
"rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key\n"
21092
msgstr ""
21093
21094
#: serverguide/C/file-server.xml:225(para)
21095
msgid ""
21096
"By default these options are set the certificate and key provided by the "
21097
"<application>ssl-cert</application> package. In a production environment "
21098
"these should be replaced with a certificate and key generated for the "
21099
"specific host. For more information on certificates see <xref "
21100
"linkend=\"certificates-and-security\"/>."
21101
msgstr ""
21102
21103
#: serverguide/C/file-server.xml:231(para)
21104
msgid ""
21105
"Now restart <application>vsftpd</application>, and non-anonymous users will "
21106
"be forced to use <emphasis>FTPS</emphasis>:"
21107
msgstr ""
21108
21109
#: serverguide/C/file-server.xml:240(para)
21110
msgid ""
21111
"To allow users with a shell of <filename>/usr/sbin/nologin</filename> access "
21112
"to FTP, but have no shell access, edit <filename>/etc/shells</filename> "
21113
"adding the <emphasis>nologin</emphasis> shell:"
21114
msgstr ""
21115
21116
#: serverguide/C/file-server.xml:245(programlisting)
21117
#, no-wrap
21118
msgid ""
21119
"\n"
21120
"# /etc/shells: valid login shells\n"
21121
"/bin/csh\n"
21122
"/bin/sh\n"
21123
"/usr/bin/es\n"
21124
"/usr/bin/ksh\n"
21125
"/bin/ksh\n"
21126
"/usr/bin/rc\n"
21127
"/usr/bin/tcsh\n"
21128
"/bin/tcsh\n"
21129
"/usr/bin/esh\n"
21130
"/bin/dash\n"
21131
"/bin/bash\n"
21132
"/bin/rbash\n"
21133
"/usr/bin/screen\n"
21134
"/usr/sbin/nologin\n"
21135
msgstr ""
21136
21137
#: serverguide/C/file-server.xml:263(para)
21138
msgid ""
21139
"This is necessary because, by default <application>vsftpd</application> uses "
21140
"PAM for authentication, and the <filename>/etc/pam.d/vsftpd</filename> "
21141
"configuration file contains:"
21142
msgstr ""
21143
21144
#: serverguide/C/file-server.xml:268(programlisting)
21145
#, no-wrap
21146
msgid ""
21147
"\n"
21148
"auth required pam_shells.so\n"
21149
msgstr ""
21150
21151
#: serverguide/C/file-server.xml:272(para)
21152
msgid ""
21153
"The <emphasis>shells</emphasis> PAM module restricts access to shells listed "
21154
"in the <filename>/etc/shells</filename> file."
21155
msgstr ""
21156
21157
#: serverguide/C/file-server.xml:277(para)
21158
msgid ""
21159
"Most popular FTP clients can be configured connect using FTPS. The "
21160
"<application>lftp</application> command line FTP client has the ability to "
21161
"use FTPS as well."
21162
msgstr ""
21163
21164
#: serverguide/C/file-server.xml:288(para)
21165
msgid ""
21166
"See the <ulink url=\"http://vsftpd.beasts.org/vsftpd_conf.html\">vsftpd "
21167
"website</ulink> for more information."
21168
msgstr ""
21169
21170
#: serverguide/C/file-server.xml:293(para)
21171
msgid ""
21172
"For detailed <filename>/etc/vsftpd.conf</filename> options see the <ulink "
21173
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/vsftpd.conf.5.html\">"
21174
"vsftpd.conf man page</ulink>."
21175
msgstr ""
21176
21177
#: serverguide/C/file-server.xml:299(para)
21178
msgid ""
21179
"The CodeGurus article <ulink "
21180
"url=\"http://www.codeguru.com/csharp/.net/net_general/internet/article.php/c1"
21181
"4329\"> FTPS vs. SFTP: What to Choose</ulink> has useful information "
21182
"contrasting FTPS and SFTP."
21183
msgstr ""
21184
21185
#: serverguide/C/file-server.xml:305(para)
21186
msgid ""
21187
"Also, for more information see the <ulink "
21188
"url=\"https://help.ubuntu.com/community/vsftpd\">Ubuntu Wiki vsftpd</ulink> "
21189
"page."
21190
msgstr ""
21191
21192
#: serverguide/C/file-server.xml:315(title)
21193
msgid "Network File System (NFS)"
21194
msgstr ""
21195
21196
#: serverguide/C/file-server.xml:316(para)
21197
msgid ""
21198
"NFS allows a system to share directories and files with others over a "
21199
"network. By using NFS, users and programs can access files on remote systems "
21200
"almost as if they were local files."
21201
msgstr ""
21202
21203
#: serverguide/C/file-server.xml:322(para)
21204
msgid "Some of the most notable benefits that NFS can provide are:"
21205
msgstr ""
21206
21207
#: serverguide/C/file-server.xml:328(para)
21208
msgid ""
21209
"Local workstations use less disk space because commonly used data can be "
21210
"stored on a single machine and still remain accessible to others over the "
21211
"network."
21212
msgstr ""
21213
21214
#: serverguide/C/file-server.xml:333(para)
21215
msgid ""
21216
"There is no need for users to have separate home directories on every "
21217
"network machine. Home directories could be set up on the NFS server and made "
21218
"available throughout the network."
21219
msgstr ""
21220
21221
#: serverguide/C/file-server.xml:339(para)
21222
msgid ""
21223
"Storage devices such as floppy disks, CDROM drives, and USB Thumb drives can "
21224
"be used by other machines on the network. This may reduce the number of "
21225
"removable media drives throughout the network."
21226
msgstr ""
21227
21228
#: serverguide/C/file-server.xml:349(para)
21229
msgid ""
21230
"At a terminal prompt enter the following command to install the NFS Server:"
21231
msgstr ""
21232
21233
#: serverguide/C/file-server.xml:355(command)
21234
msgid "sudo apt-get install nfs-kernel-server"
21235
msgstr ""
21236
21237
#: serverguide/C/file-server.xml:361(para)
21238
msgid ""
21239
"You can configure the directories to be exported by adding them to the "
21240
"<filename>/etc/exports</filename> file. For example:"
21241
msgstr ""
21242
21243
#: serverguide/C/file-server.xml:366(screen)
21244
#, no-wrap
21245
msgid ""
21246
"\n"
21247
"/ubuntu *(ro,sync,no_root_squash)\n"
21248
"/home *(rw,sync,no_root_squash)\n"
21249
msgstr ""
21250
21251
#: serverguide/C/file-server.xml:372(para)
21252
msgid ""
21253
"You can replace * with one of the hostname formats. Make the hostname "
21254
"declaration as specific as possible so unwanted systems cannot access the "
21255
"NFS mount."
21256
msgstr ""
21257
21258
#: serverguide/C/file-server.xml:378(para)
21259
msgid ""
21260
"To start the NFS server, you can run the following command at a terminal "
21261
"prompt:"
21262
msgstr ""
21263
21264
#: serverguide/C/file-server.xml:383(command)
21265
msgid "sudo /etc/init.d/nfs-kernel-server start"
21266
msgstr ""
21267
21268
#: serverguide/C/file-server.xml:388(title)
21269
msgid "NFS Client Configuration"
21270
msgstr ""
21271
21272
#: serverguide/C/file-server.xml:389(para)
21273
msgid ""
21274
"Use the <application>mount</application> command to mount a shared NFS "
21275
"directory from another machine, by typing a command line similar to the "
21276
"following at a terminal prompt:"
21277
msgstr ""
21278
21279
#: serverguide/C/file-server.xml:395(command)
21280
msgid "sudo mount example.hostname.com:/ubuntu /local/ubuntu"
21281
msgstr ""
21282
21283
#: serverguide/C/file-server.xml:399(para)
21284
msgid ""
21285
"The mount point directory <filename>/local/ubuntu</filename> must exist. "
21286
"There should be no files or subdirectories in the "
21287
"<filename>/local/ubuntu</filename> directory."
21288
msgstr ""
21289
21290
#: serverguide/C/file-server.xml:406(para)
21291
msgid ""
21292
"An alternate way to mount an NFS share from another machine is to add a line "
21293
"to the <filename>/etc/fstab</filename> file. The line must state the "
21294
"hostname of the NFS server, the directory on the server being exported, and "
21295
"the directory on the local machine where the NFS share is to be mounted."
21296
msgstr ""
21297
21298
#: serverguide/C/file-server.xml:414(para)
21299
msgid ""
21300
"The general syntax for the line in <filename>/etc/fstab</filename> file is "
21301
"as follows:"
21302
msgstr ""
21303
21304
#: serverguide/C/file-server.xml:420(programlisting)
21305
#, no-wrap
21306
msgid ""
21307
"\n"
21308
"example.hostname.com:/ubuntu /local/ubuntu nfs "
21309
"rsize=8192,wsize=8192,timeo=14,intr\n"
21310
msgstr ""
21311
21312
#: serverguide/C/file-server.xml:424(para)
21313
msgid ""
21314
"If you have trouble mounting an NFS share, make sure the <application>nfs-"
21315
"common</application> package is installed on your client. To install "
21316
"<application>nfs-common</application> enter the following command at the "
21317
"terminal prompt: <screen>\n"
21318
"<command>sudo apt-get install nfs-common</command>\n"
21319
"</screen>"
21320
msgstr ""
21321
21322
#: serverguide/C/file-server.xml:437(ulink)
21323
msgid "Linux NFS faq"
21324
msgstr ""
21325
21326
#: serverguide/C/file-server.xml:439(ulink)
21327
msgid "Ubuntu Wiki NFS Howto"
21328
msgstr ""
21329
21330
#: serverguide/C/file-server.xml:445(title)
21331
msgid "CUPS - Print Server"
21332
msgstr ""
21333
21334
#: serverguide/C/file-server.xml:446(para)
21335
msgid ""
21336
"The primary mechanism for Ubuntu printing and print services is the "
21337
"<emphasis role=\"bold\">Common UNIX Printing System</emphasis> (CUPS). This "
21338
"printing system is a freely available, portable printing layer which has "
21339
"become the new standard for printing in most Linux distributions."
21340
msgstr ""
21341
21342
#: serverguide/C/file-server.xml:453(para)
21343
msgid ""
21344
"CUPS manages print jobs and queues and provides network printing using the "
21345
"standard Internet Printing Protocol (IPP), while offering support for a very "
21346
"large range of printers, from dot-matrix to laser and many in between. CUPS "
21347
"also supports PostScript Printer Description (PPD) and auto-detection of "
21348
"network printers, and features a simple web-based configuration and "
21349
"administration tool."
21350
msgstr ""
21351
21352
#: serverguide/C/file-server.xml:463(para)
21353
msgid ""
21354
"To install CUPS on your Ubuntu computer, simply use "
21355
"<application>sudo</application> with the <application>apt-get</application> "
21356
"command and give the packages to install as the first parameter. A complete "
21357
"CUPS install has many package dependencies, but they may all be specified on "
21358
"the same command line. Enter the following at a terminal prompt to install "
21359
"CUPS:"
21360
msgstr ""
21361
21362
#: serverguide/C/file-server.xml:468(command)
21363
msgid "sudo apt-get install cups"
21364
msgstr ""
21365
21366
#: serverguide/C/file-server.xml:471(para)
21367
msgid ""
21368
"Upon authenticating with your user password, the packages should be "
21369
"downloaded and installed without error. Upon the conclusion of installation, "
21370
"the CUPS server will be started automatically."
21371
msgstr ""
21372
21373
#: serverguide/C/file-server.xml:476(para)
21374
msgid ""
21375
"For troubleshooting purposes, you can access CUPS server errors via the "
21376
"error log file at: <filename>/var/log/cups/error_log</filename>. If the "
21377
"error log does not show enough information to troubleshoot any problems you "
21378
"encounter, the verbosity of the CUPS log can be increased by changing the "
21379
"<emphasis role=\"bold\">LogLevel</emphasis> directive in the configuration "
21380
"file (discussed below) to \"debug\" or even \"debug2\", which logs "
21381
"everything, from the default of \"info\". If you make this change, remember "
21382
"to change it back once you've solved your problem, to prevent the log file "
21383
"from becoming overly large."
21384
msgstr ""
21385
21386
#: serverguide/C/file-server.xml:489(para)
21387
msgid ""
21388
"The Common UNIX Printing System server's behavior is configured through the "
21389
"directives contained in the file <filename>/etc/cups/cupsd.conf</filename>. "
21390
"The CUPS configuration file follows the same syntax as the primary "
21391
"configuration file for the Apache HTTP server, so users familiar with "
21392
"editing Apache's configuration file should feel at ease when editing the "
21393
"CUPS configuration file. Some examples of settings you may wish to change "
21394
"initially will be presented here."
21395
msgstr ""
21396
21397
#: serverguide/C/file-server.xml:499(para)
21398
msgid ""
21399
"Prior to editing the configuration file, you should make a copy of the "
21400
"original file and protect it from writing, so you will have the original "
21401
"settings as a reference, and to reuse as necessary."
21402
msgstr ""
21403
21404
#: serverguide/C/file-server.xml:503(para)
21405
msgid ""
21406
"Copy the <filename>/etc/cups/cupsd.conf</filename> file and protect it from "
21407
"writing with the following commands, issued at a terminal prompt:"
21408
msgstr ""
21409
21410
#: serverguide/C/file-server.xml:509(command)
21411
msgid "sudo cp /etc/cups/cupsd.conf /etc/cups/cupsd.conf.original"
21412
msgstr ""
21413
21414
#: serverguide/C/file-server.xml:510(command)
21415
msgid "sudo chmod a-w /etc/cups/cupsd.conf.original"
21416
msgstr ""
21417
21418
#: serverguide/C/file-server.xml:515(para)
21419
msgid ""
21420
"<emphasis role=\"bold\">ServerAdmin</emphasis>: To configure the email "
21421
"address of the designated administrator of the CUPS server, simply edit the "
21422
"<filename>/etc/cups/cupsd.conf</filename> configuration file with your "
21423
"preferred text editor, and add or modify the <emphasis "
21424
"role=\"italics\">ServerAdmin</emphasis> line accordingly. For example, if "
21425
"you are the Administrator for the CUPS server, and your e-mail address is "
21426
"'bjoy@somebigco.com', then you would modify the ServerAdmin line to appear "
21427
"as such:"
21428
msgstr ""
21429
21430
#: serverguide/C/file-server.xml:526(screen)
21431
#, no-wrap
21432
msgid ""
21433
"\n"
21434
"ServerAdmin bjoy@somebigco.com\n"
21435
msgstr ""
21436
21437
#: serverguide/C/file-server.xml:532(para)
21438
msgid ""
21439
"<emphasis role=\"bold\">Listen</emphasis>: By default on Ubuntu, the CUPS "
21440
"server installation listens only on the loopback interface at IP address "
21441
"<emphasis>127.0.0.1</emphasis>. In order to instruct the CUPS server to "
21442
"listen on an actual network adapter's IP address, you must specify either a "
21443
"hostname, the IP address, or optionally, an IP address/port pairing via the "
21444
"addition of a Listen directive. For example, if your CUPS server resides on "
21445
"a local network at the IP address <emphasis "
21446
"role=\"italics\">192.168.10.250</emphasis> and you'd like to make it "
21447
"accessible to the other systems on this subnetwork, you would edit the "
21448
"<filename>/etc/cups/cupsd.conf</filename> and add a Listen directive, as "
21449
"such:"
21450
msgstr ""
21451
21452
#: serverguide/C/file-server.xml:546(screen)
21453
#, no-wrap
21454
msgid ""
21455
"\n"
21456
"Listen 127.0.0.1:631 # existing loopback Listen\n"
21457
"Listen /var/run/cups/cups.sock # existing socket Listen\n"
21458
"Listen 192.168.10.250:631 # Listen on the LAN interface, Port 631 "
21459
"(IPP)\n"
21460
msgstr ""
21461
21462
#: serverguide/C/file-server.xml:552(para)
21463
msgid ""
21464
"In the example above, you may comment out or remove the reference to the "
21465
"Loopback address (127.0.0.1) if you do not wish <application>cupsd "
21466
"</application> to listen on that interface, but would rather have it only "
21467
"listen on the Ethernet interfaces of the Local Area Network (LAN). To enable "
21468
"listening for all network interfaces for which a certain hostname is bound, "
21469
"including the Loopback, you could create a Listen entry for the hostname "
21470
"<emphasis>socrates</emphasis> as such:"
21471
msgstr ""
21472
21473
#: serverguide/C/file-server.xml:562(screen)
21474
#, no-wrap
21475
msgid ""
21476
"\n"
21477
"Listen socrates:631 # Listen on all interfaces for the hostname 'socrates'\n"
21478
msgstr ""
21479
21480
#: serverguide/C/file-server.xml:566(para)
21481
msgid ""
21482
"or by omitting the Listen directive and using <emphasis>Port</emphasis> "
21483
"instead, as in:"
21484
msgstr ""
21485
21486
#: serverguide/C/file-server.xml:568(screen)
21487
#, no-wrap
21488
msgid ""
21489
"\n"
21490
"Port 631 # Listen on port 631 on all interfaces\n"
21491
msgstr ""
21492
21493
#: serverguide/C/file-server.xml:575(para)
21494
msgid ""
21495
"For more examples of configuration directives in the CUPS server "
21496
"configuration file, view the associated system manual page by entering the "
21497
"following command at a terminal prompt:"
21498
msgstr ""
21499
21500
#: serverguide/C/file-server.xml:582(command)
21501
msgid "man cupsd.conf"
21502
msgstr ""
21503
21504
#: serverguide/C/file-server.xml:586(para)
21505
msgid ""
21506
"Whenever you make changes to the <filename>/etc/cups/cupsd.conf</filename> "
21507
"configuration file, you'll need to restart the CUPS server by typing the "
21508
"following command at a terminal prompt:"
21509
msgstr ""
21510
21511
#: serverguide/C/file-server.xml:592(command)
21512
msgid "sudo /etc/init.d/cups restart"
21513
msgstr ""
21514
21515
#: serverguide/C/file-server.xml:598(title)
21516
msgid "Web Interface"
21517
msgstr ""
21518
21519
#: serverguide/C/file-server.xml:600(para)
21520
msgid ""
21521
"CUPS can be configured and monitored using a web interface, which by default "
21522
"is available at <ulink "
21523
"url=\"http://localhost:631/admin\">http://localhost:631/admin</ulink>. The "
21524
"web interface can be used to perform all printer management tasks."
21525
msgstr ""
21526
21527
#: serverguide/C/file-server.xml:604(para)
21528
msgid ""
21529
"In order to perform administrative tasks via the web interface, you must "
21530
"either have the root account enabled on your server, or authenticate as a "
21531
"user in the <emphasis role=\"italic\">lpadmin</emphasis> group. For security "
21532
"reasons, CUPS won't authenticate a user that doesn't have a password."
21533
msgstr ""
21534
21535
#: serverguide/C/file-server.xml:607(para)
21536
msgid ""
21537
"To add a user to the <emphasis role=\"italic\">lpadmin</emphasis> group, run "
21538
"at the terminal prompt: <screen>\n"
21539
"<command>sudo usermod -aG lpadmin username</command>\n"
21540
"</screen>"
21541
msgstr ""
21542
21543
#: serverguide/C/file-server.xml:613(para)
21544
msgid ""
21545
"Further documentation is available in the <emphasis "
21546
"role=\"italic\">Documentation/Help</emphasis> tab of the web interface."
21547
msgstr ""
21548
21549
#: serverguide/C/file-server.xml:621(ulink)
21550
msgid "CUPS Website"
21551
msgstr ""
21552
21553
#: serverguide/C/file-server.xml:624(ulink)
21554
msgid "Ubuntu Wiki CUPS page"
21555
msgstr ""
21556
21557
#: serverguide/C/dns.xml:13(title)
21558
msgid "Domain Name Service (DNS)"
21559
msgstr ""
21560
21561
#: serverguide/C/dns.xml:14(para)
21562
msgid ""
21563
"Domain Name Service (DNS) is an Internet service that maps IP addresses and "
21564
"fully qualified domain names (FQDN) to one another. In this way, DNS "
21565
"alleviates the need to remember IP addresses. Computers that run DNS are "
21566
"called <emphasis>name servers</emphasis>. Ubuntu ships with "
21567
"<application>BIND</application> (Berkley Internet Naming Daemon), the most "
21568
"common program used for maintaining a name server on Linux."
21569
msgstr ""
21570
21571
#: serverguide/C/dns.xml:24(para)
21572
msgid ""
21573
"At a terminal prompt, enter the following command to install "
21574
"<application>dns</application>:"
21575
msgstr ""
21576
21577
#: serverguide/C/dns.xml:28(command)
21578
msgid "sudo apt-get install bind9"
21579
msgstr ""
21580
21581
#: serverguide/C/dns.xml:30(para)
21582
msgid ""
21583
"A very useful package for testing and troubleshooting DNS issues is the "
21584
"dnsutils package. To install <application>dnsutils</application> enter the "
21585
"following:"
21586
msgstr ""
21587
21588
#: serverguide/C/dns.xml:35(command)
21589
msgid "sudo apt-get install dnsutils"
21590
msgstr ""
21591
21592
#: serverguide/C/dns.xml:40(para)
21593
msgid ""
21594
"There a many ways to configure <application>BIND9</application>. Some of the "
21595
"most common configurations are a caching nameserver, primary master, and a "
21596
"as a secondary master."
21597
msgstr ""
21598
21599
#: serverguide/C/dns.xml:46(para)
21600
msgid ""
21601
"When configured as a caching nameserver BIND9 will find the answer to name "
21602
"queries and remember the answer when the domain is queried again."
21603
msgstr ""
21604
21605
#: serverguide/C/dns.xml:52(para)
21606
msgid ""
21607
"As a primary master server BIND9 reads the data for a zone from a file on "
21608
"it's host and is authoritative for that zone."
21609
msgstr ""
21610
21611
#: serverguide/C/dns.xml:57(para)
21612
msgid ""
21613
"In a secondary master configuration BIND9 gets the zone data from another "
21614
"nameserver authoritative for the zone."
21615
msgstr ""
21616
21617
#: serverguide/C/dns.xml:65(para)
21618
msgid ""
21619
"The DNS configuration files are stored in the <filename>/etc/bind</filename> "
21620
"directory. The primary configuration file is "
21621
"<filename>/etc/bind/named.conf</filename>."
21622
msgstr ""
21623
21624
#: serverguide/C/dns.xml:72(para)
21625
msgid ""
21626
"The <emphasis>include</emphasis> line specifies the filename which contains "
21627
"the DNS options. The <emphasis>directory</emphasis> line in the "
21628
"<filename>/etc/bind/named.conf.options</filename> file tells DNS where to "
21629
"look for files. All files BIND uses will be relative to this directory."
21630
msgstr ""
21631
21632
#: serverguide/C/dns.xml:80(para)
21633
msgid ""
21634
"The file named <filename>/etc/bind/db.root</filename> describes the root "
21635
"nameservers in the world. The servers change over time, so the "
21636
"<filename>/etc/bind/db.root</filename> file must be maintained now and then. "
21637
"This is usually done as updates to the <application>bind9</application> "
21638
"package. The <emphasis>zone</emphasis> section defines a master server, and "
21639
"it is stored in a file mentioned in the <emphasis>file</emphasis> option."
21640
msgstr ""
21641
21642
#: serverguide/C/dns.xml:90(para)
21643
msgid ""
21644
"It is possible to configure the same server to be a caching name server, "
21645
"primary master, and secondary master. A server can be the Start of Authority "
21646
"(SOA) for one zone, while providing secondary service for another zone. All "
21647
"the while providing caching services for hosts on the local LAN."
21648
msgstr ""
21649
21650
#: serverguide/C/dns.xml:98(title)
21651
msgid "Caching Nameserver"
21652
msgstr ""
21653
21654
#: serverguide/C/dns.xml:99(para)
21655
msgid ""
21656
"The default configuration is setup to act as a caching server. All that is "
21657
"required is simply adding the IP Addresses of your ISP's DNS servers. Simply "
21658
"uncomment and edit the following in "
21659
"<filename>/etc/bind/named.conf.options</filename>:"
21660
msgstr ""
21661
21662
#: serverguide/C/dns.xml:103(programlisting)
21663
#, no-wrap
21664
msgid ""
21665
"\n"
21666
"forwarders {\n"
21667
" 1.2.3.4;\n"
21668
" 5.6.7.8;\n"
21669
" };\n"
21670
msgstr ""
21671
21672
#: serverguide/C/dns.xml:110(para)
21673
msgid ""
21674
"Replace <emphasis>1.2.3.4</emphasis> and <emphasis>5.6.7.8</emphasis> with "
21675
"the IP Adresses of actual nameservers."
21676
msgstr ""
21677
21678
#: serverguide/C/dns.xml:114(para)
21679
msgid ""
21680
"Now restart the DNS server, to enable the new configuration. From a terminal "
21681
"prompt:"
21682
msgstr ""
21683
21684
#: serverguide/C/dns.xml:118(command) serverguide/C/dns.xml:194(command) serverguide/C/dns.xml:253(command) serverguide/C/dns.xml:312(command) serverguide/C/dns.xml:561(command)
21685
msgid "sudo /etc/init.d/bind9 restart"
21686
msgstr ""
21687
21688
#: serverguide/C/dns.xml:120(para)
21689
msgid ""
21690
"See <xref linkend=\"dns-testing-dig\"/> for information on testing a caching "
21691
"DNS server."
21692
msgstr ""
21693
21694
#: serverguide/C/dns.xml:125(title)
21695
msgid "Primary Master"
21696
msgstr ""
21697
21698
#: serverguide/C/dns.xml:126(para)
21699
msgid ""
21700
"In this section <application>BIND9</application> will be configured as the "
21701
"Primary Master for the domain <emphasis>example.com</emphasis>. Simply "
21702
"replace <emphasis role=\"italic\">example.com</emphasis> with your FQDN "
21703
"(Fully Qualified Domain Name)."
21704
msgstr ""
21705
21706
#: serverguide/C/dns.xml:132(title)
21707
msgid "Forward Zone File"
21708
msgstr ""
21709
21710
#: serverguide/C/dns.xml:133(para)
21711
msgid ""
21712
"To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the "
21713
"first step is to edit <filename>/etc/bind/named.conf.local</filename>:"
21714
msgstr ""
21715
21716
#: serverguide/C/dns.xml:137(programlisting)
21717
#, no-wrap
21718
msgid ""
21719
"\n"
21720
"zone \"example.com\" {\n"
21721
"\ttype master;\n"
21722
" file \"/etc/bind/db.example.com\";\n"
21723
"};\n"
21724
msgstr ""
21725
21726
#: serverguide/C/dns.xml:143(para)
21727
msgid ""
21728
"Now use an existing zone file as a template to create the "
21729
"<filename>/etc/bind/db.example.com</filename> file:"
21730
msgstr ""
21731
21732
#: serverguide/C/dns.xml:147(command)
21733
msgid "sudo cp /etc/bind/db.local /etc/bind/db.example.com"
21734
msgstr ""
21735
21736
#: serverguide/C/dns.xml:149(para)
21737
msgid ""
21738
"Edit the new zone file <filename>/etc/bind/db.example.com</filename> change "
21739
"<emphasis>localhost.</emphasis> to the FQDN of your server, leaving the "
21740
"additional \".\" at the end. Change <emphasis>127.0.0.1</emphasis> to the "
21741
"nameserver's IP Address and <emphasis>root.localhost</emphasis> to a valid "
21742
"email address, but with a \".\" instead of the usual \"@\" symbol, again "
21743
"leaving the \".\" at the end."
21744
msgstr ""
21745
21746
#: serverguide/C/dns.xml:155(para)
21747
msgid ""
21748
"Also, create an <emphasis>A record</emphasis> for <emphasis "
21749
"role=\"italic\">ns.example.com</emphasis>. The name server in this example:"
21750
msgstr ""
21751
21752
#: serverguide/C/dns.xml:159(programlisting)
21753
#, no-wrap
21754
msgid ""
21755
"\n"
21756
";\n"
21757
"; BIND data file for local loopback interface\n"
21758
";\n"
21759
"$TTL 604800\n"
21760
"@ IN SOA ns.example.com. root.example.com. (\n"
21761
" 2 ; Serial\n"
21762
" 604800 ; Refresh\n"
21763
" 86400 ; Retry\n"
21764
" 2419200 ; Expire\n"
21765
" 604800 ) ; Negative Cache TTL\n"
21766
";\n"
21767
"@ IN NS ns.example.com.\n"
21768
"@ IN A 127.0.0.1\n"
21769
"@ IN AAAA ::1\n"
21770
"ns IN A 192.168.1.10\n"
21771
msgstr ""
21772
21773
#: serverguide/C/dns.xml:176(para)
21774
msgid ""
21775
"You must increment the <emphasis>Serial Number</emphasis> every time you "
21776
"make changes to the zone file. If you make multiple changes before "
21777
"restarting BIND9, simply increment the Serial once."
21778
msgstr ""
21779
21780
#: serverguide/C/dns.xml:180(para)
21781
msgid ""
21782
"Now, you can add DNS records to the bottom of the zone file. See <xref "
21783
"linkend=\"dns-record-types\"/> for details."
21784
msgstr ""
21785
21786
#: serverguide/C/dns.xml:184(para)
21787
msgid ""
21788
"Many admins like to use the last date edited as the serial of a zone, such "
21789
"as <emphasis>2007010100</emphasis> which is yyyymmddss (where "
21790
"<emphasis>ss</emphasis> is the Serial Number)"
21791
msgstr ""
21792
21793
#: serverguide/C/dns.xml:189(para)
21794
msgid ""
21795
"Once you have made a change to the zone file "
21796
"<application>BIND9</application> will need to be restarted for the changes "
21797
"to take effect:"
21798
msgstr ""
21799
21800
#: serverguide/C/dns.xml:198(title)
21801
msgid "Reverse Zone File"
21802
msgstr ""
21803
21804
#: serverguide/C/dns.xml:199(para)
21805
msgid ""
21806
"Now that the zone is setup and resolving names to IP Adresses a "
21807
"<emphasis>Reverse zone</emphasis> is also required. A Reverse zone allows "
21808
"DNS to resolve an address to a name."
21809
msgstr ""
21810
21811
#: serverguide/C/dns.xml:203(para)
21812
msgid "Edit /etc/bind/named.conf.local and add the following:"
21813
msgstr ""
21814
21815
#: serverguide/C/dns.xml:206(programlisting)
21816
#, no-wrap
21817
msgid ""
21818
"\n"
21819
"zone \"1.168.192.in-addr.arpa\" {\n"
21820
" type master;\n"
21821
" notify no;\n"
21822
" file \"/etc/bind/db.192\";\n"
21823
"};\n"
21824
msgstr ""
21825
21826
#: serverguide/C/dns.xml:214(para)
21827
msgid ""
21828
"Replace <emphasis>1.168.192</emphasis> with the first three octets of "
21829
"whatever network you are using. Also, name the zone file "
21830
"<filename>/etc/bind/db.192</filename> appropriately. It should match the "
21831
"first octet of your network."
21832
msgstr ""
21833
21834
#: serverguide/C/dns.xml:219(para)
21835
msgid "Now create the <filename>/etc/bind/db.192</filename> file:"
21836
msgstr ""
21837
21838
#: serverguide/C/dns.xml:223(command)
21839
msgid "sudo cp /etc/bind/db.127 /etc/bind/db.192"
21840
msgstr ""
21841
21842
#: serverguide/C/dns.xml:225(para)
21843
msgid ""
21844
"Next edit <filename>/etc/bind/db.192</filename> changing the basically the "
21845
"same options as <filename>/etc/bind/db.example.com</filename>:"
21846
msgstr ""
21847
21848
#: serverguide/C/dns.xml:229(programlisting)
21849
#, no-wrap
21850
msgid ""
21851
"\n"
21852
";\n"
21853
"; BIND reverse data file for local loopback interface\n"
21854
";\n"
21855
"$TTL 604800\n"
21856
"@ IN SOA ns.example.com. root.example.com. (\n"
21857
" 2 ; Serial\n"
21858
" 604800 ; Refresh\n"
21859
" 86400 ; Retry\n"
21860
" 2419200 ; Expire\n"
21861
" 604800 ) ; Negative Cache TTL\n"
21862
";\n"
21863
"@ IN NS ns.\n"
21864
"10 IN PTR ns.example.com.\n"
21865
msgstr ""
21866
21867
#: serverguide/C/dns.xml:244(para)
21868
msgid ""
21869
"The <emphasis>Serial Number</emphasis> in the Reverse zone needs to be "
21870
"incremented on each changes as well. For each <emphasis>A record</emphasis> "
21871
"you configure in <filename>/etc/bind/db.example.com</filename> you need to "
21872
"create a <emphasis>PTR record</emphasis> in "
21873
"<filename>/etc/bind/db.192</filename>."
21874
msgstr ""
21875
21876
#: serverguide/C/dns.xml:249(para)
21877
msgid ""
21878
"After creating the reverse zone file restart "
21879
"<application>BIND9</application>:"
21880
msgstr ""
21881
21882
#: serverguide/C/dns.xml:258(title)
21883
msgid "Secondary Master"
21884
msgstr ""
21885
21886
#: serverguide/C/dns.xml:259(para)
21887
msgid ""
21888
"Once a <emphasis>Primary Master</emphasis> has been configured a "
21889
"<emphasis>Secondary Master</emphasis> is needed in order to maintain the "
21890
"availability of the domain should the Primary become unavailable."
21891
msgstr ""
21892
21893
#: serverguide/C/dns.xml:263(para)
21894
msgid ""
21895
"First, on the Primary Master server, the zone transfer needs to be allowed. "
21896
"Add the <emphasis>allow-transfer</emphasis> option to the example Forward "
21897
"and Reverse zone definitions in "
21898
"<filename>/etc/bind/named.conf.local</filename>:"
21899
msgstr ""
21900
21901
#: serverguide/C/dns.xml:267(programlisting)
21902
#, no-wrap
21903
msgid ""
21904
"\n"
21905
"zone \"example.com\" {\n"
21906
" type master;\n"
21907
"\tfile \"/etc/bind/db.example.com\";\n"
21908
" allow-transfer { 192.168.1.11; };\n"
21909
"};\n"
21910
"\n"
21911
"zone \"1.168.192.in-addr.arpa\" {\n"
21912
" type master;\n"
21913
" notify no;\n"
21914
" file \"/etc/bind/db.192\";\n"
21915
"\tallow-transfer { 192.168.1.11; };\n"
21916
"};\n"
21917
msgstr ""
21918
21919
#: serverguide/C/dns.xml:282(para)
21920
msgid ""
21921
"Replace <emphasis>192.168.1.11</emphasis> with the IP Address of your "
21922
"Secondary nameserver."
21923
msgstr ""
21924
21925
#: serverguide/C/dns.xml:286(para)
21926
msgid ""
21927
"Next, on the Secondary Master, install the <application>bind9</application> "
21928
"package the same way as on the Primary. Then edit the "
21929
"<filename>/etc/bind/named.conf.local</filename> and add the following "
21930
"declarations for the Forward and Reverse zones:"
21931
msgstr ""
21932
21933
#: serverguide/C/dns.xml:290(programlisting)
21934
#, no-wrap
21935
msgid ""
21936
"\n"
21937
"zone \"example.com\" {\n"
21938
"\ttype slave;\n"
21939
" file \"/var/cache/bind/db.example.com\";\n"
21940
" masters { 192.168.1.10; };\n"
21941
"}; \n"
21942
" \n"
21943
"zone \"1.168.192.in-addr.arpa\" {\n"
21944
"\ttype slave;\n"
21945
" file \"/var/cache/bind/db.192\";\n"
21946
" masters { 192.168.1.10; };\n"
21947
"};\n"
21948
msgstr ""
21949
21950
#: serverguide/C/dns.xml:304(para)
21951
msgid ""
21952
"Replace <emphasis>192.168.1.10</emphasis> with the IP Address of your "
21953
"Primary nameserver."
21954
msgstr ""
21955
21956
#: serverguide/C/dns.xml:308(para)
21957
msgid "Restart <application>BIND9</application> on the Secondary Master:"
21958
msgstr ""
21959
21960
#: serverguide/C/dns.xml:314(para)
21961
msgid ""
21962
"In <filename>/var/log/syslog</filename> you should see something similar to:"
21963
msgstr ""
21964
21965
#: serverguide/C/dns.xml:317(programlisting)
21966
#, no-wrap
21967
msgid ""
21968
"\n"
21969
"slave zone \"example.com\" (IN) loaded (serial 6)\n"
21970
"slave zone \"100.18.172.in-addr.arpa\" (IN) loaded (serial 3)\n"
21971
msgstr ""
21972
21973
#: serverguide/C/dns.xml:322(para)
21974
msgid ""
21975
"Note: A zone is only transferred if the <emphasis>Serial Number</emphasis> "
21976
"on the Primary is larger than the one on the Secondary."
21977
msgstr ""
21978
21979
#: serverguide/C/dns.xml:328(para)
21980
msgid ""
21981
"The default directory for non-authoritative zone files is "
21982
"<filename>/var/cache/bind/</filename>. This directory is also configured in "
21983
"<application>AppArmor</application> to allow the "
21984
"<application>named</application> daemon to write to. For more information on "
21985
"AppArmor see <xref linkend=\"apparmor\"/>."
21986
msgstr ""
21987
21988
#: serverguide/C/dns.xml:339(para)
21989
msgid ""
21990
"This section covers ways to help determine the cause when problems happen "
21991
"with DNS and <application>BIND9</application>."
21992
msgstr ""
21993
21994
#: serverguide/C/dns.xml:345(title)
21995
msgid "resolv.conf"
21996
msgstr ""
21997
21998
#: serverguide/C/dns.xml:346(para)
21999
msgid ""
22000
"The first step in testing <application>BIND9</application> is to add the "
22001
"nameserver's IP Address to a hosts resolver. The Primary nameserver should "
22002
"be configured as well as another host to double check things. Simply edit "
22003
"<filename>/etc/resolv.conf</filename> and add the following:"
22004
msgstr ""
22005
22006
#: serverguide/C/dns.xml:351(programlisting)
22007
#, no-wrap
22008
msgid ""
22009
"\n"
22010
"nameserver\t192.168.1.10\n"
22011
"nameserver\t192.168.1.11\n"
22012
msgstr ""
22013
22014
#: serverguide/C/dns.xml:356(para)
22015
msgid ""
22016
"You should also add the IP Address of the Secondary nameserver in case the "
22017
"Primary becomes unavailable."
22018
msgstr ""
22019
22020
#: serverguide/C/dns.xml:362(title)
22021
msgid "dig"
22022
msgstr ""
22023
22024
#: serverguide/C/dns.xml:363(para)
22025
msgid ""
22026
"If you installed the <application>dnsutils</application> package you can "
22027
"test your setup using the DNS lookup utility <application>dig</application>:"
22028
msgstr ""
22029
22030
#: serverguide/C/dns.xml:369(para)
22031
msgid ""
22032
"After installing <application>BIND9</application> use "
22033
"<application>dig</application> against the loopback interface to make sure "
22034
"it is listening on port 53. From a terminal prompt:"
22035
msgstr ""
22036
22037
#: serverguide/C/dns.xml:374(command)
22038
msgid "dig -x 127.0.0.1"
22039
msgstr ""
22040
22041
#: serverguide/C/dns.xml:376(para)
22042
msgid "You should see lines similar to the following in the command output:"
22043
msgstr ""
22044
22045
#: serverguide/C/dns.xml:379(programlisting)
22046
#, no-wrap
22047
msgid ""
22048
"\n"
22049
";; Query time: 1 msec\n"
22050
";; SERVER: 192.168.1.10#53(192.168.1.10)\n"
22051
msgstr ""
22052
22053
#: serverguide/C/dns.xml:385(para)
22054
msgid ""
22055
"If you have configured <application>BIND9</application> as a "
22056
"<emphasis>Caching</emphasis> nameserver \"dig\" an outside domain to check "
22057
"the query time:"
22058
msgstr ""
22059
22060
#: serverguide/C/dns.xml:390(command)
22061
msgid "dig ubuntu.com"
22062
msgstr ""
22063
22064
#: serverguide/C/dns.xml:392(para)
22065
msgid "Note the query time toward the end of the command output:"
22066
msgstr ""
22067
22068
#: serverguide/C/dns.xml:395(programlisting)
22069
#, no-wrap
22070
msgid ""
22071
"\n"
22072
";; Query time: 49 msec\n"
22073
msgstr ""
22074
22075
#: serverguide/C/dns.xml:398(para)
22076
msgid "After a second dig there should be improvement:"
22077
msgstr ""
22078
22079
#: serverguide/C/dns.xml:401(programlisting)
22080
#, no-wrap
22081
msgid ""
22082
"\n"
22083
";; Query time: 1 msec\n"
22084
msgstr ""
22085
22086
#: serverguide/C/dns.xml:408(title)
22087
msgid "ping"
22088
msgstr ""
22089
22090
#: serverguide/C/dns.xml:410(para)
22091
msgid ""
22092
"Now to demonstrate how applications make use of DNS to resolve a host name "
22093
"use the <application>ping</application> utility to send an ICMP echo "
22094
"request. From a terminal prompt enter:"
22095
msgstr ""
22096
22097
#: serverguide/C/dns.xml:416(command)
22098
msgid "ping example.com"
22099
msgstr ""
22100
22101
#: serverguide/C/dns.xml:418(para)
22102
msgid ""
22103
"This tests if the nameserver can resolve the name "
22104
"<emphasis>ns.example.com</emphasis> to an IP Address. The command output "
22105
"should resemble:"
22106
msgstr ""
22107
22108
#: serverguide/C/dns.xml:422(programlisting)
22109
#, no-wrap
22110
msgid ""
22111
"\n"
22112
"PING ns.example.com (192.168.1.10) 56(84) bytes of data.\n"
22113
"64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms\n"
22114
"64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms\n"
22115
msgstr ""
22116
22117
#: serverguide/C/dns.xml:429(title)
22118
msgid "named-checkzone"
22119
msgstr ""
22120
22121
#: serverguide/C/dns.xml:430(para)
22122
msgid ""
22123
"A great way to test your zone files is by using the <application>named-"
22124
"checkzone</application> utility installed with the "
22125
"<application>bind9</application> package. This utility allows you to make "
22126
"sure the configuration is correct before restarting "
22127
"<application>BIND9</application> and making the changes live."
22128
msgstr ""
22129
22130
#: serverguide/C/dns.xml:437(para)
22131
msgid ""
22132
"To test our example Forward zone file enter the following from a command "
22133
"prompt:"
22134
msgstr ""
22135
22136
#: serverguide/C/dns.xml:441(command)
22137
msgid "named-checkzone example.com /etc/bind/db.example.com"
22138
msgstr ""
22139
22140
#: serverguide/C/dns.xml:443(para)
22141
msgid ""
22142
"If everything is configured correctly you should see output similar to:"
22143
msgstr ""
22144
22145
#: serverguide/C/dns.xml:446(programlisting)
22146
#, no-wrap
22147
msgid ""
22148
"\n"
22149
"zone example.com/IN: loaded serial 6\n"
22150
"OK\n"
22151
msgstr ""
22152
22153
#: serverguide/C/dns.xml:452(para)
22154
msgid "Similarly, to test the Reverse zone file enter the following:"
22155
msgstr ""
22156
22157
#: serverguide/C/dns.xml:456(command)
22158
msgid "named-checkzone example.com /etc/bind/db.192"
22159
msgstr ""
22160
22161
#: serverguide/C/dns.xml:458(para)
22162
msgid "The output should be similar to:"
22163
msgstr ""
22164
22165
#: serverguide/C/dns.xml:461(programlisting)
22166
#, no-wrap
22167
msgid ""
22168
"\n"
22169
"zone example.com/IN: loaded serial 3\n"
22170
"OK\n"
22171
msgstr ""
22172
22173
#: serverguide/C/dns.xml:468(para)
22174
msgid ""
22175
"The <emphasis>Serial Number</emphasis> of your zone file will probably be "
22176
"different."
22177
msgstr ""
22178
22179
#: serverguide/C/dns.xml:475(title)
22180
msgid "Logging"
22181
msgstr ""
22182
22183
#: serverguide/C/dns.xml:476(para)
22184
msgid ""
22185
"<application>BIND9</application> has a wide variety of logging configuration "
22186
"options available. There are two main options. The "
22187
"<emphasis>channel</emphasis> option configures where logs go, and the "
22188
"<emphasis>category</emphasis> option determines what information to log."
22189
msgstr ""
22190
22191
#: serverguide/C/dns.xml:480(para)
22192
msgid "If no logging option is configured the default option is:"
22193
msgstr ""
22194
22195
#: serverguide/C/dns.xml:483(programlisting)
22196
#, no-wrap
22197
msgid ""
22198
"\n"
22199
"logging {\n"
22200
" category default { default_syslog; default_debug; };\n"
22201
" category unmatched { null; };\n"
22202
"};\n"
22203
msgstr ""
22204
22205
#: serverguide/C/dns.xml:489(para)
22206
msgid ""
22207
"This section covers configuring <application>BIND9</application> to send "
22208
"<emphasis>debug</emphasis> messages related to DNS queries to a separate "
22209
"file."
22210
msgstr ""
22211
22212
#: serverguide/C/dns.xml:494(para)
22213
msgid ""
22214
"First, we need to configure a channel to specify which file to send the "
22215
"messages to. Edit <filename>/etc/bind/named.conf.local</filename> and add "
22216
"the following:"
22217
msgstr ""
22218
22219
#: serverguide/C/dns.xml:498(programlisting)
22220
#, no-wrap
22221
msgid ""
22222
"\n"
22223
"logging {\n"
22224
" channel query.log { \n"
22225
" file \"/var/log/query.log\";\n"
22226
" severity debug 3; \n"
22227
" }; \n"
22228
"};\n"
22229
msgstr ""
22230
22231
#: serverguide/C/dns.xml:508(para)
22232
msgid "Next, configure a category to send all DNS queries to the query file:"
22233
msgstr ""
22234
22235
#: serverguide/C/dns.xml:511(programlisting)
22236
#, no-wrap
22237
msgid ""
22238
"\n"
22239
"logging {\n"
22240
" channel query.log { \n"
22241
" file \"/var/log/query.log\"; \n"
22242
" severity debug 3; \n"
22243
" }; \n"
22244
" <emphasis>category queries { query.log; };</emphasis> \n"
22245
"};\n"
22246
msgstr ""
22247
22248
#: serverguide/C/dns.xml:523(para)
22249
msgid ""
22250
"Note: the <emphasis>debug</emphasis> option can be set from 1 to 3. If a "
22251
"level isn't specified level 1 is the default."
22252
msgstr ""
22253
22254
#: serverguide/C/dns.xml:529(para)
22255
msgid ""
22256
"Since the <emphasis>named daemon</emphasis> runs as the "
22257
"<emphasis>bind</emphasis> user the <filename>/var/log/query.log</filename> "
22258
"file must be created and the ownership changed:"
22259
msgstr ""
22260
22261
#: serverguide/C/dns.xml:534(command)
22262
msgid "sudo touch /var/log/query.log"
22263
msgstr ""
22264
22265
#: serverguide/C/dns.xml:535(command)
22266
msgid "sudo chown bind /var/log/query.log"
22267
msgstr ""
22268
22269
#: serverguide/C/dns.xml:539(para)
22270
msgid ""
22271
"Before <application>named</application> daemon can write to the new log file "
22272
"the <application>AppArmor</application> profile must be updated. First, edit "
22273
"<filename>/etc/apparmor.d/usr.sbin.named</filename> and add:"
22274
msgstr ""
22275
22276
#: serverguide/C/dns.xml:543(programlisting)
22277
#, no-wrap
22278
msgid ""
22279
"\n"
22280
"/var/log/query.log w,\n"
22281
msgstr ""
22282
22283
#: serverguide/C/dns.xml:546(para)
22284
msgid "Next, reload the profile:"
22285
msgstr ""
22286
22287
#: serverguide/C/dns.xml:550(command)
22288
msgid "cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r"
22289
msgstr ""
22290
22291
#: serverguide/C/dns.xml:552(para)
22292
msgid ""
22293
"For more information on <application>AppArmor</application> see <xref "
22294
"linkend=\"apparmor\"/>"
22295
msgstr ""
22296
22297
#: serverguide/C/dns.xml:557(para)
22298
msgid ""
22299
"Now restart <application>BIND9</application> for the changes to take effect:"
22300
msgstr ""
22301
22302
#: serverguide/C/dns.xml:565(para)
22303
msgid ""
22304
"You should see the file <filename>/var/log/query.log</filename> fill with "
22305
"query information. This is a simple example of the "
22306
"<application>BIND9</application> logging options. For coverage of advanced "
22307
"options see <xref linkend=\"dns-more-info\"/>."
22308
msgstr ""
22309
22310
#: serverguide/C/dns.xml:574(title)
22311
msgid "Common Record Types"
22312
msgstr ""
22313
22314
#: serverguide/C/dns.xml:575(para)
22315
msgid "This section covers some of the most common DNS record types."
22316
msgstr ""
22317
22318
#: serverguide/C/dns.xml:580(para)
22319
msgid ""
22320
"<emphasis>A</emphasis> record: This record maps an IP Address to a hostname."
22321
msgstr ""
22322
22323
#: serverguide/C/dns.xml:583(programlisting)
22324
#, no-wrap
22325
msgid ""
22326
"\n"
22327
"www IN A 192.168.1.12\n"
22328
msgstr ""
22329
22330
#: serverguide/C/dns.xml:588(para)
22331
msgid ""
22332
"<emphasis>CNAME</emphasis> record: Used to create an alias to an existing A "
22333
"record. You cannot create a CNAME record pointing to another CNAME record."
22334
msgstr ""
22335
22336
#: serverguide/C/dns.xml:591(programlisting)
22337
#, no-wrap
22338
msgid ""
22339
"\n"
22340
"web IN CNAME www\n"
22341
msgstr ""
22342
22343
#: serverguide/C/dns.xml:596(para)
22344
msgid ""
22345
"<emphasis>MX</emphasis> record: Used to define where email should be sent "
22346
"to. Must point to an A record, not a CNAME."
22347
msgstr ""
22348
22349
#: serverguide/C/dns.xml:599(programlisting)
22350
#, no-wrap
22351
msgid ""
22352
"\n"
22353
" IN MX 1 mail.example.com.\n"
22354
"mail IN A 192.168.1.13\n"
22355
msgstr ""
22356
22357
#: serverguide/C/dns.xml:605(para)
22358
msgid ""
22359
"<emphasis>NS</emphasis> record: Used to define which servers serve copies of "
22360
"a zone. It must point to an A record, not a CNAME. This is where Primary and "
22361
"Secondary servers are defined."
22362
msgstr ""
22363
22364
#: serverguide/C/dns.xml:609(programlisting)
22365
#, no-wrap
22366
msgid ""
22367
"\n"
22368
" IN NS ns.example.com.\n"
22369
"\tIN NS ns2.example.com.\n"
22370
"ns IN A 192.168.1.10\n"
22371
"ns2\tIN A\t 192.168.1.11\n"
22372
msgstr ""
22373
22374
#: serverguide/C/dns.xml:622(para)
22375
msgid ""
22376
"The <ulink url=\"http://www.tldp.org/HOWTO/DNS-HOWTO.html\">DNS "
22377
"HOWTO</ulink> explains more advanced options for configuring BIND9."
22378
msgstr ""
22379
22380
#: serverguide/C/dns.xml:627(para)
22381
msgid ""
22382
"For in depth coverage of <emphasis>DNS</emphasis> and "
22383
"<application>BIND9</application> see <ulink "
22384
"url=\"http://www.bind9.net/\">Bind9.net</ulink>."
22385
msgstr ""
22386
22387
#: serverguide/C/dns.xml:632(para)
22388
msgid ""
22389
"<ulink url=\"http://www.oreilly.com/catalog/dns5/index.html\">DNS and "
22390
"BIND</ulink> is a popular book now in it's fifth edition."
22391
msgstr ""
22392
22393
#: serverguide/C/dns.xml:637(para)
22394
msgid ""
22395
"A great place to ask for <application>BIND9</application> assistance, and "
22396
"get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-"
22397
"server</emphasis> IRC channel on <ulink "
22398
"url=\"http://freenode.net\">freenode</ulink>."
22399
msgstr ""
22400
22401
#: serverguide/C/dns.xml:643(para)
22402
msgid ""
22403
"Also, see the <ulink "
22404
"url=\"https://help.ubuntu.com/community/BIND9ServerHowto\">BIND9 Server "
22405
"HOWTO</ulink> in the Ubuntu Wiki."
22406
msgstr ""
22407
22408
#: serverguide/C/databases.xml:13(title)
22409
msgid "Databases"
22410
msgstr ""
22411
22412
#: serverguide/C/databases.xml:14(para)
22413
msgid "Ubuntu provides two popular database servers. They are:"
22414
msgstr ""
22415
22416
#: serverguide/C/databases.xml:22(application) serverguide/C/databases.xml:157(title)
22417
msgid "PostgreSQL"
22418
msgstr ""
22419
22420
#: serverguide/C/databases.xml:25(para)
22421
msgid ""
22422
"They are available in the main repository. This section explains how to "
22423
"install and configure these database servers."
22424
msgstr ""
22425
22426
#: serverguide/C/databases.xml:32(para)
22427
msgid ""
22428
"MySQL is a fast, multi-threaded, multi-user, and robust SQL database server. "
22429
"It is intended for mission-critical, heavy-load production systems as well "
22430
"as for embedding into mass-deployed software."
22431
msgstr ""
22432
22433
#: serverguide/C/databases.xml:41(para)
22434
msgid "To install MySQL, run the following command from a terminal prompt:"
22435
msgstr ""
22436
22437
#: serverguide/C/databases.xml:46(command)
22438
msgid "sudo apt-get install mysql-server"
22439
msgstr ""
22440
22441
#: serverguide/C/databases.xml:48(para)
22442
msgid ""
22443
"During the installation process you will be prompted to enter a password for "
22444
"the <application>MySQL</application> root user."
22445
msgstr ""
22446
22447
#: serverguide/C/databases.xml:53(para)
22448
msgid ""
22449
"Once the installation is complete, the MySQL server should be started "
22450
"automatically. You can run the following command from a terminal prompt to "
22451
"check whether the MySQL server is running:"
22452
msgstr ""
22453
22454
#: serverguide/C/databases.xml:61(command)
22455
msgid "sudo netstat -tap | grep mysql"
22456
msgstr ""
22457
22458
#: serverguide/C/databases.xml:70(programlisting)
22459
#, no-wrap
22460
msgid ""
22461
"\n"
22462
"tcp 0 0 localhost:mysql *:* LISTEN "
22463
" 2556/mysqld\n"
22464
msgstr ""
22465
22466
#: serverguide/C/databases.xml:74(para)
22467
msgid ""
22468
"If the server is not running correctly, you can type the following command "
22469
"to start it:"
22470
msgstr ""
22471
22472
#: serverguide/C/databases.xml:79(command) serverguide/C/databases.xml:104(command)
22473
msgid "sudo /etc/init.d/mysql restart"
22474
msgstr ""
22475
22476
#: serverguide/C/databases.xml:85(para)
22477
msgid ""
22478
"You can edit the <filename>/etc/mysql/my.cnf</filename> file to configure "
22479
"the basic settings -- log file, port number, etc. For example, to configure "
22480
"<application>MySQL</application> to listen for connections from network "
22481
"hosts, change the <emphasis>bind-address</emphasis> directive to the "
22482
"server's IP address:"
22483
msgstr ""
22484
22485
#: serverguide/C/databases.xml:91(programlisting)
22486
#, no-wrap
22487
msgid ""
22488
"\n"
22489
"bind-address = 192.168.0.5\n"
22490
msgstr ""
22491
22492
#: serverguide/C/databases.xml:95(para)
22493
msgid "Replace 192.168.0.5 with the appropriate address."
22494
msgstr ""
22495
22496
#: serverguide/C/databases.xml:99(para)
22497
msgid ""
22498
"After making a change to <filename>/etc/mysql/my.cnf</filename> the "
22499
"<application>mysql</application> daemon will need to be restarted:"
22500
msgstr ""
22501
22502
#: serverguide/C/databases.xml:107(para)
22503
msgid ""
22504
"If you would like to change the "
22505
"<application>MySQL</application><emphasis>root</emphasis> password, in a "
22506
"terminal enter:"
22507
msgstr ""
22508
22509
#: serverguide/C/databases.xml:113(command)
22510
msgid "sudo dpkg-reconfigure mysql-server-5.1"
22511
msgstr ""
22512
22513
#: serverguide/C/databases.xml:116(para)
22514
msgid ""
22515
"The <application>mysql</application> daemon will be stopped, and you will be "
22516
"prompted to enter a new password."
22517
msgstr ""
22518
22519
#: serverguide/C/databases.xml:125(para)
22520
msgid ""
22521
"See the <ulink url=\"http://www.mysql.com/\">MySQL Home Page</ulink> for "
22522
"more information."
22523
msgstr ""
22524
22525
#: serverguide/C/databases.xml:130(para)
22526
msgid ""
22527
"The <emphasis>MySQL Handbook</emphasis> is also available in the "
22528
"<application>mysql-doc-5.0</application> package. To install the package "
22529
"enter the following in a terminal:"
22530
msgstr ""
22531
22532
#: serverguide/C/databases.xml:135(command)
22533
msgid "sudo apt-get install mysql-doc-5.0"
22534
msgstr ""
22535
22536
#: serverguide/C/databases.xml:137(para)
22537
msgid ""
22538
"The documentation is in HTML format, to view them enter "
22539
"<command>file:///usr/share/doc/mysql-doc-5.0/refman-5.0-en.html-"
22540
"chapter/index.html</command> in your browser's address bar."
22541
msgstr ""
22542
22543
#: serverguide/C/databases.xml:143(para) serverguide/C/databases.xml:290(para)
22544
msgid ""
22545
"For general SQL information see <ulink "
22546
"url=\"http://www.informit.com/store/product.aspx?isbn=0768664128\">Using SQL "
22547
"Special Edition</ulink> by Rafe Colburn."
22548
msgstr ""
22549
22550
#: serverguide/C/databases.xml:149(para)
22551
msgid ""
22552
"The <ulink url=\"https://help.ubuntu.com/community/ApacheMySQLPHP\">Apache "
22553
"MySQL PHP Ubuntu Wiki</ulink> page also has useful information."
22554
msgstr ""
22555
22556
#: serverguide/C/databases.xml:158(para)
22557
msgid ""
22558
"PostgreSQL is an object-relational database system that has the features of "
22559
"traditional commercial database systems with enhancements to be found in "
22560
"next-generation DBMS systems."
22561
msgstr ""
22562
22563
#: serverguide/C/databases.xml:165(para)
22564
msgid ""
22565
"To install PostgreSQL, run the following command in the command prompt:"
22566
msgstr ""
22567
22568
#: serverguide/C/databases.xml:172(command)
22569
msgid "sudo apt-get install postgresql"
22570
msgstr ""
22571
22572
#: serverguide/C/databases.xml:176(para)
22573
msgid ""
22574
"Once the installation is complete, you should configure the PostgreSQL "
22575
"server based on your needs, although the default configuration is viable."
22576
msgstr ""
22577
22578
#: serverguide/C/databases.xml:184(para)
22579
msgid ""
22580
"By default, connection via TCP/IP is disabled. PostgreSQL supports multiple "
22581
"client authentication methods. By default, IDENT authentication method is "
22582
"used for <application>postgres</application> and local users. Please refer "
22583
"<ulink url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the "
22584
"PostgreSQL Administrator's Guide</ulink>."
22585
msgstr ""
22586
22587
#: serverguide/C/databases.xml:191(para)
22588
msgid ""
22589
"The following discussion assumes that you wish to enable TCP/IP connections "
22590
"and use the MD5 method for client authentication. PostgreSQL configuration "
22591
"files are stored in the "
22592
"<filename>/etc/postgresql/<version>/main</filename> directory. For "
22593
"example, if you install PostgreSQL 8.4, the configuration files are stored "
22594
"in the <filename>/etc/postgresql/8.4/main</filename> directory."
22595
msgstr ""
22596
22597
#: serverguide/C/databases.xml:201(para)
22598
msgid ""
22599
"To configure <emphasis>ident</emphasis> authentication, add entries to the "
22600
"<filename>/etc/postgresql/8.4/main/pg_ident.conf</filename> file."
22601
msgstr ""
22602
22603
#: serverguide/C/databases.xml:208(para)
22604
msgid ""
22605
"To enable TCP/IP connections, edit the file "
22606
"<filename>/etc/postgresql/8.4/main/postgresql.conf</filename>"
22607
msgstr ""
22608
22609
#: serverguide/C/databases.xml:210(para)
22610
msgid ""
22611
"Locate the line <emphasis>#listen_addresses = 'localhost'</emphasis> and "
22612
"change it to:"
22613
msgstr ""
22614
22615
#: serverguide/C/databases.xml:213(programlisting)
22616
#, no-wrap
22617
msgid ""
22618
"\n"
22619
"listen_addresses = 'localhost'\n"
22620
msgstr ""
22621
22622
#: serverguide/C/databases.xml:217(para)
22623
msgid ""
22624
"To allow other computers to connect to your "
22625
"<application>PostgreSQL</application> server replace 'localhost' with the "
22626
"<emphasis>IP Address</emphasis> of your server."
22627
msgstr ""
22628
22629
#: serverguide/C/databases.xml:222(para)
22630
msgid ""
22631
"You may also edit all other parameters, if you know what you are doing! For "
22632
"details, refer to the configuration file or to the PostgreSQL documentation."
22633
msgstr ""
22634
22635
#: serverguide/C/databases.xml:227(para)
22636
msgid ""
22637
"Now that we can connect to our <application>PostgreSQL</application> server, "
22638
"the next step is to set a password for the <emphasis>postgres</emphasis> "
22639
"user. Run the following command at a terminal prompt to connect to the "
22640
"default PostgreSQL template database:"
22641
msgstr ""
22642
22643
#: serverguide/C/databases.xml:234(command)
22644
msgid "sudo -u postgres psql template1"
22645
msgstr ""
22646
22647
#: serverguide/C/databases.xml:236(para)
22648
msgid ""
22649
"The above command connects to PostgreSQL database "
22650
"<emphasis>template1</emphasis> as user <emphasis>postgres</emphasis>. Once "
22651
"you connect to the PostgreSQL server, you will be at a SQL prompt. You can "
22652
"run the following SQL command at the <application>psql</application> prompt "
22653
"to configure the password for the user <emphasis "
22654
"role=\"italics\">postgres</emphasis>."
22655
msgstr ""
22656
22657
#: serverguide/C/databases.xml:244(command)
22658
msgid "ALTER USER postgres with encrypted password 'your_password';"
22659
msgstr ""
22660
22661
#: serverguide/C/databases.xml:246(para)
22662
msgid ""
22663
"After configuring the password, edit the file "
22664
"<filename>/etc/postgresql/8.4/main/pg_hba.conf</filename> to use "
22665
"<emphasis>MD5</emphasis> authentication with the "
22666
"<emphasis>postgres</emphasis> user:"
22667
msgstr ""
22668
22669
#: serverguide/C/databases.xml:252(programlisting)
22670
#, no-wrap
22671
msgid ""
22672
"\n"
22673
"local all postgres md5\n"
22674
msgstr ""
22675
22676
#: serverguide/C/databases.xml:256(para)
22677
msgid ""
22678
"Finally, you should restart the <application>PostgreSQL</application> "
22679
"service to initialize the new configuration. From a terminal prompt enter "
22680
"the following to restart <application>PostgreSQL</application>:"
22681
msgstr ""
22682
22683
#: serverguide/C/databases.xml:262(command)
22684
msgid "sudo /etc/init.d/postgresql-8.4 restart"
22685
msgstr ""
22686
22687
#: serverguide/C/databases.xml:265(para)
22688
msgid ""
22689
"The above configuration is not complete by any means. Please refer <ulink "
22690
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\"> the PostgreSQL "
22691
"Administrator's Guide</ulink> to configure more parameters."
22692
msgstr ""
22693
22694
#: serverguide/C/databases.xml:276(para)
22695
msgid ""
22696
"As mentioned above the <ulink "
22697
"url=\"http://www.postgresql.org/docs/8.4/static/admin.html\">Administrator's "
22698
"Guide</ulink> is an excellent resource. The guide is also available in the "
22699
"<application>postgresql-doc-8.4</application> package. Execute the following "
22700
"in a terminal to install the package:"
22701
msgstr ""
22702
22703
#: serverguide/C/databases.xml:282(command)
22704
msgid "sudo apt-get install postgresql-doc-8.4"
22705
msgstr ""
22706
22707
#: serverguide/C/databases.xml:284(para)
22708
msgid ""
22709
"To view the guide enter <command>file:///usr/share/doc/postgresql-doc-"
22710
"8.4/html/index.html</command> into the address bar of your browser."
22711
msgstr ""
22712
22713
#: serverguide/C/databases.xml:296(para)
22714
msgid ""
22715
"Also, see the <ulink "
22716
"url=\"https://help.ubuntu.com/community/PostgreSQL\">PostgreSQL Ubuntu "
22717
"Wiki</ulink> page for more information."
22718
msgstr ""
22719
22720
#: serverguide/C/clustering.xml:13(title)
22721
msgid "Clustering"
22722
msgstr ""
22723
22724
#: serverguide/C/clustering.xml:16(title)
22725
msgid "DRBD"
22726
msgstr ""
22727
22728
#: serverguide/C/clustering.xml:18(para)
22729
msgid ""
22730
"Distributed Replicated Block Device (DRBD) mirrors block devices between "
22731
"multiple hosts. The replication is transparent to other applications on the "
22732
"host systems. Any block device hard disks, partitions, RAID devices, logical "
22733
"volumes, etc can be mirrored."
22734
msgstr ""
22735
22736
#: serverguide/C/clustering.xml:24(para)
22737
msgid ""
22738
"To get started using <application>drbd</application>, first install the "
22739
"necessary packages. From a terminal enter:"
22740
msgstr ""
22741
22742
#: serverguide/C/clustering.xml:29(command)
22743
msgid "sudo apt-get install drbd8-utils"
22744
msgstr ""
22745
22746
#: serverguide/C/clustering.xml:33(para)
22747
msgid ""
22748
"If you are using the <emphasis>virtual kernel</emphasis> as part of a "
22749
"virtual machine you will need to manually compile the "
22750
"<application>drbd</application> module. It may be easier to install the "
22751
"<application>linux-server</application> package inside the virtual machine."
22752
msgstr ""
22753
22754
#: serverguide/C/clustering.xml:40(para)
22755
msgid ""
22756
"This section covers setting up a <application>drbd</application> to "
22757
"replicate a separate <filename>/srv</filename> partition, with an "
22758
"<application>ext3</application> filesystem between two hosts. The partition "
22759
"size is not particularly relevant, but both partitions need to be the same "
22760
"size."
22761
msgstr ""
22762
22763
#: serverguide/C/clustering.xml:49(para)
22764
msgid ""
22765
"The two hosts in this example will be called <emphasis>drbd01</emphasis> and "
22766
"<emphasis>drbd02</emphasis>. They will need to have name resolution "
22767
"configured either through DNS or the <filename>/etc/hosts</filename> file. "
22768
"See <xref linkend=\"dns\"/> for details."
22769
msgstr ""
22770
22771
#: serverguide/C/clustering.xml:57(para)
22772
msgid ""
22773
"To configure <application>drbd</application>, on the first host edit "
22774
"<filename>/etc/drbd.conf</filename>:"
22775
msgstr ""
22776
22777
#: serverguide/C/clustering.xml:61(programlisting)
22778
#, no-wrap
22779
msgid ""
22780
"\n"
22781
"global { usage-count no; }\n"
22782
"common { syncer { rate 100M; } }\n"
22783
"resource r0 {\n"
22784
" protocol C;\n"
22785
" startup {\n"
22786
" wfc-timeout 15;\n"
22787
" degr-wfc-timeout 60;\n"
22788
" }\n"
22789
" net {\n"
22790
" cram-hmac-alg sha1;\n"
22791
" shared-secret \"secret\";\n"
22792
" }\n"
22793
" on drbd01 {\n"
22794
" device /dev/drbd0;\n"
22795
" disk /dev/sdb1;\n"
22796
" address 192.168.0.1:7788;\n"
22797
" meta-disk internal;\n"
22798
" }\n"
22799
" on drbd02 {\n"
22800
" device /dev/drbd0;\n"
22801
" disk /dev/sdb1;\n"
22802
" address 192.168.0.2:7788;\n"
22803
" meta-disk internal;\n"
22804
" }\n"
22805
"} \n"
22806
msgstr ""
22807
22808
#: serverguide/C/clustering.xml:90(para)
22809
msgid ""
22810
"There are many other options in <filename>/etc/drbd.conf</filename>, but for "
22811
"this example their default values are fine."
22812
msgstr ""
22813
22814
#: serverguide/C/clustering.xml:98(para)
22815
msgid "Now copy <filename>/etc/drbd.conf</filename> to the second host:"
22816
msgstr ""
22817
22818
#: serverguide/C/clustering.xml:103(command)
22819
msgid "scp /etc/drbd.conf drbd02:~"
22820
msgstr ""
22821
22822
#: serverguide/C/clustering.xml:109(para)
22823
msgid ""
22824
"And, on <emphasis>drbd02</emphasis> move the file to "
22825
"<filename>/etc</filename>:"
22826
msgstr ""
22827
22828
#: serverguide/C/clustering.xml:114(command)
22829
msgid "sudo mv drbd.conf /etc/"
22830
msgstr ""
22831
22832
#: serverguide/C/clustering.xml:120(para)
22833
msgid ""
22834
"Next, on both hosts, start the <application>drbd</application> daemon:"
22835
msgstr ""
22836
22837
#: serverguide/C/clustering.xml:125(command)
22838
msgid "sudo /etc/init.d/drbd start"
22839
msgstr ""
22840
22841
#: serverguide/C/clustering.xml:131(para)
22842
msgid ""
22843
"Now using the <application>drbdadm</application> utility initialize the meta "
22844
"data storage. On each server execute:"
22845
msgstr ""
22846
22847
#: serverguide/C/clustering.xml:137(command)
22848
msgid "sudo drbdadm create-md r0"
22849
msgstr ""
22850
22851
#: serverguide/C/clustering.xml:143(para)
22852
msgid ""
22853
"On the <emphasis>drbd01</emphasis>, or whichever host you wish to be the "
22854
"primary, enter the following:"
22855
msgstr ""
22856
22857
#: serverguide/C/clustering.xml:148(command)
22858
msgid "sudo drbdadm -- --overwrite-data-of-peer primary all"
22859
msgstr ""
22860
22861
#: serverguide/C/clustering.xml:154(para)
22862
msgid ""
22863
"After executing the above command, the data will start syncing with the "
22864
"secondary host. To watch the progresss, on <emphasis>drbd02</emphasis> enter "
22865
"the following:"
22866
msgstr ""
22867
22868
#: serverguide/C/clustering.xml:160(command)
22869
msgid "watch -n1 cat /proc/drbd"
22870
msgstr ""
22871
22872
#: serverguide/C/clustering.xml:163(para)
22873
msgid "To stop watching the output press <emphasis>Ctrl+c</emphasis>."
22874
msgstr ""
22875
22876
#: serverguide/C/clustering.xml:170(para)
22877
msgid ""
22878
"Finally, add a filesystem to <filename>/dev/drbd0</filename> and mount it:"
22879
msgstr ""
22880
22881
#: serverguide/C/clustering.xml:175(command)
22882
msgid "sudo mkfs.ext3 /dev/drbd0"
22883
msgstr ""
22884
22885
#: serverguide/C/clustering.xml:176(command) serverguide/C/clustering.xml:224(command)
22886
msgid "sudo mount /dev/drbd0 /srv"
22887
msgstr ""
22888
22889
#: serverguide/C/clustering.xml:186(para)
22890
msgid ""
22891
"To test that the data is actually syncing between the hosts copy some files "
22892
"on the <emphasis>drbd01</emphasis>, the primary, to "
22893
"<filename>/srv</filename>:"
22894
msgstr ""
22895
22896
#: serverguide/C/clustering.xml:195(para)
22897
msgid "Next, unmount <filename>/srv</filename>:"
22898
msgstr ""
22899
22900
#: serverguide/C/clustering.xml:203(para)
22901
msgid ""
22902
"<emphasis>Demote</emphasis> the <emphasis>primary</emphasis> server to the "
22903
"<emphasis>secondary</emphasis> role:"
22904
msgstr ""
22905
22906
#: serverguide/C/clustering.xml:208(command)
22907
msgid "sudo drbdadm secondary r0"
22908
msgstr ""
22909
22910
#: serverguide/C/clustering.xml:211(para)
22911
msgid ""
22912
"Now on the <emphasis>secondary</emphasis> server "
22913
"<emphasis>promote</emphasis> it to the <emphasis>primary</emphasis> role:"
22914
msgstr ""
22915
22916
#: serverguide/C/clustering.xml:216(command)
22917
msgid "sudo drbdadm primary r0"
22918
msgstr ""
22919
22920
#: serverguide/C/clustering.xml:219(para)
22921
msgid "Lastly, mount the partition:"
22922
msgstr ""
22923
22924
#: serverguide/C/clustering.xml:227(para)
22925
msgid ""
22926
"Using <emphasis>ls</emphasis> you should see "
22927
"<filename>/srv/default</filename> copied from the former "
22928
"<emphasis>primary</emphasis> host <emphasis>drbd01</emphasis>."
22929
msgstr ""
22930
22931
#: serverguide/C/clustering.xml:238(para)
22932
msgid ""
22933
"For more information on <application>DRBD</application> see the <ulink "
22934
"url=\"http://www.drbd.org/\">DRBD web site</ulink>."
22935
msgstr ""
22936
22937
#: serverguide/C/clustering.xml:243(para)
22938
msgid ""
22939
"The <ulink "
22940
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man5/drbd.conf.5.html\">dr"
22941
"bd.conf man page</ulink> contains details on the options not covered in this "
22942
"guide."
22943
msgstr ""
22944
22945
#: serverguide/C/clustering.xml:249(para)
22946
msgid ""
22947
"Also, see the <ulink "
22948
"url=\"http://manpages.ubuntu.com/manpages/lucid/en/man8/drbdadm.8.html\">drbd"
22949
"adm man page</ulink>."
22950
msgstr ""
22951
22952
#: serverguide/C/clustering.xml:254(para)
22953
msgid ""
22954
"The <ulink url=\"https://help.ubuntu.com/community/DRBD\">DRBD Ubuntu "
22955
"Wiki</ulink> page also has more information."
22956
msgstr ""
22957
22958
#: serverguide/C/chat.xml:13(title)
22959
msgid "Chat Applications"
22960
msgstr ""
22961
22962
#: serverguide/C/chat.xml:19(para)
22963
msgid ""
22964
"In this section, we will discuss how to install and configure a IRC server, "
22965
"<application>ircd-irc2</application>. We will also discuss how to install "
22966
"and configure Jabber, an instance messaging server."
22967
msgstr ""
22968
22969
#: serverguide/C/chat.xml:28(title)
22970
msgid "IRC Server"
22971
msgstr ""
22972
22973
#: serverguide/C/chat.xml:30(para)
22974
msgid ""
22975
"The Ubuntu repository has many Internet Relay Chat servers. This section "
22976
"explains how to install and configure the original IRC server "
22977
"<application>ircd-irc2</application>."
22978
msgstr ""
22979
22980
#: serverguide/C/chat.xml:39(para)
22981
msgid ""
22982
"To install <application>ircd-irc2</application>, run the following command "
22983
"in the command prompt:"
22984
msgstr ""
22985
22986
#: serverguide/C/chat.xml:45(command)
22987
msgid "sudo apt-get install ircd-irc2"
22988
msgstr ""
22989
22990
#: serverguide/C/chat.xml:48(para)
22991
msgid ""
22992
"The configuration files are stored in <filename>/etc/ircd</filename> "
22993
"directory. The documents are available in <filename>/usr/share/doc/ircd-"
22994
"irc2</filename> directory."
22995
msgstr ""
22996
22997
#: serverguide/C/chat.xml:59(para)
22998
msgid ""
22999
"The IRC settings can be done in the configuration file "
23000
"<filename>/etc/ircd/ircd.conf</filename>. You can set the IRC host name in "
23001
"this file by editing the following line:"
23002
msgstr ""
23003
23004
#: serverguide/C/chat.xml:64(programlisting)
23005
#, no-wrap
23006
msgid ""
23007
"\n"
23008
"M:irc.localhost::Debian ircd default configuration::000A\n"
23009
msgstr ""
23010
23011
#: serverguide/C/chat.xml:68(para)
23012
msgid ""
23013
"Please make sure you add DNS aliases for the IRC host name. For instance, if "
23014
"you set irc.livecipher.com as IRC host name, please make sure "
23015
"irc.livecipher.com is resolvable in your Domain Name Server. The IRC host "
23016
"name should not be same as the host name."
23017
msgstr ""
23018
23019
#: serverguide/C/chat.xml:75(para)
23020
msgid ""
23021
"The IRC admin details can be configured by editting the following line:"
23022
msgstr ""
23023
23024
#: serverguide/C/chat.xml:80(programlisting)
23025
#, no-wrap
23026
msgid ""
23027
"\n"
23028
"A:Organization, IRC dept.:Daemon <ircd@example.irc.org>:Client "
23029
"Server::IRCnet:\n"
23030
msgstr ""
23031
23032
#: serverguide/C/chat.xml:84(para)
23033
msgid ""
23034
"You should add specific lines to configure the list of IRC ports to listen "
23035
"on, to configure Operator credentials, to configure client authentication, "
23036
"etc. For details, please refer to the example configuration file "
23037
"<filename>/usr/share/doc/ircd-irc2/ircd.conf.example.gz</filename>."
23038
msgstr ""
23039
23040
#: serverguide/C/chat.xml:92(para)
23041
msgid ""
23042
"The IRC banner to be displayed in the IRC client, when the user connects to "
23043
"the server can be set in <filename>/etc/ircd/ircd.motd</filename> file."
23044
msgstr ""
23045
23046
#: serverguide/C/chat.xml:97(para)
23047
msgid ""
23048
"After making necessary changes to the configuration file, you can restart "
23049
"the IRC server using following command:"
23050
msgstr ""
23051
23052
#: serverguide/C/chat.xml:101(programlisting)
23053
#, no-wrap
23054
msgid ""
23055
"\n"
23056
"sudo /etc/init.d/ircd-irc2 restart\n"
23057
msgstr ""
23058
23059
#: serverguide/C/chat.xml:109(para)
23060
msgid ""
23061
"You may also be interested to take a look at other IRC servers available in "
23062
"Ubuntu Repository. It includes, <application>ircd-ircu</application> and "
23063
"<application>ircd-hybrid</application>."
23064
msgstr ""
23065
23066
#: serverguide/C/chat.xml:117(para)
23067
msgid ""
23068
"Refer to <ulink url=\"http://www.irc.org/tech_docs/ircnet/faq.html\">IRCD "
23069
"FAQ</ulink> for more details about the IRC Server."
23070
msgstr ""
23071
23072
#: serverguide/C/chat.xml:124(para)
23073
msgid ""
23074
"Also, the <ulink url=\"https://help.ubuntu.com/community/ircd\">Ubuntu Wiki "
23075
"IRCD</ulink> page has more information."
23076
msgstr ""
23077
23078
#: serverguide/C/chat.xml:132(title)
23079
msgid "Jabber Instant Messaging Server"
23080
msgstr ""
23081
23082
#: serverguide/C/chat.xml:134(para)
23083
msgid ""
23084
"<emphasis>Jabber</emphasis> a popular instant message protocol is based on "
23085
"XMPP, an open standard for instant messaging, and used by many popular "
23086
"applications. This section covers setting up a <emphasis>Jabberd "
23087
"2</emphasis> server on a local LAN. This configuration can also be adapted "
23088
"to providing messaging services to users over the Internet."
23089
msgstr ""
23090
23091
#: serverguide/C/chat.xml:143(para)
23092
msgid "To install <application>jabberd2</application>, in a terminal enter:"
23093
msgstr ""
23094
23095
#: serverguide/C/chat.xml:148(command)
23096
msgid "sudo apt-get install jabberd2"
23097
msgstr ""
23098
23099
#: serverguide/C/chat.xml:155(para)
23100
msgid ""
23101
"A couple of XML configuration files will be used to configure "
23102
"<application>jabberd2</application> for <emphasis>Berkely DB</emphasis> user "
23103
"authentication. This is a very simple form of authentication. However, "
23104
"<application>jabberd2</application> can be configured to use LDAP, MySQL, "
23105
"Postgresql, etc for for user authentication."
23106
msgstr ""
23107
23108
#: serverguide/C/chat.xml:162(para)
23109
msgid "First, edit <filename>/etc/jabberd2/sm.xml</filename> changing:"
23110
msgstr ""
23111
23112
#: serverguide/C/chat.xml:166(programlisting)
23113
#, no-wrap
23114
msgid ""
23115
"\n"
23116
" <id>jabber.example.com</id>\n"
23117
msgstr ""
23118
23119
#: serverguide/C/chat.xml:171(para)
23120
msgid ""
23121
"Replace <emphasis>jabber.example.com</emphasis> with the hostname, or other "
23122
"id, of your server."
23123
msgstr ""
23124
23125
#: serverguide/C/chat.xml:176(para)
23126
msgid "Now in the <storage> section change the <driver> to:"
23127
msgstr ""
23128
23129
#: serverguide/C/chat.xml:180(programlisting)
23130
#, no-wrap
23131
msgid ""
23132
"\n"
23133
" <driver>db</driver>\n"
23134
msgstr ""
23135
23136
#: serverguide/C/chat.xml:184(para)
23137
msgid ""
23138
"Next, edit <filename>/etc/jabberd2/c2s.xml</filename> in the "
23139
"<emphasis><local></emphasis> section change:"
23140
msgstr ""
23141
23142
#: serverguide/C/chat.xml:188(programlisting)
23143
#, no-wrap
23144
msgid ""
23145
"\n"
23146
" <id>jabber.example.com</id>\n"
23147
msgstr ""
23148
23149
#: serverguide/C/chat.xml:192(para)
23150
msgid ""
23151
"And in the <authreg> section adjust the <module> section to:"
23152
msgstr ""
23153
23154
#: serverguide/C/chat.xml:196(programlisting)
23155
#, no-wrap
23156
msgid ""
23157
"\n"
23158
" <module>db</module>\n"
23159
msgstr ""
23160
23161
#: serverguide/C/chat.xml:200(para)
23162
msgid ""
23163
"Finally, restart <application>jabberd2</application> to enable the new "
23164
"settings:"
23165
msgstr ""
23166
23167
#: serverguide/C/chat.xml:205(command)
23168
msgid "sudo /etc/init.d/jabberd2 restart"
23169
msgstr ""
23170
23171
#: serverguide/C/chat.xml:208(para)
23172
msgid ""
23173
"You should now be able to connect to the server using a Jabber client like "
23174
"<application>Pidgin</application> for example."
23175
msgstr ""
23176
23177
#: serverguide/C/chat.xml:213(para)
23178
msgid ""
23179
"The advantage of using Berkeley DB for user data is that after being "
23180
"configured no additional maintenance is required. If you need more control "
23181
"over user accounts and credentials another authentication method is "
23182
"recommended."
23183
msgstr ""
23184
23185
#: serverguide/C/chat.xml:225(para)
23186
msgid ""
23187
"The <ulink url=\"http://codex.xiaoka.com/wiki/jabberd2:start\">Jabberd2 Web "
23188
"Site</ulink> contains more details on configuring "
23189
"<application>Jabberd2</application>."
23190
msgstr ""
23191
23192
#: serverguide/C/chat.xml:231(para)
23193
msgid ""
23194
"For more authentication options see the <ulink "
23195
"url=\"http://jabberd2.xiaoka.com/wiki/InstallGuide\">Jabberd2 Install "
23196
"Guide</ulink>."
23197
msgstr ""
23198
23199
#: serverguide/C/chat.xml:236(para)
23200
msgid ""
23201
"Also, the <ulink "
23202
"url=\"https://help.ubuntu.com/community/SettingUpJabberServer\">Setting Up "
23203
"Jabber Server Ubuntu Wiki</ulink> page has more information."
23204
msgstr ""
23205
23206
#: serverguide/C/backups.xml:13(title)
23207
msgid "Backups"
23208
msgstr ""
23209
23210
#: serverguide/C/backups.xml:14(para)
23211
msgid ""
23212
"There are many ways to backup an Ubuntu installation. The most important "
23213
"thing about backups is to develop a <emphasis>backup plan</emphasis> "
23214
"consisting of what to backup, where to back it up to, and how to restore it."
23215
msgstr ""
23216
23217
#: serverguide/C/backups.xml:18(para)
23218
msgid ""
23219
"The following sections discuss various ways of accomplishing these tasks."
23220
msgstr ""
23221
23222
#: serverguide/C/backups.xml:22(title)
23223
msgid "Shell Scripts"
23224
msgstr ""
23225
23226
#: serverguide/C/backups.xml:23(para)
23227
msgid ""
23228
"One of the simplest ways to backup a system is using a <emphasis>shell "
23229
"script</emphasis>. For example, a script can be used to configure which "
23230
"directories to backup, and use those directories as arguments to the "
23231
"<application>tar</application> utility creating an archive file. The archive "
23232
"file can then be moved or copied to another location. The archive can also "
23233
"be created on a remote file system such as an <emphasis>NFS</emphasis> mount."
23234
msgstr ""
23235
23236
#: serverguide/C/backups.xml:29(para)
23237
msgid ""
23238
"The <application>tar</application> utility creates one archive file out of "
23239
"many files or directories. <application>tar</application> can also filter "
23240
"the files through compression utilities reducing the size of the archive "
23241
"file."
23242
msgstr ""
23243
23244
#: serverguide/C/backups.xml:35(title)
23245
msgid "Simple Shell Script"
23246
msgstr ""
23247
23248
#: serverguide/C/backups.xml:36(para)
23249
msgid ""
23250
"The following shell script uses <application>tar</application> to create an "
23251
"archive file on a remotely mounted NFS file system. The archive filename is "
23252
"determined using additional command line utilities."
23253
msgstr ""
23254
23255
#: serverguide/C/backups.xml:40(programlisting)
23256
#, no-wrap
23257
msgid ""
23258
"\n"
23259
"#!/bin/sh\n"
23260
"####################################\n"
23261
"#\n"
23262
"# Backup to NFS mount script.\n"
23263
"#\n"
23264
"####################################\n"
23265
"\n"
23266
"# What to backup. \n"
23267
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23268
"\n"
23269
"# Where to backup to.\n"
23270
"dest=\"/mnt/backup\"\n"
23271
"\n"
23272
"# Create archive filename.\n"
23273
"day=$(date +%A)\n"
23274
"hostname=$(hostname -s)\n"
23275
"archive_file=\"$hostname-$day.tgz\"\n"
23276
"\n"
23277
"# Print start status message.\n"
23278
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23279
"date\n"
23280
"echo\n"
23281
"\n"
23282
"# Backup the files using tar.\n"
23283
"tar czf $dest/$archive_file $backup_files\n"
23284
"\n"
23285
"# Print end status message.\n"
23286
"echo\n"
23287
"echo \"Backup finished\"\n"
23288
"date\n"
23289
"\n"
23290
"# Long listing of files in $dest to check file sizes.\n"
23291
"ls -lh $dest\n"
23292
msgstr ""
23293
23294
#: serverguide/C/backups.xml:77(para)
23295
msgid ""
23296
"<emphasis>$backup_files:</emphasis> a variable listing which directories you "
23297
"would like to backup. The list should be customized to fit your needs."
23298
msgstr ""
23299
23300
#: serverguide/C/backups.xml:83(para)
23301
msgid ""
23302
"<emphasis>$day:</emphasis> a variable holding the day of the week (Monday, "
23303
"Tuesday, Wednesday, etc). This is used to create an archive file for each "
23304
"day of the week, giving a backup history of seven days. There are other ways "
23305
"to accomplish this including other ways using the "
23306
"<application>date</application> utility."
23307
msgstr ""
23308
23309
#: serverguide/C/backups.xml:90(para)
23310
msgid ""
23311
"<emphasis>$hostname:</emphasis> variable containing the "
23312
"<emphasis>short</emphasis> hostname of the system. Using the hostname in the "
23313
"archive filename gives you the option of placing daily archive files from "
23314
"multiple systems in the same directory."
23315
msgstr ""
23316
23317
#: serverguide/C/backups.xml:97(para)
23318
msgid "<emphasis>$archive_file:</emphasis> the full archive filename."
23319
msgstr ""
23320
23321
#: serverguide/C/backups.xml:102(para)
23322
msgid ""
23323
"<emphasis>$dest:</emphasis> destination of the archive file. The directory "
23324
"needs to be created and in this case <emphasis>mounted</emphasis> before "
23325
"executing the backup script. See <xref linkend=\"network-file-system\"/> for "
23326
"details using <emphasis>NFS</emphasis>."
23327
msgstr ""
23328
23329
#: serverguide/C/backups.xml:109(para)
23330
msgid ""
23331
"<emphasis>status messages:</emphasis> optional messages printed to the "
23332
"console using the <application>echo</application> utility."
23333
msgstr ""
23334
23335
#: serverguide/C/backups.xml:115(para)
23336
msgid ""
23337
"<emphasis>tar czf $dest/$archive_file $backup_files:</emphasis> the "
23338
"<application>tar</application> command used to create the archive file."
23339
msgstr ""
23340
23341
#: serverguide/C/backups.xml:121(para)
23342
msgid "<emphasis>c:</emphasis> creates an archive."
23343
msgstr ""
23344
23345
#: serverguide/C/backups.xml:126(para)
23346
msgid ""
23347
"<emphasis>z:</emphasis> filter the archive through the "
23348
"<application>gzip</application> utility compressing the archive."
23349
msgstr ""
23350
23351
#: serverguide/C/backups.xml:131(para)
23352
msgid ""
23353
"<emphasis>f:</emphasis> use archive file. Otherwise the "
23354
"<application>tar</application> output will be sent to STDOUT."
23355
msgstr ""
23356
23357
#: serverguide/C/backups.xml:138(para)
23358
msgid ""
23359
"<emphasis>ls -lh $dest:</emphasis> optional statement prints a <emphasis>-"
23360
"l</emphasis> long listing in <emphasis>-h</emphasis> human readable format "
23361
"of the destination directory. This is useful for a quick file size check of "
23362
"the archive file. This check should not replace testing the archive file."
23363
msgstr ""
23364
23365
#: serverguide/C/backups.xml:145(para)
23366
msgid ""
23367
"This is a simple example of a backup shell script. There are large amount of "
23368
"options that can be included in a backup script. See <xref linkend=\"backup-"
23369
"shellscript-references\"/> for links to resources providing more in depth "
23370
"shell scripting information."
23371
msgstr ""
23372
23373
#: serverguide/C/backups.xml:152(title)
23374
msgid "Executing the Script"
23375
msgstr ""
23376
23377
#: serverguide/C/backups.xml:154(title)
23378
msgid "Executing from a Terminal"
23379
msgstr ""
23380
23381
#: serverguide/C/backups.xml:155(para)
23382
msgid ""
23383
"The simplest way of executing the above backup script is to copy and paste "
23384
"the contents into a file. <filename>backup.sh</filename> for example. Then "
23385
"from a terminal prompt:"
23386
msgstr ""
23387
23388
#: serverguide/C/backups.xml:160(command)
23389
msgid "sudo bash backup.sh"
23390
msgstr ""
23391
23392
#: serverguide/C/backups.xml:162(para)
23393
msgid ""
23394
"This is a great way to test the script to make sure everything works as "
23395
"expected."
23396
msgstr ""
23397
23398
#: serverguide/C/backups.xml:167(title)
23399
msgid "Executing with cron"
23400
msgstr ""
23401
23402
#: serverguide/C/backups.xml:168(para)
23403
msgid ""
23404
"The <application>cron</application> utility can be used to automate the "
23405
"script execution. The <application>cron</application> daemon allows the "
23406
"execution of scripts, or commands, at a specified time and date."
23407
msgstr ""
23408
23409
#: serverguide/C/backups.xml:172(para)
23410
msgid ""
23411
"<application>cron</application> is configured through entries in a "
23412
"<filename>crontab</filename> file. <filename>crontab</filename> files are "
23413
"separated into fields:"
23414
msgstr ""
23415
23416
#: serverguide/C/backups.xml:176(programlisting)
23417
#, no-wrap
23418
msgid ""
23419
"\n"
23420
"# m h dom mon dow command\n"
23421
msgstr ""
23422
23423
#: serverguide/C/backups.xml:181(para)
23424
msgid ""
23425
"<emphasis>m:</emphasis> minute the command executes on between 0 and 59."
23426
msgstr ""
23427
23428
#: serverguide/C/backups.xml:186(para)
23429
msgid ""
23430
"<emphasis>h:</emphasis> hour the command executes on between 0 and 23."
23431
msgstr ""
23432
23433
#: serverguide/C/backups.xml:191(para)
23434
msgid "<emphasis>dom:</emphasis> day of month the command executes on."
23435
msgstr ""
23436
23437
#: serverguide/C/backups.xml:196(para)
23438
msgid ""
23439
"<emphasis>mon:</emphasis> the month the command executes on between 1 and 12."
23440
msgstr ""
23441
23442
#: serverguide/C/backups.xml:201(para)
23443
msgid ""
23444
"<emphasis>dow:</emphasis> the day of the week the command executes on "
23445
"between 0 and 7. Sunday may be specified by using 0 or 7, both values are "
23446
"valid."
23447
msgstr ""
23448
23449
#: serverguide/C/backups.xml:206(para)
23450
msgid "<emphasis>command:</emphasis> the command to execute."
23451
msgstr ""
23452
23453
#: serverguide/C/backups.xml:211(para)
23454
msgid ""
23455
"To add or change entries in a <filename>crontab</filename> file the "
23456
"<application>crontab -e</application> command should be used. Also, the "
23457
"contents of a <filename>crontab</filename> file can be viewed using the "
23458
"<application>crontab -l</application> command."
23459
msgstr ""
23460
23461
#: serverguide/C/backups.xml:215(para)
23462
msgid ""
23463
"To execute the <application>backup.sh</application> script listed above "
23464
"using <application>cron</application>. Enter the following from a terminal "
23465
"prompt:"
23466
msgstr ""
23467
23468
#: serverguide/C/backups.xml:220(command)
23469
msgid "sudo crontab -e"
23470
msgstr ""
23471
23472
#: serverguide/C/backups.xml:223(para)
23473
msgid ""
23474
"Using <application>sudo</application> with the <application>crontab -"
23475
"e</application> command edits the <emphasis>root</emphasis> user's crontab. "
23476
"This is necessary if you are backing up directories only the root user has "
23477
"access to."
23478
msgstr ""
23479
23480
#: serverguide/C/backups.xml:228(para)
23481
msgid "Add the following entry to the <filename>crontab</filename> file:"
23482
msgstr ""
23483
23484
#: serverguide/C/backups.xml:231(programlisting)
23485
#, no-wrap
23486
msgid ""
23487
"\n"
23488
"# m h dom mon dow command\n"
23489
"0 0 * * * bash /usr/local/bin/backup.sh\n"
23490
msgstr ""
23491
23492
#: serverguide/C/backups.xml:235(para)
23493
msgid ""
23494
"The <application>backup.sh</application> script will now be executed every "
23495
"day at 12:00 am."
23496
msgstr ""
23497
23498
#: serverguide/C/backups.xml:239(para)
23499
msgid ""
23500
"The <application>backup.sh</application> script will need to be copied to "
23501
"the <filename>/usr/local/bin/</filename> directory in order for this entry "
23502
"to execute properly. The script can reside anywhere on the file system "
23503
"simply change the script path appropriately."
23504
msgstr ""
23505
23506
#: serverguide/C/backups.xml:244(para)
23507
msgid ""
23508
"For more in depth <application>crontab</application> options see <xref "
23509
"linkend=\"backup-shellscript-references\"/>."
23510
msgstr ""
23511
23512
#: serverguide/C/backups.xml:250(title)
23513
msgid "Restoring from the Archive"
23514
msgstr ""
23515
23516
#: serverguide/C/backups.xml:251(para)
23517
msgid ""
23518
"Once an archive has been created it is important to test the archive. The "
23519
"archive can be tested by listing the files it contains, but the best test is "
23520
"to <emphasis>restore</emphasis> a file from the archive."
23521
msgstr ""
23522
23523
#: serverguide/C/backups.xml:257(para)
23524
msgid "To see a listing of the archive contents. From a terminal prompt:"
23525
msgstr ""
23526
23527
#: serverguide/C/backups.xml:261(command)
23528
msgid "tar -tzvf /mnt/backup/host-Monday.tgz"
23529
msgstr ""
23530
23531
#: serverguide/C/backups.xml:265(para)
23532
msgid "To restore a file from the archive to a different directory enter:"
23533
msgstr ""
23534
23535
#: serverguide/C/backups.xml:269(command)
23536
msgid "tar -xzvf /mnt/backup/host-Monday.tgz -C /tmp etc/hosts"
23537
msgstr ""
23538
23539
#: serverguide/C/backups.xml:271(para)
23540
msgid ""
23541
"The <emphasis>-C</emphasis> option to <application>tar</application> "
23542
"redirects the extracted files to the specified directory. The above example "
23543
"will extract the <filename>/etc/hosts</filename> file to "
23544
"<filename>/tmp/etc/hosts</filename>. <application>tar</application> "
23545
"recreates the directory structure that it contains."
23546
msgstr ""
23547
23548
#: serverguide/C/backups.xml:276(para)
23549
msgid ""
23550
"Also, notice the leading <emphasis>\"/\"</emphasis> is left off the path of "
23551
"the file to restore."
23552
msgstr ""
23553
23554
#: serverguide/C/backups.xml:281(para)
23555
msgid "To restore all files in the archive enter the following:"
23556
msgstr ""
23557
23558
#: serverguide/C/backups.xml:285(command)
23559
msgid "cd /"
23560
msgstr ""
23561
23562
#: serverguide/C/backups.xml:286(command)
23563
msgid "sudo tar -xzvf /mnt/backup/host-Monday.tgz"
23564
msgstr ""
23565
23566
#: serverguide/C/backups.xml:291(para)
23567
msgid "This will overwrite the files currently on the file system."
23568
msgstr ""
23569
23570
#: serverguide/C/backups.xml:300(para)
23571
msgid ""
23572
"For more information on shell scripting see the <ulink "
23573
"url=\"http://tldp.org/LDP/abs/html/\">Advanced Bash-Scripting Guide</ulink>"
23574
msgstr ""
23575
23576
#: serverguide/C/backups.xml:305(para)
23577
msgid ""
23578
"The book <ulink url=\"http://safari.samspublishing.com/0672323583\">Teach "
23579
"Yourself Shell Programming in 24 Hours</ulink> is available online and a "
23580
"great resource for shell scripting."
23581
msgstr ""
23582
23583
#: serverguide/C/backups.xml:311(para)
23584
msgid ""
23585
"The <ulink url=\"https://help.ubuntu.com/community/CronHowto\">CronHowto "
23586
"Wiki Page</ulink> contains details on advanced "
23587
"<application>cron</application> options."
23588
msgstr ""
23589
23590
#: serverguide/C/backups.xml:318(para)
23591
msgid ""
23592
"See the <ulink url=\"http://www.gnu.org/software/tar/manual/index.html\">GNU "
23593
"tar Manual</ulink> for more <application>tar</application> options."
23594
msgstr ""
23595
23596
#: serverguide/C/backups.xml:324(para)
23597
msgid ""
23598
"The Wikipedia <ulink "
23599
"url=\"http://en.wikipedia.org/wiki/Backup_rotation_scheme\">Backup Rotation "
23600
"Scheme</ulink> article contains information on other backup rotation schemes."
23601
msgstr ""
23602
23603
#: serverguide/C/backups.xml:330(para)
23604
msgid ""
23605
"The shell script uses <application>tar</application> to create the archive, "
23606
"but there many other command line utilities that can be used. For example:"
23607
msgstr ""
23608
23609
#: serverguide/C/backups.xml:336(para)
23610
msgid ""
23611
"<ulink url=\"http://www.gnu.org/software/cpio/\">cpio</ulink>: used to copy "
23612
"files to and from archives."
23613
msgstr ""
23614
23615
#: serverguide/C/backups.xml:341(para)
23616
msgid ""
23617
"<ulink url=\"http://www.gnu.org/software/coreutils/\">dd</ulink>: part of "
23618
"the <application>coreutils</application> package. A low level utility that "
23619
"can copy data from one format to another"
23620
msgstr ""
23621
23622
#: serverguide/C/backups.xml:347(para)
23623
msgid ""
23624
"<ulink url=\"http://www.rsnapshot.org/\">rsnapshot</ulink>: a file system "
23625
"snap shot utility used to create copies of an entire file system."
23626
msgstr ""
23627
23628
#: serverguide/C/backups.xml:358(title)
23629
msgid "Archive Rotation"
23630
msgstr ""
23631
23632
#: serverguide/C/backups.xml:359(para)
23633
msgid ""
23634
"The shell script in section <xref linkend=\"backup-shellscripts\"/> only "
23635
"allows for seven different archives. For a server whose data doesn't change "
23636
"often this may be enough. If the server has a large amount of data a more "
23637
"robust rotation scheme should be used."
23638
msgstr ""
23639
23640
#: serverguide/C/backups.xml:365(title)
23641
msgid "Rotating NFS Archives"
23642
msgstr ""
23643
23644
#: serverguide/C/backups.xml:366(para)
23645
msgid ""
23646
"In this section the shell script will be slightly modified to implement a "
23647
"grandfather-father-son rotation scheme (monthly-weekly-daily):"
23648
msgstr ""
23649
23650
#: serverguide/C/backups.xml:372(para)
23651
msgid ""
23652
"The rotation will do a <emphasis>daily</emphasis> backup Sunday through "
23653
"Friday."
23654
msgstr ""
23655
23656
#: serverguide/C/backups.xml:377(para)
23657
msgid ""
23658
"On Saturday a <emphasis>weekly</emphasis> backup is done giving you four "
23659
"weekly backups a month."
23660
msgstr ""
23661
23662
#: serverguide/C/backups.xml:382(para)
23663
msgid ""
23664
"The <emphasis>monthly</emphasis> backup is done on the first of the month "
23665
"rotating two monthly backups based on if the month is odd or even."
23666
msgstr ""
23667
23668
#: serverguide/C/backups.xml:388(para)
23669
msgid "Here is the new script:"
23670
msgstr ""
23671
23672
#: serverguide/C/backups.xml:391(programlisting)
23673
#, no-wrap
23674
msgid ""
23675
"\n"
23676
"#!/bin/bash\n"
23677
"####################################\n"
23678
"#\n"
23679
"# Backup to NFS mount script with\n"
23680
"# grandfather-father-son rotation.\n"
23681
"#\n"
23682
"####################################\n"
23683
"\n"
23684
"# What to backup. \n"
23685
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23686
"\n"
23687
"# Where to backup to.\n"
23688
"dest=\"/mnt/backup\"\n"
23689
"\n"
23690
"# Setup variables for the archive filename.\n"
23691
"day=$(date +%A)\n"
23692
"hostname=$(hostname -s)\n"
23693
"\n"
23694
"# Find which week of the month 1-4 it is.\n"
23695
"day_num=$(date +%d)\n"
23696
"if (( $day_num <= 7 )); then\n"
23697
" week_file=\"$hostname-week1.tgz\"\n"
23698
"elif (( $day_num > 7 && $day_num <= 14 )); then\n"
23699
" week_file=\"$hostname-week2.tgz\"\n"
23700
"elif (( $day_num > 14 && $day_num <= 21 )); then\n"
23701
" week_file=\"$hostname-week3.tgz\"\n"
23702
"elif (( $day_num > 21 && $day_num < 32 )); then\n"
23703
" week_file=\"$hostname-week4.tgz\"\n"
23704
"fi\n"
23705
"\n"
23706
"# Find if the Month is odd or even.\n"
23707
"month_num=$(date +%m)\n"
23708
"month=$(expr $month_num % 2)\n"
23709
"if [ $month -eq 0 ]; then\n"
23710
" month_file=\"$hostname-month2.tgz\"\n"
23711
"else\n"
23712
" month_file=\"$hostname-month1.tgz\"\n"
23713
"fi\n"
23714
"\n"
23715
"# Create archive filename.\n"
23716
"if [ $day_num == 1 ]; then\n"
23717
"\tarchive_file=$month_file\n"
23718
"elif [ $day != \"Saturday\" ]; then\n"
23719
" archive_file=\"$hostname-$day.tgz\"\n"
23720
"else \n"
23721
"\tarchive_file=$week_file\n"
23722
"fi\n"
23723
"\n"
23724
"# Print start status message.\n"
23725
"echo \"Backing up $backup_files to $dest/$archive_file\"\n"
23726
"date\n"
23727
"echo\n"
23728
"\n"
23729
"# Backup the files using tar.\n"
23730
"tar czf $dest/$archive_file $backup_files\n"
23731
"\n"
23732
"# Print end status message.\n"
23733
"echo\n"
23734
"echo \"Backup finished\"\n"
23735
"date\n"
23736
"\n"
23737
"# Long listing of files in $dest to check file sizes.\n"
23738
"ls -lh $dest/\n"
23739
msgstr ""
23740
23741
#: serverguide/C/backups.xml:456(para)
23742
msgid ""
23743
"The script can be executed using the same methods as in <xref "
23744
"linkend=\"backup-executing-shellscript\"/>."
23745
msgstr ""
23746
23747
#: serverguide/C/backups.xml:459(para)
23748
msgid ""
23749
"It is good practice to take backup media off site in case of a disaster. In "
23750
"the shell script example the backup media is another server providing an NFS "
23751
"share. In all likelihood taking the NFS server to another location would not "
23752
"be practical. Depending upon connection speeds it may be an option to copy "
23753
"the archive file over a WAN link to a server in another location."
23754
msgstr ""
23755
23756
#: serverguide/C/backups.xml:465(para)
23757
msgid ""
23758
"Another option is to copy the archive file to an external hard drive which "
23759
"can then be taken off site. Since the price of external hard drives continue "
23760
"to decrease it may be cost affective to use two drives for each archive "
23761
"level. This would allow you to have one external drive attached to the "
23762
"backup server and one in another location."
23763
msgstr ""
23764
23765
#: serverguide/C/backups.xml:472(title)
23766
msgid "Tape Drives"
23767
msgstr ""
23768
23769
#: serverguide/C/backups.xml:473(para)
23770
msgid ""
23771
"A tape drive attached to the server can be used instead of a NFS share. "
23772
"Using a tape drive simplifies archive rotation, and taking the media off "
23773
"site as well."
23774
msgstr ""
23775
23776
#: serverguide/C/backups.xml:477(para)
23777
msgid ""
23778
"When using a tape drive the filename portions of the script aren't needed "
23779
"because the date is sent directly to the tape device. Some commands to "
23780
"manipulate the tape are needed. This is accomplished using "
23781
"<application>mt</application>, a magnetic tape control utility part of the "
23782
"<application>cpio</application> package."
23783
msgstr ""
23784
23785
#: serverguide/C/backups.xml:482(para)
23786
msgid "Here is the shell script modified to use a tape drive:"
23787
msgstr ""
23788
23789
#: serverguide/C/backups.xml:485(programlisting)
23790
#, no-wrap
23791
msgid ""
23792
"\n"
23793
"#!/bin/bash\n"
23794
"####################################\n"
23795
"#\n"
23796
"# Backup to tape drive script.\n"
23797
"#\n"
23798
"####################################\n"
23799
"\n"
23800
"# What to backup. \n"
23801
"backup_files=\"/home /var/spool/mail /etc /root /boot /opt\"\n"
23802
"\n"
23803
"# Where to backup to.\n"
23804
"dest=\"/dev/st0\"\n"
23805
"\n"
23806
"# Print start status message.\n"
23807
"echo \"Backing up $backup_files to $dest\"\n"
23808
"date\n"
23809
"echo\n"
23810
"\n"
23811
"# Make sure the tape is rewound.\n"
23812
"mt -f $dest rewind\n"
23813
"\n"
23814
"# Backup the files using tar.\n"
23815
"tar czf $dest $backup_files\n"
23816
"\n"
23817
"# Rewind and eject the tape.\n"
23818
"mt -f $dest rewoffl\n"
23819
"\n"
23820
"# Print end status message.\n"
23821
"echo\n"
23822
"echo \"Backup finished\"\n"
23823
"date\n"
23824
msgstr ""
23825
23826
#: serverguide/C/backups.xml:519(para)
23827
msgid ""
23828
"The default device name for a SCSI tape drive is "
23829
"<filename>/dev/st0</filename>. Use the appropriate device path for your "
23830
"system."
23831
msgstr ""
23832
23833
#: serverguide/C/backups.xml:524(para)
23834
msgid ""
23835
"Restoring from a tape drive is basically the same as restoring from a file. "
23836
"Simply rewind the tape and use the device path instead of a file path. For "
23837
"example to restore the <filename>/etc/hosts</filename> file to "
23838
"<filename>/tmp/etc/hosts</filename>:"
23839
msgstr ""
23840
23841
#: serverguide/C/backups.xml:529(command)
23842
msgid "mt -f /dev/st0 rewind"
23843
msgstr ""
23844
23845
#: serverguide/C/backups.xml:530(command)
23846
msgid "tar -xzf /dev/st0 -C /tmp etc/hosts"
23847
msgstr ""
23848
23849
#: serverguide/C/backups.xml:535(title)
23850
msgid "Bacula"
23851
msgstr ""
23852
23853
#: serverguide/C/backups.xml:536(para)
23854
msgid ""
23855
"<application>Bacula</application> is a backup program enabling you to "
23856
"backup, restore, and verify data across your network. There are Bacula "
23857
"clients for Linux, Windows, and Mac OSX. Making it a cross platform network "
23858
"wide solution."
23859
msgstr ""
23860
23861
#: serverguide/C/backups.xml:542(para)
23862
msgid ""
23863
"<application>Bacula</application> is made up of several components and "
23864
"services used to manage which files to backup and where to back them up to:"
23865
msgstr ""
23866
23867
#: serverguide/C/backups.xml:548(para)
23868
msgid ""
23869
"<application>Bacula Director:</application> a service that controls all "
23870
"backup, restore, verify, and archive operations."
23871
msgstr ""
23872
23873
#: serverguide/C/backups.xml:553(para)
23874
msgid ""
23875
"<application>Bacula Console:</application> an application allowing "
23876
"communication with the Director. There are three versions of the Console:"
23877
msgstr ""
23878
23879
#: serverguide/C/backups.xml:558(para)
23880
msgid "Text based command line version."
23881
msgstr ""
23882
23883
#: serverguide/C/backups.xml:559(para)
23884
msgid "Gnome based GTK+ Graphical User Interface (GUI) interface."
23885
msgstr ""
23886
23887
#: serverguide/C/backups.xml:560(para)
23888
msgid "wxWidgets GUI interface."
23889
msgstr ""
23890
23891
#: serverguide/C/backups.xml:564(para)
23892
msgid ""
23893
"<application>Bacula File:</application> also known as the "
23894
"<application>Bacula Client</application> program. This application is "
23895
"installed on machines to be backed up, and is responsible for the data "
23896
"requested by the Director."
23897
msgstr ""
23898
23899
#: serverguide/C/backups.xml:570(para)
23900
msgid ""
23901
"<application>Bacula Storage:</application> the programs that perform the "
23902
"storage and recovery of data to the physical media."
23903
msgstr ""
23904
23905
#: serverguide/C/backups.xml:575(para)
23906
msgid ""
23907
"<application>Bacula Catalog:</application> is responsible for maintaining "
23908
"the file indexes and volume databases for all files backed up, enabling "
23909
"quick location and restoration of archived files. The Catalog supports three "
23910
"different databases MySQL, PostgreSQL, and SQLite."
23911
msgstr ""
23912
23913
#: serverguide/C/backups.xml:581(para)
23914
msgid ""
23915
"<application>Bacula Monitor:</application> allows the monitoring of the "
23916
"Director, File daemons, and Storage daemons. Currently the Monitor is only "
23917
"available as a GTK+ GUI application."
23918
msgstr ""
23919
23920
#: serverguide/C/backups.xml:587(para)
23921
msgid ""
23922
"These services and applications can be run on multiple servers and clients, "
23923
"or they can be installed on one machine if backing up a single disk or "
23924
"volume."
23925
msgstr ""
23926
23927
#: serverguide/C/backups.xml:594(para)
23928
msgid ""
23929
"There are multiple packages containing the different "
23930
"<application>Bacula</application> components. To install Bacula, from a "
23931
"terminal prompt enter:"
23932
msgstr ""
23933
23934
#: serverguide/C/backups.xml:599(command)
23935
msgid "sudo apt-get install bacula"
23936
msgstr ""
23937
23938
#: serverguide/C/backups.xml:601(para)
23939
msgid ""
23940
"By default installing the <application>bacula</application> package will use "
23941
"a <application>MySQL</application> database for the Catalog. If you want to "
23942
"use SQLite or PostgreSQL, for the Catalog, install <application>bacula-"
23943
"director-sqlite3</application> or <application>bacula-director-"
23944
"pgsql</application> respectively."
23945
msgstr ""
23946
23947
#: serverguide/C/backups.xml:607(para)
23948
msgid ""
23949
"During the install process you will be asked to supply credentials for the "
23950
"database <emphasis>administrator</emphasis> and the "
23951
"<emphasis>bacula</emphasis> database <emphasis>owner</emphasis>. The "
23952
"database administrator will need to have the appropriate rights to create a "
23953
"database, see <xref linkend=\"mysql\"/> for more information."
23954
msgstr ""
23955
23956
#: serverguide/C/backups.xml:617(para)
23957
msgid ""
23958
"<application>Bacula</application> configuration files are formatted based on "
23959
"<emphasis>resources</emphasis> comprising of <emphasis>directives</emphasis> "
23960
"surrounded by <quote>{}</quote> braces. Each Bacula component has an "
23961
"individual file in the <filename role=\"directory\">/etc/bacula</filename> "
23962
"directory."
23963
msgstr ""
23964
23965
#: serverguide/C/backups.xml:622(para)
23966
msgid ""
23967
"The various <application>Bacula</application> components must authorize "
23968
"themselves to each other. This is accomplished using the "
23969
"<emphasis>password</emphasis> directive. For example, the "
23970
"<emphasis>Storage</emphasis> resource password in the "
23971
"<filename>/etc/bacula/bacula-dir.conf</filename> file must match the "
23972
"<emphasis>Director</emphasis> resource password in "
23973
"<filename>/etc/bacula/bacula-sd.conf</filename>."
23974
msgstr ""
23975
23976
#: serverguide/C/backups.xml:628(para)
23977
msgid ""
23978
"By default the backup job named <emphasis>Client1</emphasis> is configured "
23979
"to archive the <application>Bacula</application> Catalog. If you plan on "
23980
"using the server to backup more than one client you should change the name "
23981
"of this job to something more descriptive. To change the name edit "
23982
"<filename>/etc/bacula/bacula-dir.conf</filename>:"
23983
msgstr ""
23984
23985
#: serverguide/C/backups.xml:633(programlisting)
23986
#, no-wrap
23987
msgid ""
23988
"\n"
23989
"#\n"
23990
"# Define the main nightly save backup job\n"
23991
"# By default, this job will back up to disk in \n"
23992
"Job {\n"
23993
" Name = \"BackupServer\"\n"
23994
" JobDefs = \"DefaultJob\"\n"
23995
" Write Bootstrap = \"/var/lib/bacula/Client1.bsr\"\n"
23996
"}\n"
23997
msgstr ""
23998
23999
#: serverguide/C/backups.xml:644(para)
24000
msgid ""
24001
"The example above changes the job name to <emphasis>BackupServer</emphasis> "
24002
"matching the machine's host name. Replace <quote>BackupServer</quote> with "
24003
"your appropriate hostname, or other descriptive name."
24004
msgstr ""
24005
24006
#: serverguide/C/backups.xml:649(para)
24007
msgid ""
24008
"The <emphasis>Console</emphasis> can be used to query the "
24009
"<emphasis>Director</emphasis> about jobs, but to use the Console with a "
24010
"<emphasis>non-root</emphasis> user, the user needs to be in the "
24011
"<emphasis>bacula</emphasis> group. To add a user to the bacula group enter "
24012
"the following from a terminal:"
24013
msgstr ""
24014
24015
#: serverguide/C/backups.xml:655(command)
24016
msgid "sudo adduser $username bacula"
24017
msgstr ""
24018
24019
#: serverguide/C/backups.xml:658(para)
24020
msgid ""
24021
"Replace <emphasis>$username</emphasis> with the actual username. Also, if "
24022
"you are adding the current user to the group you should log out and back in "
24023
"for the new permissions to take effect."
24024
msgstr ""
24025
24026
#: serverguide/C/backups.xml:665(title)
24027
msgid "Localhost Backup"
24028
msgstr ""
24029
24030
#: serverguide/C/backups.xml:666(para)
24031
msgid ""
24032
"This section describes how to backup specified directories on a single host "
24033
"to a local tape drive."
24034
msgstr ""
24035
24036
#: serverguide/C/backups.xml:671(para)
24037
msgid ""
24038
"First, the <emphasis>Storage</emphasis> device needs to be configured. Edit "
24039
"<filename>/etc/bacula/bacula-sd.conf</filename> add:"
24040
msgstr ""
24041
24042
#: serverguide/C/backups.xml:674(programlisting)
24043
#, no-wrap
24044
msgid ""
24045
"\n"
24046
"Device {\n"
24047
" Name = \"Tape Drive\"\n"
24048
" Device Type = tape\n"
24049
" Media Type = DDS-4\n"
24050
" Archive Device = /dev/st0\n"
24051
" Hardware end of medium = No;\n"
24052
" AutomaticMount = yes; # when device opened, read it\n"
24053
" AlwaysOpen = Yes;\n"
24054
" RemovableMedia = yes;\n"
24055
" RandomAccess = no;\n"
24056
" Alert Command = \"sh -c 'tapeinfo -f %c | grep TapeAlert'\"\n"
24057
"}\n"
24058
msgstr ""
24059
24060
#: serverguide/C/backups.xml:688(para)
24061
msgid ""
24062
"The example is for a <emphasis>DDS-4</emphasis> tape drive. Adjust the Media "
24063
"Type and Archive Device to match your hardware."
24064
msgstr ""
24065
24066
#: serverguide/C/backups.xml:691(para)
24067
msgid "You could also uncomment one of the other examples in the file."
24068
msgstr ""
24069
24070
#: serverguide/C/backups.xml:696(para)
24071
msgid ""
24072
"After editing <filename>/etc/bacula/bacula-sd.conf</filename> the "
24073
"<application>Storage</application> daemon will need to be restarted:"
24074
msgstr ""
24075
24076
#: serverguide/C/backups.xml:701(command)
24077
msgid "sudo /etc/init.d/bacula-sd restart"
24078
msgstr ""
24079
24080
#: serverguide/C/backups.xml:705(para)
24081
msgid ""
24082
"Now add a <emphasis>Storage</emphasis> resource in "
24083
"<filename>/etc/bacula/bacula-dir.conf</filename> to use the new Device:"
24084
msgstr ""
24085
24086
#: serverguide/C/backups.xml:708(programlisting)
24087
#, no-wrap
24088
msgid ""
24089
"\n"
24090
"# Definition of \"Tape Drive\" storage device\n"
24091
"Storage {\n"
24092
" Name = TapeDrive\n"
24093
" # Do not use \"localhost\" here \n"
24094
" Address = backupserver # N.B. Use a fully qualified name "
24095
"here\n"
24096
" SDPort = 9103\n"
24097
" Password = \"Cv70F6pf1t6pBopT4vQOnigDrR0v3LT3Cgkiyj\"\n"
24098
" Device = \"Tape Drive\"\n"
24099
" Media Type = tape\n"
24100
"}\n"
24101
msgstr ""
24102
24103
#: serverguide/C/backups.xml:720(para)
24104
msgid ""
24105
"The <emphasis>Address</emphasis> directive needs to be the Fully Qualified "
24106
"Domain Name (FQDN) of the server. Change <emphasis>backupserver</emphasis> "
24107
"to the actual host name."
24108
msgstr ""
24109
24110
#: serverguide/C/backups.xml:724(para)
24111
msgid ""
24112
"Also, make sure the <emphasis>Password</emphasis> directive matches the "
24113
"password string in <filename>/etc/bacula/bacula-sd.conf</filename>."
24114
msgstr ""
24115
24116
#: serverguide/C/backups.xml:730(para)
24117
msgid ""
24118
"Create a new <emphasis>FileSet</emphasis>, which will determine what "
24119
"directories to backup, by adding:"
24120
msgstr ""
24121
24122
#: serverguide/C/backups.xml:733(programlisting)
24123
#, no-wrap
24124
msgid ""
24125
"\n"
24126
"# LocalhostBacup FileSet.\n"
24127
"FileSet {\n"
24128
" Name = \"LocalhostFiles\"\n"
24129
" Include {\n"
24130
" Options {\n"
24131
" signature = MD5\n"
24132
" compression=GZIP\n"
24133
" }\n"
24134
" File = /etc\n"
24135
" File = /home\n"
24136
" }\n"
24137
"}\n"
24138
msgstr ""
24139
24140
#: serverguide/C/backups.xml:747(para)
24141
msgid ""
24142
"This <emphasis>FileSet</emphasis> will backup the <filename "
24143
"role=\"directory\">/etc</filename> and <filename "
24144
"role=\"directory\">/home</filename> directories. The "
24145
"<emphasis>Options</emphasis> resource directives configure the FileSet to "
24146
"create a MD5 signature for each file backed up, and to compress the files "
24147
"using GZIP."
24148
msgstr ""
24149
24150
#: serverguide/C/backups.xml:754(para)
24151
msgid "Next, create a new <emphasis>Schedule</emphasis> for the backup job:"
24152
msgstr ""
24153
24154
#: serverguide/C/backups.xml:757(programlisting)
24155
#, no-wrap
24156
msgid ""
24157
"\n"
24158
"# LocalhostBackup Schedule -- Daily.\n"
24159
"Schedule {\n"
24160
" Name = \"LocalhostDaily\"\n"
24161
" Run = Full daily at 00:01\n"
24162
"}\n"
24163
msgstr ""
24164
24165
#: serverguide/C/backups.xml:764(para)
24166
msgid ""
24167
"The job will run every day at 00:01 or 12:01 am. There are many other "
24168
"scheduling options available."
24169
msgstr ""
24170
24171
#: serverguide/C/backups.xml:769(para)
24172
msgid "Finally create the <emphasis>Job</emphasis>:"
24173
msgstr ""
24174
24175
#: serverguide/C/backups.xml:772(programlisting)
24176
#, no-wrap
24177
msgid ""
24178
"\n"
24179
"# Localhost backup.\n"
24180
"Job {\n"
24181
" Name = \"LocalhostBackup\"\n"
24182
" JobDefs = \"DefaultJob\"\n"
24183
" Enabled = yes\n"
24184
" Level = Full\n"
24185
" FileSet = \"LocalhostFiles\"\n"
24186
" Schedule = \"LocalhostDaily\"\n"
24187
" Storage = TapeDrive\n"
24188
" Write Bootstrap = \"/var/lib/bacula/LocalhostBackup.bsr\"\n"
24189
"} \n"
24190
msgstr ""
24191
24192
#: serverguide/C/backups.xml:785(para)
24193
msgid ""
24194
"The job will do a <emphasis>Full</emphasis> backup every day to the tape "
24195
"drive."
24196
msgstr ""
24197
24198
#: serverguide/C/backups.xml:790(para)
24199
msgid ""
24200
"Each tape used will need to have a <emphasis>Label</emphasis>. If the "
24201
"current tape does not have a label <application>Bacula</application> will "
24202
"send an email letting you know. To label a tape using the "
24203
"<application>Console</application> enter the following from a terminal:"
24204
msgstr ""
24205
24206
#: serverguide/C/backups.xml:796(command)
24207
msgid "bconsole"
24208
msgstr ""
24209
24210
#: serverguide/C/backups.xml:800(para)
24211
msgid "At the Bacula Console prompt enter:"
24212
msgstr ""
24213
24214
#: serverguide/C/backups.xml:804(command)
24215
msgid "label"
24216
msgstr ""
24217
24218
#: serverguide/C/backups.xml:808(para)
24219
msgid ""
24220
"You will then be prompted for the <emphasis>Storage</emphasis> resource:"
24221
msgstr ""
24222
24223
#: serverguide/C/backups.xml:818(userinput)
24224
#, no-wrap
24225
msgid "2"
24226
msgstr ""
24227
24228
#: serverguide/C/backups.xml:812(computeroutput)
24229
#, no-wrap
24230
msgid ""
24231
"\n"
24232
"Automatically selected Catalog: MyCatalog\n"
24233
"Using Catalog \"MyCatalog\"\n"
24234
"The defined Storage resources are:\n"
24235
" 1: File\n"
24236
" 2: TapeDrive\n"
24237
"Select Storage resource (1-2):<placeholder-1/>\n"
24238
msgstr ""
24239
24240
#: serverguide/C/backups.xml:823(para)
24241
msgid "Enter the new <emphasis>Volume</emphasis> name:"
24242
msgstr ""
24243
24244
#: serverguide/C/backups.xml:828(userinput)
24245
#, no-wrap
24246
msgid "Sunday"
24247
msgstr ""
24248
24249
#: serverguide/C/backups.xml:827(computeroutput)
24250
#, no-wrap
24251
msgid ""
24252
"\n"
24253
"Enter new Volume name: <placeholder-1/>\n"
24254
"Defined Pools:\n"
24255
" 1: Default\n"
24256
" 2: Scratch"
24257
msgstr ""
24258
24259
#: serverguide/C/backups.xml:833(para)
24260
msgid "Replace <emphasis>Sunday</emphasis> with the desired label."
24261
msgstr ""
24262
24263
#: serverguide/C/backups.xml:838(para)
24264
msgid "Now, select the <emphasis>Pool</emphasis>:"
24265
msgstr ""
24266
24267
#: serverguide/C/backups.xml:843(userinput)
24268
#, no-wrap
24269
msgid "1"
24270
msgstr ""
24271
24272
#: serverguide/C/backups.xml:842(computeroutput)
24273
#, no-wrap
24274
msgid ""
24275
"\n"
24276
"Select the Pool (1-2): <placeholder-1/>\n"
24277
"Connecting to Storage daemon TapeDrive at backupserver:9103 ...\n"
24278
"Sending label command for Volume \"Sunday\" Slot 0 ...\n"
24279
msgstr ""
24280
24281
#: serverguide/C/backups.xml:850(para)
24282
msgid ""
24283
"Congratulations, you have now configured <emphasis>Bacula</emphasis> to "
24284
"backup the localhost to an attached tape drive."
24285
msgstr ""
24286
24287
#: serverguide/C/backups.xml:858(para)
24288
msgid ""
24289
"For more <emphasis>Bacula</emphasis> configuration options refer to the "
24290
"<ulink url=\"http://www.bacula.org/en/rel-manual/index.html\">Bacula User's "
24291
"Manual</ulink>"
24292
msgstr ""
24293
24294
#: serverguide/C/backups.xml:864(para)
24295
msgid ""
24296
"The <ulink url=\"http://www.bacula.org/\">Bacula Home Page</ulink> contains "
24297
"the latest Bacula news and developments."
24298
msgstr ""
24299
24300
#: serverguide/C/backups.xml:869(para)
24301
msgid ""
24302
"Also, see the <ulink url=\"https://help.ubuntu.com/community/Bacula\">Bacula "
24303
"Ubuntu Wiki</ulink> page."
24304
msgstr ""
24305
24306
#. Put one translator per line, in the form of NAME <EMAIL>, YEAR1, YEAR2
24307
#: serverguide/C/backups.xml:0(None)
24308
msgid "translator-credits"
24309
msgstr ""
24310
"Launchpad Contributions:\n"
24311
" Shunhsiung Shih https://launchpad.net/~sshsiung"
Loggerhead is a web-based interface for Breezy
Version: 2.0.1